Data Processing Information

This working information describes the processing visible in the current Riffparcel website and application: visitor browsing, contact enquiries, free-sample and service-intake requests, account and portal use, and related communications. It is a practical draft for owner and UK data-protection review, not a final privacy notice or processor agreement.

The controller legal entity, business or registered address, effective date and dedicated privacy contact have not been confirmed in this checkout. The owner must identify the controller, document any controller or processor roles, and confirm the final notice before publication.

The observed purposes include operating and securing the website, responding to enquiries, reviewing service-intake requests, maintaining request and lead workflow records, providing portal access, sending service communications and managing owner notifications. The owner must map each purpose to its final UK GDPR lawful basis and confirm where PECR consent or another rule applies.

Depending on the interaction, information can include identity and contact details, company and website details, request details, source content or video URLs, messages, account and session information, workflow status and history, notification state, portal activity, technical request information and analytics or visitor identifiers. The owner must confirm the final categories and whether any special-category or criminal-offence data is prohibited from submission.

The free-sample request form accepts a name, work email, company, website, source content type, request details for context, and a source-video URL. It accepts a URL, not an uploaded source-video file. The submitted information is used to review the request and follow up about a sample; submitting a form does not itself create a service agreement.

Customers should submit only source material, source URLs, music, fonts, brand assets and personal information they are authorised to share. These inputs may be used to review a request, communicate about it and, where an engagement exists, operate the requested service; this page does not itself grant, transfer or confirm copyright, licensing or publication rights.

Service-intake records contain the submitted form snapshot, answers, extracted contact value, reference, status, status history and notification state. Requests are reviewed and worked through the service-intake/admin workflow. The owner must confirm the final access model, audit approach and retention schedule.

Clip-work records can include a batch title and client association, review state, review comments, revision notes and status, delivery-file labels and URLs, and QA checklist completion state. These records support review, revision and delivery workflows.

The location of the media itself and its retention period are unconfirmed. A delivery-file URL stored in an application record does not establish where the underlying media is stored or how long it remains available; the owner must confirm those details.

Account and client-portal handling uses authentication and session technology to recognise an authorised user and show the protected workspace.

The contact form stores the submitted name, email address and message. The workflow then attempts to surface the submission in the founder dashboard; when that notification cannot be recorded, it uses the configured company-inbox email fallback. The supplied email address may also be used to reply about the enquiry or service request. The owner must confirm provider names, communication purposes, lawful bases, the marketing position and reply or unsubscribe wording.

Information may be handled by the application, database, hosting, authentication, dashboard, email, analytics and visitor-technology providers needed for the flows described here. The owner must confirm each provider’s legal name, role, processing instructions, contractual terms and access to each information category; this page does not invent a processor list or provider terms.

The owner must identify any transfer outside the UK, destination country, transfer mechanism and supplementary safeguards. International-transfer wording and the applicable UK GDPR assessment remain explicit review items until those facts are confirmed.

The application uses authenticated routes and role-aware dashboard surfaces for protected records, alongside ordinary hosting, database and operational security controls. The owner must confirm the complete technical and organisational measures, incident process, backup handling and access-review process before publication.

No final retention periods are asserted here. The owner must set and document periods or review criteria for technical records, consent preferences, contact messages, service-intake records, dashboard communications, analytics data and backups, together with deletion or anonymisation procedures.

Subject to applicable law and exemptions, UK rights can include access, correction, erasure, restriction, portability and objection. The owner must confirm the request identity checks, response process, lawful exemptions and any additional rights for each processing purpose. The public /contact route is currently a general enquiry path, not a confirmed dedicated privacy inbox.

You may complain to the Information Commissioner’s Office (ICO). The owner must confirm controller contact details, purposes and lawful bases, recipients and provider roles, international transfers and safeguards, retention periods, the rights-request process, security and incident details, and the effective date. The ICO’s privacy information guidance is a reference for the owner’s review; it is guidance, not legal advice. The page’s approval flag records the owner’s publication decision and does not independently verify facts outside the application.