Private by design. A TyPawb Client Area account is bound to one client organisation and provides access only to that organisation’s private workspace. Wrexham Media does not sell Client Area personal data.
1. Who is responsible for your information
Wrexham Media is the controller for Client Area account, access-review, security, support and business-administration data. Where we host or process files solely on a client organisation’s instructions, Wrexham Media may instead act as that organisation’s processor. Questions or rights requests can be sent to info@wrexhammedia.com.
2. Information we collect
- organisation, contact name, business email, access request and correspondence;
- account status, role, password hash, reset and session records (we do not store readable account passwords);
- client workspace files, music, folders, filenames, metadata, checksums and PRS/reporting documents;
- software entitlement, installation identifier, app version, platform, device label and validation activity;
- security and audit information, including timestamps, event results, a protected hash derived from an IP address and limited browser/device information;
- support requests and service communications.
3. Why we use it and our lawful bases
- Taking steps before and performing a contract: assessing access, providing the private workspace and software service, uploads, playback, downloads, reporting and support.
- Legitimate interests: protecting accounts, preventing abuse and fraud, maintaining audit evidence, administering and improving a secure service, and resolving disputes. We consider the impact on individuals before relying on these interests.
- Legal obligations: keeping records or disclosing information where UK law, regulators or courts require it.
- Consent: only for a separate optional purpose where we specifically ask for it. Consent can then be withdrawn without affecting earlier lawful processing.
Contact and organisation information is necessary to assess and administer an account. Without it, we cannot provide access. We do not make decisions producing legal or similarly significant effects solely by automated means.
4. Client separation and security
Accounts, files, manifests, uploads, PRS records, installations and sessions are scoped to a private tenant identifier. The server checks the authenticated account and tenant for every protected operation. Signed file references are short-lived; raw cloud-storage identifiers and credentials are not supplied through the client portal. We use access controls, password hashing, encrypted transport, session expiry and rotation, rate limits, audit records and restricted administrator access. No online service can promise absolute security.
5. Sharing and service providers
Information may be processed by suppliers that help us provide hosting, email, Google Workspace/Drive storage, security, support and professional advice. It may also be disclosed to authorities where legally required. Suppliers are limited to the information needed for their task and are subject to appropriate contractual or legal safeguards.
A restricted operational Google Sheet may mirror non-secret account and service-status fields for authorised administration. Passwords, password hashes, session or reset tokens, private keys, cloud credentials and raw storage identifiers must not be written to that mirror.
6. International transfers
Some service providers may process information outside the United Kingdom. Where required, we use UK adequacy regulations or recognised safeguards such as the UK International Data Transfer Agreement or the UK Addendum, together with appropriate risk and security measures.
7. How long we keep information
We retain information while the client relationship or account is active and afterwards only for as long as reasonably necessary to provide the service, follow client instructions, maintain security and audit evidence, resolve disputes, and meet legal, tax or accounting obligations. Client content is reviewed and removed or archived according to the relevant service agreement or authorised client instruction. Backup copies expire through controlled technical backup cycles. We periodically review whether information is still required.
8. Your UK data protection rights
Depending on the circumstances, you may ask for access, correction, erasure, restriction, portability, or object to processing. You have a particular right to object where processing is based on legitimate interests or is used for direct marketing. Where processing relies on consent, you may withdraw it at any time. Some rights are qualified by law and by another person’s rights.
Contact info@wrexhammedia.com to exercise a right. You may also complain to the Information Commissioner’s Office.
9. Other people’s information and children
Anyone uploading files or entering information about another person must be authorised to do so and must provide any privacy information required by law. The Client Area is a professional service and is not intended for children.
10. Changes to this notice
Material changes will receive a new version and effective date. Where appropriate, active users will be notified or asked to acknowledge the updated notice before continuing to use affected services.