Privacy Policy
Last updated: 10 November 2026
Songs of Freedom Limited ("we", "our", "us") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our Website at songsoffreedom.co.uk (the "Website"), buy from our online shop, use the Songs of Freedom app, watch our live stream or come to our events, in accordance with data protection laws (which includes the European General Data Protection Regulation (GDPR), as amended and/or incorporated into the laws of the United Kingdom of Great Britain and Northern Ireland (UK), if applicable and other applicable EU, Member State and UK laws). In the UK, this means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended by the Data (Use and Access) Act 2025. Please read this Privacy Policy carefully. By accessing our Website or doing business with us, you confirm you have read and understand our Privacy Policy. For any data protection inquiries or queries related to this Privacy Policy, please use the contact details provided in this policy.
Who Is Responsible for Your Data
Songs of Freedom is run by two organisations, and each is responsible for different personal data:
• Songs of Freedom Limited is responsible for the Website, our online shop, the Songs of Freedom app, the live stream, our events and our marketing emails. Company number 17295501. Registered office: First Floor, 14-15 Berners Street, London W1T 3LJ. Email: info@songsoffreedom.co.uk.
• Monday Charitable Trust receives and administers donations to the Songs of Freedom appeal, including Gift Aid, and is the controller of donors' personal data. Registered charity number 1174232 (Charity Commission for England and Wales). Company number 10910936. Registered office: Floor 8, 71 Queen Victoria Street, London EC4V 4AY. See "Donations (Monday Charitable Trust)" below.
In this policy, "we", "our" and "us" mean Songs of Freedom Limited, and "MCT" means Monday Charitable Trust. If you are not sure who to contact, email info@songsoffreedom.co.uk and we will make sure your message reaches the right organisation.
Personal Data We Collect and Process
"Personal data" means any information relating to an identified or identifiable natural person ('data subject'). We collect and process various types of personal data depending on our interactions with you. This may include:
• Data collected directly from you:
◦ Contact information: Name, postal address, billing address, shipping address, email address and phone number.
◦ Account information: Username, password, preferences and marketing preferences, if you create an account in the Songs of Freedom app. You do not need an account to use the Website or buy from our shop.
◦ Financial information: Payment information (e.g., credit card details, account numbers). Card payments are handled by our payment providers, and by Apple or Google for purchases in the app. We do not store full card details ourselves.
◦ Transaction information: viewed items, cart and waitlist notifications requests, transaction history (including returns).
◦ Live stream and app information: the streams you buy and watch in the app, when you watch them, and the type of device you use.
◦ Event information: the booking details Ticketmaster passes to us when you buy a ticket (see "Tickets (Ticketmaster)" below), whether your ticket was scanned at the venue, and any access needs you tell us about so you can attend safely.
◦ Images and recordings: you may appear in photos, film and the live broadcast of our events (see "Live Stream, Filming and Photography" below).
◦ Communication: Records of your communications with us.
◦ Other information you choose to provide to us.
• Automated data collection through our Website: When you visit our Website or use our services, we may automatically collect data such as IP addresses, cookie identifiers, other online identifiers, and location data. This may also include information about your device, browser type, and interactions with our Website (e.g., pages viewed, clicks). These technologies may create profiles of natural persons.
• Automated data collection through the app: When you use the Songs of Freedom app, it collects your device type, operating system, app version, IP address and crash reports and, if you allow notifications, a notification token so we can send them.
• Data we receive from others: We receive booking details from Ticketmaster when you buy a ticket for one of our events, confirmation from Apple or Google when you buy stream access in the app (but not your card details), your contact details and communication preferences from MCT if you make a donation and choose to hear more about Songs of Freedom, and information from social media platforms if you contact us through them.
• Third-Party Services: We may collect and process your data with trusted third-party service providers who assist us in operating our Website, conducting our business, or providing our services to our users, so long as those parties agree to keep this information confidential. Our Website is hosted by a third-party service provider called Squarespace. Learn more about Squarespace below. Our online shop runs on Shopify, and the Songs of Freedom app is built and run for us by another company. Learn more about both below.
• Marketing Emails | Campaigns: We may send you marketing emails, which you can unsubscribe from. We will only send you marketing emails about our events, music, merchandise and the app if you have agreed to receive them, for example by ticking the box at our shop checkout, when you buy a ticket through Ticketmaster, or when you make a donation and choose to hear more about Songs of Freedom. If you unsubscribe, we keep a record of your request so that we don't contact you again by mistake. The app will only send you push notifications if you allow them, and you can turn them off at any time in your device settings.
• Special Categories of Personal Data: We generally prohibit the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation. We will only process such special categories of personal data if one of the specific exceptions under Article 9(2) of the GDPR applies, for example:
◦ You have given explicit consent for one or more specified purposes.
◦ It is necessary for reasons of substantial public interest, based on Union or Member State law, with suitable and specific measures to safeguard your rights and interests.
◦ It is necessary for the purposes of preventive or occupational medicine, medical diagnosis, health or social care, or the management of health/social care systems and services, processed by a professional subject to professional secrecy obligations.
◦ The data has been manifestly made public by you.
The only special category data we expect to hold is information about health or access needs that you choose to tell us so you can attend an event safely. We only use it with your explicit consent, only for that purpose, and we delete it within one month after the event.
How We Use Your Personal Data
Depending on how you engage with our Website and services, we use the information we collect for the following purposes:
• To operate and maintain our Website.
• To provide you with the services, fulfil your orders and arrange shipping.
• To tailor your experience and remember your preferences.
• To improve our Website and services.
• To communicate with you about your transactions, service-related announcements and assist with customer support
• To process your payments from you for services requested.
• To perform marketing activities about our products, services and promotions messages.
• To foster the safety, security and integrity of our Website and services, including fraud and risk monitoring related to payments. investigate or take action regarding possible fraudulent, illegal or malicious activity, and to secure our Website and services
• To analyse Website traffic and usage trends (e.g., via Google Analytics).
• To manage third-party service relationships.
• To comply with applicable legal requirements, such as tax and other government regulations and industry standards, contracts or law enforcement requests.
• To run your app account, sell you access to the live stream and let you watch it.
• To run our events, including checking tickets at the venue, keeping everyone safe and telling ticket holders about any changes.
• To film, photograph and broadcast our events.
Legal Basis to Process Your Personal Data
We process your personal data for specified, explicit, and legitimate purposes. The legal bases for our processing activities are as follows:
• Your Consent: We will process your personal data when you have given us clear, affirmative consent for one or more specific purposes. For example, for sending you marketing communications, or for certain types of cookies. You have the right to withdraw your consent at any time. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.
• Performance of a Contract: Processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract. For example, to provide you with the services or goods you have requested.
• Compliance with a Legal Obligation: Processing is necessary for compliance with a legal obligation to which we are subject.
• Protection of Vital Interests: Processing is necessary in order to protect your vital interests or those of another natural person. This applies in emergency situations, such as to protect your life or physical integrity.
• Performance of a Task Carried Out in the Public Interest or Exercise of Official Authority: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us. The purpose of such processing will be determined by Union or Member State law.
• Legitimate Interests: Processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms, especially if you are a child. Our legitimate interests include:
◦ Improving our services and products: To understand how our services are used and to enhance their functionality and user experience.
◦ Marketing our products and services: To inform you about our offerings that may be of interest to you.
◦ Preventing fraud and ensuring network security: To protect against unauthorized access, malicious code distribution, and other cyber threats.
◦ Internal administrative purposes: For processing client or employee data within our group of undertakings.
◦ Processing by public authorities in the performance of their tasks is not based on legitimate interests.
• Which legal basis we use for each purpose:
◦ Selling and delivering shop orders: performance of a contract.
◦ Running your app account, selling stream access and letting you watch the stream: performance of a contract.
◦ Sending messages about your order, booking or account, such as confirmations, stream links and changes to an event: performance of a contract.
◦ Running our events for ticket holders: performance of a contract and legitimate interests (running the event you have booked for).
◦ Checking tickets at the venue and keeping everyone at the event safe: legitimate interests.
◦ Recording health or access needs so you can attend safely: your explicit consent.
◦ Filming, photographing and broadcasting our events: legitimate interests (sharing the event with people watching at home and promoting Songs of Freedom), and your consent for close-up interviews or featuring an identifiable child.
◦ Sending marketing emails, including to donors whose details MCT has passed to us because they asked to hear from us: your consent.
◦ Sending push notifications from the app: your consent, which you give and can withdraw in your device settings.
◦ Analytics and performance cookies: your consent.
◦ Keeping our Website, shop and app secure, fixing faults, and preventing fraud, ticket touting and account sharing: legitimate interests.
◦ Responding to your enquiries, feedback and complaints: legitimate interests.
◦ Keeping a record of people who have asked not to be contacted: compliance with a legal obligation and legitimate interests.
◦ Keeping tax and accounting records: compliance with a legal obligation.
Live Stream, Filming and Photography
The gig will be filmed and photographed, and broadcast live through the Songs of Freedom app. By buying a ticket and attending, you accept that you may appear in the broadcast, recordings and photos, for example in crowd shots.
There will also be signs at the venue. If you would prefer not to be filmed, please speak to our staff when you arrive and we will do our best to help.
We will ask for your consent before filming a close-up interview with you, and we will ask a parent or guardian before featuring an identifiable child.
We can't edit a live broadcast, but if you would like us to remove a photo or clip of you from our own channels afterwards, contact us and we will consider your request.
The Songs of Freedom App
The app is built and run for us by another company, which acts on our instructions. This policy covers the app.
When you buy stream access in the app, Apple or Google processes your payment under its own privacy policy. They tell us that you have paid, but not your card details. Apple and Google are also responsible for the data they collect when you download the app from their stores.
You can delete your app account at any time in the app's settings or by emailing info@songsoffreedom.co.uk. We will delete your account data within 30 days, except records of purchases, which we must keep for tax purposes.
Our Shop (Shopify)
Our online shop, where we sell merchandise and copies of the single, runs on Shopify and is linked from our Website. You do not need an account to buy from it. Shopify processes your orders and payment details on our behalf. Shopify is also responsible for some data it uses for its own services, such as Shop Pay and the Shop app, under its own privacy policy: shopify.com/legal/privacy.
Tickets (Ticketmaster)
Tickets for our events are sold by Ticketmaster. Ticketmaster is responsible for the personal data it collects when you buy a ticket, under its own privacy policy: ticketmaster.co.uk/privacy. Ticketmaster shares your booking details with us so we can run the event, and your contact details if you agree to hear from us. This policy explains what we do with them.
Listening on Spotify
The single is also available to stream on Spotify. If you listen there, Spotify's own privacy policy applies. Spotify only gives us overall listening statistics, which don't identify you.
Donations (Monday Charitable Trust)
Donations to the Songs of Freedom appeal are received and administered by Monday Charitable Trust ("MCT"), not by Songs of Freedom Limited. MCT is the controller of donors' personal data. MCT's own privacy notice explains in full how it uses this information: Privacy Notice | Songs of Freedom Appeal.
Donation Payments (Stripe)
Donation payments are processed by Stripe, a payment provider. Stripe handles your payment card details, so neither MCT nor Songs of Freedom Limited receives or stores your full card details. Stripe also uses information about your payment and your device to detect and prevent fraudulent transactions, under its own privacy policy: stripe.com/gb/privacy.
When you use the donation page, Stripe uses cookies and similar technologies, such as local storage. These are strictly necessary to process your payment securely, prevent and detect fraud and keep the service secure, so they are used without asking for your consent. You can block or delete cookies in your browser settings, but if you block these cookies you may not be able to complete your donation. Stripe's cookie policy explains more: stripe.com/gb/legal/cookies-policy.
How We Disclose Your Information
As part of the services we provide, we may disclose information about you to third parties, on your behalf to provide the services request, for legitimate purposes, legal obligation and by your consent in accordance with this Privacy Policy. We only share your information with service providers to help run our business. This may include:
• Squarespace and other vendors. Squarespace and other vendors assist us in providing the services (e.g. website hosting, scheduling, order processing, invoicing, transacting, payment processing, shipping, customer accounts or subscriptions, form blocks). Please see below for more information about our platform provider, Squarespace.
• Payment Processing. We transmit your payment information via an encrypted connection to our payment processors, to enable us to operate and provide the payments services.
• Customer support vendors. These vendors assist us in hosting our support offerings.
• Safety and security vendors. These vendors enable us to keep our services safe and secure.
• Sales and marketing vendors. These vendors assist us in sending marketing and other communications.
• Third party plugins and social networks. We may disclose information about you to other parties that operate website plugins, social media platforms or similar third party services to improve your experience, at your direction, or when you intentionally interact with the plug-in.
• Your Consent. When you provide us with a direction or request to provide certain information to a third party.
• Following the law or protecting rights and interests. We disclose your information if we determine that such disclosure is reasonably necessary to comply with the law or law enforcement, protect our or others' rights, prevent fraud and abuse, or prevent other criminal or illegal activity.
• Corporate group. With affiliates to within our company group.
• Shopify. Shopify runs our online shop and processes orders and payments for us (see "Our Shop (Shopify)" above).
• The app developer and streaming provider. These companies build, host and support the Songs of Freedom app and deliver the live stream, acting on our instructions.
• Apple and Google. They process app downloads and in-app purchases, and are responsible for their own use of your data.
• Merchandise suppliers and delivery companies. These companies make and deliver your shop orders.
• Ticketmaster. Ticketmaster sells our tickets and shares booking details with us (see "Tickets (Ticketmaster)" above).
• The venue. We only share what is needed for entry and safety on the night, such as access needs you ask us to pass on.
• Our professional advisers. Our accountants and lawyers, where needed.
The service providers that act on our instructions are bound by contracts to keep your data secure and use it only for the services they provide to us.
Data Retention and Security
We retain personal data for no longer than is necessary for the purposes for which it was collected or otherwise processed. In some cases, personal data may be stored for longer periods if processed solely for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, provided appropriate safeguards are in place for individuals' rights and freedoms.
In practice, we keep:
• Shop orders, payments and financial records: for six years after the end of the financial year they relate to.
• Ticket booking details from Ticketmaster: for 12 months after the event.
• Health or access information for events: deleted within one month after the event.
• App accounts: until you delete your account, or two years after you last used it.
• Viewing activity in the app: for 12 months.
• Crash reports and technical logs: for 90 days.
• Contact details for marketing: until you unsubscribe, or two years after you last bought from us or engaged with us.
• Records of people who have asked not to be contacted: for as long as needed to respect the request (name and minimal contact details only).
• Enquiries and complaints: for two years after the matter is closed.
• Event footage and photos: for five years after the event, unless we agree to remove something sooner.
For how long MCT keeps donor data, see "Donations (Monday Charitable Trust)" above.
We implement appropriate technical and organizational measures to ensure the appropriate level of security and confidentiality for the personal data we process. This includes protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage. Our measures include, but are not limited to:
• Using SSL certificates (HTTPS) to encrypt data shared between our Website and servers.
• Implementing strong password policies for administrative accounts.
• Minimising the collection of personal data to only what is necessary for our stated purposes.
• Storing app passwords in encrypted form.
While we strive to protect your personal data, no method of transmission over the Internet or method of electronic storage is 100% secure. Therefore, we cannot guarantee its absolute security.
If a data breach is likely to put your rights at risk, we will report it to the Information Commissioner's Office within 72 hours. If the risk to you is high, we will also tell you without undue delay.
Your Data Protection Rights
Under data protection laws in the European Economic Area and the UK, you have several important rights regarding your personal data. We are committed to facilitating the exercise of these rights. These rights include:
• Right to be Informed: You have the right to receive clear, transparent, and easily understandable information about how we use your personal data and your rights. This Privacy Policy aims to provide you with this information.
• Right of Access: You have the right to obtain confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, access to the personal data and certain information about the processing, free of charge.
• Right to Rectification: You have the right to have inaccurate personal data concerning you rectified without undue delay. You also have the right to have incomplete personal data completed, including by means of providing a supplementary statement. If we have shared incorrect data, we will inform recipients of the change where possible.
• Right to Erasure: In certain circumstances, you have the right to ask us to erase your personal data without undue delay, for example, if the data is no longer necessary for the purposes for which it was collected or if you withdraw consent and there is no other legal ground for processing. We are not obliged to erase data if processing is necessary for exercising the right of freedom of expression and information, compliance with a legal obligation, reasons of public interest (e.g., public health, scientific/historical research), or for the establishment, exercise, or defense of legal claims.
• Right to Restriction of Processing: You have the right to request the restriction of the processing of your personal data in certain situations (e.g., if you contest the accuracy of the data, or the processing is unlawful but you oppose erasure).
• Right to Data Portability: Where processing is based on consent or a contract, and is carried out by automated means, you have the right to receive the personal data concerning you in a structured, commonly used, and machine-readable format and have the right to transmit those data to another controller without hindrance from us. This includes data you provided and data observed from your behavior.
• Right to Object: You have the right to object, at any time, to the processing of your personal data for direct marketing purposes, or when processing is based on our legitimate interests or for a task in the public interest, unless we demonstrate compelling legitimate grounds for the processing that override your interests. In the case of direct marketing, we are always obliged to stop processing your personal data if requested.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. The process for withdrawing consent should be as easy as giving it.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority, particularly in the EEA Member State or the UK of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the data protection laws in the EU or the UK.
To exercise any of these rights, please contact us using the contact details provided in this Privacy Policy. In accordance with applicable laws, we may be required to verify your identity or request additional information prior to processing your request.
We will respond within one month. If your request is complex, we may need up to two more months, and we will tell you if so. Some rights have exceptions. For example, we must keep records of purchases for tax purposes even if you delete your app account. For data that Ticketmaster, Apple, Google, Shopify or Spotify hold for their own purposes, please contact them directly. For donor data, contact MCT (see "Donations (Monday Charitable Trust)" above).
We do not make any decisions about you based solely on automated processing that have a legal or similarly significant effect on you.
Complaints
If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. Email info@songsoffreedom.co.uk or write to us at the address under "Contact Us". We will acknowledge your complaint within 30 days, look into it, keep you updated, and tell you the outcome without undue delay.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, on 0303 123 1113 or at ico.org.uk/make-a-complaint. The ICO usually expects you to raise your concern with us first.
Squarespace Platform
Our Website and certain services we provide are hosted by Squarespace. Squarespace, as our processor collects and processes personal data for the purpose of providing the services to us and to improve the services to you. Squarespace may also act as an independent controller for some personal data relating to your use of the services and is responsible for processing such personal data in compliance with applicable laws. Please see Squarespace Privacy Policy for details relating to your end user site usage information, for which they act as an independent controller. We share personal data and other information with Squarespace as part of the services they provide to us.
Data Transfers
As our Website is hosted by Squarespace, a U.S.-based company, certain personal data may be transferred outside the European Economic Area (EEA) or the United Kingdom (UK) (a "third country") or to an international organisation and transferred to and stored in the United States. In accordance with applicable data protection laws in the EEA and UK, Squarespace relies upon a number of means to transfer personal data. These include:
• Adequacy decision. In accordance with Article 45 of the GDPR, a country that European Commission, UK or Swiss data protection supervisory authority(ies) have confirmed, by decision, offers an adequate level of data protection (adequacy decision).
• Data Privacy Frameworks. Transfer of personal data to Squarespace, Inc. in the US from, as applicable, the EEA, Switzerland and the UK pursuant to the Data Privacy Frameworks. An adequacy decision was adopted for the EU-U.S. Data Privacy Framework, Swiss-US Data Privacy Framework and the UK Extension to the EU-US Data Privacy Framework (each individually and jointly, the Data Privacy Frameworks).
• Standard data protection clauses ("SCCs") and other transfer methods. For countries without an adequacy decision, in accordance with Article 46 of the GDPR, recipients may enter the approved form of transfer contract (SCCs) for the transfer of personal data outside the EEA or UK.
Some of our other service providers, such as Shopify, our email marketing provider and our app developer's hosting provider, may also store or access data outside the UK. When they do, we make sure your data is protected to UK standards using the same kinds of safeguards.
Children's Privacy
Our services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you are a parent or guardian and you are aware that your child has provided us with personal data, you may contact us. If we become aware that we have collected personal data from children without verification of parental consent, we take steps to remove that information from our servers.
Cookies & Analytics
Some information is collected automatically using cookies and similar technologies, as described below.
This Website uses cookies and similar technologies, which are small files or pieces of text that download to a device when a visitor accesses a website or app. For specific information about the cookies dropped on your device by our third-party website hosting service provider, Squarespace, visit The cookies Squarespace uses.
• These functional and required cookies are always used, which allow Squarespace, our hosting platform, to securely serve this Website to you.
• These analytics and performance cookies are used on this Website, as described below, only when you acknowledge our cookie banner. This Website uses analytics and performance cookies to view Website traffic, activity, and other data.
This Website may collect personal data to power our Website analytics, including:
• Information about your browser, network, and device
• Web pages you visited prior to coming to this Website
• Your IP address
This information may also include details about your use of this Website, including:
• Clicks
• Internal links
• Pages visited
• Scrolling
• Searches
• Timestamps
We use this information to learn about Website traffic and activity.
Our Shopify shop also uses cookies. Essential cookies make the shop and checkout work. Any analytics or marketing cookies in the shop are only used if you accept them using the shop's cookie banner.
Stripe, which processes donation payments, uses cookies that are strictly necessary to process payments securely and prevent fraud (see "Donation Payments (Stripe)" above).
The Songs of Freedom app uses similar technologies, such as software development kits, to keep you signed in, process purchases and tell us when the app has a fault. Where a technology isn't essential to the app working, we will ask for your consent or give you a simple way to switch it off.
Third-Party Services and External Links
Our Website may contain links to third-party Websites or services, or integrate with third-party services. These third-party services may have their own privacy policies governing the collection and use of your information. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal data through their platforms. If your Website uses third-party services through connected accounts or code-based integrations, check with those platforms to review how they manage visitor data, as our privacy policy only addresses our own practices and our hosting platform's core functions.
Fonts
This Website serves font files from and renders fonts using Google Fonts and Adobe Fonts. To properly display this site to you, these third parties may receive personal information about you, including:
• Information about your browser, network, or device
• Information about this site and the page you're viewing on it
• Your IP address
Changes to This Privacy Policy
We may update this privacy policy from time to time to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will notify you of any changes by posting the new Privacy Policy on this page and updating the 'Last updated' date. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.
Contact Us
If you have any questions about this Privacy Policy or any data protection inquiries, please contact us at: Website: songsoffreedom.co.uk, Email: info@songsoffreedom.co.uk, Address: First Floor, 14-15, Berners Street, London, United Kingdom, W1T 3LJ
For questions about donations or donor data, contact Monday Charitable Trust (MCT) at info@mondaycharity.org.uk or Floor 8, 71 Queen Victoria Street, London EC4V 4AY.