Data Protection and Privacy Policy

Sonic Artistes (Aljo Ents Ltd) is a UK-based musicians' agency. We are the data controller responsible for the personal information described in this policy.

Purpose: To detail how we collect, use, and protect personal data, ensuring compliance with UK GDPR and Data Protection Act 2018.

• Personal Information: Name, contact details (telephone, email), date of birth, bank details.
• Professional Data: Links to videos/audio/documents (showreels, performances), CVs/Resumes, and other supporting documents.
• Compliance Documents: Passport details, seafarers medical records, Seaman's Discharge Booklet, vaccination records, and other documents as required by cruise lines.
• Protected characteristics: We collect and store the following data that is defined as protected characteristics (see definition below) under the GDPR policy: age, sex/gender, disability (only as outlined in a medical certificate). We do not collect or store data associated with the following protected characteristics: gender reassignment, pregnancy and maternity, race, religion or belief, and sexual orientation.

• Submission Form: Initial collection through a form for auditions or interviews.
• Direct Communication: Data collected via email and online contracts.
• Online Agreements: Musicians sign contracts or agreements digitally once offered a position.

• Compliance: Ensuring musicians possess the necessary documentation to work legally at sea, including verification of legal and medical documents.
• Operational Use: Maintaining records for contact purposes, payroll processing, and contract management.

• Third-Party Disclosure: Personal data shared with cruise lines for compliance purposes. Payroll data (e.g., Payee name, IBAN) shared with relevant financial institutions for payment processing.
• Data Handling: Musicians paid directly by the cruise line will have their data managed and held by the cruise line.

• Personal Identification and Contact Information: Retained for the duration of the contract plus 6 years for legal and auditing purposes.
• Financial and Payroll Data: Held for the contract period and 6 years after, to comply with financial regulations.
• Compliance-Related Documentation: Maintained for the contract duration and 6 years post-contract for verification and compliance.
• Video/Audio Links and Supporting Documents: Retained during consideration and up to 6 years after for potential re-evaluation.

Please see more detail in our Data Retention Policy [SAP009].

• Data Storage: All data is stored on self-hosted, UK-based Hostinger VPS infrastructure. Musician documents are held in enterprise-grade, S3-compatible cloud storage with AES-256 encryption at rest and TLS 1.2+ encryption in transit. Application data resides in a PostgreSQL database on a UK-based VPS. Access is controlled through role-based permissions enforced at the database level (Row Level Security), with time-limited signed URLs for document access. The platform architecture includes a private internal network, CDN with DDoS protection and WAF, least-privilege service credentials rotated every 90 days, and comprehensive audit logging across all key areas. Full details are set out in our Security & Data Protection Overview document.
• Access Control: Data access restricted to Sonic Artistes team members and end-users with fully encrypted username and password protection.

• Internal Access: Limited to team members responsible for processing musician data.
• External Requests: Musicians can request access to their data via email.

• Exercise of Rights: Musicians have the right to access, rectify, erase, restrict processing, and object to the processing of their personal data. They can submit requests via email.

• Notification: Affected individuals will be informed promptly, but no later than 72 hours after discovering a breach. Notification to the Information Commissioner's Office (ICO) is required if the breach poses a risk to individuals' rights and freedoms.

• Current Status: Data is stored in our database system provided by Hostinger VPS in Manchester, United Kingdom.
• Recommended Safeguards: Sonic Artistes has a Data Processing Addendum (DPA) with Airtable that sets out the terms that apply when a customer's personal data is processed by Airtable, including the appropriate technical and organisational measures implemented to protect such personal data.

• Role: The DPO oversees compliance with data protection laws and acts as a point of contact for data protection issues.

Protected characteristics:

In the context of the GDPR (General Data Protection Regulation), "protected characteristics" refer to specific attributes or traits of individuals that are particularly sensitive and require special consideration when processing personal data. These characteristics are given additional protection under the law because they can be used to identify or discriminate against individuals. The GDPR places stricter requirements on the processing of data related to these characteristics to ensure individuals' rights and freedoms are respected.

The idea is to protect individuals from unfair treatment or discrimination based on these attributes, ensuring equal treatment and safeguarding privacy. This means that when organisations handle data related to protected characteristics, they must implement stronger security measures and have legitimate, lawful grounds for processing such data. Additionally, individuals have enhanced rights concerning their data related to these characteristics, such as the right to access, correct, or delete their data.