BandBox
Privacy Policy.
Last updated: 03/03/2026
Who we are
BandBox is a project operated by Harvey Castree, an individual based in Bristol, United Kingdom. Harvey Castree is the data controller for the personal data described in this policy.
You can contact us at contact@bandbox.music.
What data we collect
We collect the following personal data:
- Survey responses: Your answers to our survey questions about music habits and preferences, plus your name and email address if you choose to enter our prize draw.
- Waitlist signups: Your name, email address, and optionally your mobile phone number.
Why we collect it and our lawful basis
| Purpose | Data used | Lawful basis |
|---|---|---|
| Administering the prize draw (contacting winner, delivering prize) | Name, email | Consent (you opt in by ticking the prize draw checkbox) |
| Analysing survey responses to improve our product | Survey answers | Legitimate interests (understanding what musicians need from our product) |
| Sending you emails about BandBox's launch, updates, and news | Name, email | Consent (you opt in by ticking the marketing checkbox) |
| Sending you text messages about BandBox | Name, mobile number | Consent (you opt in by ticking the SMS checkbox) |
| Waitlist management and launch notification | Name, email | Consent (you sign up to the waitlist) |
Who we share your data with
We share your data with the following service providers who process it on our behalf:
- Tally — to host our survey
- Formspree — to receive and store waitlist signups
We do not sell your data to any third party.
International transfers
Some of our service providers are based outside the UK. Where your data is transferred outside the UK, it is protected by appropriate safeguards including Standard Contractual Clauses or the relevant country's adequacy decision under UK GDPR.
How long we keep your data
- Prize draw entries: Deleted within 90 days after the draw takes place and the prize is delivered.
- Survey responses: Retained for up to 24 months from collection, then deleted or fully anonymised.
- Waitlist and marketing contacts: Retained until you unsubscribe, or for 24 months from signup (whichever is sooner), then deleted. We review our marketing list annually.
We maintain a suppression list of email addresses that have unsubscribed, to prevent re-contact.
Your rights
Under UK GDPR, you have the right to:
- Access your personal data (request a copy of what we hold)
- Rectify inaccurate or incomplete data
- Erase your data ("right to be forgotten")
- Restrict processing in certain circumstances
- Data portability — receive your data in a structured, machine-readable format
- Object to processing based on legitimate interests
- Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal
To exercise any of these rights, email us at contact@bandbox.music. We will respond within one month.
How to withdraw consent
You can withdraw your marketing consent at any time by clicking the unsubscribe link in any email we send, replying STOP to any text message, or emailing us at contact@bandbox.music.
Automated decision-making
We do not use automated decision-making or profiling.
How to complain
If you have concerns about how we handle your data, please contact us first at contact@bandbox.music. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk, telephone 0303 123 1113, or write to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Changes to this policy
We may update this policy from time to time. We will notify you of significant changes by email or a prominent notice on our website. The date at the top of this page shows when it was last updated.
← Back to waiting list