1. WHO WE ARE & WHAT THIS POLICY COVERS
1.1 JBM Music Ltd (“JBM Music”, “we”, “us” or “our”) is the “controller” of the personal information described in this policy, which means we decide how and why it is used, except where another organization is named as a separate or joint controller. We are registered with the Information Commission (formerly the Information Commissioner’s Office, or ICO) under registration number ZC267201.

CONTROLLER DETAILS

JBM Music Ltd, a company registered in England and Wales.
Company Number 11451431 | VAT Number 310020786
Registered Office: 106 Princess Street, Manchester, England, M1 6NG
Email: privacy@jbmmusic.com | Data protection Contact: Bill Rogers

1.2 This policy applies to JBM Music Ltd and all our current and future events and brands, which may be marketed under a different brand name. Each website and store names JBM Music Ltd as the operator, for example in the website footer.

1.3 It covers, but is not limited to, personal information handled through our websites and event pages, online stores, ticketing arrangements, sign-up forms and mailing lists, apps, competitions, surveys, access requests, customer service channels, advertising, social media accounts and attendance at our events. It does not cover third-party websites and services we link to (see section 16).

1.4 It applies to, but is not limited to, ticket buyers, attendees, website and app users, store customers, competition entrants, survey respondents, people who contact us, marketing subscribers, and business contacts such as press, suppliers, artists and partners. Our employees, workers, volunteers and job applicants receive separate notices.

1.5 Tickets are sold through third-party ticketing agents. An agent may act as our service provider and may also be a separate controller for matters such as customer accounts, payment processing, fraud prevention and its own legal obligations. Its own privacy notice applies to what it controls. We receive orders, ticket types, payment statuses and customer information from agents so that we can run events. We do not receive or store full payment card details. Where an agent handles information only on our behalf, we remain responsible for it.

1.6 Where a co-promoter, venue or other partner is also responsible for your information, the checkout, form or event information will say so, and their own privacy notice may also apply.

1.7 We handle personal information in line with UK data protection law, including the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).
1.8 To contact us about anything covered by this policy, use the details in section 17.

2. INFORMATION COLLECTED

2.1 The table below sets out the main ways we collect personal information; this is not a conclusive list. “Lawful basis” is the legal reason we are allowed to use it: consent (you agree), contract (we need it to deliver something you have asked for), legal obligation (the law requires it) or legitimate interests (a genuine business or safety reason that does not override your rights).

WHEN:

• VISITING OUR WEBSITES
• CONTACTING US AND SOCIAL MEDIA
• MARKETING AND ADVERTS
• BUYING FROM OUR ONLINE STORE
• BUYING A TICKET
• ENTERING A COMPETITION
• REQUESTING ACCESS SUPPORT
• ATTENDING AN EVENT
• PRESS, TRADERS, PARTNERS, SUPPLIERS AND CONTRACTORS

WHAT WE COLLECT:

IP address, device and browser details, pages viewed, approximate location and cookie identifiers.

• Name, email address, phone number if given, your message and anything else you tell us. On social media, information you make public and messages you send us.

• Email address, names, phone number & any other details the sign-up form asks for. For adverts: a secure (hashed) version of your email address or phone number, past ticket purchases (event and brand), interests and engagement, and results from the advertising platforms.

• Name, email, phone number, delivery and billing address, order details and payment confirmation. If you create an account, your login details. Card details are handled by our payment provider and are not stored by us.

• The ticketing agent is responsible for your purchase. They give us access to ticket buyers’ details, including name, address, contact details and purchase history. Access is limited to staff who need it, using user roles.

• Name, contact details, your entry and, for winners, delivery details. If a third party provides or sends a prize, we tell you who.

• The information shared with us by Nimbus Disability and the Access Card scheme. We do not receive contact details or other personal details from Nimbus Disability.

• Depending on the event: ticket scans, CCTV, photographs and film, vehicle details for parking, security, search and incident records, welfare and medical records, and details of anyone removed or banned. If an official event app is available, usually only anonymized usage statistics, plus your email address if you choose to share it through the app. See sections 4 and 5.

• Name, role, organization, contact details and any application, accreditation or site access details.

WHY WE USE IT AND OUR LAWFUL BASIS:

• To run, secure and improve the website. Legitimate interests, and consent for non-essential cookies (see our Cookie Policy).

• To respond to and keep a record of your enquiry, and to engage with our audience. Legitimate interests.

• To send news, line-ups and ticket information, show you relevant adverts, avoid showing them to people who already have tickets, and measure campaigns. Consent, or where the law otherwise allows (see section 7). For adverts, consent where required, otherwise legitimate interests (see clause 7.5).

• To process, deliver and support your order. Contract. Legal obligation for accounting and tax records.

• To manage entry, customer service, event operations and safety, and to prevent fraud and touting. Legitimate interests. Marketing for ticket buyers is explained in section 7.

• To run the competition, choose and contact winners and send prizes. Contract (the competition rules) and legitimate interests. Each competition’s rules explain who runs it, how entries are used and whether a partner is involved.

• To provide access arrangements at our events. Legal obligation and legitimate interests, with explicit consent for health-related information, which you give through Nimbus Disability when you apply. See section 3.

• Safety and security, preventing crime, license conditions, running the event and promoting it. Legitimate interests and legal obligation. Vital interests in an emergency. Consent if you share your email address through the app. Anonymized statistics are not personal information.

• To manage applications, accreditation, site access and business relationships. Contract, legal obligation and legitimate interests.

2.2 We also receive information from ticketing agents (see clause 1.5) and Nimbus Disability (see section 3), through cookies and similar technologies, from CCTV and event photography, and from advertising and social media platforms, in line with your settings on them.
2.3 We do not make decisions about you solely by automated means where they have a legal or similarly significant effect on you. We group people by factors such as event interests, purchase history, approximate location or engagement, to create audiences for our adverts and to make messages more relevant. You can object to this at any time.
2.4 Information you must provide. Some information is needed to enter or carry out a contract, comply with the law, issue or check a ticket, provide an access arrangement, run a competition or protect event safety. If you do not give us information we need, we may be unable to supply the ticket, service, arrangement, entry or response. We show which fields are optional where practical.
2.5 Our legitimate interests. Where we rely on legitimate interests, those interests include producing and managing events, providing customer support, protecting customers and the public, preventing fraud, improving our services, keeping accurate records, promoting our own events, measuring campaign effectiveness and protecting our legal rights. Unless the law recognizes the interest directly, such as preventing crime, safeguarding or an emergency, we check that these interests are necessary and balanced against your rights and reasonable expectations.

3. ACCESS REQUESTS & HEALTH INFORMATION
3.1 Information about disability or health is “special category data” and has extra protection. Eligibility for access provision is assessed by Nimbus Disability and the Access Card scheme, which are responsible for the personal information you give them and handle it under their own privacy notices.
3.2 JBM Music does not store or manage the personal details you give to Nimbus Disability. We receive only the information declared on your Access Card or digital access pass obtained through Nimbus Disability: your name, Access Card number, the access requirements shown as nationally recognized icons, and any festival specific notes about your requirements. We do not receive contact details or other personal information from Nimbus Disability. We use this only to validate requested access arrangements for a specific event and retain this for a maximum of three months after the event has taken place.
3.3 Where we rely on your consent to use this information, you can withdraw it at any time by contacting us at the address in section 17, although we may then be unable to provide some access arrangements. Withdrawing consent does not affect what we did before you withdrew it.
3.4 If you tell us about a medical condition or need welfare support at an event, medical and welfare staff may record details to treat you and keep you safe. Medical contractors may be responsible for their own treatment records. In an emergency we may share information with the emergency services where necessary to protect your vital interests.
3.5 We do not use access or health information for marketing, advertising audiences or profiling.
3.6 Before 26 October 2026, we handled access requests ourselves. We used the details only to confirm and arrange the accessible booking and deleted them within three months of the event taking place.

4. EVENTS & CCTV
4.1 What happens at an event varies. Specific details for each event are given in the event information, in ticket information and on signs on site. This section and section 5 describe what we may do at any of our events.
4.2 CCTV. Security contractors instructed by us, and in some cases the venue operator, may operate CCTV, body-worn cameras and other cameras at and around event sites, for example at entrances, queues, car parks, stages and bar areas. The contractor can change from event to event. We use them for safety and security, to prevent and detect crime, to manage crowds, to investigate incidents and to help the emergency services and police. Our lawful bases are legitimate interests and legal obligations, such as license conditions.
4.3 Footage is only viewed by authorized parties. We keep it only for as long as necessary, for example while an incident or investigation is open, and then it is deleted. We may share footage with the police and other authorities, our insurers and legal advisers where necessary. Where a venue operator or contractor runs its own cameras, it is responsible for them. We do not share footage with anyone else, other than individuals who make a lawful request for footage of themselves (we protect other people’s images when we respond).
4.4 Facial recognition. We do not currently use facial recognition at our events. If we ever do, we will tell you clearly in advance, on the event page and on signs on site, explain why, and update this policy.
4.5 Wi-Fi and wristbands. Our wristbands do not currently carry personal data. If we introduce wristbands or cashless payment that do, we will tell you what is collected before you use them. Public Wi-Fi at an event site, where offered, is provided by a third-party company under its own terms and privacy policy, not by us.
4.6 Event app. When an official event app is available, it is provided by a third-party app provider, which is responsible for the information the app collects. We may receive anonymized and aggregated statistics about how the app is used. If the app lets you choose to share your email address with us and you do, we become responsible for that email address and use it as described in this policy. Depending on the features you use and the permissions you allow, the app may collect your location and how you use the app. You can change location and notification permissions in your device settings. Please read the app’s own privacy policy.
4.7 Security and incident records. If someone is removed from an event, banned or involved in an incident, we or our security contractors may record details, which can include information about alleged or suspected offences. We use this to keep people safe, prevent & detect crime as well as meet venue license conditions. This may be shared with the police and other authorities when required. Our lawful bases are legitimate interests and legal obligations, together with the specific legal conditions that allow information about offences to be used for these purposes.

5. PHOTOGRAPHY & FILMING

5.1 We, or media contractors acting for us, take photographs, film and audio recordings, and run livestreams at our events to promote them, broadcast them and to keep an archive. Images may show crowds and general scenes and may appear on our websites, social media, press coverage and other marketing materials. This is declared upon entry to our events, and within our Terms & Conditions. Our lawful basis is legitimate interests. Where someone is featured, for example in an interview or testimonial, we ask for their consent.
5.2 If you do not want to appear identifiable in photographs or film, tell a member of event staff on site or contact us. We will stop filming you and, where we can, remove images in which you can be identified. We take extra care with images of children. If you are a parent or guardian and want an image of your child removed, tell us and we will remove it. Accredited press and media are responsible for their own images.

6. CHILDREN
6.1 Each event operates its own age policy, which is set out in the event information and ticket terms. Some events are for adults only. Where an event allows under-18s to attend with a responsible adult, this section applies.
6.2 Our websites and marketing are not aimed at children under 18, and we do not knowingly collect their information through them. Online purchases, competitions and accessible support applications are for adults, unless a competition’s rules say otherwise. Where possible, the responsible adult should make the booking and give the contact details. We collect information about a child only where needed for ticketing, safety, accessibility support, a competition or another purpose we have told you about, and we do not knowingly use a child’s information for direct marketing.
6.3 If you give us information about a child (for example when asking for access support), you confirm you are their parent or legal guardian.
6.4 If you think a child has given us information without a parent’s or guardian’s permission, please contact us and we will delete it.

7. MARKETING
7.1 We send marketing emails and messages only if you have signed up and agreed, or where the law otherwise allows (for example, to people who have bought similar products from us). We only send marketing emails or messages to ticket buyers if they choose to receive them when buying, or where the law otherwise allows. We may also use ticket buyers’ details to show them adverts (see clause 7.5).
7.2 You can unsubscribe at any time using the link in any message or by contacting us. We do not sell or rent your information to other companies for their own marketing. If we ever share your details with a sponsor or partner for their marketing, we will only do so with your clear consent.
7.3 When you sign up, we tell you at that point that you may receive news, offers and information from JBM Music and its associated brands. If you agree, we may send you marketing about any of them. You can unsubscribe at any time.
7.4 Partnerships and brand sponsors. If you have agreed to receive marketing from us, we may include offers, news and competitions from our sponsors and brand partners. We send these ourselves, on the partner’s behalf. Partners do not have access to our databases or to your information. The only exception is a stand-alone competition with its own terms and conditions that say the sponsor or brand partner will receive your details, which you agree to when you enter. You can unsubscribe at any time.
7.5 Advertising audiences. We may use contact details such as email addresses or phone numbers, in a secured (hashed) form, to create or exclude audiences on advertising and social media platforms. This can include the details of people who have bought tickets from us, so that we can show them adverts for events under the brand they bought from or for similar events. We also use it to avoid showing adverts to people who already have tickets, and to measure our campaigns. Hashing does not make information anonymous. We ask for your consent where the law requires it and otherwise rely on legitimate interests. You can object at any time by contacting us, and you can manage advertising choices in each platform’s settings.

8. COOKIES & SIMILAR TECHNOLOGIES
8.1 Our websites, event pages, emails, apps and advertising may use cookies, pixels, tags and similar technologies. These keep services secure, remember your choices, measure usage, help us understand how campaigns perform and support personalized advertising.
8.2 We use strictly necessary technologies without asking and may use others without consent where the law allows, such as certain low-risk statistics and functionality uses. We ask for your consent before using advertising, tracking or other non-essential technologies where the law requires it. If you refuse optional technologies, the basic website still works, although some optional features may be limited.
8.3 You can manage your choices through the cookie settings on the relevant website and through your browser or device settings. Our Cookie Policy explains the types we use. The cookie settings show the current cookies, who provide them, what they do and how long they last, which may vary between websites and campaigns.

9. SHARING INFORMATION
9.1 We share personal information only where necessary and with appropriate safeguards. Depending on how you interact with us, this may include:
• Official ticketing agents who facilitate the sale of event tickets for our events, who are responsible for their own use of your purchase information.
• Nimbus Disability / Access Card scheme, in connection with access requests.
• Service providers (processors) acting on our instructions, such as but not limited to website hosting, IT, email and productivity providers, mailing list, CRM tools, online store & payment providers, security, stewarding, medical / welfare contractors, ticket scanning and cashless systems, and competition and prize providers.
• Delivery providers who receive the details needed to deliver your order and are responsible for their own use of them.
• Venues, co-promoters, local authorities and licensing bodies where we are required to run the event lawfully and safely.
• Police and security services where we are required by law or to prevent or detect crime.
• Professional advisers such as lawyers, accountants and insurers.
• Other organizations in a business sale or reorganization, who would be bound to use your information as described here.
9.2 Travel partners, social media platforms and other third-party websites we link to collect information for their own purposes when you use them. We are not responsible for how they use it, and this is managed under their individual Privacy Policies.

10. TRANSFERS OUTSIDE THE UK
10.1 Some of our service providers store or process information outside the UK. Where they do, we make sure it is protected by an appropriate safeguard, such as UK adequacy regulations (including the UK–US data bridge for certified US organizations) or approved contract terms (the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses). You can contact us for more information.

11. HOW LONG WE KEEP INFORMATION
11.1 We keep personal information only for as long as needed for the purposes described in this policy, including meeting legal, accounting and reporting requirements and dealing with any claims. Where the law sets a minimum period, we follow it: for example, we keep accounting and tax records for 6 years. In other cases, we keep information for as long as necessary. When we no longer need information, we delete or anonymize it.
11.2 Some organizations are responsible for their own copies of your information and set their own retention periods, for example our payment and delivery providers, ticketing agents, social media platforms, the event app provider and Nimbus Disability. Please see their privacy notices.
11.3 If we export ticket buyer information from a ticketing agent’s system for use elsewhere, for example to create advertising audiences, we delete the export once it has been used.
11.4 If you unsubscribe, we keep a minimal record so that we do not contact you again.

12. KEEPING YOUR INFORMATION SECURE
12.1 We use appropriate technical and organizational measures to protect personal information, including access controls, secure systems and limiting who can see sensitive information. No system is completely secure. If a breach is likely to risk your rights and freedoms, we will tell you and the Information Commission as the law requires.

13. YOUR RIGHTS
13.1 Under data protection law you have the right to:
• Be informed about how we use your information (this policy).
• Access a copy of the personal information we hold about you.
• To have inaccurate information corrected or incomplete information completed.
• To have your information erased in certain circumstances.
• Restrict how we use your information in certain circumstances.
• To receive information, you gave us in a portable format where we use it by automated means based on consent or contract.
• Object to us using your information based on legitimate interests, and to any direct marketing at any time.
• Withdraw your consent at any time where we rely on it.

13.2 To use any of these rights, please contact us using the details in section 17. We may need to check your identity first. We will respond within one month, which can be extended in some cases, and we will tell you if so. These rights are not absolute, and some only apply in certain circumstances. We will explain if we cannot do what you ask.
13.3 We may not be able to delete information straight away if we need it for an upcoming event or to meet a legal duty. We will explain if so.

14. COMPLAINTS
14.1 If you are unhappy with how we used your information, you can complain to us. Please email privacy@jbmmusic.com and say you wish to make a data protection complaint. We will acknowledge your complaint within 30 days, investigate it without undue delay and tell you the outcome. You do not need to use any particular words.
14.2 You also have the right to complain to the Information Commission (formerly the Information Commissioner’s Office, or ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first, but you can contact the Information Commission at any time.

15. CHANGES TO THIS POLICY
15.1 We may update this policy from time to time. The current version is always on our websites, and the “Published” date shows when it last changed. Where a change is significant, we will tell you in an appropriate way, for example by email or a notice on the website.

16. THIRD PARTY / AFFILIATE LINKS
16.1 Our websites link to third-party sites and services, such as ticketing agents, travel and parking providers, discount verification services, apps and social media platforms. They have their own privacy policies, which apply when you use them. Please read them.

17. CONTACT US
JBM Music Ltd, a company registered in England and Wales.
Company Number 11451431 | VAT Number 310020786
Registered Office: 106 Princess Street, Manchester, England, M1 6NG
Email: privacy@jbmmusic.com | Data protection Contact: Bill Rogers