This may not be the currently effective version of our Privacy Policy.
View the current Privacy PolicyPolicy version: 26 October 2026
1. INTRODUCTION
This Privacy Policy is provided by Band Pencil Ltd, a company registered in England and Wales under company number 15732150 with registered office at C/O The Greenhouse Greencroft Industrial Estate, Amos Drive, Annfield Plain, Stanley, Co Durham, United Kingdom, DH9 7XN ('Band Pencil', 'we', 'our' or 'us'). It explains how we collect, store, use and share personal data in connection with the Band Pencil website at bandpencil.com, our browser-based booking and management platform, Member and Client Portals, and related services (together, the Services).
We take your privacy seriously. Please read this Privacy Policy carefully because it contains important information about how and why we use personal data, the choices available to you and your rights under applicable data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Band Pencil supports businesses in the music and wider entertainment industry. Depending on how you interact with the Services, we may process personal data as a controller, or we may process personal data on behalf of one of our business customers as a processor. This distinction is explained below.
2. WHAT THIS POLICY APPLIES TO
This Privacy Policy applies where Band Pencil acts as a controller, meaning that we determine why and how the relevant personal data is processed. This includes, as applicable, personal data relating to website visitors, prospective customers, Administrators and their personnel, billing and support contacts, central Member accounts, Trust Cards, security and fraud-prevention activities, marketing, and our own business operations.
Where an Administrator uses Band Pencil to enter, store or manage personal data about its Members, Clients, events, bookings, contracts, invoices or other business activities, Band Pencil will generally process that personal data on the Administrator's behalf as a processor. The Administrator is responsible for explaining that processing to the affected individuals in its own privacy notice. Our processing on behalf of Administrators is governed by our Data Processing Agreement and is not treated as Band Pencil's own controller processing merely because the data is held within the Platform.
If you are a Member or Client and your request concerns information that an Administrator controls through its Band Pencil account, you may need to contact that Administrator directly. We will assist the Administrator with relevant data protection requests where required by law and our Data Processing Agreement.
The Services may link to or integrate with third-party websites, APIs, payment services and other platforms. Those third parties may process personal data under their own privacy notices. We encourage you to read the privacy information provided by any third-party service you use.
3. WHO USES BAND PENCIL
The Services support several types of users. An Administrator is the business customer that subscribes to Band Pencil and controls its Band Pencil account. A Member is typically a musician or performer added to one or more Administrator accounts. A Client is the Administrator's own customer who may be given access to a Client Portal to view event information, complete forms, sign contracts or make payments.
A Member may use one central Band Pencil login while being connected to more than one Administrator account. If one Administrator removes that Member, information associated specifically with that Administrator account may be removed or dealt with in accordance with that Administrator's instructions, while the Member's central account may continue where the Member remains linked to another Administrator or where Band Pencil otherwise has a lawful reason to retain information for its own account, security or legal purposes.
4. PERSONAL DATA WE COLLECT ABOUT YOU
The personal data we collect depends on how you interact with the Services and whether we are acting as controller or processor. Where Band Pencil acts as controller, the categories of personal data may include:
| Category of data | In more detail |
|---|---|
| Identity and contact data | Your name, email address, telephone number, business or organisation, job title or role, and other contact information you provide to us. |
| Account and subscription data | Account identifiers, login information, Administrator account details, subscription plan, authorised users, settings, account status and account history. |
| Billing and transaction data | Subscription and billing information, payment status, invoices, transaction references and related financial records. Payment card details may be handled directly by our payment provider rather than stored by Band Pencil. |
| Member account data | Where Band Pencil operates a central Member account, information such as the Member's name, contact details, account identifier, authentication information, account links and information needed to administer that central login. |
| Trust Card and activity data | Where the Trust Card feature is used, information or metrics relating to a Member's use of Band Pencil, which may include platform tenure, gig or booking activity, accepted gigs, response rates and similar activity metrics associated with an identifiable Member. |
| Support and communications data | Emails, support requests, feedback, enquiries and other correspondence with Band Pencil. |
| Technical, security and usage data | IP address, browser and device information, login and security records, diagnostic information, activity logs, usage information and similar technical information where Band Pencil determines the relevant processing. |
| Marketing and preference data | Marketing preferences, communications preferences, campaign engagement and opt-out or suppression information. |
| Website and analytics data | Information collected through cookies, pixels, analytics tools and similar technologies, as described further in our Cookie Policy. |
| AI-related data | Where an AI-assisted feature is used, information submitted to or generated through that feature to the extent Band Pencil processes that information as controller. Administrator-controlled data used within AI features is generally processed by Band Pencil on the Administrator's behalf under our Data Processing Agreement. |
4.1. ADMINISTRATOR-CONTROLLED DATA
Administrators may use the Platform to process information about Members, Clients and other individuals, including contact information, event and gig information, availability, contracts, invoices, payment information, communications, forms, dietary requirements and other information relevant to their business. Where Band Pencil processes that information only on the Administrator's documented instructions, the Administrator is the controller and Band Pencil is the processor. The fact that such information is stored in the Platform does not, by itself, make Band Pencil the controller of it.
5. SPECIAL CATEGORY AND SENSITIVE DATA
Special category personal data includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic or biometric data used for identification, health data, and information concerning a person's sex life or sexual orientation.
Band Pencil does not generally seek to collect special category personal data for its own independent business purposes. However, Administrators may use the Platform to process information that is, or may reveal, special category personal data. For example, dietary requirements may in some circumstances reveal information about health, religion or belief.
Where an Administrator asks Band Pencil to process this type of information through its account, the Administrator is responsible for ensuring that it has an appropriate lawful basis and, where required, a condition for processing special category personal data. Band Pencil will process such information on the Administrator's documented instructions and in accordance with the Data Processing Agreement.
Please do not provide special category personal data to Band Pencil for our own purposes unless it is necessary and you have been asked to do so, or there is another lawful reason for providing it.
6. HOW YOUR PERSONAL DATA IS COLLECTED
We may collect personal data:
- directly from you when you create or use an account, contact us, request support, subscribe to Band Pencil, communicate with us, respond to forms or otherwise use the Services;
- from an Administrator or another Band Pencil user, for example where an Administrator invites a Member, adds contact information or provides information needed to connect a Member to an Administrator account;
- automatically when you use our website or Services, including through security logs, cookies, analytics technologies and similar tools;
- from payment, hosting, communications, analytics and other service providers where needed to operate, secure or administer the Services; and
- from third-party integrations where you or an Administrator authorises the relevant connection.
7. COOKIES AND SIMILAR TECHNOLOGIES
We use cookies and similar storage or access technologies on our website and, where applicable, within the Services. These technologies may support essential functionality, security, analytics, service improvement and marketing. Where applicable law requires consent for a particular technology, we will seek that consent before using it unless an exemption applies. For more information, including information about the analytics and advertising technologies we use and how you can manage your choices, please see our Cookie Policy.
8. HOW AND WHY WE USE YOUR PERSONAL DATA
Under data protection law, we may only use personal data where we have a lawful basis. Depending on the circumstances, we may rely on consent, performance of a contract, compliance with a legal obligation, or our legitimate interests or those of a third party, provided those interests are not overridden by your rights and interests.
Where we rely on legitimate interests, we consider the nature and purpose of the processing, whether the processing is reasonably expected, the impact on individuals and any safeguards that should apply. You can contact us for more information about a particular legitimate interest assessment.
The table below summarises the main purposes for which Band Pencil processes personal data as controller and the lawful bases we expect to rely on. The precise basis may depend on the circumstances.
| What we use your personal data for | Our reasons |
|---|---|
| Creating and administering customer and Administrator accounts | Performance of a contract where you contract with us directly; otherwise our legitimate interests in administering customer relationships and providing the Services to business customers. |
| Providing customer support and service communications | Performance of a contract and/or our legitimate interests in supporting users and operating the Services effectively. |
| Managing subscriptions, billing and financial records | Performance of a contract, compliance with legal obligations and our legitimate interests in administering payments and accounts. |
| Maintaining central Member accounts and connecting Members to Administrator accounts | Our legitimate interests in operating a consistent Member account and access model across the Platform; and, where applicable, performance of a contract with the Member. |
| Generating and making available Trust Card information and activity metrics | Our legitimate interests in providing platform functionality that allows relevant Band Pencil activity to be summarised and shared, subject to appropriate transparency and safeguards. |
| Platform security, authentication, fraud prevention and misuse detection | Our legitimate interests in protecting Band Pencil, our users and the integrity of the Services; and compliance with legal obligations where applicable. |
| Service analytics, troubleshooting and product improvement | Our legitimate interests in understanding, maintaining and improving the Services; consent where required for particular cookies or similar technologies. |
| AI-assisted functionality for Band Pencil-controlled processing | Performance of a contract and/or our legitimate interests in providing and improving relevant functionality. Where AI processes Administrator-controlled personal data, Band Pencil generally acts as processor under the Data Processing Agreement. |
| Direct marketing and information about Band Pencil products and features | Consent where required, and otherwise our legitimate interests in promoting relevant business services, subject to applicable electronic marketing rules and your right to opt out. |
| Responding to enquiries and managing prospective customer relationships | Taking steps at your request before entering a contract and/or our legitimate interests in responding to business enquiries. |
| Establishing, exercising or defending legal claims and protecting our legal rights | Our legitimate interests in protecting our business and legal rights; compliance with legal obligations where applicable. |
| Corporate transactions or restructuring | Our legitimate interests in managing and realising the value of our business and assets, subject to appropriate safeguards. |
9. MEMBERS, THE CENTRAL MEMBER ACCOUNT AND TRUST CARDS
A Member may be connected to more than one Administrator account while using a single central Band Pencil login. Band Pencil may process the information needed to create, authenticate, maintain and secure that central Member account for its own platform-management purposes. This is separate from the Member information that Band Pencil processes solely on an Administrator's instructions within that Administrator's workspace.
Band Pencil may also provide a Trust Card feature which aggregates or displays information about a Member's Band Pencil activity, such as how long the Member has used Band Pencil, gig or booking history, accepted gigs, response rates and other activity metrics. A Trust Card may, where enabled, be accessible using a shareable public URL. Because these metrics may relate to an identifiable Member, we treat them as personal data where applicable.
Trust Card information is intended to provide information about activity recorded through Band Pencil. It is not a professional reference, guarantee, endorsement or definitive assessment by Band Pencil of a Member's suitability, quality or reliability.
10. ARTIFICIAL INTELLIGENCE
Band Pencil may make AI-assisted features available within the Services. These features may, for example, extract information from emails or other content to populate Band Pencil fields, or generate suggested draft emails or event communications for an Administrator to review before sending.
We may use third-party AI service providers, including OpenAI, to support these features. Information submitted to an AI-assisted feature may therefore be processed by the relevant provider for the purpose of supplying that functionality. Where the information is Administrator-controlled personal data, Band Pencil will generally process it as processor on the Administrator's behalf and in accordance with the Data Processing Agreement.
AI-generated outputs may be incomplete or inaccurate and are intended to assist users rather than replace human review or judgment. Administrators remain responsible for reviewing outputs before relying on or sending them.
11. MARKETING
We may send you information about Band Pencil products, features, services, promotions or events where permitted by law. Depending on the recipient and circumstances, we may rely on your consent or on our legitimate interests, subject to applicable rules governing electronic marketing.
You can opt out of marketing communications at any time by:
- using the unsubscribe or preference-management link included in our marketing communications; or
- contacting us using the details in the section “How to contact us” below.
Opting out of marketing does not prevent us from sending service, security, billing, legal or other non-marketing communications where they are necessary.
We do not sell personal data to third parties for their own marketing purposes.
12. WHO WE SHARE YOUR PERSONAL DATA WITH
We may share personal data with third parties where reasonably necessary to operate, secure and improve the Services, administer our business, comply with law or provide functionality you or an Administrator has chosen to use. Depending on the context and the processing role, these third parties may act as our processor, sub-processor, independent controller or another type of recipient.
Relevant categories and examples may include:
- payment and accounting providers, including Stripe and QuickBooks;
- email and communications providers, including Mailgun;
- hosting, infrastructure, security, monitoring and backup providers, including DigitalOcean, Krystal Hosting, Cloudflare, JetBackup, SnapShooter and Sentry;
- AI service providers, including OpenAI, where AI-assisted functionality is used;
- analytics, product-insight and advertising technology providers, which may include Google Analytics, SplitBee, Microsoft Clarity, Meta and PostHog, subject to our Cookie Policy and applicable consent requirements;
- professional advisers such as lawyers, accountants, insurers and auditors;
- regulators, law enforcement bodies, courts and other authorities where disclosure is required or permitted by law; and
- a purchaser, investor, lender or other relevant party in connection with a merger, acquisition, financing, asset sale, restructuring, insolvency process or similar corporate transaction, subject to appropriate confidentiality arrangements where applicable.
Where Band Pencil engages another organisation to process Administrator-controlled personal data on an Administrator's behalf, the relevant relationship is governed by our Data Processing Agreement and applicable sub-processing arrangements. Not every third party listed above will necessarily process every category of personal data or act in the same legal capacity.
13. HOW LONG YOUR PERSONAL DATA WILL BE KEPT
We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including to provide the Services, maintain appropriate business and financial records, meet legal and regulatory requirements, protect the security and integrity of the Platform, resolve disputes and establish, exercise or defend legal claims.
Retention periods may therefore vary by category of data. For example:
- customer, Administrator and contractual records may be retained for the duration of the customer relationship and for a reasonable period afterwards where needed for legal, accounting, tax or claims purposes;
- central Member account information may be retained while the account remains active or linked to one or more Administrator accounts, and for any further period reasonably required for security, legal or account-management purposes;
- marketing preference and suppression information may be retained after an opt-out where necessary to ensure that the opt-out is respected;
- security, diagnostic and usage logs may be retained for periods appropriate to their operational and security purpose; and
- Administrator-controlled personal data is retained and deleted in accordance with the applicable SaaS Terms, Administrator instructions and Data Processing Agreement.
At the end of the applicable retention period, we will delete or anonymise personal data unless continued retention is required or permitted by law.
14. TRANSFERRING YOUR PERSONAL DATA OUTSIDE THE UK
Band Pencil and the third parties we use may store or process personal data in the United Kingdom, the European Economic Area, the United States and other countries in which our service providers operate. This means that personal data may be transferred outside the UK.
Where a transfer of personal data from the UK is a restricted transfer under applicable data protection law, we will ensure that an appropriate transfer mechanism or safeguard is used. Depending on the destination and circumstances, this may include:
- a UK adequacy regulation recognising that the destination provides an adequate level of protection;
- the UK International Data Transfer Agreement;
- the UK Addendum to the EU Standard Contractual Clauses;
- the EU Standard Contractual Clauses where the EU GDPR applies; or
- another transfer mechanism or exception permitted by applicable data protection law.
Where appropriate, we also assess supplementary safeguards and the circumstances of the relevant transfer. You can contact us for more information about the safeguards relevant to a particular transfer.
15. YOUR RIGHTS
Depending on the circumstances and applicable law, you may have the following rights in relation to personal data for which Band Pencil acts as controller. These rights are not absolute and may be subject to exemptions or conditions.
| Your right | What it means |
|---|---|
| Access to your personal data | The right to ask whether we process your personal data and to receive a copy of personal data we hold about you, together with certain information about how it is used. |
| Correction (rectification) | The right to require us to correct inaccurate personal data and, in certain circumstances, complete incomplete personal data. |
| Erasure | The right to ask us to delete personal data in certain circumstances. |
| Restriction of processing | The right to ask us to restrict the way we use personal data in certain circumstances. |
| Data portability | The right, in certain circumstances, to receive personal data you provided to us in a structured, commonly used and machine-readable format and/or have it transmitted to another organisation. |
| Object to processing | The right to object to processing based on legitimate interests in certain circumstances, and to object at any time to processing for direct marketing. |
| Withdraw consent | Where we rely on consent, the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. |
15.1. REQUESTS RELATING TO ADMINISTRATOR-CONTROLLED DATA
If Band Pencil holds your personal data only as processor on behalf of an Administrator, the Administrator is generally responsible for responding to your data protection request. If you contact us about that information, we may refer your request to the relevant Administrator or assist them in responding in accordance with our legal and contractual obligations.
16. AUTOMATED DECISION-MAKING AND PROFILING
Band Pencil may use automated processes to calculate activity metrics for features such as Trust Cards and may use AI-assisted tools to extract information or generate draft content. Based on the current operation of the Services, Band Pencil does not use these features to make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
If we introduce solely automated decision-making of that kind in the future, we will provide the information required by applicable law, including information about the logic involved, the significance and envisaged consequences of the processing, and the rights available to you.
17. EXERCISING YOUR RIGHTS
If you would like to exercise a data protection right in relation to processing for which Band Pencil is controller, please contact us using the details below. We may ask you for information reasonably necessary to verify your identity and understand your request. We will respond within the time required by applicable data protection law.
18. KEEPING YOUR PERSONAL DATA SECURE
We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Access to personal data is restricted to personnel and service providers who need it for legitimate business purposes and who are subject to appropriate confidentiality and security obligations.
No internet-based or cloud service can be guaranteed to be completely secure. We maintain procedures to identify, investigate and respond to suspected personal data breaches and will notify affected individuals and regulators where we are legally required to do so.
19. HOW TO COMPLAIN
Please contact us first if you have questions or concerns about our use of your personal data. We will try to resolve your concerns.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. Information about making a complaint is available at ico.org.uk/make-a-complaint and the ICO can currently be contacted by telephone on 0303 123 1113.
If you are located outside the UK, you may also have the right to complain to another competent data protection authority where applicable.
20. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time, for example where our Services, technology, suppliers or legal obligations change. We will publish the updated version and change the policy version date above. Where a change is significant, we will take reasonable steps to bring it to the attention of affected users, for example through the Services or by email where appropriate.
21. HOW TO CONTACT US
You can contact us if you have any questions about this Privacy Policy, our use of personal data, or your data protection rights.
Band Pencil Ltd
Registered office: C/O The Greenhouse Greencroft Industrial Estate, Amos Drive, Annfield Plain, Stanley, Co Durham, United Kingdom, DH9 7XN
Privacy email: support [at] bandpencil.com
Website: https://bandpencil.com