Privacy Policy

Last updated 14 August 2026

DJ-CRM is booking management software for DJs, magicians, bands and entertainment agencies. This policy explains what the software stores, why, and how Google user data is handled.

DJ-CRM is operated by Paddy Gordon DJ, Glasgow, United Kingdom. For any question about this policy, contact [email protected].

1. Who this policy covers

There are two groups of people whose data appears in DJ-CRM.

• Users — performers, agency staff and administrators who sign in to the software.
• Clients — the people booking an event, whose details are entered by a user or submitted through an enquiry form.

Where a user's business is the data controller for their own clients, DJ-CRM acts as the processor for that data.

2. What is stored

Account data

Name, email address, profile photo, role and organisation membership. Sign-in is by Google, by Apple, or by passkey; DJ-CRM never sees or stores a Google or Apple password.

Business data

Bookings, events, venues, quotes, contracts, invoices, payments, availability, and the planning information a client submits for their event, such as running order, song choices and venue logistics.

Client contact data

Names, email addresses, phone numbers and event addresses, entered by a user or submitted through an enquiry form.

Correspondence

Emails sent by the software are recorded so a user can see what was sent to whom and whether it was delivered and opened. Where a user has connected a Google account with read access, message content from that user's own mailbox is stored so the conversation with a client can be shown against their booking.

Technical data

Session cookies, device tokens for push notifications, and server logs containing IP addresses and request paths, kept for security and troubleshooting.

3. Google user data

Connecting a Google account is optional and is done by the individual user for their own account. DJ-CRM only ever accesses that user's own calendar and mailbox, never anyone else's, and requests the narrowest scopes that support the features described.

• calendar — creates and updates events on the calendar the user selects, so bookings appear in their own calendar and availability stays accurate. Some users also select a second, anonymised calendar which shows only that they are busy, with no client details.
• gmail.send — sends quotes, contracts, confirmations and reminders from the user's own address, so clients recognise the sender.
• gmail.readonly — reads messages in the user's own mailbox so the email history with a client can be shown alongside that client's booking.
• gmail.modify — updates read and archive state so that a message read in DJ-CRM is also marked read in Gmail, and the same message is not handled twice.
• userinfo.email, userinfo.profile, openid — identifies the user at sign-in and populates their name and profile photo.

OAuth tokens are stored encrypted. A user can disconnect their Google account at any time in Settings, which deletes the stored tokens, and can revoke access independently at myaccount.google.com/permissions.

4. Where data is held

DJ-CRM runs on servers hosted by Hetzner in the European Union. Databases and file storage are held on those servers, with encrypted backups retained on separate machines under the operator's control for disaster recovery. Traffic is encrypted in transit with TLS. Stored credentials, including OAuth tokens and mail passwords, are encrypted at rest.

5. Third parties

Data is shared only with services needed to run the product:

• Google — sign-in, calendar synchronisation and email, where a user has connected an account.
• Apple — Sign in with Apple, iCloud calendar synchronisation, and push notifications to iOS devices.
• Xero — accounting, where a business has connected it, for invoices and payment status.
• Monzo — where a business connects its own bank account, DJ-CRM is granted read-only access to transaction data (date, amount, description and counterparty name) so that incoming payments can be matched against invoices. DJ-CRM cannot move money or initiate payments, and the business can disconnect the account at any time, which stops further access immediately.
• GoCardless — payment links and payment collection. DJ-CRM does not store card numbers.
• Cloudflare — network routing and protection for the public web addresses.

Google user data is not shared with any of the others.

6. Retention

Business records such as bookings, contracts and invoices are retained while the account is active and afterwards for as long as needed to meet legal and accounting obligations. Synchronised mail is retained while the Google account remains connected and is removed when it is disconnected or the account is deleted. Server logs are kept for a limited period for security and troubleshooting.

7. Your rights

Under UK GDPR you may request access to your personal data, correction of it, deletion of it, restriction of processing, or a copy in a portable format, and you may object to processing. Requests go to [email protected] and are answered within one month.

If a request concerns data entered by a business that uses DJ-CRM about its own client, it is passed to that business as the controller.

You may also complain to the Information Commissioner's Office at ico.org.uk.

8. Children

DJ-CRM is business software and is not directed at children. Accounts are not knowingly created for anyone under 18.

9. Changes

Material changes to this policy will be notified to account holders by email. The date at the top records the last revision.