Personal information should be collected with a clear purpose, kept only while needed, protected properly and remain under the control of the person it belongs to.
What this statement covers.
This statement sets out the data protection standards followed by In:House Artist Management, operated by Daniel Williams. It should be read with our Privacy Policy, which explains the specific information collected through this website and the purposes, lawful bases, recipients and retention periods that apply.
Our approach is based on the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and current guidance from the Information Commissioner’s Office (ICO). This statement is a public summary of our commitments rather than a substitute for those laws.
The seven principles.
Lawfulness, fairness and transparency
We identify a lawful basis, avoid unexpected or misleading uses and explain processing in clear language.
Purpose limitation
We collect information for specified, explicit purposes and do not repurpose it incompatibly without a valid legal basis and notice.
Data minimisation
Forms and working records should ask for information that is adequate, relevant and no more than the work requires.
Accuracy
We take reasonable steps to keep important personal information accurate and correct or delete inaccurate records when identified.
Storage limitation
We use retention periods and delete or anonymise personal information when its business, legal or safeguarding purpose has ended.
Integrity and confidentiality
We use proportionate access, provider and security controls to protect against unauthorised access, loss, alteration or disclosure.
Accountability
We take responsibility for these principles, review our processing and maintain records proportionate to the nature and risk of our work.
Every use needs a reason.
Before collecting or using personal information, we identify the purpose and an appropriate lawful basis. For In:House this will most commonly be:
- Contract or pre-contract steps when someone applies, requests a quote or becomes a client;
- Legitimate interests where necessary to answer enquiries, operate the business, secure the site or maintain appropriate professional records, balanced against the person’s rights;
- Legal obligation for tax, accounting, regulatory or legally required disclosure;
- Consent where a genuine choice is appropriate, including optional direct marketing or non-essential cookies if introduced.
We do not seek special category or criminal-offence data through ordinary website forms. If such information is genuinely required, we will identify both an Article 6 basis and the additional legal condition, limit access and provide any additional notice required.
People stay in control.
We respect the applicable rights to information, access, rectification, erasure, restriction, objection, data portability, withdrawal of consent, and safeguards around solely automated decisions.
How a request is handled
- Send the request to [email protected].
- We log the request, confirm its scope and may request proportionate proof of identity.
- We search relevant systems, assess any lawful exemption and respond securely.
- We respond without undue delay and normally within one calendar month. A lawful extension may apply to complex or multiple requests, and we will explain it.
The website assistant can answer questions, but In:House does not use solely automated processing to accept or reject an artist application or make another decision with legal or similarly significant effect.
Security and minimisation.
Controls are selected in proportion to the information and risk. They include reputable hosted infrastructure, restricted access, secure connections, form validation, anti-spam measures, software maintenance and avoiding unnecessary collection.
When introducing a new supplier, system or materially different use of data, we consider the purpose, categories of information, access, location, retention and security. Higher-risk processing is subject to a data protection impact assessment where the law requires one.
Anyone given access for In:House work is expected to keep personal information confidential and use it only for the authorised task.
Data breach response.
A suspected loss, disclosure or unauthorised access should be reported immediately to [email protected]. We will contain the incident, preserve relevant facts, assess the risk to people, record the decision and take corrective action.
Where a personal data breach is likely to risk people’s rights and freedoms, we will notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware. Where the risk is high, affected individuals will also be informed without undue delay, unless a lawful exception applies.
Processors are part of the chain.
We use service providers only where there is a legitimate operational need. Current website functions rely principally on Cloudflare for hosting, database, security and AI infrastructure, and on Google for calendar booking and selected browser services.
Where a supplier processes personal information for In:House, we seek appropriate contractual data protection terms, confidentiality, security commitments, deletion/return provisions and reasonable assistance with rights or incidents. Supplier access should be limited to the service provided.
For restricted transfers outside the UK, an appropriate transfer mechanism must apply, such as UK adequacy regulations, the UK International Data Transfer Agreement/Addendum or another mechanism approved under UK law. Relevant safeguards can be requested from us.
Accountability in practice.
- Maintain a proportionate record of the main personal-data activities and service providers.
- Keep privacy information accessible at the point personal information is collected.
- Apply the retention periods stated in the Privacy Policy and periodically remove data no longer needed.
- Review access when working relationships or supplier arrangements change.
- Refresh this statement and the Privacy Policy when processing or legal requirements materially change.
Daniel Williams is the first contact for data protection matters. In:House will seek specialist legal or technical advice where a request, incident or new processing activity requires it.
Contact.
Email [email protected] or call 0800 341 1174. A current postal correspondence address is available on request.
You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.