Keep Hush Privacy Policy
This policy explains how KH Music Group LTD, trading as Keep Hush, collects and uses personal information when you visit our websites, attend our events, buy products or tickets, join our community, enter competitions or interact with us. It covers our activities worldwide. Additional notices may apply to particular events, services or countries, and this policy does not limit rights you have under applicable local law.
Our events are filmed, photographed and may be livestreamed. Identifiable attendees may appear in content published by Keep Hush and our partners, including sponsored content. Published recordings may remain available indefinitely, subject to the safeguards and rights explained below. We also use website tracking and, with appropriate permission, customer contact details for advertising audiences. See the sections on event capture and advertising for details.
1 Who we are and how to contact us
KH Music Group LTD is the controller of personal information where we decide why and how it is used. Our company number is 15532694. You can contact us about privacy, your rights or a complaint at info@keephush.net, or write to KH Music Group LTD, 39a Markfield Road, London, N15 4QA, United Kingdom.
Other organisations, such as ticketing platforms, co-promoters and social media platforms, may be responsible for their own uses of your information. Their privacy notices also apply to those uses. Where we jointly determine a particular use with another organisation, we will provide the relevant information through the event or service notice. You can contact us to ask about the arrangements.
2 Information we collect
Depending on how you interact with us, we collect the following information:
Identity and eligibility information: your name, date of birth, age and, where relevant, social media handle or account identifier.
Contact information: email address, telephone number, billing or delivery address and country or location information you provide.
Event and purchase information: registrations, guestlist entries, ticket and merchandise orders, attendance or check-in records, payment and refund information and transaction references. Payment providers also process information needed to complete payments under their own arrangements.
Membership and account information: information submitted through a become-a-member form, your interests and preferences, and account or authentication information where an account service is offered.
Messages and entries: enquiries, feedback, survey responses, competition entries and correspondence with us.
Images and recordings: photographs, video, audio, livestreams and associated event information in which you may be identifiable.
Technical and interaction information: IP address, device and browser information, pages viewed, referring links, identifiers and interactions with our websites, embedded players, messages or adverts, where the relevant technology is enabled.
Permission and preference records: the source, date and wording of your permissions, marketing preferences, cookie choices and records of objections or withdrawals.
We do not routinely ask for health information or other special category information. Please avoid including unnecessary sensitive information in forms or messages. If we need such information for a particular purpose, we will explain the purpose and the additional legal condition that applies.
3 Where information comes from
We receive information directly from you when you use a form, register, buy something, contact us or interact with our services. We also capture information at events and through the website technologies described below.
We may receive information from ticketing and registration platforms, event partners, co-promoters, payment and fulfilment providers, and membership or audience platforms. These include Beatport, Openstage, Shopify and Typeform where used for the relevant activity. The relevant platform or partner is identified through the form, checkout or event information. Contact us if you want to know the source of a particular record.
Where an event partner collects information for us or shares it with us, we explain the arrangement at collection. Permission given to another organisation does not automatically allow Keep Hush to send you marketing.
4 Why we use information and our legal bases
Where UK or EU data protection law applies, we use the legal bases below. A contract basis applies only where the use is necessary to fulfil a contract with you or take steps you request before entering one. Where we rely on legitimate interests, we assess whether the use is necessary and balance those interests against your rights and reasonable expectations.
Events and purchases
We use identity, contact, event and transaction information to manage bookings, admission, orders, deliveries, refunds and essential service messages. We rely on contract where applicable. For free registrations, guestlist administration and operational coordination outside a contract, we rely on our legitimate interests in running events and providing the service you requested. We use date of birth or age information to check relevant eligibility or age restrictions, relying on legitimate interests or a legal obligation where one applies.
Community and membership
We use form responses and preferences to administer community participation, membership requests and any membership or account service offered. We rely on contract for services you subscribe to, or legitimate interests in administering enquiries and community participation. Marketing is handled separately as explained below.
Enquiries and competitions
We use correspondence to respond to you, resolve problems and manage our relationship with you, relying on legitimate interests or contract where the enquiry concerns a contract. We use competition information to administer entries, check eligibility and award prizes under the competition terms. We rely on contract where those terms create a contract with you, or legitimate interests in administering the competition. We explain any proposed publication of winner details in the competition notice.
Business administration and security
We use relevant records for accounting, legal compliance, preventing fraud, protecting our systems and dealing with disputes. We rely on legal obligations where applicable, and otherwise on legitimate interests in keeping our business secure, maintaining appropriate records and establishing or defending legal claims.
Content and marketing
We use event recordings, contact details and online activity for the specific purposes and on the bases described in the next three sections. We do not treat acceptance of this policy as consent to marketing, tracking or every possible use of event images.
Where information is necessary to fulfil an order, booking or membership contract, we may be unable to provide that service if you do not supply it. Optional information and permissions will be distinguished from information required for the particular service.
5 Email and SMS marketing
We use contact details and preferences to send news, event announcements, ticket offers, merchandise updates, community information and other Keep Hush marketing. We may use Openstage, Textmagic and other relevant service providers to manage and deliver communications.
Where consent is required, we ask you to actively opt in to the relevant channel. Consent to email marketing does not automatically cover SMS. Joining a guestlist, entering a competition, submitting a membership form or buying a ticket does not, by itself, give permission for all marketing.
Where the law permits, we may send marketing about our own similar products or services using the existing-customer soft opt-in. We use this only where we obtained your details during a sale or negotiations with us and offered a clear opt-out when collecting them and in every subsequent message. In that situation, our data protection basis is legitimate interests in promoting our similar products and services. We do not use this exception where local law requires consent.
If a partner collects marketing permission for Keep Hush, it must specifically cover us and the communication channel. Where a form offers marketing from another organisation, it will identify that organisation and explain the choice. We do not generally share your contact details with event partners or sponsors for their own marketing unless this is specifically explained and the required permission has been obtained.
You can object to direct marketing at any time, including profiling used for direct marketing. We will stop using your information for that purpose.
Use the unsubscribe link in an email, the opt-out instructions in an SMS, or email info@keephush.net. We retain the minimum information needed to honour your choice. Opting out does not prevent essential messages about a booking, order or service you have requested.
6 Event filming photography and livestreaming
Capturing and publishing music and the atmosphere around it is a central part of Keep Hush. Our events are normally filmed and photographed and may be livestreamed. This may capture your image, voice and presence, including in crowd shots and close-up footage.
We use this content to record and distribute performances, document events and music culture, maintain our content catalogue, promote Keep Hush and future events, and deliver collaborations and sponsorships. Uses may include full sets, livestreams, photographs, edited clips, social posts, websites, press materials, sponsored or branded content and paid advertising, where the particular use is lawful.
We may share content with artists, venues, co-promoters, sponsors, media, production and distribution partners for these purposes. Content may be published on Keep Hush channels and partner channels and viewed worldwide. Publication partners may act as independent controllers for their own lawful use. Specific arrangements may be explained in an event notice or separate permission request.
For routine capture, publication, promotion and continued availability of event content, we generally rely on legitimate interests in producing and distributing music content, documenting our events, promoting our activities and delivering relevant partnerships. We assess the necessity of the particular use and its effect on people, including the context, prominence of individuals and whether the use is reasonably expected. This is not unrestricted permission for any use. Where consent or a separate release is required for a particular use, including certain featured appearances or advertising, we will obtain it separately.
We provide filming information through event booking or registration information and at the event as appropriate. If you have concerns, contact us before attending or speak to the event team before entering a filmed area. We will consider reasonable steps to reduce unwanted capture, but cannot guarantee that an attendee will never appear, particularly in crowd shots or a live broadcast.
Published recordings and related materials are intended to remain available indefinitely as part of our catalogue and record of events. We review whether continued retention and use remain justified. This does not remove your rights to object or request deletion. Unpublished production material is assessed separately and is not automatically kept forever.
To raise a concern or request a review, email info@keephush.net with the event, a link or timestamp and enough information to identify you. We assess requests under applicable law and consider appropriate steps, which may include editing, obscuring an image or removing material. We may have lawful grounds to retain some material, but will explain our decision. Material already broadcast or copied independently may be outside our control; we will consider any further steps required by law.
7 Cookies analytics and advertising
Our websites use cookies and similar technologies for website operation, analytics, advertising and embedded content. Tools may include Google Analytics, Meta Pixel, TikTok Pixel and YouTube embedded players. Depending on the tool, information can include device identifiers, IP addresses, pages visited, interactions and conversion events.
We use essential technologies where needed to provide a service you request. We obtain consent before enabling advertising tracking and other technologies that require it. Analytics is used with consent unless a specific legal exception applies and its conditions are met, including information and an opportunity to object where required. Our data protection basis is consent where required, or legitimate interests in operating and improving the service where a lawful exception applies.
Meta and TikTok technologies help us understand campaign performance and show relevant adverts, including to people who have interacted with our services. With the required permissions, information may be combined with information those platforms already hold. Google and YouTube may also process information for their own purposes under their privacy notices. Where an embedded player requires consent, we enable the relevant tracking only after that consent.
Customer lists used for Meta advertising
With your specific consent, we may provide contact details such as your email address or telephone number to Meta to match you with a Facebook or Instagram account and show Keep Hush adverts. We may also use the matched audience to find similar audiences where that use is covered by your permission. This is separate from permission to receive email or SMS. Matching may involve hashing contact details; hashing does not make this information anonymous.
You can withdraw advertising-matching consent or object to direct marketing by contacting info@keephush.net. We will stop using your information for that purpose and take appropriate steps to update relevant audiences. Changing browser cookie choices does not, by itself, withdraw permission for previously uploaded customer-list matching.
Our cookie information and consent controls explain the technologies in use, their providers, purposes and lifetimes, and how to change your choices. You can also use relevant browser and platform privacy controls. General audience segmentation and campaign measurement are not intended to make solely automated decisions producing legal or similarly significant effects on you. If we introduce such decisions, we will provide the additional information and safeguards required by law.
8 Who we share information with
We share relevant information only for the purposes described in this policy, with a lawful basis and appropriate safeguards. Recipients may include:
Technology and delivery providers: website hosting, forms, ticketing, audience management, ecommerce, payment processing, communications, storage and fulfilment providers. Our tools include Beatport, Openstage, Shopify, Typeform, Textmagic and Framer, where used for the relevant service.
Event and content partners: venues, co-promoters, event staff, artists, photographers, production teams, sponsors and publication partners, where needed to operate the event or create and use content as described above. Operational sharing of an attendee list does not itself authorise a partner to send its own marketing.
Analytics, advertising and video providers: Google, Meta, TikTok and YouTube, subject to the permissions and purposes described above.
Professional advisers, insurers, authorities and other parties: where necessary for advice, legal compliance, safety, dispute resolution or protecting legal rights.
Parties to a business transaction: where necessary for a proposed or completed restructuring, investment, merger or transfer of our business or assets, with appropriate confidentiality and data protection safeguards.
Some providers process information on our instructions under contracts. Others act independently or jointly with us for particular activities. Their roles depend on the service and processing involved. We will provide relevant additional information where required; contact us if you need details of a particular recipient or arrangement.
9 International processing
Keep Hush is based in the United Kingdom, but our activities and service providers are international. Information may be processed in the UK, the European Economic Area, the United States and other countries in which relevant providers or event partners operate. Public event content can be accessed worldwide.
Where a transfer is restricted under applicable data protection law, we use a permitted transfer mechanism. Depending on the destination and recipient, this may be applicable UK adequacy regulations or an EU adequacy decision, including a relevant certified data privacy framework arrangement, or appropriate contractual safeguards such as the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, or EU Standard Contractual Clauses. We assess the transfer and additional safeguards where required.
You can contact info@keephush.net for information about the countries and safeguards relevant to your information, including how to obtain a copy of applicable contractual safeguards, subject to appropriate redactions. Additional country-specific notices will apply where required. Nothing in this policy requires you to give up protections available under your local law.
10 How long we keep information
We do not apply a single retention period to all personal information. We keep each category while it remains necessary for a specific purpose described in this policy, subject to applicable legal requirements and your rights. We determine retention using the criteria below and review whether information is still needed. When it is no longer needed for any lawful purpose, we delete it or make it genuinely anonymous.
Event registrations, attendance and customer history: we keep information while needed to administer events, manage bookings, resolve queries, or maintain a continuing customer or community relationship. We consider the last relevant interaction, whether the relationship remains active, the usefulness and accuracy of the information, and whether less detailed information would meet the purpose. Where relevant information is also lawfully used for marketing, it follows the marketing criteria below; registering for an event does not automatically authorise marketing or justify retaining every field indefinitely.
Enquiries and competition information: we keep records while needed to respond, administer the competition, award and deliver prizes, resolve complaints and deal with relevant claims. After completion, we assess whether any information remains necessary for those purposes or for another separately explained lawful purpose. We do not retain all entry or correspondence details solely because they might be useful in future.
Orders, payments and accounting records: we retain records for the period required by applicable tax and accounting rules and while needed for relevant contractual issues or legal claims. For UK company accounting records, this is generally at least six years from the end of the last financial year to which they relate, and longer where applicable law requires it. This does not mean that every item of personal information connected with a purchase must be kept for the same period.
Membership and account information: we keep information while needed to administer your membership, account or outstanding request. After a relationship or request ends, we retain only information still justified for matters such as unresolved obligations, complaints, legal claims, or another lawful purpose explained in this policy. We consider account status, recent activity and the nature of any continuing relationship.
Marketing information: we may maintain a long-term audience database while there is a valid lawful basis and a continuing need to use the relevant information for the marketing purpose explained to you. We assess relevance and accuracy, your interactions with us, the age and scope of any consent, and your reasonable expectations. There is no automatic expiry period applying to every subscriber, but failure to unsubscribe alone does not justify keeping all information indefinitely. If you withdraw consent or object, we stop the marketing covered by that choice and retain only information justified for another lawful purpose.
Permission and suppression records: we retain evidence of permissions and the minimum information needed to honour opt-outs, demonstrate compliance or address relevant complaints and claims. We may retain a minimal suppression record for as long as necessary to prevent someone who has opted out from being added back to marketing.
Event content: published recordings, photographs and related materials are intended to remain available indefinitely as part of our music catalogue and record of events, while continued use remains lawfully justified. We review this where appropriate, including when someone objects or requests deletion. Unpublished footage is retained while reasonably needed for editing, planned publication, licensing or relevant disputes and is reviewed for deletion when those purposes end. Published content is not exempt from data protection rights merely because it forms part of our catalogue.
Technical data and advertising audiences: retention depends on the specific analytics, security or campaign purpose, the useful life of the information, provider settings and your choices. We remove or update audiences when the relevant purpose or permission no longer applies. Cookie and similar identifier lifetimes are described in the relevant cookie information.
We may retain relevant information while an unresolved complaint, legal hold or reasonably anticipated claim requires it, taking account of applicable limitation periods. Residual backup copies are restricted from ordinary use and removed or put beyond use through the applicable backup cycle, subject to legal requirements.
We may keep genuinely anonymous statistics for longer because they no longer identify people. Removing a name or hashing contact details does not necessarily make information anonymous.
11 Your rights and choices
Depending on the law that applies and the circumstances, you may have rights to access your information, correct inaccuracies, request deletion, restrict processing, receive or transfer certain information, withdraw consent and complain to a regulator. Withdrawal does not affect the lawfulness of processing before withdrawal. Some rights have legal exceptions; if we cannot fulfil a request, we will explain why.
You have an absolute right to object to use of your information for direct marketing, including related profiling. You may also object to processing based on legitimate interests on grounds relating to your particular situation.
Where applicable local law provides additional rights, including rights concerning targeted advertising or certain disclosures, you can contact us to exercise them. We do not discriminate against you for exercising applicable privacy rights.
Email info@keephush.net to make a request. We may need proportionate information to verify your identity. We normally respond within one month where UK or EU GDPR applies, subject to lawful extensions or adjustments, and otherwise within the period required by applicable law. Requests are normally free of charge, subject to legal exceptions.
Some events and services have minimum age requirements, which are explained at registration or purchase. We use date of birth or age information where needed to check eligibility. Where we process children’s information, additional safeguards may apply. Contact us if you have concerns about a child’s information.
12 Security
We use appropriate technical and organisational measures to protect personal information and limit access to people and service providers who need it for their work. No online service or transmission can be guaranteed completely secure. We assess suspected personal data breaches and notify affected people and relevant authorities where required by law.
13 Complaints
Please send privacy complaints to info@keephush.net or the postal address above. We will acknowledge a data protection complaint within 30 days, investigate without undue delay, keep you informed as appropriate and explain the outcome.
You can also complain to the UK Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/ or by telephone on 0303 123 1113. Where applicable, you may complain to your local data protection authority, including the relevant authority in the EEA. We would welcome the opportunity to address your concern, but this does not restrict your right to contact a regulator.
14 Changes to this policy
We review this policy as our activities and legal requirements change. We publish the updated version with a revised date and bring significant changes or new uses of information to your attention as required. Where a new use requires consent, updating this policy alone does not provide that consent.