Data Rights Policy

Data Rights Policy[HT1]

Data Rights Policy

1. Purpose

This Policy sets out how JW Media Music Limited manages and responds to queries including complaints relating to the processing of personal data.

If you consider that we have incorrectly processed your personal data or failed to meet any of our data obligations, you are entitled to complain. It is helpful if you do this immediately. We will do our best to resolve the issue, as we want to give you the best possible service.

2. Scope

2.1This Policy applies to all external clients, service users and other external stakeholders, and to all employees, workers, contractors, agency staff, apprentices, volunteers and applicants whose personal data we process. It is intended to align with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), the Data Use and Access Act 2025 (DUAA 2025) and guidance from the Information Commissioner’s Office (ICO).

2.2This Policy may be incorporated into the Employee Handbook and related client-facing materials and applies in addition to any internal grievance, whistleblowing or complaints procedures. If there is any conflict, this Policy governs issues concerning personal data.

2.3 If you have a general complaint, please contact Jenny Oakes, our Managing Director who is responsible for client care matters at jenny@jwmediamusic.co.uk

3. Definitions

For the purposes of this Policy:

Personal data means any information relating to an identified or identifiable living individual.

Special category data means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for identification, health data and data concerning a person’s sex life or sexual orientation.

Processing means any operation performed on personal data, such as collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, erasure or destruction.

Data subject means the identified or identifiable individual to whom personal data relates.

Complaint means any expression of dissatisfaction about our handling of personal data, our response to a data subject request, our data protection practices, a suspected personal data breach, or our compliance with UK GDPR, DPA 2018, DUAA 2025 or ICO guidance.

Data Controller means the organisation that determines the purposes and means of processing personal data.

Data Processor means a party that processes personal data on behalf of the Data Controller.

Data Protection team means the designated individuals responsible for advising on and monitoring compliance with data protection obligations, where appointed. Within our organisation the individual assigned the equivalent of the DPO role is the Managing Director.

Personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

4. Data Protection Principles

4.1 We handle complaints and personal data in accordance with the data protection principles under UK GDPR and DPA 2018, as supplemented by DUAA 2025, namely :

  • Lawfulness, fairness and transparency: We process data on a lawful basis and communicate clearly about our handling.

  • Purpose limitation: We use complaint data only for managing and improving our complaints handling, regulatory compliance and related purposes.

  • Data minimisation: We collect only what is necessary to assess and address the complaint.

  • Accuracy: We take reasonable steps to ensure data is accurate and up to date.

  • Storage limitation: We keep complaint records only for as long as needed for the purposes identified and to meet legal, regulatory or audit requirements.

  • Integrity and confidentiality (security): We apply appropriate technical and organisational measures to protect complaint data.

  • Accountability: We document decisions and are able to demonstrate compliance.

5. Rights of Data Subjects

  • Depending on the circumstances and applicable law, you may have the right to:
  • Access your personal data and receive information about how we process it.
  • Rectification of inaccurate or incomplete personal data.
  • Erasure of your personal data in certain circumstances (sometimes referred to as the “right to be forgotten”).
  • Restriction of the processing of your personal data in certain circumstances.
  • Object to certain processing, including processing based on our legitimate interests and processing for direct marketing purposes.
  • Data portability, allowing you, in certain circumstances, to receive personal data you have provided to us in a structured, commonly used and machine-readable format and to transmit that data to another controller.
  • Where you are subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects, to be provided with information about the decision, to make representations about it, to obtain human intervention and to contest the decision. Additional restrictions apply where such decisions involve special category personal data.
  • Withdraw your consent at any time where we rely on consent as the lawful basis for processing. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.
  • Complain to us if you have concerns about how we process your personal data or how we have handled a request to exercise your data protection rights.
  • Complain to the Information Commissioner’s Office (ICO) and, where applicable, seek a judicial remedy if you consider that your data protection rights have been infringed.
    • Requests to exercise your rights can be submitted using any of the contact details below. We may ask you for information that is reasonably necessary to verify your identity and to identify the information or processing to which your request relates.

  • We will respond to requests without undue delay and within the statutory time limits. This will normally be within one month of receiving your request, although in certain circumstances this period may be extended by up to a further two months, for example where a request is complex or you have made a number of requests.

  • These rights are not absolute and may be subject to conditions, limitations, and exemptions under applicable data protection law, including the UK GDPR, the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.

5.5 Requests to exercise rights can be submitted via the contact details in Section 6below. We will verify identity where appropriate, and we will respond within thestatutory timescales, normally within one month, extendable by up to two furthermonths for complex or multiple requests. Certain rights may be limited by legal obligations, privileges or exemptions under the DPA 2018 and DUAA 2025.

6. Data Infringement Procedure

6.1 You can make a data complaint using any of the following channels:

  1. Email: at hello@jwmediamusic.co.uk clearly labelling your matter ‘Data’

  1. Post: Data Team, J W Media, Argyle House, 29 -31 Euston Road, London, NW1 2SD

  1. Telephone: 0207 400 1460

  1. In person: Please ask for the Managing Director at reception.

6.2 To help us both understand and investigate your matter please include the following:

  • Your name and contact details.
  • Details of your concern, together with the relevant dates.
  • The Data that you believe is affected.
  • Supporting emails or documents you have in relation to the matter.
  • The outcome you wish to seek, including any remediation points we may be able to address.

6.3If you are complaining on behalf of another, please note that we will require confirmation in writing that you are authorised to act, and communicate on behalf of that individual.

  • Investigation and Resolution

  • We will acknowledge your complaint within 14 working days of receipt. The acknowledgement will confirm receipt, outline next steps and enclose a copy of this procedure.

  • Your complaint will be recorded in a central register.

  • The Management Team will begin investigating your complaint promptly and provide you an update within 14 days, or whenever possible during the investigation. If your complaint relates to a matter where the file has been closed, we may need to obtain your file from our archive storage facility, which may take 1-2 days.

  • The investigation may include reviewing relevant records, interviewing staff, and clarifying details with you. If it seems appropriate, we may suggest a meeting to obtain further details from you, or to discuss matters with you.

  • The duration of our investigation will depend on the complexity of the issues raised and the steps needed to resolve your complaint.

  • We will write to you within 30 days of receiving your request confirming our final position on your complaint and explaining our reasons, perhaps including suggestions for resolving the matter.

  • We aim to provide an outcome without undue delay, clearly explaining our findings.

  • If the matter is complex or we have received multiple complaints, we may extend the response period by a further [30] calendar days. If we need more time, we will inform you within the initial [30] day period and explain why we deem this to be necessary.

  • You may submit your complaint in an accessible format suited to your needs. We will make reasonable adjustments to facilitate lodging and progressing complaints.

  • The investigation may include reviewing relevant systems, records and policies; seeking information from relevant staff or processors; consulting legal and security teams; and, where appropriate, contacting you for clarification or further evidence. We will maintain confidentiality and data minimisation throughout. Access to complaint files is strictly limited to personnel with a need to know.

  • We will assess whether the complaint is upheld in whole or in part, and determine appropriate remedial actions, which may include correcting or updating data, changing processing practices, providing additional information, restricting or deleting data where legally justified, revising security measures, retraining staff or improving procedures.

  • We will provide you with a clear outcome explaining our findings, decisions and reasons, and any steps we have taken or propose to take. If we cannot fully resolve your complaint, we will explain your options, including escalation internally and your right to complain to the ICO.

  • Escalation of Complaints

8.1.You have the right to complain to a supervisory authority about our collection and use of your personal data. You can lodge a complaint with a supervisory authority in the Member State (if EU) or Country in which you usually reside, work or in which you believe a data right infringement occurred; please contact your local supervisory authority.

8.2Contact details for the ICO, the UK's data protection authority, are available here.

8.3The UK’s supervisory authority requests that require that organisations exhaust their own internal complaints process before investigating a data subjects’ complaint. Their contact number is 0303 123 1113, and postal address isthe Information Commissioner’s Office,Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

9. Record Keeping

We maintain a central log of all data complaints, including the complainant’s details, dates received and acknowledged, summary of issues, steps taken, decisions reached, outcomes, and any remedial actions. We retain complaint files for six years from closure, or longer where required for legal, regulatory, insurance or audit purposes. Records are secured with appropriate access controls. Anonymised and aggregated insights may be used to improve services and compliance.

10. Review and Updates

10.1 This Policy is reviewed annually and on material changes in law, ICO guidance, business operations, or following significant incidents or findings. The next scheduled review date is 18 June 2027.

10.2 Updates will be approved by the Managing Director and communicated to employees. Historic versions will be archived for audit.

11. Accessibility

We are committed to ensuring this Policy and our complaints process are accessible to all. On request we can provide this Policy and related communications in alternative formats or languages, including large print, Braille, audio or easy read, and we can offer reasonable adjustments to how you contact us or how we communicate with you. Please tell us about any accessibility needs when you get in touch.

12. Roles and Responsibilities

The Managing Director is responsible for oversight of this Policy and resourcing effective complaints handling, and ensure staff understand and follow this Policy. All staff must promptly escalate data complaints or incidents to Management and cooperate with investigations. Processors and third-party suppliers must notify us without undue delay of any data complaints they receive relating to our processing.

13. Interaction with Other Policies

This Policy should be read alongside our Privacy Notice, and associated policies as applicable. Where a complaint overlaps with whistleblowing, safeguarding, equality or HR grievances, we will coordinate processes to avoid duplication and ensure a fair outcome.

14. Lawful Bases and Special Category Data

When handling complaint data, we typically rely on legitimate interests and/or legal obligations as our lawful basis, and, where relevant to employees, performance of the employment contract. For special category data contained in a complaint, we will identify and document an applicable condition under Article 9 UK GDPR and Schedule 1 DPA 2018, such as the establishment, exercise or defence of legal claims or employment-related conditions and apply enhanced safeguards.

15. International Transfers

If complaint data is transferred outside the UK, we will ensure appropriate safeguards are in place, such as UK adequacy regulations or the ICO’s international data transfer agreement/addendum, and we will provide relevant information to complainants in accordance with our Privacy Notice.

16. Effective Date

This Policy takes effect on 19 June 2026, and updated with a revised version.

Version

Version

Implementation Date

Approval

V1

19.June 2026

J.Oakes

V2

10.September 2026