Privacy notice

This site (the9075.com) is operated by The 9075. References to “we”, “us” or “our” below mean The 9075. If you have any questions about this notice or about how we handle your data, contact us at info@the9075.com.

We collect personal data in the following ways:

• Contact form submissions - when you send us a message via the contact form on the home page, we collect the name, email address, and message you provide.
• Server logs - when you visit any page or submit the form, our server records the IP address you connected from and the browser user-agent string. This is used for abuse prevention and rate limiting.
• Visitor statistics - to count how many people visit and which pages they look at, we combine your IP address and browser type with a secret that changes every day and turn them into a one-way code. Nothing is stored on your device (no cookies), the code can't be turned back into your IP address, and the daily secret is deleted so visits on different days can't be linked. We only keep the daily totals, never a record of what any one person viewed.
• Meta Pixel tracking - when you visit any page on this site, a small piece of code from Meta (Facebook) runs in your browser and sends Meta the page URL, your IP address, basic browser/device info, and some interaction signals (e.g. link clicks). See the “Meta Pixel” section below for full detail.
• Setlist vote submissions - when you vote on the setlist for a specific show, we collect your first name, email address, your song picks, any comment you leave, the IP address and browser you voted from, and the consent statement you agreed to. See the “Setlist voting” section below.

On selected shows we run a public “vote for the setlist” page where fans can pick songs they'd like added to the night's set.

What we store on our side: your first name, email address (lowercased; we store a hash of it as the document key so the email itself isn't in the URL of your record), the songs you picked, the one song you marked as your “Lose Your Mind”, any optional comment, the IP and browser you voted from (for spam protection), and a verbatim snapshot of the consent statement you agreed to at the moment you submitted.

Our mailing list: when you tick the consent box and submit, your first name and email are added to our mailing list, which we run on our own systems, along with a record of what you agreed to and when, so we can keep you in the loop about the band. You can unsubscribe at any time using the link at the bottom of every email we send. Our newsletters may record whether you opened them, which links you clicked and the general type of email app you read them in (for example Gmail or Apple Mail), using a small image and tracked links measured on our own site, so we can tell what fans find useful. If you unsubscribe you can optionally tell us why. We don't share any of this with anyone.

Lawful basis: your explicit consent for the mailing list subscription; our legitimate interest (running the band) for storing and aggregating the votes themselves.

One vote per email per show. We block duplicate submissions on our side.

When you buy from our shop we collect your name, email address, delivery address and the items you ordered. We use them to take payment, deliver your order, email you about it (confirmation and dispatch), and handle any return or refund.

Payments: you pay on a secure page run by Stripe. Your card details go straight to Stripe and never reach us; we only see that the payment went through.

Marketing: checkout has an optional, unticked box to hear about new merch, gigs and news. We only email you marketing if you tick it, and you can unsubscribe any time.

Lawful basis: performing our contract with you (your order), and our legal obligation to keep sales records. Marketing emails rely on your consent.

We use the Meta Pixel (a tracking tool provided by Meta Platforms Ireland Ltd) to measure the effectiveness of our advertising on Facebook and Instagram, and to show our ads to people who have visited this site (“remarketing”).

What gets sent to Meta: every time you load a page on the9075.com, your browser sends Meta the URL of the page, your IP address, your browser and device information (user-agent, screen size, referrer), and certain interactions such as outbound link clicks. Meta also sets its own cookies in your browser via this pixel.

Purpose: to understand which ads led people to our site, to measure ad performance, and to show ads on Facebook and Instagram to people who have visited this site or pages with similar audiences.

Lawful basis: our legitimate interest in promoting the band's gigs and reaching potential fans through paid advertising. You can opt out of personalised ads from Meta in your Facebook ad preferences and via your browser's tracking-prevention settings.

Meta acts as an independent data controller for the data it receives via the pixel. Its use of that data is governed by Meta's own Privacy Policy.

This site uses two categories of cookies:

• First-party functional cookies - set only in the back-office area (/admin) for authenticated staff, and on the venue poster page (/promoters) to remember that a venue has entered the password from its booking email. They keep the sign-in active and remember interface preferences. As a regular visitor you'll never receive these.
• Third-party cookies from Meta - set by the Meta Pixel (see section above) on every page of this site for advertising measurement and remarketing purposes.

• Contact form data - to read and respond to the message you sent us. Lawful basis: our legitimate interest in being able to reply to people who get in touch.
• Server logs - to detect and block automated abuse of the site (e.g. spam submissions, brute-force login attempts on the admin area). Lawful basis: legitimate interest in keeping the site secure.
• Visitor statistics - to understand how many people use the site and which pages help them. Lawful basis: legitimate interest in running the band's website, kept to anonymous daily totals.
• Meta Pixel data - to measure ad performance and reach potential fans through paid advertising on Facebook and Instagram. Lawful basis: legitimate interest in promoting the band's gigs.
• Setlist vote submissions - to count votes and build a setlist informed by fan preference. Lawful basis: legitimate interest. The mailing-list signup that runs alongside the vote uses explicit consent (the GDPR checkbox), separately recorded.

Only the band's authorised admins (a small fixed list of email addresses) can read contact-form submissions through the back-office. We do not sell, share, or rent your data to anyone.

To run this site we rely on a small number of infrastructure providers, who process data on our instructions only:

• Vercel - hosting
• Google Firebase - data storage (EU region)
• Resend - email delivery when we reply to you, order emails and newsletters
• Stripe - payment processing for shop orders
• Meta Platforms Ireland Ltd - advertising measurement and remarketing via the Meta Pixel (see “Meta Pixel” section above). Unlike the providers above, Meta acts as an independent data controller for the data it receives, not as our processor.

Our infrastructure providers (Vercel, Firebase, Resend, Stripe) are bound by GDPR-compliant data processing agreements and don't use the data for their own purposes. Meta uses the data it receives under its own privacy policy.

We keep contact-form submissions until an admin manually deletes them or until the data is no longer needed for the purpose it was collected. There is no automatic expiry.

Server logs (IP, user agent) are kept for the lifetime of any given submission they relate to. Older request logs handled at the platform level (Vercel) follow the provider's own retention schedule.

Visitor-statistics codes and the daily secret behind them are deleted automatically within two days. Only anonymous daily totals are kept after that.

Shop order records (what you bought, what you paid, and your name and delivery address) are kept for six years after the order, because UK tax law requires us to keep sales records for that long. Stripe keeps its own payment records under its own legal obligations.

Rate-limiting counters store a one-way hash of your IP address, never the address itself, and are deleted automatically shortly after the limit window ends (at most a day).

Under UK GDPR you have the right to:

• Ask for a copy of the personal data we hold about you.
• Ask us to correct or delete it.
• Object to our use of it where we're relying on legitimate interest.
• Withdraw consent (where consent is the lawful basis).
• Lodge a complaint with the Information Commissioner's Office (ICO) if you think we've mishandled your data.

To exercise any of these rights, email us at info@the9075.com.

If we change this notice we'll update the “Last updated” date at the top. Material changes (e.g. new types of data collected) will be flagged more prominently.