Privacy Policy
Last updated: April 2026
1. Who We Are and How to Contact Us
Brassing Around is a growing media group powered by a dedicated community of brass musicians, volunteers, and music lovers. We publish commentary, news, and features on all things brass banding, and we also host brass band events.
Brassing Around operates as a volunteer-run unincorporated association. It is not a registered company.
For the purposes of UK data protection law, Brassing Around is the data controller in respect of all personal data collected through this website and in connection with our events and media activities.
Contact for all privacy and data protection matters: aroundbrassing@gmail.com
2. Who This Policy Covers
This policy applies to personal data collected about:
- Registered users: people who create an account on the Brassing Around website;
- Event attendees: people who register for or attend brass band events hosted by Brassing Around;
- Contributors: individuals who contribute content to Brassing Around, such as writers, commentators, or event-day personnel; and
- Media and industry contacts: performers, band officials, and others whose information we may process in connection with our commentary and media activities.
3. Personal Data We Collect, How We Use It, and Our Lawful Basis
The table below sets out all the personal data we collect, the purpose for which we collect it, and the lawful basis under UK GDPR Article 6 that we rely on. We do not sell, rent, or share personal data with third parties for their own marketing purposes.
| Data Collected | Purpose | Lawful Basis (UK GDPR Art. 6) |
|---|---|---|
| Registered Users | ||
| Username, email address, hashed password | Account management — to create and maintain your account and enable you to log in | Contract Art. 6(1)(b). Processing is necessary to provide the service you registered for. |
| Email address, marketing preference | Marketing emails — to send occasional updates about brass band events, news, and Brassing Around activities | Consent Art. 6(1)(a). Only where you explicitly opted in at registration. Consent may be withdrawn at any time (see Section 6). |
| Profile information, posts, and comments submitted through the site | Publishing user-generated content — to display contributions you choose to make on the site | Contract Art. 6(1)(b); or Legitimate interests Art. 6(1)(f), where content is published in connection with the community purpose of the site. |
| Login activity | Site security — to protect the integrity of accounts and prevent misuse | Legitimate interests Art. 6(1)(f). We have a legitimate interest in maintaining a secure platform. |
| Event Attendees | ||
| Name, email address, ticket or registration details | Event administration — to manage your registration, communicate about the event, and facilitate entry | Contract Art. 6(1)(b); or Legitimate interests Art. 6(1)(f), where attendance is free and no formal contract exists. |
| Accessibility or dietary requirements (if provided) | Accessibility and welfare — to make appropriate arrangements at the event | Legitimate interests Art. 6(1)(f); or Legal obligation Art. 6(1)(c). |
| Images and/or video footage in which you may appear | Photography and filming at events — to create a record of our events and promote Brassing Around's activities | Legitimate interests Art. 6(1)(f), where footage is of a general crowd/event nature; or Consent Art. 6(1)(a), where individuals are specifically filmed. |
| Email address | Post-event marketing — to inform you of future Brassing Around events | Consent Art. 6(1)(a), where you have opted in; or Soft opt-in (PECR reg. 22), where you have attended a previous event and are being contacted about similar events, provided you were given the opportunity to opt out. |
| Contributors | ||
| Name, email address, contact and biographical information | Coordination of contributions — to contact you about your contribution and publish it on the site | Contract Art. 6(1)(b), where a formal arrangement exists; or Legitimate interests Art. 6(1)(f), for informal contributions. |
| Name and any byline or biographical note provided for publication | Publishing contributor credits — to attribute published content to its author | Legitimate interests Art. 6(1)(f); or Consent Art. 6(1)(a). |
| Bank or payment details | Payment processing — to pay contributors for their work | Contract Art. 6(1)(b). |
| Media and Industry Contacts | ||
| Name, role, band affiliation, publicly available performance and biographical information | Commentary and reporting — to publish accurate, attributed coverage of brass banding events, results, and personalities | Legitimate interests Art. 6(1)(f). Brassing Around has a legitimate interest in providing accurate, attributed media coverage of a public art form. Individuals covered are generally public-facing in their brass banding role. |
| Name, email address, and any information provided in correspondence | Press and editorial enquiries — to communicate with performers, officials, or press contacts who contact us | Legitimate interests Art. 6(1)(f); or Contract Art. 6(1)(b), where relevant. |
4. Third-Party Services and Data Processors
We use the following third-party services to operate the website and support our activities. Where these services process personal data on our behalf, they act as data processors. Some act as independent data controllers in their own right.
| Provider | Service | Data Involved | Role & Notes |
|---|---|---|---|
| GoDaddy (US) | Domain registration & DNS | Domain/technical data; no user personal data directly processed | Processor. GoDaddy's privacy policy applies to their own processing. |
| Heroku/Salesforce (US) | Web application hosting & compute | All data submitted to or stored by the site passes through Heroku, including user account and event data | Processor. Heroku processes data under Salesforce's Data Processing Agreement. |
| GitHub/Microsoft (US) | Source code repository and deployment pipeline | Application code and configuration; application logs may incidentally contain personal data | Processor. Access is restricted to authorised Brassing Around volunteers. Logs should be minimised and reviewed periodically. |
| Google/Gmail (US) | Email communications (aroundbrassing@gmail.com) | Email addresses and message content of users, attendees, contributors, and media contacts contacted by email | Independent controller for the Gmail service. As emails are sent manually, no automated processor relationship exists, but Google processes email data under its own terms and privacy policy. |
| YouTube/Google (US) | Embedded video content on the website | Cookie and usage data, where non-essential cookies are accepted | Independent controller. YouTube cookies are blocked by default. Google's Privacy Policy governs their processing. |
We may engage additional processors in the future, for example to support event ticketing, mailing list management, or analytics. Before doing so, we will carry out appropriate due diligence, update this policy, and (where required) notify affected individuals.
5. International Transfers of Personal Data
When personal data is processed by third-party providers, it may be transferred to and stored in other countries outside the UK or EEA.
The UK does not currently have a general adequacy decision in respect of the US. We rely on the following safeguards:
- Heroku/Salesforce: Standard Contractual Clauses (SCCs) and UK International Data Transfer Addendum (IDTA).
- GitHub/Microsoft: Microsoft's standard contractual clauses and UK IDTA.
- Google (Gmail & YouTube): Google's standard contractual clauses and UK IDTA.
- GoDaddy: GoDaddy's standard contractual clauses.
You may request further information about the safeguards in place by contacting us at aroundbrassing@gmail.com.
6. Marketing Communications and Withdrawing Consent
We will only send you marketing emails where we have a lawful basis to do so, either because you have given us your explicit consent, or where the 'soft opt-in' under PECR regulation 22 applies.
Marketing emails are currently sent manually from aroundbrassing@gmail.com. You can withdraw consent or opt out at any time by:
- Replying to any marketing email with 'Unsubscribe' in the subject line; or
- Emailing us at aroundbrassing@gmail.com with 'Unsubscribe' in the subject line.
Withdrawal of consent does not affect the lawfulness of any processing carried out before withdrawal.
7. How Long We Keep Your Data
- Registered user account data (username, email, hashed password, marketing preference): retained while your account is active and deleted within 30 days of a verified account deletion request.
- Event attendee data: retained for 12 months following the event for administrative, welfare, and follow-up purposes, then securely deleted unless you have consented to ongoing marketing communications.
- Event photography and footage: retained indefinitely as a record of our events unless you request removal.
- Contributor contact and biographical details: retained for the duration of the relevant engagement and for up to 12 months afterwards in case of queries relating to published content.
- Contributor published credits (name, byline, biographical note): may be retained on the site indefinitely as part of the published record, unless you request removal.
- Media and industry contact information: retained for as long as it remains relevant to our commentary activities, and reviewed at least annually. Information that is no longer current or relevant will be deleted.
- Email correspondence (via Gmail): retained in accordance with Google's standard Gmail retention settings, and deleted on request where we have the ability to do so.
8. Security
We take reasonable steps to protect personal data against unauthorised access, loss, or disclosure:
- Passwords are stored using a secure one-way hashing algorithm (we never store or transmit plain-text passwords).
- The website is served over HTTPS (TLS encryption in transit).
- Access to the application and its underlying data is restricted to authorised Brassing Around volunteers.
- The application is hosted on Heroku, which provides platform-level security controls including network isolation and access logging.
- Source code is managed via GitHub with repository access controls applied.
In the event of a personal data breach that is likely to result in a risk to individuals' rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it, and will notify affected individuals where required.
9. Your Data Protection Rights
Under UK GDPR, you have the following rights in relation to your personal data:
- Right of access: to obtain a copy of the personal data we hold about you.
- Right to rectification: to have inaccurate or incomplete data corrected.
- Right to erasure: to request deletion of your data in certain circumstances.
- Right to restrict processing: to ask us to pause processing of your data in certain circumstances.
- Right to data portability: to receive your data in a structured, machine-readable format, where processing is based on consent or contract and carried out by automated means.
- Right to object: to object to processing based on legitimate interests, or to direct marketing at any time. Where you object to direct marketing, we will stop immediately.
- Rights in relation to automated decision-making: Brassing Around does not carry out automated decision-making or profiling that produces legal or similarly significant effects on individuals.
- Right to withdraw consent: where processing is based on your consent, to withdraw it at any time without affecting the lawfulness of prior processing (see Section 6 for marketing).
To exercise any of these rights, please contact us at aroundbrassing@gmail.com.
We will respond within one calendar month of receiving your request. We do not charge a fee unless the request is manifestly unfounded or excessive. We may ask you to verify your identity before processing your request.
10. Right to Complain
If you are unhappy with how we have handled your personal data, please contact us first at aroundbrassing@gmail.com. We will do our best to resolve your concern promptly.
You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):
- Website: www.ico.org.uk
- Telephone: 0303 123 1113
- Post: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
11. Cookies
Cookies are small text files stored on your device when you visit our website. We use the following cookies:
| Cookie Name | Type | Purpose | Provider | Expiry |
|---|---|---|---|---|
| Session cookie (e.g. session_id) | Essential | Maintains your login session while you use the site. The site cannot function without this cookie. | Brassing Around (Heroku) | Session |
| Consent cookie (e.g. cookie_consent) | Essential | Stores your cookie preferences so we do not ask again on every visit. | Brassing Around | 12 months |
| CONSENT, YSC, VISITOR_INFO1_LIVE (and others) | Non-essential (Third-party) | Set by YouTube/Google when you accept non-essential cookies. Used for video functionality and Google analytics. | Google/YouTube | Up to 2 years |
Non-essential cookies are blocked by default. You can update your preferences at any time via our cookie settings control. Blocking essential cookies may affect the functionality of the site.
12. Children
The Brassing Around website is not directed at children under the age of 13. We do not knowingly collect personal data from children under this age without verifiable parental consent.
If you become aware that a child has provided personal data without appropriate consent, please contact us at aroundbrassing@gmail.com and we will delete that data promptly.
13. Changes to This Policy
We will update this policy when we introduce new processing activities, engage new service providers, or when data protection law changes. As a growing media group and event organiser, we expect to update this policy periodically.
When we make significant changes, we will notify registered users by email and display a notice on the website. The 'Last updated' date at the top of this policy reflects the most recent revision. We encourage you to review this policy from time to time.
← Back to registration