1. Who we are
PENREC Music Group is an independent music project founded and operated by Darren Penman. For UK data-protection purposes, PENREC Music Group is the controller of personal information collected through this website.
You can contact us about privacy through the PENREC contact form. Choose “Website support” and include “Privacy” in the subject.
2. Information we collect
Contact enquiries
When you contact us, we collect your name, email address, enquiry type, subject and message.
PENREC accounts
If you create an account, we collect your email address, display name, encrypted authentication information and account preferences. Depending on the services you use, we may also store wishlist items, music-library entries and order records.
Technical information
Our hosting and security providers may process limited technical information such as IP address, browser type, device information, requested pages, timestamps and security logs. Essential authentication cookies are used when you sign in.
Information you choose to provide
Please do not include sensitive personal information in free-text messages unless it is necessary for your enquiry.
3. How and why we use information
| Purpose | Information | Lawful basis |
|---|---|---|
| Responding to enquiries | Contact details and message | Legitimate interests in communicating about PENREC and, where relevant, steps requested before a contract |
| Creating and securing accounts | Account and authentication details | Performance of our agreement with you and legitimate interests in service security |
| Providing wishlists, libraries and account preferences | Account activity and choices | Performance of our agreement with you |
| Managing future purchases and records | Order, account and transaction records | Performance of a contract and compliance with legal obligations |
| Protecting and improving the website | Technical and security information | Legitimate interests in operating a reliable and secure service |
| Optional news and release updates | Email address and communication preferences | Consent, where you have actively opted in |
We do not sell personal information and we do not use it for automated decision-making or profiling that produces legal or similarly significant effects.
5. How long we keep information
- Contact enquiries are normally retained for up to 24 months after the last meaningful contact, unless a longer period is needed for an ongoing matter.
- Account information is retained while the account remains active and then deleted or anonymised when no longer needed, subject to legal and security requirements.
- Order and financial records may be retained for up to six years where required for tax, accounting, dispute or legal purposes.
- Security and technical records are retained only for as long as reasonably necessary for security, diagnosis and legal compliance.
6. Security
We use proportionate technical and organisational safeguards, including restricted database access, row-level security, encrypted connections and HTTP-only authentication cookies. No online service can guarantee absolute security, but we review the controls used to protect PENREC information.
7. Your data-protection rights
Depending on the circumstances, UK data-protection law may give you rights to:
- request access to your personal information;
- have inaccurate or incomplete information corrected;
- request erasure or restriction of processing;
- object to processing based on legitimate interests;
- receive certain information in a portable format; and
- withdraw consent at any time where consent is the basis used.
Your right to object: you may object to our use of personal information where we rely on legitimate interests. You have an absolute right to object to direct marketing.
These rights are not absolute in every situation. We may need to confirm your identity before acting on a request.
8. Children
The PENREC website and account services are not directed at children under 13. We do not knowingly seek to collect personal information from children under that age.
9. Contact and complaints
Contact us through the PENREC contact page to make a request or raise a privacy concern. We will try to resolve concerns directly.
You also have the right to complain to the UK Information Commissioner’s Office. Information is available at ico.org.uk/make-a-complaint.
10. Changes to this notice
We may update this policy when PENREC services, providers or legal obligations change. The latest version and its update date will always appear on this page.