Legal
GDPR Compliance
Last updated: October 2026
Our data protection commitment
Protecting personal data is part of how we operate. Read our privacy policy for information about data collection, use and your rights. Contact us for the arrangements relevant to your organisation.
Our Commitment
RosterRoyalties Limited takes data protection seriously. As a platform that handles sensitive financial and artist data on behalf of music industry professionals, we have built GDPR compliance into the foundation of how Roster operates.
Data Controller
RosterRoyalties Limited is the controller for personal data we collect for our own website, account administration and communications. When we process artist or collaborator records on your organisation's instructions, the controller and processor roles depend on the service and the applicable agreement.
Lawful Basis for Processing
We process personal data under the following lawful bases as defined by UK GDPR Article 6:
- Contract (Article 6(1)(b)) — processing necessary to provide the Roster service to you
- Legitimate Interests (Article 6(1)(f)) — product analytics and platform improvement
- Legal Obligation (Article 6(1)(c)) — where required by applicable law
- Consent (Article 6(1)(a)) — for optional website analytics, recordings, advertising and referral tracking, and marketing communications where applicable
Your Rights Under GDPR
As a data subject, you have the following rights:
Right of Access
Request a copy of the data we hold about you.
Right to Rectification
Correct inaccurate or incomplete data.
Right to Erasure
Request deletion of your personal data.
Right to Restriction
Limit how we process your data.
Right to Portability
Receive your data in a machine-readable format.
Right to Object
Object to processing based on legitimate interests.
To exercise any of these rights, contact us at legal@rosterroyalties.com. We will respond within 30 days.
Data Storage and Security
Data handling depends on the service and the providers involved. This marketing website is hosted on Vercel and its PostHog analytics is configured to use the EU cloud endpoint. Contact us for the current application hosting, processing locations and transfer arrangements relevant to your workspace.
Data Processors
This marketing website uses Vercel for hosting and PostHog for analytics. Stripe processes Roster billing payments. Application services may involve additional providers; request the current processor and transfer information for your workspace.
- Stripe — billing payment processing
- PostHog — website analytics; this website uses the EU cloud endpoint
- Vercel — marketing website hosting
Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware, and affected individuals without undue delay.
Complaints
If you have concerns about how we handle your data, please contact us first at legal@rosterroyalties.com. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).
Contact
RosterRoyalties Limited
Company No. 17242618
82a, RosterRoyalties James Carter Road
Mildenhall, IP28 7DE
legal@rosterroyalties.com