Privacy Policy

This Privacy Policy applies to www.labelworx.com (“Website”), the client portal at lms.labelworx.com (the “LabelWorx Platform”), LabelWorx’s mobile and desktop apps (the “Apps”) and all related sites, players, widgets, tools, apps, data, software, APIs and other services (the “Services”) produced and maintained by Label Worx Limited (company number 06729435), a company registered in England and Wales with its registered office at 61b Humber Street, Kingston upon Hull, HU1 1TU, United Kingdom (“LabelWorx”). The Website, Apps and Services are included under “LabelWorx Platform” for the purposes of this Privacy Policy.

LabelWorx is the controller of the personal data described in this Privacy Policy, except where section 3 explains that it acts as a processor for its clients. LabelWorx is registered with the Information Commissioner’s Office (“ICO”) under registration number ZA823278. This Privacy Policy is issued under the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), each as amended from time to time, including by the Data (Use and Access) Act 2025, and, where LabelWorx offers Services to or monitors individuals in the European Economic Area, the EU General Data Protection Regulation (“EU GDPR”) (together, “Data Protection Law”).

LabelWorx operates a “business to business” music distribution, promotion and rights management service. You may use LabelWorx in two ways: (a) if you are aged 18 or over, by creating an account on the Website to use PromoBox, DemoWorx and LabelWorx’s other web-based services (the “Website Services”) under LabelWorx’s website terms and conditions (the “LabelWorx Website Terms”); or (b) by applying for a distribution or other services agreement, in which case LabelWorx will collect and store certain types of data before acceptance in order to determine whether a business relationship can be established. In each case the relevant agreement governs the Services and this Privacy Policy explains how LabelWorx handles personal data in connection with them. Please read these documents carefully.

This Privacy Policy is a transparency notice, not a contract. LabelWorx does not rely on your use of the LabelWorx Platform as consent to anything: where LabelWorx needs your consent it will ask for it separately and you may withdraw it at any time (see section 13). LabelWorx’s lawful bases for processing are set out in section 5. Where LabelWorx asks you for information it will tell you if providing it is required. If you do not provide required information, LabelWorx may be unable to assess your application, open or secure your account, make payments or provide the relevant Services.

If you have any questions about this Privacy Policy, contact LabelWorx by email at privacy@label-worx.com or by post at the address above, marked for the attention of the Data Protection Lead.

This Privacy Policy applies to the following people (each, “you”):

• Visitors to the Website and users of the Apps;
• Individuals who apply for a services contract with LabelWorx, including sole traders and the directors, employees and representatives of record labels and other businesses that apply;
• Users of the client portal at lms.labelworx.com, being LabelWorx’s clients and the individuals authorised by those clients to access their accounts;
• Artists, songwriters, producers, payees, PromoBox campaign recipients (such as DJs, press and other promo-list contacts), DemoWorx demo submitters and other individuals whose personal data LabelWorx’s clients submit to the LabelWorx Platform in order to receive the Services (“Client-Submitted Individuals”) — see section 3;
• People who contact LabelWorx, subscribe to LabelWorx’s newsletters or interact with LabelWorx at conferences and events or on social media; and
• Representatives of LabelWorx’s suppliers, digital service providers (“DSPs”), stores and business partners.

LabelWorx does not process personal data of its own staff or job applicants under this Privacy Policy; separate notices apply to them.

To deliver the Services, LabelWorx’s clients upload release metadata, contributor credits, artwork, contracts, split and payee details and other information that may include personal data about Client-Submitted Individuals. Where LabelWorx stores, organises, calculates or transmits that personal data solely on the client’s documented instructions, LabelWorx is the client’s processor and the client is the controller. LabelWorx’s processing on behalf of clients is governed by data-processing terms that meet Article 28 UK GDPR: for Website Services these terms are in the LabelWorx Website Terms; for distribution and other services they are in the data protection provisions of the relevant services agreement. LabelWorx is a controller where it decides the purposes and means itself — for example for its own legal compliance, fraud prevention, security, claims handling and payment administration.

If you are a Client-Submitted Individual, requests concerning processing for which LabelWorx is a processor should ordinarily be made to the client that submitted your data, although LabelWorx will forward requests and assist that client as Article 28 UK GDPR requires. Where LabelWorx acts as controller, this Privacy Policy provides the information required by Article 14 UK GDPR. Because LabelWorx usually has no direct relationship with Client-Submitted Individuals, providing that information to each of you individually would involve disproportionate effort (Article 14(5)(b) UK GDPR); LabelWorx therefore publishes this Privacy Policy on the Website and requires its clients to bring it to the attention of the individuals whose personal data they submit. LabelWorx obtains personal data about Client-Submitted Individuals from its clients and, where relevant, from DSPs and stores, publicly available sources such as company and rights registers, and identity-verification and payment providers (Article 14(2)(f) UK GDPR). Where LabelWorx acts as controller, you may exercise your rights directly against LabelWorx (see section 13).

LabelWorx collects the following categories of personal data about you when you use the LabelWorx Platform, apply for or receive the Services or otherwise interact with LabelWorx.

• Identity and contact data: name, job title, business name, postal address, email address, telephone number, and, where relevant, date of birth and identity documents required for anti-fraud or payment verification.
• Application and account data: the information requested in the sign-up and application forms (which may change from time to time), label and catalogue details, usernames, passwords (stored in hashed form), account settings, device IDs and communication preferences.
• Contract and financial data: bank account details, VAT and tax identifiers, self-billing and withholding-tax forms, royalty statements and payment history.
• Payment card and PayPal data: see section 7.
• Content and rights data: sound recordings, metadata, contributor names and credits, artwork, contracts and split sheets that you or your label submit, which may contain personal data about you or other people.
• Communications data: emails, support tickets, contact-form submissions, survey responses, testimonials and records of calls or meetings with you.
• Technical and usage data: see below.
• Marketing data: your newsletter and marketing preferences and LabelWorx’s records of the communications it has sent you and how you interacted with them.

When you are using the LabelWorx Platform to complete an application for a services contract with LabelWorx, LabelWorx collects the data requested in the fields found as part of the application process. Those fields may change from time to time. LabelWorx retains that data in its system to facilitate your application process (e.g.: if you log out mid-way through the application process, your data will still be there when you log back in to further the application process). If you commence the application process but for any reason decide not to complete it and wish LabelWorx to delete the data you have submitted, please contact LabelWorx at privacy@label-worx.com. Incomplete applications are deleted automatically six months after the applicant’s last activity unless an earlier deletion request applies or continued retention is required by law or for a documented legal claim.

LabelWorx does not ordinarily require or intentionally collect special category data (such as health, racial or ethnic origin, religious beliefs, sexual orientation or biometric data) or criminal-offence data. Please do not submit such data unless LabelWorx specifically asks for it and explains why it is needed and the legal condition it relies on. If LabelWorx receives such data unexpectedly, it will restrict access to it and securely delete it unless it is legally entitled, and needs, to keep it.

Information LabelWorx collects automatically

There is certain information that LabelWorx collects automatically as the result of your use of the LabelWorx Platform, or through the use of web analytics services as described in the LabelWorx Cookie Policy. This information includes:

• the Internet Protocol (IP) address of the device from which you access the LabelWorx Platform (this can sometimes be used to derive the country or city from which you are accessing the LabelWorx Platform)
• the site that you visited immediately prior to visiting the Website
• any search terms that you may enter on the LabelWorx Platform
• the time, frequency and duration of your visits to the LabelWorx Platform
• your browser type and operating system
• the nature of the device from which you are accessing the LabelWorx Platform, for example, whether you are accessing the LabelWorx Platform from a personal computer or from a mobile device and its device-ID
• your approximate location, derived from your IP address, when using the Apps (LabelWorx does not collect precise GPS location)
• information collected through cookies and similar technology, as described in the LabelWorx Cookie Policy
• information regarding your interaction with email messages, for example, whether you opened, clicked on, or forwarded the email message (LabelWorx only uses email tracking where PECR permits it — see section 6)
• security and audit logs for the LabelWorx Platform, including login times and actions taken on your account.

Data Protection Law requires LabelWorx to have a lawful basis for each purpose for which it uses your personal data. The table below sets out LabelWorx’s purposes and the lawful basis it relies on under Article 6 UK GDPR. Where LabelWorx relies on legitimate interests, it has assessed that its interests are not overridden by your interests, rights and freedoms; you can ask LabelWorx for details of that assessment and you have the right to object (section 13).

LabelWorx does not sell personal data for monetary consideration; however, disclosures through advertising technologies may constitute a “sale” or “sharing” under applicable US state privacy laws, as explained in section 13, and may be used only after any consent required by PECR and Data Protection Law. LabelWorx only discloses personal data as described in section 9.

LabelWorx only uses your personal data for the purposes for which it collected it, unless it reasonably considers that it needs to use it for another purpose that is compatible with the original purpose. If LabelWorx needs to use your personal data for an unrelated purpose, it will notify you and explain the lawful basis for doing so.

LabelWorx may email you newsletters and information about its Services, events and offers if: (a) you have consented; (b) you are an existing client or have enquired about LabelWorx’s services, the message is about similar services, and you were given a simple, free way to opt out when your details were collected and in every message since (the PECR “soft opt-in”); or (c) you are a corporate subscriber (for example, an email address in the name of a limited company). Sole traders and partnerships (other than Scottish partnerships and limited liability partnerships) are treated as individual subscribers. Where LabelWorx relies on legitimate interests for marketing it has carried out a balancing assessment, and you can object at any time.

You can opt out at any time by clicking “unsubscribe” in any marketing email, by changing your preferences in the Settings tab of your account, or by emailing privacy@label-worx.com. Opting out of marketing will not stop service messages that LabelWorx needs to send you to operate your account.

LabelWorx only uses open- and click-tracking in marketing emails if you have separately consented to it; agreeing to receive marketing is not consent to tracking. You can withdraw that consent at any time through your preference settings or by emailing privacy@label-worx.com. LabelWorx does not use tracking in service messages.

LabelWorx does not sell or share your personal data with third parties for their own marketing.

LabelWorx uses various methods for payments. For payments using Stripe, LabelWorx stores the last four digits of the payment card being used in order to identify the card; LabelWorx never receives or stores the full card number, expiry date or security code. All other billing information in connection with Stripe is collected and stored by Stripe and its affiliates (“Stripe”), which act as independent controllers for that data; Stripe’s privacy policy is at https://stripe.com/gb/privacy. In connection with any payments via PayPal, PayPal and its affiliates (“PayPal”) handle the transaction and collect and store your data as independent controllers, and LabelWorx only stores your PayPal email address and transaction references. For further information regarding PayPal please read their privacy statement at https://www.paypal.com/uk/legalhub/privacy-full.

Where LabelWorx pays royalties to you, it holds your bank account details and tax information for as long as needed to make payments and to satisfy its tax and accounting obligations (see section 12).

LabelWorx uses cookies and similar technologies, including local storage, pixels and SDKs in the Apps, on the LabelWorx Platform. Strictly necessary technologies — for example session and security cookies — are set without consent, as PECR permits. Analytics, advertising and other non-essential technologies are only set if you consent through the LabelWorx cookie banner, which lets you accept or reject by purpose with no pre-ticked options. You can change or withdraw your consent at any time, as easily as you gave it, using the persistent “Cookie settings” link in the footer of the Website, and withdrawal will prevent further access to or storage of the affected non-essential technologies without affecting prior lawful processing. Full details of each technology, its provider, purpose and duration are set out in the LabelWorx Cookie Policy.

LabelWorx shares personal data with the following categories of recipient, and only to the extent needed for the purposes in section 5:

• Service providers acting as LabelWorx’s processors: cloud infrastructure (Google, Amazon Web Services, Dropbox, Docusign, Pipedrive) customer support (Zendesk), email delivery (Zendesk, Sendgrid), website analytics (Fathom Analytics) and IT, security and back-up providers. Each is bound by a written contract meeting Article 28 UK GDPR and may only use personal data on LabelWorx’s instructions. LabelWorx keeps this list up to date and will update it before appointing a new processor for client data, so that clients can object where the applicable data processing terms allow.
• Payment providers: Stripe and PayPal, which act as independent controllers as described in section 7, and LabelWorx’s banks.
• DSPs, streaming services, online stores, collecting societies and promotional partners: when LabelWorx distributes or promotes releases, it provides the release metadata, contributor names and credits, artwork and related information needed for the relevant service. These recipients are independent controllers of the data they receive and their own privacy policies apply.
• Advertising and social-media platforms: if you accept advertising cookies, Meta Platforms Ireland Limited (Facebook/Instagram) receives information about your visit to the Website through the Meta Pixel to measure LabelWorx’s advertising and show you relevant advertisements. Meta is a joint controller with LabelWorx for the collection of that data and an independent controller thereafter. The essence of the joint-controller arrangement is set out in Meta’s Controller Addendum, and you may exercise your rights against either LabelWorx or Meta; see https://www.facebook.com/privacy/policy.
• Professional advisers: LabelWorx’s accountants, auditors, lawyers, insurers and bankers.
• Authorities and law enforcement: HMRC, regulators, courts and law-enforcement agencies where LabelWorx is required by law or where it is necessary to establish, exercise or defend legal claims.
• Buyers or successors: see section 15.
• Anyone you ask LabelWorx to share it with, such as a client whose account you are authorised to use, or a manager or publisher you nominate.

LabelWorx requires all third parties to respect the security of your personal data and to treat it in accordance with the law. LabelWorx does not allow its processors to use your personal data for their own purposes.

LabelWorx hosts client data in [CONFIRM COUNTRIES/REGIONS]. Some of the recipients listed in section 9 (including Stripe, PayPal, Zendesk, Meta and DSPs) are located, or process data, outside the UK, including in the United States. Whenever LabelWorx transfers your personal data outside the UK it ensures one of the following safeguards is in place:

• the destination is covered by UK adequacy regulations (Article 45 UK GDPR), which currently include the EEA, Switzerland and other countries listed by the UK government;
• for transfers to the United States, the recipient is certified under the UK Extension to the EU-US Data Privacy Framework; or
• LabelWorx has entered into the ICO’s International Data Transfer Agreement, or the EU Standard Contractual Clauses with the ICO’s UK Addendum, with the recipient, together with any supplementary measures identified in a transfer risk assessment; or
• in limited cases, the transfer is necessary to perform LabelWorx’s contract with you or a contract concluded in your interest (for example, delivering a release to a DSP outside the UK that you or your label have chosen) or to make a payment to you (Article 49(1)(b) and (c) UK GDPR).

You can ask LabelWorx for further information about the safeguards it uses by contacting privacy@label-worx.com.

LabelWorx takes the security of all data it holds seriously. The following outlines some of the precautions taken to ensure the security of data held by LabelWorx but is not an exhaustive list:

• All client systems are protected by TLS encryption
• Sensitive data (such as passwords and payment details) stored on LabelWorx servers is encrypted or hashed before storage
• Client data is disclosed only where authorised by the client agreement or the client’s instructions, needed for a purpose described in this Privacy Policy, or required by law
• Data is only accessible to those who are authorised to view it, in most cases this is achieved via username and password access restrictions e.g. to databases and client systems, with additional access controls for staff access to production systems.
• Client-system data is hosted in the locations stated in section 10 and is accessed, supported or backed up from other locations only under appropriate access controls, processor terms and international-transfer safeguards.
• LabelWorx has procedures in place to deal with any suspected personal data breach and will notify you and the ICO of a breach where it is legally required to do so.

The transmission of information via the internet is not completely secure. Although LabelWorx does its best to protect your personal data, it cannot guarantee the security of data transmitted to the LabelWorx Platform; any transmission is at your own risk. You are responsible for keeping your password confidential.

LabelWorx keeps personal data only for as long as necessary for the purpose for which it was collected, taking account of legal, tax and accounting duties, limitation periods and contractual requirements. When the applicable period below expires, data is deleted or irreversibly anonymised from live systems and backups unless a legal hold applies:

If you would like to request the deletion of your personal data or request that it be returned to you, please contact LabelWorx at privacy@label-worx.com. By deleting your data from the LabelWorx Platform, you understand that you will no longer be able to use the Services. LabelWorx may retain your anonymised, aggregated, depersonalised data after it has been deleted from the LabelWorx Platform, which is no longer personal data.

Under Data Protection Law you have the following rights in relation to personal data LabelWorx holds about you as a controller:

• Access: to obtain a copy of your personal data and information about how LabelWorx processes it.
• Rectification: to have inaccurate or incomplete personal data corrected. You can update most account information yourself in the Settings tab of your account.
• Erasure: to have your personal data deleted in certain circumstances, for example where it is no longer needed for the purposes LabelWorx collected it. LabelWorx may need to keep some data to comply with legal obligations or to defend legal claims.
• Restriction: to ask LabelWorx to suspend processing of your personal data in certain circumstances, for example while you contest its accuracy.
• Portability: to receive the personal data you provided to LabelWorx, where LabelWorx processes it by automated means on the basis of contract or consent, in a structured, commonly used, machine-readable format, and to have it transmitted to another controller.
• Objection: to object to processing based on LabelWorx’s legitimate interests, and to object at any time to direct marketing. If you object to direct marketing LabelWorx will stop.
• Withdraw consent: where LabelWorx relies on consent, to withdraw it at any time. This does not affect the lawfulness of processing before withdrawal. If you withdraw consent to processing that is necessary to operate your account, LabelWorx may be unable to continue providing the Services.
• Automated decisions: LabelWorx uses automated tools to help with security monitoring, fraud detection, application triage and payment review, but no decision with legal or similarly significant effects on you (such as rejecting an application, suspending an account or withholding payment) is made solely by automated means without meaningful human review. If that changes, LabelWorx will update this Privacy Policy first and explain the logic involved and your rights to human intervention and to contest the decision.

To exercise any of these rights, email privacy@label-worx.com or write to LabelWorx at the address in section 1. LabelWorx may need to ask for specific information to confirm your identity. LabelWorx will respond within one month; it may extend this by up to two further months if the request is complex or you have made several requests, in which case LabelWorx will tell you. LabelWorx does not charge a fee unless a request is manifestly unfounded or excessive.

California residents: where the California Consumer Privacy Act applies to LabelWorx, you also have the right to know what personal information LabelWorx collects, uses and discloses, to access, correct and delete it, to opt out of its sale or sharing for cross-context behavioural advertising, and not to be discriminated against for exercising these rights. LabelWorx does not sell personal information and does not knowingly sell or share the personal information of anyone under 16. Advertising cookies may amount to sharing; you can opt out by rejecting them in Cookie settings, and LabelWorx honours Global Privacy Control signals. LabelWorx only uses sensitive personal information, such as log-in and bank details, for purposes the CCPA permits. You or an authorised agent may make a request using the contact details in this Privacy Policy, and LabelWorx will verify your identity before responding.

If you are unhappy with how LabelWorx has handled your personal data, please contact LabelWorx first so that it can try to resolve your concern. You also have the right to lodge a complaint at any time with the Information Commissioner’s Office, the UK supervisory authority for data protection: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; telephone 0303 123 1113; https://ico.org.uk/make-a-complaint/. If you are located in the EEA you may also complain to your local supervisory authority.

The LabelWorx Platform is a business-to-business service and is not directed at children. Accounts may only be created and administered by persons aged 18 or over; if LabelWorx learns that a person under 18 has done so, it will restrict the account and delete the personal data unless retention is legally required. Clients may submit limited personal data about under-18 artists or contributors where necessary to distribute content, attribute credits, administer rights or make payments; the client is responsible for having the authority and a lawful basis (including any parental consent) to do so.

LabelWorx may also use or disclose personal data if required to do so by law or in the good-faith belief that such action is necessary to (a) conform to applicable law or comply with legal process served on LabelWorx or the LabelWorx Platform; (b) protect and defend LabelWorx’s rights or property, the LabelWorx Platform or its users, or (c) act under emergency circumstances to protect the personal safety of LabelWorx, its affiliates, agents, or the users of the LabelWorx Platform or the public.

LabelWorx may change its ownership or corporate organisation while providing the LabelWorx Platform and Services. As a result, please be aware that LabelWorx may transfer your personal data to another company that is affiliated with LabelWorx or with which it has merged, or to a purchaser of all or part of its business. Under such circumstances LabelWorx would require the acquiring party to follow the practices described in this Privacy Policy, as it may be amended from time to time, and LabelWorx will notify you of any change of controller.

The LabelWorx Platform contains links to third-party websites, including the LabelWorx support centre hosted by Zendesk and the websites of DSPs and social media platforms. Clicking on those links may allow third parties to collect or share data about you. LabelWorx does not control those websites and is not responsible for their privacy practices; please read their privacy notices.

LabelWorx may update this Privacy Policy from time to time. The effective date at the top shows when it was last changed. If LabelWorx makes material changes it will notify account holders by email or by a notice in the LabelWorx Platform before the changes take effect, and where a change would require your consent LabelWorx will ask for it. Previous versions are available on request.

The controller for the personal data described in this Privacy Policy is:

Label Worx Limited (company number 06729435)
61b Humber Street
Kingston upon Hull
HU1 1TU
United Kingdom

Email: privacy@label-worx.com
ICO registration number: ZA823278

If you have any questions or queries regarding this Privacy Policy then please contact LabelWorx using the details above.