Privacy Policy

Registered name: Jonny Ross Music Ltd.
Effective from: 23rd October 2025
Last updated: 23rd October 2025
This privacy policy explains what you can expect us to do with your personal information when you contact us or use one of our services.
Contact details
Jonny Ross Music is the controller for the personal information we process, unless otherwise stated.
There are several ways to contact us, including by phone, email, and post. More information on how to get in touch is provided on our contact page.
Our postal address:
55 Grove Road, Harrogate, North Yorkshire, HG1 5EP
Our telephone number:
0333 257 1869
Our email:
bookings@jonnyrossmusic.com
What information we collect, use, and why
We collect and use personal information to provide our services, manage bookings, and meet legal or business requirements. The type of information we collect depends on your relationship with us, for example, whether you’re a client, musician, supplier, or job applicant.
Client and service information
We may collect or use the following information to improve our services for clients:
Names and contact details (such as email addresses, phone numbers, and addresses).
Pronoun preferences or gender (if provided).
Date of birth.
Occupation.
Marital status.
Third-party information (such as family members or other relevant parties).
Payment details (including card or bank information for transfers and direct debits).
Transaction data (including details about payments to and from you and details of products and services you have purchased).
Usage data (including information about how you interact with and use our website, products and services).
Information relating to compliments or complaints.
Video recordings.
Audio recordings (e.g., calls).
Account access information.
Website user information.
Account management and website use
We collect or use the following personal information for the operation of client or customer accounts:
Names and contact details.
Addresses.
Purchase or service history.
Account information, including registration details.
Information used for security purposes.
Marketing preferences.
Technical data, including information about browsers and operating systems.
Legal, compliance, and safety
We collect or use the following personal information for the prevention, detection, investigation or prosecution of crimes:
Names and contact information.
Client accounts and records.
Marketing
We collect or use the following personal information for information updates or marketing purposes:
Names and contact details.
Addresses.
Profile information.
Marketing preferences.
Purchase or account history.
Website and app user journey information.
IP addresses.
Research, analytics, and service improvements
We collect or use the following personal information for research or archiving purposes:
Names and contact details.
Addresses.
Purchase or client account history.
Website and app user journey information.
IP addresses.
Legal requirements
We collect or use the following personal information to comply with legal requirements:
Name.
Contact information.
Health and safety information.
Any other personal information required to comply with legal obligations.
Safeguarding information.
Client welfare
We collect or use the following personal information to protect client welfare:
Names and contact information.
Client account information.
Recruitment
We collect or use the following personal information for recruitment purposes:
Contact details (e.g., name, address, telephone number or personal email address).
Date of birth.
National Insurance number.
Copies of passports or other photo ID.
Employment history (e.g., job application, employment references or secondary employment).
Education history (e.g., qualifications).
Right to work information.
Details of any criminal convictions (e.g., Disclosure and Barring Service (DBS), Access NI or Disclosure Scotland checks).
Security clearance details (e.g., basic checks and higher security clearance).
Complaints, queries, and claims
We collect or use the following personal information for dealing with queries, complaints or claims:
Names and contact details
Addresses.
Payment details.
Account information.
Purchase or service history.
Lawful bases and data protection rights
Under UK data protection law, we must have a ‘lawful basis’ for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.
The lawful basis we rely on may affect your data protection rights, which are outlined briefly below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:
Your right of access: You have the right to request copies of your personal information. You can request other information, such as details on where we get personal information from and who we share it with. There are some exemptions that may mean you do not receive all the information you request.
Your right to rectification: You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
Your right to erasure: You have the right to ask us to delete your personal information in certain circumstances.
Your right to restriction of processing: You have the right to ask us to limit how we can use your personal information in certain circumstances.
Your right to object to processing: You have the right to object to the processing of your personal data.
Your right to data portability: You have the right to ask that we transfer the personal information you gave us to another organisation or to you. However, if we are processing your data for criminal law enforcement purposes, your rights are slightly different.
Your right to withdraw consent: When we use consent as our lawful basis, you have the right to withdraw your consent at any time. If you make a request, we must respond to you without undue delay and in any event within one month.
To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.
Our lawful bases for the collection and use of your data
We only collect and use your personal information where we have a lawful reason to do so under data protection law. Depending on the situation, this may be based on:
Consent: You have given us permission to use your information, such as to receive marketing communications or to share the artist’s content, including photos, video, and audio recordings. You can withdraw your consent at any time.
Contract: We have to collect or use your information to enter into or carry out a contract with you. For example, to respond to enquiries, manage bookings, and process payments.
Legal obligation: We have to collect or use your information to comply with the law. For example, to maintain our business records and comply with legal requirements.
Vital interests: In rare circumstances, we may use information to protect someone’s life, health, or safety in an emergency. For example, in a medical or safety emergency during a music event.
Legitimate interests: We use information when it benefits you, us, or others in a fair and balanced way that does not override your rights or cause undue risk of harm. Our specific interests include network and information security, business improvement, and direct marketing or similar services to existing clients. For example, to communicate with musicians and venues or to analyse and improve our website using analytics data.
All your usual data protection rights apply, except the right to data portability when we rely on legitimate interests.
Processing Special Category Data (Article 9)
We sometimes process sensitive personal data referred to as ‘Special Category Data’ under UK GDPR, such as gender, marital status, health information, or criminal convictions.
We rely on the following specific Article 9 conditions for this data:
Explicit consent: For optional personal details like gender or marital status (listed in ‘Client and service information’), we rely on your explicit consent to process the data.
Vital interests: For health and safety information (listed in ‘Legal requirements’), we rely on the vital interests condition, which applies only in emergency situations where consent cannot be obtained.
Employment law: For criminal convictions (listed in ‘Recruitment’), we rely on employment, social security, and social protection law to fulfil our legal vetting obligations.
Where we get your personal information from
Directly from you.
Regulatory authorities.
Publicly available sources.
Previous employment.
Providers of marketing lists and other personal information.
Suppliers and service providers.
How long we keep information
We only keep your personal data for as long as necessary.
Clients: We typically retain client information for up to six years after a booking for tax and record-keeping purposes.
Artists and suppliers: We typically retain artist and supplier information for up to six years after our working relationship ends.
Marketing: We typically retain marketing information until you unsubscribe or withdraw your consent.
After this time, we securely delete or anonymise your data.
Who we share information with
Who we share personal information with:
Debt collection agencies.
Other financial or fraud investigation authorities.
Insurance companies, brokers or other intermediaries.
Professional or legal advisors.
Emergency services.
External auditors.
Organisations we’re legally obliged to share information with.
Publicly on our website, social media or other marketing and information media.
Suppliers and service providers.
Professional consultants.
Where we transfer your personal information
The personal data we collect is primarily stored and processed within the United Kingdom. However, to provide our services (e.g. email marketing, cloud hosting, or website analytics), we may use third-party companies who are based or store data outside of the United Kingdom and the European Economic Area (EEA).
If we transfer your data outside of these areas, we ensure that an equivalent level of protection is applied by applying the necessary legal safeguards, most commonly UK-approved International Data Transfer Agreements (IDTAs).
Cookies and other tracking technologies
We use cookies and similar technologies to collect information about how you use our website and to help us improve its performance. Analytics cookies collect data such as your IP address, location, and the type of device or browser you use.
For more information about the cookies we use, and how to manage, accept, or decline them, see our Cookie Policy.
Children’s data
Our services are primarily aimed at adults. We do not knowingly collect personal data from anyone under 18 without their parent or guardian’s consent.
Third-party websites
Our site contains links to other websites over which we have no control. We are not responsible for the privacy policies and practices of other websites. We will always take great care to ensure we partner with other websites which maintain the same standards as present on our website, but we cannot guarantee this. We advise you to check the privacy policy on each website that you visit to learn how they use and process your data.
Updates to this privacy policy
We may update this privacy policy from time to time. The latest version will always be available on our website with the ‘last updated’ date shown at the top.
How to complain
If you have concerns about the use of your personal data, you can make a complaint to us using the contact details at the top of this privacy policy.
If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the Information Commissioner’s Office (ICO) at:
The ICO’s address:
Information Commissioner’s Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint