Privacy Notice

This notice explains how we collect and use personal information in Lineup Lab, the tool we use to plan the line-ups for our live shows — booking tribute artists, performers and DJs, and keeping track of their availability and fees.

Who we are

Who this notice is for

Lineup Lab holds information about:

• Our team — staff who log in to plan and manage line-ups.
• Artists, performers and DJs — including the real name behind a tribute act — whom we book or ask about availability for a show.
• Talent agents and venue contacts — the individuals we deal with to arrange and confirm an act, including a show's event manager.

What information we collect

• Identity and contact details — name (and the real name behind a tribute act), email address and phone number.
• Booking information — the act or role, availability for a show, quoted and agreed fees and costs (base fee, travel and other costs), and any notes we add.
• Account and security data (team members only) — one-time sign-in codes (never stored in plain text), session records, and a log of actions taken in the system for security and accountability.
• Records of our contact with you — a log of the emails we send you through the tool.

We do not ask for special-category information (such as health data) through Lineup Lab. Please don't submit that kind of information in free-text fields.

Why we use it, and our lawful basis

What we do	Why	Lawful basis (UK GDPR)
Run team member accounts and keep the tool secure	So authorised staff can do their jobs safely	Legitimate interests / performance of a contract
Hold contact details for artists, performers, DJs and agents	To plan line-ups and get in touch about shows	Legitimate interests / performance of a contract
Ask about availability and fees for a show	To find, cost and confirm the right act	Legitimate interests / performance of a contract
Confirm a booking and share the details with the people running the show	So everyone has what they need to deliver the show	Performance of a contract / legitimate interests
Send operational emails via our email provider	To send availability requests, confirmations and updates	Legitimate interests

Who we share it with

We only share information with people who need it to deliver the event, and we limit what each party sees:

• Our own team, according to their role.
• The people running a show, who receive the details needed to run it (for example, that a particular act is confirmed).
• Artists and agents, who only ever see their own shows, availability and fees via a unique, unguessable link — never other people's details, fees or notes.

We use a small number of trusted service providers ("processors") who handle data on our instructions only, under contract:

• Railway — secure hosting of the application and database.
• Brevo — sending our operational emails.
• Google — reading our master event calendar and holding our secure backups.

We do not sell personal information or use it for advertising.

Where your information is held

Our application and database are hosted on Railway. Where a provider processes some data outside the UK/EU (for example a globally operated email or calendar service), we rely on the appropriate safeguards required by law, such as UK-approved contractual clauses or an adequacy / "data bridge" arrangement.

How long we keep it

We keep personal information only as long as we need it for planning and delivering our shows and keeping our records straight, then remove or anonymise it. Short-lived security items (like sign-in codes) expire automatically. You can ask us to remove your details at any time and we will do so unless we're required to keep them.

How we protect it

Access to the admin tool requires a login, and permissions are limited by role. Sign-in codes are hashed, sessions use secure browser cookies, all traffic is encrypted (HTTPS), the database is queried safely against tampering, the links we send to artists and agents are unguessable, and significant actions are recorded in an audit log.

Your rights

You have the right to: access a copy of your information; ask us to correct it if it's wrong; ask us to delete it; withdraw consent or object to / ask us to restrict certain uses; and, where relevant, receive it in a portable format. To make a request, contact us at beth@groovebox.co.uk. We will respond within one month.

If you're unhappy with how we've handled your information, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113 — though we'd appreciate the chance to put things right first.

This notice may be updated from time to time; the date at the top shows the current version.