Mobile DJ Manager (Cloud) – Terms of use
Last updated: 07/11/2026
The short version
- MDJM Cloud is booking and business management software for mobile DJs, entertainers and event businesses. It is sold to businesses, not to consumers.
- Your subscription renews automatically until you cancel it. Cancelling stops the next renewal; you keep access until the end of the period you have paid for.
- Your business’s data belongs to you. For your customers’ personal data, you are the controller and we are your processor.
- Payments your customers make go straight into your own Stripe account. We are not a party to your contracts with your customers.
- When you leave, you can download everything, and then we permanently delete it, including our backups.
This summary is for convenience only. The full terms below are what apply.
Contents
- Terms of Service
- Acceptable Use Policy
- Data Processing Agreement
- Privacy Policy
- Cookie Policy
- Sub-processors
- If you booked with a business that uses MDJM Cloud
- Contact us
1. Terms of Service
1. About us and these terms
1.1 MDJM Cloud (the Service) is provided by Mobile DJ Manager ™. You can contact us at [email protected].
1.2 These Terms of Service, together with the Acceptable Use Policy, the Data Processing Agreement, the Privacy Policy and the Cookie Policy on this page (together, the Agreement), form the contract between us and the business that subscribes to the Service (you, the Business).
1.3 By creating an account, starting a subscription or using the Service, you accept the Agreement. If you are accepting on behalf of a company or other organisation, you confirm that you have authority to bind it.
1.4 The Service is provided for business use only. You confirm that you are acting for purposes relating to your trade, business, craft or profession and not as a consumer, and that you are at least 18 years old.
2. Definitions
- Admin Panel: the part of the Service your administrators and employees use to run your business.
- Customer: a person or organisation who enquires with or books your services, including anyone you give access to the Customer Portal.
- Customer Portal: the part of the Service where your Customers view their events, sign contracts, pay, plan their event and request music.
- Customer Data: all data, files and content that you, your Users or your Customers put into the Service, including personal data about your Customers, their guests, your staff and the venues you work at.
- Users: the people you authorise to use the Admin Panel on your behalf (administrators and employees).
- Subscription Period: the monthly or annual billing period of your subscription.
- Data Protection Law: the UK General Data Protection Regulation, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and any other law relating to personal data that applies to the processing.
3. The Service
3.1 The Service is cloud-hosted software that includes, depending on your plan and settings: lead and enquiry management, event booking, customer records, venue records, packages, add-ons and equipment hire, quotes and invoices, contracts with electronic signatures, online payments through your own Stripe account, automated and manual emails, a Customer Portal, planning forms, timelines, guest playlist requests, contact forms and widgets for your own website, staff management, calendar feeds and Google Calendar sync, reports, data import, and branded email and document templates.
3.2 Each Business gets its own area of the Service, usually reached at its own subdomain of mdjm.co.uk. We may refuse, change or withdraw a subdomain that is offensive, misleading, infringes someone else’s rights or is needed for our own use.
3.3 We improve the Service continually and may add, change or remove features. We will not make a change that materially reduces the core functionality of your plan during a Subscription Period you have paid for without giving you reasonable notice and, where the change is significant, the option to cancel and receive a pro rata refund for the unused part of that period.
4. Your account and Users
4.1 You must give accurate information when you sign up and keep it up to date, including a contact email address that you monitor. We send important notices about your account, billing, security and data there.
4.2 Each User must have their own login. Logins must not be shared. One person can use a single login to work with, or book with, more than one business on MDJM Cloud; each business only sees its own relationship with that person.
4.3 Staff you invite must accept their invitation, using the link we email them, within 3 days. Until they accept, an invitation holds one of your seats but gives no access.
4.4 You are responsible for everything done under your account by your Users, for deciding what each User can access, and for removing access promptly when someone leaves your business.
4.5 Two-factor authentication is switched on by default for Admin Panel accounts. You can choose to switch it off for your business, but if you do, you accept the increased risk to your account and your Customer Data.
4.6 You must keep passwords, recovery codes and secret links confidential, and tell us immediately at [email protected] if you suspect any unauthorised access to your account.
4.7 Your plan includes a set number of employee seats. Additional seats can be added for an extra charge (see clause 5.5).
5. Subscriptions, trials and payment
5.1 Plans and prices. Our plans and prices are shown on our website and at checkout. Prices are in pounds sterling and do not include VAT.
5.2 Checkout. Subscriptions are billed through our payment provider, Stripe. You must complete checkout, including giving a valid payment method, before you can use your account. An account whose checkout is never completed gives access only to the subscription page.
5.3 Free trials. Where a plan includes a free trial (currently 14 days on our Standard plan), you will not be charged until the trial ends. Unless you cancel before the trial ends, your subscription starts automatically and your payment method is charged. We may change or withdraw free trials for new sign-ups at any time, and only one free trial is available per business.
5.4 Automatic renewal. Your subscription renews automatically at the end of each Subscription Period, and we charge your payment method at the start of each new period, until you cancel.
5.5 Extra employee seats. If you raise your employee seat limit above the number included in your plan, the extra seats are added to your subscription at the seat price in force at the time. Stripe adjusts your next invoice pro rata for changes made part way through a Subscription Period.
5.6 Discounts. Any discount we agree with you applies as stated when it is given. Unless we say otherwise in writing, we may withdraw a discount with 30 days’ notice.
5.7 Price changes. We may change our prices by giving you at least 30 days’ notice by email. A new price applies from your next renewal after the notice period ends. If you do not accept the change, you can cancel before it takes effect.
5.8 Failed payments. If a payment fails, Stripe will retry it and you can update your payment method in Settings > Subscription. If your subscription ends because payment could not be taken, or because you cancelled, you keep access for a grace period (currently 7 days). After the grace period, your Admin Panel is restricted to a read-only list of your events and the Settings area, so you can still see your bookings and renew, until you subscribe again.
5.9 Abandoned sign-ups. If you sign up but never complete checkout, we will email you 7 days after your latest checkout attempt. If checkout is still not completed 7 days after that email, the account and everything in it will be permanently deleted.
5.10 Refunds. Fees are non-refundable, including for part-used Subscription Periods, unused seats or periods when you did not use the Service, except where these terms say otherwise or the law requires it.
5.11 Invoices. Stripe issues our invoices and receipts to you. You can view your billing history and manage your payment method through the billing portal linked from Settings > Subscription.
6. Payments from your Customers (Stripe Connect)
6.1 You can let your Customers pay deposits, balances and invoices online by connecting your own Stripe account to the Service. Those payments are made directly to your Stripe account. We never receive or hold your Customers’ money and we do not see or store their full card details.
6.2 Your use of Stripe is governed by your own agreement with Stripe, including the Stripe Connected Account Agreement. Stripe’s processing fees are charged to you by Stripe. We do not currently charge a fee on your Customers’ payments; if we introduce one, we will give you at least 30 days’ notice.
6.3 You are solely responsible for your prices, deposits, refunds, disputes, chargebacks and the tax treatment of the payments you take. If you disconnect your Stripe account, or Stripe suspends it, online payments for your Customers stop.
7. Your responsibilities
7.1 You are responsible for your business and for your relationship with your Customers. In particular you are responsible for:
- the services you provide, your prices, and whether you turn up to an event: we are not a party to any booking, contract or dispute between you and your Customers;
- the content and legal effect of your contracts, terms, quotes and invoices, including whether an electronic signature is suitable for a particular document;
- the accuracy of the VAT, totals and other details on the invoices you raise, and for keeping your own financial and tax records for as long as the law requires;
- having any self-billing agreements HM Revenue & Customs requires before you issue self-billed invoices or remittances to your staff or subcontractors;
- having a lawful basis, and where required consent, for the personal data you put into the Service and for the emails you send through it, including marketing emails;
- telling your Customers how you use their data, including, where you use it, that the emails you send may record when they are opened and which links are clicked;
- the automations, email templates and planning forms you set up, and checking that they send the right message to the right person at the right time;
- the contact forms, widgets and links you place on your own website or share with others;
- keeping your own copy of any data you need, using the exports the Service provides (see clause 12.4).
7.2 You confirm that you have the right to upload, import and use all Customer Data in the way the Service allows, including any data you import from another system or spreadsheet.
7.3 You must comply with our Acceptable Use Policy.
8. Email sent through the Service
8.1 Emails you send through the Service, including automated emails, invoices, contracts and messages to your Customers, are delivered through our email provider. If you set up your own sending domain, you confirm that you own or are authorised to use it, and you are responsible for keeping its DNS records in place.
8.2 To protect deliverability for every business on the platform, we apply sending limits. Where limits are close to being reached, we may delay non-essential emails so that essential emails (such as password resets and invitations) still get through. We do not guarantee that any email will be delivered or read.
8.3 We may suspend sending for your account if your emails cause excessive bounces, spam complaints or a risk to our sending reputation.
9. Third-party services and integrations
9.1 The Service works with third-party services, including Stripe (payments), Google Calendar (pushing your events to your staff’s own calendars), Apple’s iTunes Search API and GetSongBPM (song artwork, previews and tempo for playlist requests), and Spotify (links to playlists you recommend). Connecting an integration is optional.
9.2 Third-party services are provided by those third parties under their own terms. We are not responsible for them, for their availability, or for any changes they make that affect how they work with the Service. If a third party withdraws or changes its service, we may have to change or remove the related feature.
9.3 When you connect Google Calendar, the Service only creates, updates and deletes the events it pushes to the calendar you choose. MDJM Cloud’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect at any time; events already added to your calendar stay there.
10. Your data
10.1 You own your Customer Data. You grant us a non-exclusive, worldwide, royalty-free licence to host, copy, process, transmit and display Customer Data only as needed to provide, secure, support and improve the Service, and as otherwise set out in the Agreement.
10.2 For personal data within Customer Data, you are the controller and we are your processor. The Data Processing Agreement on this page forms part of these terms and applies to that processing.
10.3 For the personal data we hold about you and your Users to run our relationship with you (for example account, billing and support records), we are the controller, as explained in our Privacy Policy.
10.4 Our staff will only access your account or Customer Data where needed to provide support you have asked for, to keep the Service secure and working, to investigate a suspected breach of the Agreement, or where the law requires it.
10.5 We may create anonymous, aggregated statistics about use of the Service (for example how many events are booked across the platform) to run and improve it. These never identify you, your Users or your Customers.
11. Security and backups
11.1 We use appropriate technical and organisational measures to protect the Service and Customer Data, as described in the Data Processing Agreement.
11.2 We make an encrypted backup of each Business’s data every night and keep it on separate storage for a limited period (currently 7 days). Backups exist so that we can recover from incidents. Any restore is at our discretion, and restoring a backup replaces your current data with the data as it was when the backup was taken.
11.3 No system is completely secure. You are responsible for the security of your own devices, passwords and networks.
12. Availability, support and exports
12.1 We aim to keep the Service available at all times, but we do not guarantee that it will be uninterrupted or error-free. We may need to carry out maintenance, and where we can we will do this at quiet times and give notice of planned downtime that is likely to be significant.
12.2 We provide support by email at [email protected] during normal UK business hours. We do not offer a guaranteed response time unless we agree one with you in writing.
12.3 You should not rely on the Service as the only record of information you cannot afford to lose, or as the only way of knowing where you need to be and when.
12.4 You can export individual Customer records (PDF and JSON) from the Admin Panel at any time, and when your account closes you can download a full export of your data (see clause 15).
13. Intellectual property
13.1 We and our licensors own all intellectual property rights in the Service, including its software, design, templates we provide and documentation. You receive a non-exclusive, non-transferable right for your Users to use the Service for your internal business purposes during your subscription. Nothing in the Agreement transfers ownership of the Service to you.
13.2 You keep all rights in your own content, including your logo, branding, templates you write, photographs and documents you upload.
13.3 If you give us feedback or suggestions, we may use them freely without any obligation to you.
14. Cancelling your subscription
14.1 You can cancel at any time in Settings > Subscription. Cancelling stops your subscription renewing. You keep full access until the end of the current Subscription Period, followed by the grace period in clause 5.8, and you can resume the subscription before it ends.
14.2 Cancelling a subscription does not delete your data. To close your account and have your data deleted, follow clause 15.
15. Closing your account and deleting your data
15.1 To close your account permanently, email us at [email protected] from your account’s contact email or an administrator’s email address. We will agree a deletion date with you, normally 30 days later.
15.2 During that notice period:
- your subscription stops renewing;
- your Admin Panel is replaced by a page from which your administrators can download a full export of your data (CSV files of every record, plus the files you and your Customers uploaded);
- your Customer Portal, contact forms, widgets, playlist links and calendar feeds stop working, and automated emails and invoice reminders stop being sent;
- we email your administrators a reminder about 7 days before the deletion date;
- you can ask us to cancel the closure, which restores your account.
15.3 On the deletion date we permanently delete your account and all Customer Data, including your financial records, and our backups of your data. Logins belonging to people who also use another business on MDJM Cloud are kept for that other business, but lose all access to yours. Deletion cannot be undone, so please download your export first. If you are required to keep financial records (for example for six years for tax purposes), that export is how you meet that obligation.
15.4 After deletion, we keep only: one audit entry recording that the deletion happened, which contains no names or contact details; our own billing records with you held by Stripe, which we need for our accounts; and copies in our whole-server disaster recovery backups, which are overwritten on a rolling basis within 7 days. We disconnect your Stripe and Google Calendar connections and remove your email sending domain as part of the deletion.
16. Suspension and termination by us
16.1 We may suspend or restrict your account, immediately and without notice where necessary, if:
- you breach the Acceptable Use Policy or another material term of the Agreement;
- your use of the Service puts the Service, other businesses, or anyone’s data at risk;
- we are required to by law, a court or a regulator; or
- you have not paid fees that are due (see clause 5.8).
16.2 While an account is suspended, your Users cannot sign in, the Customer Portal and public features stop working, scheduled emails stop, and your subscription stops renewing. Your data is kept and backed up while we resolve the issue with you.
16.3 We may terminate the Agreement: on 30 days’ written notice for any reason, in which case we will refund any fees you have paid for the period after termination; or immediately by written notice if you commit a material breach that cannot be remedied, or that you fail to remedy within 14 days of being asked to, or if you become insolvent.
16.4 When the Agreement ends for any reason, we will follow the process in clause 15 so that you can download your data before it is deleted, unless the law prevents us from doing so.
17. Our liability
17.1 Nothing in the Agreement limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot be limited or excluded by law.
17.2 Subject to clause 17.1, we are not liable, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for any: loss of profits, revenue, business, bookings or goodwill; loss arising from a missed, late or disrupted event; loss or corruption of data where you could have avoided it by keeping your own export; or indirect or consequential loss.
17.3 Subject to clause 17.1, our total liability to you arising under or in connection with the Agreement in any 12-month period is limited to the total fees you paid us in the 12 months before the event giving rise to the claim.
17.4 Except as expressly set out in the Agreement, all warranties, conditions and other terms implied by statute or common law are excluded to the fullest extent permitted by law. The Service is not designed to give legal, tax or accounting advice.
18. Your indemnity
18.1 You will indemnify us against any claims, losses, fines and reasonable costs we incur because of: Customer Data you put into the Service without the right to do so; emails you send through the Service in breach of the law; your dealings with your Customers; or your breach of the Acceptable Use Policy.
19. Changes to these terms
19.1 We may update the Agreement from time to time. For changes that materially affect you, we will email your account’s contact address at least 30 days before they take effect. If you do not agree, you may cancel before the change takes effect. Continuing to use the Service after that date means you accept the updated terms.
19.2 We may make changes needed for legal, regulatory or security reasons, or that do not disadvantage you, with shorter notice or immediately.
20. General
20.1 Events outside our control. We are not liable for any delay or failure caused by events outside our reasonable control, including failures of the internet, hosting providers, payment or email providers, power, or acts of government.
20.2 Assignment. You may not transfer your rights under the Agreement without our written consent. We may transfer ours to a company that takes over all or part of our business, and will tell you if we do.
20.3 Notices. We will send notices to your account’s contact email address. You should send notices to [email protected].
20.4 Entire agreement. The Agreement is the whole agreement between us about the Service and replaces any earlier discussions. Each of us confirms we have not relied on anything not set out in it.
20.5 Severance and waiver. If any part of the Agreement is found to be unenforceable, the rest remains in force. Not enforcing a right straight away does not mean we give up that right.
20.6 Third parties. No one other than you and us has any right to enforce the Agreement under the Contracts (Rights of Third Parties) Act 1999.
20.7 Governing law. The Agreement and any dispute arising from it are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
2. Acceptable Use Policy
This policy applies to every Business, User and Customer who uses MDJM Cloud. You must not use the Service, or allow anyone to use it, to:
- break any law or regulation, or infringe anyone’s rights, including intellectual property, privacy and data protection rights;
- send spam or unsolicited marketing, or email people who have not agreed to hear from you where the law requires their consent;
- upload or send material that is unlawful, defamatory, harassing, discriminatory, obscene, threatening or misleading;
- upload malicious code, or attempt to interfere with, overload or disrupt the Service or any network connected to it;
- try to access another Business’s data, another person’s account, or any part of the Service you have not been given access to, or to probe, scan or test its security without our written permission;
- get around sending limits, seat limits, subscription restrictions, two-factor authentication, bot protection or any other limit or security measure;
- use automated tools to scrape, copy or extract data from the Service, other than the exports and feeds it provides;
- copy, resell, sublicense, rent or reverse engineer the Service, or use it to build a competing product;
- impersonate any person or business, or use a sending domain, subdomain or branding you are not entitled to use;
- store payment card numbers, passwords for other services, or special category data (such as health information) other than what is genuinely needed for an event and handled lawfully;
- use the Service for any purpose other than running a legitimate business.
We may remove content, suspend sending, or suspend accounts that break this policy (see clause 16 of the Terms of Service). Please report any abuse to [email protected].
3. Data Processing Agreement
This Data Processing Agreement (DPA) forms part of the Terms of Service between us and the Business. It sets out the terms required by Article 28 of the UK GDPR for our processing of personal data on the Business’s behalf. Words defined in the Terms of Service have the same meaning here. If there is a conflict between this DPA and the rest of the Agreement about personal data, this DPA applies.
1. Roles
1.1 The Business is the controller, and we are the processor, of personal data within Customer Data (Business Personal Data).
1.2 We are a separate controller of personal data we process for our own purposes, such as account management, billing, security and support. Our Privacy Policy covers that processing.
2. Details of the processing
| Subject matter | Providing the Service to the Business. |
|---|---|
| Duration | For as long as the Business uses the Service, and until the data is deleted under clause 15 of the Terms of Service. |
| Nature and purpose | Hosting, storing, organising, displaying, transmitting (including by email and to integrations the Business connects), backing up, exporting and deleting data, so that the Business can manage enquiries, bookings, events, payments, contracts, communications, planning and staff. |
| Data subjects | The Business’s Customers and prospective customers; their guests and contacts (for example those making playlist requests or named in event plans); people who submit the Business’s contact forms; the Business’s staff and subcontractors; and venue contacts. |
| Types of personal data | Names, email addresses, phone numbers and postal addresses; event details (dates, venues, times, plans, timelines, music choices and notes); enquiry and contact form answers; quotes, invoices and payment records (but not full card details, which Stripe holds); signed contracts, including signatures, the signer’s name and IP address; emails sent and their open and click records (time, IP address, device); meeting notes; staff details, including wages and availability; login and security records; and any other data the Business chooses to enter or upload. |
| Special category data | Not intended. The Business must not enter special category or criminal offence data unless it has a lawful basis and it is necessary for an event (for example an accessibility requirement or allergy). |
3. Our obligations
We will:
- process Business Personal Data only on the Business’s documented instructions, which are the Agreement and the Business’s use and configuration of the Service, unless the law requires otherwise (in which case we will tell the Business first, unless the law forbids that);
- tell the Business if we think an instruction breaks Data Protection Law;
- make sure that everyone we authorise to process Business Personal Data is bound by confidentiality;
- keep appropriate technical and organisational security measures in place (see section 5 below);
- help the Business, taking into account the nature of the processing, to respond to requests from data subjects exercising their rights, mainly through the export, correction and anonymisation tools in the Admin Panel;
- help the Business meet its obligations on security, breach notification, data protection impact assessments and prior consultation with the Information Commissioner’s Office, taking into account the information available to us;
- notify the Business without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting Business Personal Data, with the information the Business reasonably needs to meet its own obligations;
- at the end of the Service, return Business Personal Data through the full data export and then delete it, as set out in clause 15 of the Terms of Service, unless the law requires us to keep it;
- make available the information reasonably needed to demonstrate compliance with this DPA, and allow audits as set out in section 7 below.
4. Sub-processors
4.1 The Business gives us general authorisation to use sub-processors. The current list is in the Sub-processors section of this page.
4.2 We will give the Business at least 30 days’ notice, by email or by updating that list and notifying the Business, before adding or replacing a sub-processor that processes Business Personal Data. If the Business objects on reasonable data protection grounds, we will discuss the objection in good faith; if we cannot resolve it, the Business may terminate the affected Service and receive a pro rata refund of prepaid fees for it.
4.3 We will put a written contract in place with each sub-processor that gives data protection obligations equivalent in substance to this DPA, and we remain responsible to the Business for each sub-processor’s performance.
5. Security measures
Our measures include:
- encryption in transit (HTTPS) for all access to the Service, and encrypted, separately stored nightly backups, each Business’s backups protected with that Business’s own encryption key;
- logical separation of each Business’s data, enforced in the application on every request and tested automatically;
- two-factor authentication for all platform administrators, and on by default for Business staff;
- protection against automated abuse on sign-in, sign-up and public forms, and rate limiting;
- access to production systems restricted to authorised personnel, with an audit log of significant actions, including data exports, anonymisation and deletion;
- passwords stored only as one-way hashes, and secrets such as integration tokens stored encrypted;
- monitoring of the platform’s services and error reporting configured not to send personal data by default;
- scheduled deletion of logs and working data once they are no longer needed (see the retention table in the Privacy Policy);
- tested backup and restore procedures.
6. International transfers
We host the Service in the United Kingdom. Some sub-processors process data outside the UK. Where they do, we make sure the transfer is protected by an adequacy regulation (including the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified) or by appropriate safeguards such as the UK International Data Transfer Agreement or Addendum.
7. Audits
On reasonable written request, and no more than once in any 12-month period (unless a supervisory authority requires it or following a personal data breach), we will answer the Business’s reasonable written questions about our compliance with this DPA. Any further audit must be agreed in advance, on reasonable notice, during business hours, subject to confidentiality, and at the Business’s cost.
8. The Business’s obligations
The Business confirms that it has a lawful basis for the processing it instructs, that it has given data subjects the information required by Data Protection Law, and that its instructions comply with that law. The Business is responsible for responding to requests from its Customers and other data subjects within the time the law requires. If a data subject contacts us directly about Business Personal Data, we will pass the request to the Business and will not respond to it ourselves, unless the law requires us to.
4. Privacy Policy
This policy explains how Mobile DJ Manager ™ (we) uses personal data as a controller: data about businesses that use or sign up to MDJM Cloud, their staff, and visitors to our website and sign-in pages.
If you are a customer of a business that uses MDJM Cloud, that business decides how your data is used, not us. Please see If you booked with a business that uses MDJM Cloud.
1. What we collect
- Account details: your name, email address, business name, address, phone number, logo and branding, and the settings you choose.
- Login and security data: your password (stored only as a one-way hash), two-factor authentication settings, sign-in and sign-out records, failed login attempts, IP addresses, browser and device information.
- Billing data: your plan, seats, subscription status and billing history. Stripe collects and holds your payment card details; we never see your full card number.
- Usage data: records of significant actions in your account (the activity log), notifications, and technical error reports.
- Analytics data: only if you accept analytics cookies on our sign-up pages, Google Analytics records which of those pages you visit, how far you get through sign-up, where you came from, and your browser, device and approximate location. We do not use analytics anywhere else in MDJM Cloud.
- Communications: emails and messages you send us, and records of the service emails we send you.
- Integration data: if you connect Stripe or Google Calendar, the account identifiers and access tokens needed for the connection. If you allow browser push notifications, the push subscription your browser gives us.
2. How we use it, and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Creating and running your account and providing the Service | Contract |
| Taking subscription payments, invoicing and recovering unpaid fees | Contract; legal obligation (accounting and tax records) |
| Sending service emails, such as invitations, password resets, security alerts, billing notices and account closure notices | Contract; legitimate interests (keeping accounts secure) |
| Keeping the Service secure, preventing fraud and abuse, and investigating incidents | Legitimate interests |
| Fixing errors, monitoring performance and improving the Service | Legitimate interests |
| Measuring how people find and use our sign-up pages (Google Analytics) | Consent, which you can withdraw at any time from “Cookie settings” on those pages |
| Answering support requests | Contract; legitimate interests |
| Telling you about new features or offers related to the Service | Legitimate interests (you can opt out at any time); consent where the law requires it |
| Meeting legal obligations and responding to lawful requests from authorities | Legal obligation |
We do not sell personal data, and we do not use it for advertising or for automated decisions that have legal or similarly significant effects on you.
3. Who we share it with
We share personal data only with the service providers who help us run MDJM Cloud (listed under Sub-processors), with professional advisers such as accountants and lawyers, with a buyer or successor if our business is sold or reorganised, and where the law requires it. If you belong to more than one business on MDJM Cloud, each business sees only its own relationship with you; we do not tell one business about another.
4. International transfers
Some of our providers process data outside the UK, including in the United States. Where they do, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for certified providers) or on the UK International Data Transfer Agreement or Addendum.
5. How long we keep it
We keep account data for as long as your account is open, and delete it when your account is closed (see clause 15 of the Terms of Service). Billing records are kept for six years after the end of the financial year they relate to, as required for tax purposes. Logs and working data are deleted automatically on the following schedule:
| Data | Kept for |
|---|---|
| Sign-in, sign-out, failed login and two-factor records | 90 days |
| Other activity log entries (changes to records, data exports, anonymisation, backups) | 24 months |
| In-app notifications | 90 days once read; one year if never read |
| Email open and click records (time, IP address, browser) | 13 months |
| Uploaded import files and their row logs | 30 days after the import finishes (abandoned drafts: 30 days after last use) |
| Password reset links | 60 minutes |
| Expired sessions | Deleted hourly once expired |
| Encrypted nightly backups of each business | Currently 7 days |
| Backup history records | 90 days |
| Accounts that sign up but never complete checkout | Deleted about 14 days after the latest checkout attempt |
| Google Analytics data from the sign-up pages | 14 months |
6. Your rights
You have the right to ask for access to your personal data, and to ask us to correct, erase or restrict it, or to send it to you or another organisation in a portable format. You can object to processing based on legitimate interests, including direct marketing, and withdraw any consent you have given. To use any of these rights, email [email protected]. We will respond within one month, or tell you within that month if we need up to two more months because the request is complex. There is normally no charge.
Some data cannot be erased straight away, for example billing records we must keep for tax purposes, or a login that another business you work with still relies on. If that applies, we will explain what we kept and why.
If you are unhappy with how we have handled your data, please contact us first. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
7. Children
MDJM Cloud is not intended for children, and business accounts are only for people aged 18 or over.
8. Changes to this policy
We will update the date at the top of this page when we change this policy, and email you about any significant change.
5. Cookie Policy
Cookies are small files a website stores in your browser. Inside MDJM Cloud (the Admin Panel, the Customer Portal and the pages businesses share with their customers) we use only cookies and similar storage that are strictly necessary for the Service to work, so we do not ask for consent to them. On our sign-up pages we also ask whether we may use Google Analytics cookies, and set them only if you accept. We do not use advertising cookies.
Strictly necessary
| Name | Set by | Purpose | Duration |
|---|---|---|---|
| Session cookie | MDJM Cloud | Keeps you signed in as you move between pages, and remembers which business you are working in. | Until you sign out or the session expires |
XSRF-TOKEN |
MDJM Cloud | Protects forms against cross-site request forgery. | As the session |
remember_web_* |
MDJM Cloud | Keeps you signed in between visits, only if you tick “Remember me”. | Until you sign out |
__cf_bm and similar |
Cloudflare | Distinguishes people from bots and protects the Service against attacks. | Up to 30 minutes |
| Turnstile | Cloudflare | Runs a privacy-preserving check that you are not a bot on sign-in, sign-up and contact forms. | During the check |
| Local storage | MDJM Cloud | Remembers display preferences, such as light or dark mode and collapsed menus. | Until you clear it |
mdjm_analytics_consent |
MDJM Cloud | Remembers whether you accepted or rejected analytics cookies on the sign-up pages, so we don’t ask again. | 12 months |
Analytics (only if you accept)
If you accept analytics cookies on our sign-up pages, Google Analytics, run by Google LLC, counts visits and tells us how far people get through sign-up, so we can improve it. Google Signals and advertising features are switched off. These cookies are shared with our marketing website at mdjm.co.uk, which uses the same Google Analytics account.
| Name | Set by | Purpose | Duration |
|---|---|---|---|
_ga |
Google Analytics | Distinguishes one visitor from another. | 2 years |
_ga_* |
Google Analytics | Keeps track of the current visit. | 2 years |
Push notifications
If you allow notifications in your browser, your browser gives us a push subscription address. Notifications are delivered through your browser maker’s push service (for example Google, Mozilla or Apple) and their content is encrypted. You can switch them off at any time in your browser settings.
Email open and click tracking
Emails that businesses send through MDJM Cloud can contain a small image and tracked links that record when an email is opened and which links are clicked, so the business can see whether its customer has seen a quote or invoice. This records the time, IP address and browser. Records are deleted after 13 months. Each business is responsible for telling its customers about this. You can stop it by turning off image loading in your email program.
Managing cookies
You can change your analytics choice at any time with the “Cookie settings” link on the sign-up pages; rejecting deletes the Google Analytics cookies. You can also block or delete cookies in your browser settings, but if you block strictly necessary cookies you will not be able to sign in.
6. Sub-processors
These are the third parties that process personal data on our behalf to provide MDJM Cloud. We will update this list, and notify Businesses as set out in the Data Processing Agreement, before we add or replace a sub-processor.
| Provider | What they do | Location |
|---|---|---|
| Hosting | Hosts the servers that run MDJM Cloud and store its database and files | United Kingdom |
| Backup storage | Stores encrypted nightly backups | United Kingdom |
| Cloudflare, Inc. | Network security, attack protection, content delivery and bot checks (Turnstile) | Global network; United States |
| Resend (Plus Five Five, Inc.) | Delivers emails sent from the Service | United States |
| Stripe Payments UK Ltd and its affiliates | Subscription billing for businesses; online payments from customers through each business’s own connected Stripe account | United Kingdom; United States |
| Functional Software, Inc. (Sentry) | Error monitoring, configured not to send personal data by default | European Union |
| Google LLC | Google Calendar sync, only for staff who connect their own calendar; address suggestions on the sign-up form, using what is typed into the address field; website analytics on the sign-up pages, only for visitors who accept analytics cookies | United States |
To show song artwork, previews and tempo for playlist requests, the Service sends the song title and artist (never any personal data) to Apple’s iTunes Search API and to GetSongBPM. These are not sub-processors, because they receive no personal data.
7. If you booked with a business that uses MDJM Cloud
Many DJs, entertainers and event businesses use MDJM Cloud to manage their bookings. If you enquired with, booked or were invited to plan an event by one of them, this section is for you.
Who is responsible for your data
The business you booked with is the controller of your personal data. It decides what it collects, how it uses it and how long it keeps it, and its own privacy notice applies. We provide the software and process your data on its behalf, under the Data Processing Agreement above.
Your rights
To access, correct or delete your data, please contact the business directly. It can export your data and anonymise your records from within MDJM Cloud. If you contact us instead, we will pass your request to the business, because the law makes it responsible for responding.
Your portal login
If a business gave you access to its Customer Portal, you sign in with your own login, which you can also use with any other business on MDJM Cloud that you deal with. Each business sees only its own bookings with you. You must keep your password secure and not share your login, and you must use the portal in line with the Acceptable Use Policy. Your contract for the event itself is with the business, not with us.
Payments
Card payments you make through the portal are processed by Stripe and paid directly to the business. Neither we nor the business see your full card details. Questions about refunds or charges should go to the business.
Guest playlist requests and contact forms
If you submit a song request through a guest playlist link, or an enquiry through a business’s contact form, the information you enter goes to that business. Contact forms may run a Cloudflare Turnstile check to stop spam.
8. Contact us
Mobile DJ Manager ™
Email: [email protected]