Privacy Policy

This Privacy Policy explains how Record Store Day UK ("we", "us", "our") collects, uses, stores, and protects personal data when you use recordstoreday.co.uk and related MyRSD services.

Record Store Day UK is operated by the Entertainment Retailers Association ("ERA"), a company registered in England and Wales with company number 2268007. ERA is the data controller for the personal data described in this policy.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Contact us about privacy

If you have questions about this policy or how we handle your personal data, contact us through our contact page at /contact or email admin@eraltd.org.

When you contact us about a privacy or data-protection matter, please include enough detail for us to identify your request. We may need to verify your identity before responding.

What personal data we collect

The information we collect depends on how you use the site. We only collect what we need to run the website, provide MyRSD account features, respond to enquiries, and improve our services.

When you browse the site

If you accept analytics cookies, we may record page-visit analytics including the page path, how long you stayed on the page, whether the visit was on a marketing or app section of the site, an anonymous client token, and, if you are signed in, your user account ID. Admin, auth, API, and offline routes are excluded from this tracking. If you reject analytics cookies, we do not record these page visits.

We use a cookie and local storage entry to remember your cookie consent choice. See our Cookie Policy at /cookie-policy for more detail.

Our service worker may cache parts of the site on your device so the site works offline or loads faster. Push notifications, if you enable them, use a browser-generated subscription stored on our systems.

Some features store information locally in your browser (for example event favourites, banner dismissal, dashboard layout, and PWA onboarding helpers). Signed-in release wishlists and shop favourites are stored in your MyRSD account.

When you use the store locator, map tile and address-search providers may process requests needed to show the map or find a place (see Who we share personal data with).

We may record limited application and error logs (for example technical fault details) to keep the site secure and reliable. These logs are used for operations and troubleshooting, not for advertising.

When you create a MyRSD account

If you register for a MyRSD account, we collect your email address, password (stored securely by our authentication provider), and the name you provide at sign-up. You may also choose a username used for your public profile URL. We record when you agreed to this Privacy Policy and our Terms of Use, and whether you opted in to marketing communications.

You may add a display name and profile photo, manage notification preferences (in-app updates, push alerts, email updates, and activity notifications), enable two-factor authentication, and register passkeys for passwordless sign-in where your browser supports it.

Authentication emails (such as sign-up confirmation, password reset, and email change verification) are sent through our authentication provider.

When you use MyRSD features

Wishlist and favourites: if you are signed in and like a release or shop, we store which releases and shops you have saved against your account.

Store check-ins: if you check in at a participating shop while signed in, we ask your browser for your location so we can confirm you are near the store (within our distance rule). You may optionally upload a photo. Check-ins are reviewed before public display where applicable.

Shop notifications: if you subscribe to notifications from a shop page, we store that subscription against your account and honour your notification preferences when messages are sent.

Notifications and badges: we store in-app notifications sent to you, push subscription details if you enable push, and records of milestone badges you earn (for example for check-ins, wishlists, or shop favourites).

Leaderboard: participation in check-ins, shop likes, and release likes contributes to points shown on the MyRSD home leaderboard for signed-in members.

Public profile: if your profile is set to public, visitors can view a page with your display name, avatar, activity counts, leaderboard rank, wishlist, check-in photos, and festival posters you have shared. You can turn public visibility off in MyRSD settings.

PWA install: if you install the site as an app, are signed in, and have accepted analytics cookies, we may record that you installed the app and basic platform information for internal statistics.

RSD Festival poster builder: if you use the poster builder, we store your selections and generated poster so you can complete and share your poster.

When you contact us or subscribe

Contact, press, and partnership forms: we collect your name, email address, optional phone number, and message so we can respond. Messages are emailed to the appropriate ERA team and we send you a confirmation email.

Newsletter: if you subscribe on the homepage, we store your email address in our newsletter list and send a confirmation email. You can unsubscribe using the link in our emails or by contacting us.

Take-part and industry enquiries may be handled by email outside these forms; any personal data you send us by email is processed so we can respond to your enquiry.

Record Token purchases

If you buy Record Tokens while signed in, we collect your name, email address, phone number, and UK delivery address, and we create an order record. Payment card details are entered directly into Stripe and are processed by Stripe; we do not store your full card number on our servers. We may send a receipt email when payment succeeds.

Shop and industry accounts

Independent record shops and industry users may receive invitations to join team accounts. Invitations include the email address supplied by the inviting administrator. Shop profile information (such as store name, address, contact details, and images) is published on the site when the shop is visible.

Shop team members' names, email addresses, and roles are stored so they can access shop dashboards and manage store content.

Shop teams may submit drafts for store details, events, Meet the Team answers (including optional YouTube links), and subscriber notifications. Platform administrators review those submissions before they go live or are sent.

Retail Code of Conduct: shops may submit a digital registration form (including business details, VAT information where provided, staff contact emails, and an electronic signature) or upload a signed document. We store those submissions and generated PDFs so ERA can administer participation. Separate commercial terms may also apply outside this policy.

How we use your information and our lawful bases

We use personal data to provide the site and MyRSD features you request, to process orders and enquiries, to send service and account-related communications, to moderate user-generated content (such as check-in photos and shop submissions), to improve and secure the site, and to produce aggregated statistics for ERA and participating shops.

Our lawful bases under UK GDPR include: (a) performance of a contract — for example providing your account, processing Record Token orders, and delivering notifications you subscribe to; (b) legitimate interests — for example fraud prevention, security and application logging, operating public profiles and leaderboards you choose to use, and anonymised social-proof activity on marketing pages, balanced against your rights; (c) consent — for optional marketing emails, newsletter sign-up where applicable, browser push notifications, browser location access for check-ins, and first-party analytics cookies as described in our Cookie Policy; and (d) legal obligation — where we must comply with applicable law.

We do not sell your personal data.

Cookies and similar technologies

We use essential cookies and storage to keep you signed in, remember your cookie choice, and protect forms. With your consent (Accept all), we also use first-party analytics technologies as described in our Cookie Policy. Reject all turns those analytics off.

You can change or withdraw cookie consent by clearing site data in your browser; the consent banner will appear again on your next visit. See /cookie-policy.

Marketing communications

If you opt in when creating a MyRSD account or subscribe to our newsletter, we may send you marketing emails about Record Store Day, releases, events, and related news. You can opt out at any time using the unsubscribe link in an email or by contacting us.

Even if you opt out of marketing, we may still send service messages that are necessary for your account or orders (for example password resets, order confirmations, or important service notices).

Admin and shop notification emails respect your in-app, push, and email preference settings in MyRSD.

Who we share personal data with

We use trusted service providers who process data on our behalf, including: Supabase (database hosting, authentication, and file storage), Vercel (website hosting), Stripe (payment processing for Record Tokens), and our email delivery provider (transactional and notification emails).

Map and location helpers: the store locator uses CARTO / OpenStreetMap for map tiles and Photon (Komoot) for address search when you search for a place or use locate-me features.

Embedded media: YouTube and Spotify may process data when you play embedded videos or playlists on the Site.

Operational tools: authorised administrators may run performance scans of public pages using Google PageSpeed Insights. That tool is not used to track individual visitors for advertising.

ERA staff and authorised platform administrators may access personal data where needed to operate the site, review check-ins and shop submissions, respond to enquiries, manage shop accounts, and produce analytics.

Participating shop account members may see aggregated or operational information about their own store pages (for example visitor counts when analytics are collected) and wishlists members have sent to their shop where that feature is enabled. Shop-submitted notifications are reviewed by platform administrators before they are sent to subscribers.

We may disclose personal data if required by law, court order, or regulatory request, or to protect the rights, safety, and security of ERA, our users, or others.

International transfers

Some of our service providers may process or store data outside the UK. Where personal data is transferred internationally, we ensure appropriate safeguards are in place in line with UK GDPR requirements, such as adequacy regulations or standard contractual clauses.

How long we keep personal data

We keep personal data only for as long as necessary for the purposes described in this policy, including legal, accounting, or reporting requirements.

Account data is retained while your account is active. If you delete your account through MyRSD settings, we delete or anonymise your personal account data, subject to limited exceptions (for example where we must retain order records for legal or financial reasons, or where another team member must remain the owner of a shop account).

Analytics, logs, and aggregated statistics may be kept for a longer period in a form that does not directly identify you, or in pseudonymised form, to help us understand trends and improve the site.

Security

We use appropriate technical and organisational measures to protect personal data, including access controls, encrypted connections (HTTPS), and restricted access for administrators. No online service can be guaranteed completely secure; please keep your password confidential and contact us if you believe your account has been compromised.

Your rights

Under UK data protection law, you have the right to request access to the personal data we hold about you, to ask us to correct inaccurate data, to request erasure in certain circumstances, to restrict or object to processing in certain circumstances, to request data portability where applicable, and to withdraw consent at any time where processing is based on consent (without affecting processing already carried out).

You can update much of your account information directly in MyRSD settings at /home/settings, manage notification preferences and public profile visibility there, and delete your account from the same page (subject to team ownership checks for shop accounts).

To exercise any other rights, contact us through /contact or admin@eraltd.org. We will respond within one month in most cases.

Complaints

If you are unhappy with how we have handled your personal data, please contact us first so we can try to resolve the issue.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection: ico.org.uk.

Children

The site is intended for a general audience and is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.

Links to other websites

Our site links to independent record shops, labels, social networks, Spotify, ticket sellers, and other third-party sites. This policy does not apply to those websites. Please read their privacy policies before providing personal data to them.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date at the top of this page. Significant changes may also be highlighted on the site where appropriate.

We encourage you to review this page periodically. Continued use of the site after changes are posted constitutes your acknowledgement of the updated policy, where permitted by law.