Legal
Privacy notice
What we collect when you use this site, send us an enquiry, submit music or hold an artist portal account, why we hold it, who else sees it, and what you can ask us to do about it.
Last updated 3 October 2026
This notice explains what personal information XZONE MEDIA LTD collects through this website, why we hold it, who else sees it and what you can ask us to do about it.
It covers xzonemedia.com, the enquiry and submission forms on it, and the artist portal. Studio bookings, equipment hire and distribution agreements are each covered by their own written agreement; where those involve personal information, this notice still describes how we handle it.
Who we are
XZONE MEDIA LTD is a company registered in England and Wales, company number 15333219, with its registered office at Suite A, 82 James Carter Road, Mildenhall IP28 7DE. We are the data controller for the information described in this notice.
To contact us about anything on this page, email hello@xzonemedia.com, call 020 3576 5770, or write to the registered office above. If your message is about data protection, please say so at the top, so that it reaches the right person quickly.
What we collect
When you send us an enquiry
Our contact and project forms ask for your name and email address, and depending on the form your phone number, postal address and whatever you tell us in the message. We also record the IP address the form was submitted from, which is used for spam filtering and to investigate abuse.
Submissions are stored in our database and emailed to us. The forms include a simple arithmetic check and a consent box; ticking the box is how you tell us we may use your details to reply.
When you submit music for free distribution
The submission form collects your name and contact details, your artist or stage name, the audio and artwork files you upload, the information you give us about the release, and the IP address the submission came from.
Sending us a submission does not create an agreement and does not oblige us to select anything. If we do select your music, we will email you an invitation to an artist portal account.
When you hold an artist portal account
We hold your email address, username and a hashed version of your password, which means we cannot read the password itself. Against your artist profile we hold your stage name, your legal name, your country, a biography, a profile image and links to your own pages, where you have given them.
For each release we hold the title, format, release date, artwork, track listing, ISRC and UPC codes, the stores selected and the current delivery status. We also hold the reporting we receive back: streams, downloads, listeners, revenue and currency, broken down by platform, country and date.
We keep an activity log of significant actions taken on an account. Each entry records what happened, when, the IP address and the browser user agent. It exists so that we can establish who changed what, which matters on accounts holding agreements and payment-relevant records.
When you just visit
We run our own visitor counter. It records the page visited, the date, and the website you arrived from. It sets no cookie and stores no IP address. To avoid counting the same person twice in a day it stores a one-way token derived from your IP address and a secret that changes daily; the secret is destroyed after two days, after which the token cannot be connected to anyone.
If you accept analytics and advertising cookies, Google also collects information about your visit. The cookie policy sets out exactly what is set, by whom and for how long. Nothing beyond what is strictly necessary is set before you make a choice.
Our hosting provider keeps server logs that include IP addresses for a short period, which is there for security and fault diagnosis.
Why we hold it
We have to have a lawful basis for everything we do with your information. These are ours.
| What we do | Our lawful basis |
|---|---|
| Reply to your enquiry and talk to you about a project | Our legitimate interests in responding to people who contact us, and where you are asking about a service, taking steps towards a contract |
| Review a music submission and tell you the outcome | Our legitimate interests in running a submissions process, and taking steps towards a contract |
| Run your portal account, deliver releases and report back on them | Performance of our agreement with you |
| Keep accounting, royalty and payment records | Our legal obligations, principally tax and company law |
| Keep the site and the portal secure, including the activity log | Our legitimate interests in protecting accounts and preventing misuse |
| Filter spam from form submissions | Our legitimate interests in keeping our inbox and database usable |
| Set analytics and advertising cookies | Your consent, which you can withdraw at any time |
| Send you marketing email, if you have asked for it | Your consent, which you can withdraw at any time |
Where we rely on legitimate interests, the interest is operating a creative business and keeping it secure. We have considered whether that is fair to you and concluded that none of it is intrusive or unexpected. You can object to any of it, and we will stop unless we have a compelling reason not to.
Who else sees it
We do not sell personal information, and we do not share it so that anyone else can advertise to you. We do share it with the following, in each case only as much as they need.
- Our hosting provider, which operates the servers this website and the portal run on. Those servers are in the European Union.
- Google, for analytics and advertising measurement, and only where you have consented to those cookies.
- Our spam filtering provider, which receives the content of form submissions and the IP address in order to score them.
- Our distribution partner, the platform through which we deliver releases to stores. Where we distribute your music, your artist name, release and track details and your artwork are passed to it. If you would like to know who that is, ask us and we will tell you.
- The digital stores and streaming services selected for your release, which receive the release details and artwork so that the release can appear on them.
- Our accountants, auditors, insurers and professional advisers, where they need it to do their work for us.
- A regulator, law enforcement or a court, where we are legally required to hand something over.
Where it goes
Our servers are in the European Union. Some of the providers above are based in the United States, and digital stores operate worldwide, so some information is transferred outside the United Kingdom.
Where that happens we rely either on the UK extension to the EU–US Data Privacy Framework, where the recipient is certified under it, or on the International Data Transfer Addendum to the European Commission’s standard contractual clauses. You can ask us for details of the safeguards applying to any particular transfer.
How long we keep it
| What | How long |
|---|---|
| Enquiry and project form submissions | 24 months from our last contact with you |
| Music submissions we do not select | 12 months from the decision, then deleted along with the uploaded files |
| Artist portal accounts, releases and reporting | For as long as the agreement runs, then 7 years |
| Royalty, payment and accounting records | 7 years from the end of the financial year they relate to |
| Account activity log | 12 months |
| Visitor counter | The daily token, 2 days. The counts themselves hold no personal information and are kept indefinitely |
| Server logs | A short period set by our hosting provider, normally around 30 days |
| Records of consent and of marketing preferences | For as long as you are subscribed, then 24 months, so that we can show what you agreed to |
Where we have a legal claim open or reasonably anticipated, we may keep relevant records until it is resolved.
Your rights
Under UK data protection law you can ask us to do any of the following.
- Give you a copy of the personal information we hold about you.
- Correct anything that is wrong or incomplete.
- Delete information we no longer have a good reason to keep.
- Stop using it for a while, if you dispute it or object to our using it.
- Stop processing it where we rely on legitimate interests, including for the activity log.
- Send you, or another provider, a machine-readable copy of information you gave us, where we hold it on the basis of consent or a contract.
- Withdraw a consent you have given, including your cookie choice and any marketing subscription.
We do not make any decision about you by automated means alone. Selection for free distribution is decided by a person.
Email hello@xzonemedia.com to exercise any of these. It is free, and we will reply within one month. We may ask you to confirm who you are first, so that we do not hand your information to somebody else.
If you are unhappy with how we have handled your information you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first, so that we can put it right.
Cookies
We ask for your choice on cookies before anything beyond the strictly necessary is set, and you can change that choice whenever you like using the cookie link at the bottom of any page. The cookie policy lists every cookie, what it does and how long it lasts.
Security
Traffic to this site and the portal is encrypted in transit. Passwords are stored hashed, not in readable form. Portal accounts are created by us rather than by public registration, permissions are set by role, and members can reach only their own records. Uploads are restricted by file type. Access to the systems behind the site is limited to the people who need it.
No system is beyond reach, so if something does go wrong we will tell you, and the Information Commissioner’s Office, where the law requires it.
Age
Artist portal accounts and the agreements behind them are for people aged 18 or over. If you are under 18 and want to work with us, ask a parent or guardian to deal with us on your behalf. We do not knowingly collect information from children, and if you believe a child has given us information, tell us and we will delete it.
Changes to this notice
We update this notice when what we do changes. The date at the top of the page is the date of the current version. If a change materially affects portal account holders we will tell them in the portal as well as updating this page.