Privacy and Cookie Policy
Last updated: 15 September 2026
1. Who We Are
BAY CUSTOM STUDIOS LIMITED, trading as BAY Custom Studios (“BAY Custom Studios”, “we”, “us” or “our”), is a company registered in England and Wales under company number 16058699.
BAY CUSTOM STUDIOS LIMITED is the controller of the personal information covered by this policy.
This policy explains how we collect, use, share and protect personal information when you visit www.baycustomstudios.com, contact us, request a quotation, make or discuss a booking, subscribe to updates, interact with us or our advertising through social media, or use our services, including services delivered remotely or through our operations in the United Kingdom and France.
If you have a privacy question, wish to exercise a data-protection right or wish to make a complaint to us, please contact:
Email: info@baycustomstudios.com
Website: www.baycustomstudios.com
Registered office: 23 Wood Lane, Wedges Mills, Cannock, Staffordshire, England, WS11 1SZ
2. Personal Information We May Collect
Depending on how you interact with us, we may collect:
• Identity and contact information, such as your name, email address, telephone number, postal or billing address, organisation, professional role and relevant social-media details.
• Enquiry, booking and project information, such as the services required, preferred dates, number of artists, musicians or guests, creative brief, musical references, technical requirements, deadlines, quotation details, feedback and agreed deliverables.
• Audio and other project material, such as demos, private listening or download links, raw recordings, multitracks, stems, session files, mixes, masters, artwork, photographs, video, metadata and associated notes. Some of this material may be personal information where it identifies or can be linked to an individual.
• Accommodation and visit information, such as dates, guest numbers, practical requirements and other information reasonably needed to arrange a stay or studio session.
• Business and transaction information, such as quotations, contracts, invoices, payment status, transaction records and related correspondence. We do not currently take payments through this website.
• Communications, such as emails, telephone enquiries, form submissions, social-media messages, feedback, complaints and records of discussions about a project.
• Marketing information, such as newsletter subscriptions, communication preferences, campaign responses and records of consent, objections or opt-outs.
• Website and device information, such as IP address, browser and device type, operating system, referring page, pages viewed, approximate location, timestamps, cookie or similar identifiers, form and button interactions, and information about responses to advertisements.
• Information supplied by another person involved in a project, such as an artist, band member, manager, representative, client, session musician or other authorised contact.
Please make sure that you are authorised to give us another person’s information and, where appropriate, make this policy available to them.
3. How We Collect Personal Information
We may collect personal information:
• Directly from you when you contact us, complete a website or social-media form, subscribe to updates, request a quotation, enter into an agreement, send project material, visit a studio or communicate with us.
• Automatically when you use our website or interact with our online advertising, through cookies, pixels, tags, server logs and similar technologies, subject to the choices described in this policy.
• From someone acting for you or involved in the same project, such as an artist representative, manager, band member, client or other authorised participant.
• From service providers and platforms used to support our website, communications, advertising and social-media activity, where permitted by law.
4. Sensitive Information and People Under 18
We do not routinely ask for health information or other special-category personal information. If a particular studio session, visit or accommodation booking reasonably requires information about accessibility, allergies, dietary needs, health or another sensitive matter, we will explain why it is needed and collect only what is reasonably necessary. Where this amounts to special-category information, we will normally seek your explicit consent. In limited circumstances, another legal condition may apply, such as protecting someone’s vital interests in a genuine emergency or establishing, exercising or defending legal claims.
Please do not send sensitive information through a general enquiry form unless we have asked you to do so.
Our website and general enquiry forms are not intended for children to use independently. If a project involves a person under 18, a parent, guardian or other appropriately authorised adult should contact us. We will collect only the information reasonably required to arrange and deliver the project and will seek the appropriate adult’s involvement where necessary.
5. How and Why We Use Personal Information
Data-protection law requires us to have a lawful basis for each use of personal information. Depending on the circumstances, we rely on steps taken at your request before entering into a contract, performance of a contract, compliance with a legal obligation, our legitimate interests, your consent or, rarely, protection of vital interests.
We may use personal information to:
• Respond to enquiries, understand requirements, check availability and prepare quotations. We rely on steps taken at your request before entering into a contract and, where appropriate, our legitimate interests in responding to genuine business enquiries.
• Arrange bookings and provide recording, production, mixing, mastering, accommodation, session-musician and related services. We rely on performance of a contract or, where the individual is acting for an organisation or another person, our legitimate interests in administering and delivering the project.
• Communicate with clients, artists, representatives, musicians, engineers, technicians, contractors and other people involved in a project. We rely on contract and our legitimate interests in planning, coordinating and completing the agreed work.
• Receive, organise, edit, transfer, deliver and, for the periods described below, retain project material. We rely on contract and our legitimate interests in delivering the work, providing reasonable project continuity and handling follow-up requests.
• Administer quotations, contracts, invoices, payments, accounts, taxation, insurance and other business records. We rely on contract, legal obligations and our legitimate interests in operating and protecting our business.
• Provide support, respond to feedback or complaints, resolve disputes, enforce agreements and establish, exercise or defend legal claims. We rely on contract, legal obligations and our legitimate interests in protecting our rights and those of others.
• Operate, maintain, troubleshoot and secure our website, forms, communications and systems; prevent spam, fraud and misuse; and understand website or service performance. We rely on legal obligations, our legitimate interests and, for non-essential cookies or similar technologies where required by law, consent.
• Send news, updates and information about our services. We rely on consent where required and otherwise on our legitimate interests where direct-marketing law permits.
• Measure advertising performance, understand campaign responses, create or reach relevant advertising audiences and show more relevant advertising. Where this involves non-essential cookies, pixels or similar technologies, we rely on consent where required by law.
• Publish an agreed artist credit, testimonial, image, audio extract, video or other portfolio material. We will do this only with your consent or under a written contractual licence or portfolio term that covers the particular use. Where we rely on consent, you may withdraw it for future use at any time.
• Comply with lawful requests from courts, regulators, law-enforcement bodies, tax authorities or other public authorities. We rely on legal obligations and our legitimate interests in complying with and protecting our legal position.
Our legitimate interests include operating, improving and protecting our business; responding to clients and professional contacts; delivering and maintaining continuity of our services; promoting our services in a proportionate way; securing our systems; and protecting legal and commercial rights. Before relying on legitimate interests, we consider the likely effect on the people concerned.
If information is needed to enter into or perform a contract and you do not provide it, we may be unable to provide an accurate quotation, accept or administer a booking, or deliver the requested service.
6. Marketing, Social Media and Advertising
We may send you news or information about BAY Custom Studios where:
• You have asked to receive it or have otherwise given valid consent.
• We obtained your contact details directly during a sale or genuine negotiation for a sale, the message concerns our own similar services, we offered a clear opt-out when collecting the details, and we provide an opt-out in every message, as required by the “soft opt-in”.
• You are a relevant business contact and applicable law permits proportionate business-to-business marketing based on our legitimate interests.
We will not treat this privacy policy, silence or a pre-ticked box as consent where consent is required. Marketing is optional and does not affect your ability to enquire about or use our services.
You can unsubscribe or object to direct marketing at any time by using the unsubscribe option in an email or contacting info@baycustomstudios.com. After an opt-out, we may retain the minimum information needed on a suppression list so that we do not contact you again accidentally. Opting out of marketing will not stop necessary service, project, booking or administrative communications.
If you send us a message or submit a lead form through Facebook, Instagram, LinkedIn, Google or another platform, we receive the information you choose to provide and use it to respond to your enquiry and manage any resulting relationship. The platform also processes information under its own privacy terms.
Subject to applicable law and your cookie choices, we use or may use services provided by Meta, Google and LinkedIn to measure campaigns, retarget website visitors, create or reach advertising audiences and avoid showing unsuitable or repetitive advertising. An advertising provider may use website-activity data to associate a browser or device with a user of its service. The provider may act as a separate or joint controller for parts of that processing.
7. Who We Share Personal Information With
We disclose personal information only where reasonably necessary for the purposes described in this policy. Recipients may include:
• Squarespace and providers that support our website, forms, mailing-list functions, hosting and website security.
• Email, telephone, IT, cloud-storage, backup, collaboration and file-transfer providers selected according to the technical and security needs of the work or an agreed client workflow.
• Engineers, producers, session musicians, technicians, accommodation personnel and other project contractors where their involvement is required. We share only the information reasonably needed for their role.
• Accountants, insurers, banks, payment-service providers, legal advisers and other professional advisers.
• Meta, Google, LinkedIn and other advertising, analytics or social-media providers where the relevant service is used and the necessary consent or other lawful authority exists.
• Courts, regulators, law-enforcement bodies, tax authorities and other public authorities where disclosure is required or legally justified.
• A prospective purchaser, investor, funder or successor if our business or assets are reorganised, financed, sold or transferred, subject to appropriate confidentiality safeguards.
Some recipients process personal information only on our instructions. Others decide independently or jointly how they use information and will provide their own privacy information. When using a provider on our behalf, we take proportionate steps to select an appropriate provider and put suitable data-protection arrangements in place.
The particular cloud-storage, backup, collaboration or file-transfer service may vary according to the project and client preference. We will use reputable services and provide further information where the choice of provider materially affects how personal information is handled.
8. Payments and Any Future Online Checkout
We do not currently take payments through this website. Payments for our bespoke services are arranged separately, and we retain the invoice, payment-status and transaction information needed to administer the project and meet our legal and accounting obligations.
If we introduce an online checkout or another online payment option, the checkout will identify the relevant payment provider and any additional information needed will be given at the point of collection. Full payment-card details would normally be submitted directly to that provider rather than to us. We would generally receive limited billing, transaction and payment-status information. We will review and update this policy when necessary before introducing a materially different payment arrangement.
9. Squarespace, Website Forms and Mailing Lists
Our website is hosted by Squarespace. Squarespace provides website hosting and may support forms, mailing-list functions, analytics, security and related services. Information submitted through a website form may be processed and stored through Squarespace and delivered to us so that we can respond.
Our forms may ask for contact details, project requirements and a private listening or file-transfer link. Please use a transfer method appropriate to the material and do not place passwords, highly sensitive information or valuable source files directly in a general enquiry form. We may agree a different delivery method for project files.
Squarespace forms may use Google reCAPTCHA to help distinguish people from automated activity and prevent spam, fraud and abuse. When the service runs, it may process technical and interaction information, such as an IP address, browser and device information and signals about how the form is used, for security and risk assessment.
Squarespace’s privacy policy is available at:
https://www.squarespace.com/privacy
10. Cookies and Similar Technologies
Our website uses cookies and similar technologies, including pixels, tags, local storage and embedded media players. A cookie is a small text file stored on your device. These technologies can recognise a browser or device, remember choices, operate and secure the website, measure how the website is used and support advertising.
The technologies used on a particular visit depend on the page you view, the features available at that time, your cookie choices and the settings of the relevant provider.
Strictly necessary technologies are used to deliver and secure the website, remember privacy choices, protect forms and provide features you request. Squarespace forms may use Google reCAPTCHA, which sets a necessary cookie called _GRECAPTCHA when it runs to perform its risk analysis. Strictly necessary technologies cannot normally be switched off through our cookie controls. You can block them in your browser, but parts of the website may then stop working correctly.
Analytics and performance technologies help us understand visits, traffic sources, pages viewed and interactions with forms, links and buttons. Squarespace Analytics may process information such as IP address, browser, network and device information, referring pages, page and link views, clicks, scrolling, searches and timestamps. We use this information to understand and improve the website and our marketing.
Advertising and measurement technologies may include the Meta Pixel, Google advertising and measurement tags and the LinkedIn Insight Tag. These services can process online and cookie identifiers, IP address, page and referring URLs, timestamps, browser and device characteristics, and actions such as page views, button clicks or form submissions. We use them to measure and attribute campaigns, understand responses to advertising, create or reach advertising audiences and show more relevant advertising. The providers may process information under their own privacy notices and account or advertising settings.
Pages on our website may include media players or content supplied by Spotify, Apple Music and YouTube. When embedded content loads, or when you interact with it, the provider may receive your IP address, browser or device details, information about the page or domain containing the player, and information about your interactions or playback. If you are signed in to that provider, the activity may be associated with your account. Embedded content may not work if you decline the relevant cookies.
Where consent is required, we use non-essential analytics, advertising and embedded-media technologies only after you choose to allow them. You can accept, reject or change your choices at any time using the cookie banner or Cookie Settings control on our website. You can also delete or block cookies through your browser settings. Withdrawing consent does not affect processing that took place before withdrawal.
Some cookies are deleted when you close your browser. Others remain for a stated period unless you delete them sooner. The exact technologies used depend on the page, campaign, provider settings and your choices. The cookie banner or Cookie Settings control provides the most current information we make available about non-essential technologies active on the website. Current provider-published examples for services we use or may use include:
• Squarespace analytics cookies: from 30 minutes to two years. Squarespace cookies that remember performance and marketing choices: 30 days.
• Google advertising and YouTube cookies: from the browser session to 13 months in the United Kingdom, European Economic Area and Switzerland, depending on the cookie and service. Google advertising cookies beginning gcl commonly last for 90 days.
• LinkedIn advertising and analytics cookies: from seven days to one year, depending on the cookie. LinkedIn states that direct member identifiers in Insight Tag data are removed within seven days and the remaining pseudonymised website-visit data is deleted within 180 days.
• Apple Music’s embedded web player: its web-player identifier resets after one day and is not linked to an Apple Account. Apple may retain information about the player and activity within it for up to two years.
• Meta and Spotify: cookie and identifier periods vary according to the feature, account status, provider settings and consent choice.
Not every technology described above will be used on every visit. Providers may change their technologies and retention periods. Their current details and controls are available in the provider information below.
Provider information:
Squarespace cookies:
https://support.squarespace.com/hc/en-us/articles/360001264507-The-cookies-Squarespace-uses
Squarespace privacy policy:
https://www.squarespace.com/privacy
Meta privacy policy:
https://www.facebook.com/privacy/policy/
Meta cookie policy:
https://www.facebook.com/privacy/policies/cookies/
Google privacy policy:
https://policies.google.com/privacy
Google cookie information:
https://policies.google.com/technologies/cookies?hl=en-GB
Google reCAPTCHA information:
https://docs.cloud.google.com/recaptcha/docs/faq
LinkedIn privacy policy:
https://www.linkedin.com/legal/privacy-policy
LinkedIn cookie policy and cookie table:
https://www.linkedin.com/legal/cookie-policy
https://www.linkedin.com/legal/l/cookie-table
Spotify privacy and cookie policies:
https://www.spotify.com/uk/legal/privacy-policy/
https://www.spotify.com/uk/legal/cookies-policy/
Apple Music web player and privacy information:
https://www.apple.com/legal/privacy/data/en/apple-music-web/
YouTube embedded-player information:
https://support.google.com/youtube/answer/171780?hl=en
11. International Transfers
Because we operate in the United Kingdom and France and use online service providers, personal information may be processed in the United Kingdom, the European Economic Area and other countries, including the United States.
Where data-protection law restricts an international transfer, we use or require an appropriate safeguard where necessary. Depending on the transfer, this may include a United Kingdom or European adequacy decision or regulation, approved standard contractual clauses, the United Kingdom International Data Transfer Agreement or Addendum, or another legally recognised mechanism. We may also apply additional technical or organisational safeguards where appropriate.
You can contact info@baycustomstudios.com for further information about the safeguard relevant to your personal information.
12. How Long We Keep Personal Information
We keep personal information only for as long as reasonably necessary for the purposes for which it was collected. This may include responding to enquiries, preparing quotations, providing and administering our services, maintaining an appropriate business or client record, supporting an ongoing client relationship, resolving complaints or disputes, enforcing an agreement and complying with legal, tax and accounting obligations.
When deciding how long information is needed, we consider its nature and sensitivity, the purpose for which it is used, the risks associated with retaining it, the status of our relationship with you, whether further related work is reasonably anticipated, and any applicable legal, regulatory or limitation period. Information that is no longer required is securely deleted or anonymised.
Enquiry, quotation, client, booking, contract, project-administration and ordinary correspondence records are retained for as long as reasonably necessary when assessed against those criteria, rather than for a single fixed period in every case.
Financial, tax and accounting records are normally retained for at least six years from the end of the company financial year to which they relate, or for longer where required by law, where a transaction covers more than one accounting period, or while a relevant enquiry, claim or investigation remains unresolved. A longer period may apply to particular records where French law applies.
Some recordings and project files may contain personal information, including identifiable voices, names or file metadata. As part of our ordinary project workflow, our standard minimum operational retention periods are:
• Raw recordings, session files and working versions: normally retained for at least 90 days after final delivery or completion of the relevant project, whichever is later.
• Approved final masters and other final deliverables: normally retained for at least 12 months after final delivery or completion of the relevant project, whichever is later.
These are minimum operational periods, not a promise of permanent storage. After the relevant period has expired, files may be securely deleted without further notice.
We may retain recordings or project files for longer at our discretion where a continuing and lawful reason remains—for example, to complete or revise work, maintain reasonable continuity for an active or repeat client, respond to a query, resolve a dispute, meet a legal obligation, use agreed portfolio material or provide a longer storage arrangement agreed in writing—and where suitable secure storage is available. Any extended retention is subject to periodic review and is not guaranteed.
Unless we expressly agree to provide an archiving or storage service in writing, BAY Custom Studios does not operate as a permanent archive or backup provider. Clients are responsible for promptly downloading, checking and securely backing up all files supplied to them and should not rely on BAY Custom Studios retaining copies after delivery.
We retain marketing information until you unsubscribe, withdraw consent, object to its use or it is no longer reasonably needed for the relevant marketing purpose. We periodically review inactive marketing records, taking account of whether there is an active client or professional relationship, recent meaningful engagement or a reasonable continuing prospect that our services remain relevant. Where you opt out, we may retain the minimum information needed on a suppression list for as long as necessary to respect your choice.
Sensitive information collected for an accessibility, dietary, health, safety or similar practical requirement is deleted or anonymised when it is no longer reasonably needed, unless an incident, claim or legal obligation requires longer retention.
Cookie and similar-technology data is retained for the lifespan of the relevant cookie or according to the settings and retention practices of the service concerned, as described in this policy, our cookie controls or the provider’s information.
We may retain genuinely anonymised information for longer because it no longer identifies an individual. Deletion from active systems may not immediately remove residual copies held in protected backups. Those copies are isolated from ordinary use and are deleted or overwritten through the normal backup cycle, unless they must be preserved for legal or security reasons.
All retention is subject to applicable data-protection rights and legal obligations.
13. Security
We use proportionate technical and organisational measures intended to protect personal information against accidental or unlawful loss, alteration, unauthorised access or disclosure. Access is limited to people and providers who reasonably need the information for the relevant purpose.
No method of internet transmission or electronic storage is completely secure. Clients should use the transfer method agreed for their project and should not send highly sensitive information or valuable source material through an unsecured general enquiry form.
14. Your Data-Protection Rights
Depending on the circumstances and the law that applies, you may have the right to:
• Ask for access to your personal information and a copy of it.
• Ask us to correct inaccurate or incomplete information.
• Ask us to erase personal information.
• Ask us to restrict how personal information is used.
• Object to processing based on legitimate interests.
• Receive certain information in a portable format or ask us to transfer it where technically feasible.
• Withdraw consent at any time where processing is based on consent, without affecting processing that was lawful before withdrawal.
• Complain about how we use personal information.
These rights are not absolute and may depend on the lawful basis and circumstances. We may ask for information reasonably needed to confirm your identity and understand your request. We will respond within the period required by applicable law.
Your right to object to direct marketing is absolute. If you object, we will stop using your personal information for direct marketing. You may also object to processing based on legitimate interests; we will stop unless we can demonstrate compelling lawful grounds that override your interests, rights and freedoms, or the information is needed to establish, exercise or defend legal claims.
We do not use personal information to make solely automated decisions that produce legal or similarly significant effects. If you consent to advertising technologies, advertising providers may use automated methods to infer interests, create audience groups and select advertising.
To exercise a right, email info@baycustomstudios.com.
15. Complaints
If you have a concern about how we have handled personal information, please email info@baycustomstudios.com so that we can investigate it. We will acknowledge a data-protection complaint within 30 days and will take appropriate steps to investigate, keep you informed where necessary and explain the outcome without undue delay.
You may also complain to the United Kingdom Information Commissioner’s Office. Information about making a complaint is available at:
https://ico.org.uk/make-a-complaint/data-protection-complaints/
If European Union data-protection law applies, you may complain to the supervisory authority in the country where you live or work or where the alleged infringement occurred. In France, the supervisory authority is the Commission Nationale de l’Informatique et des Libertés (CNIL):
https://www.cnil.fr/
16. Third-Party Websites and Services
Our website may contain links to, or embedded content from, websites and services controlled by other organisations. Those organisations may collect and use information for their own purposes. We do not control their independent privacy practices, and you should review their privacy information and account settings before providing information or using their services.
17. Changes to This Policy
We may update this policy when our services, systems, providers or legal obligations change. The current version and its revision date will be published on this page. Where a change materially affects how we use information already collected, we will provide additional notice where required by law.