Privacy Policy
1.About this policy and who controls your data
This policy applies to our corporate website, which sets out the services we provide to artists, labels, managers and rights holders. This website does not sell products. Our official artist stores are operated separately and have their own privacy policy, cookie policy and terms, available on each store.
In this policy "BSI", "we", "us" and "our" mean the following companies, which operate this website together as joint controllers of your personal data:
| Entity | Details |
|---|---|
| Backstreet International Merchandise Ltd (trading as BSI Merch & Artist Services) |
Company no. 02597733, registered in England and Wales Registered office: 1a High Street, Epsom, Surrey, KT19 8DA Trading address: 20 Commercial Street, London, E1 6LP VAT: GB 549 0485 22 |
| BSI Merch GmbH |
Amtsgericht Charlottenburg, HRB 232304B Registered office: Gottlieb-Dunkel-Str. 20/21, Haus 1, Bereich Blau, 12099 Berlin Trading address: Pfuelstr. 5, Aufgang III / 3rd floor, 10997 Berlin VAT: DE345828165 |
We have an arrangement in place setting out our respective responsibilities as joint controllers, the essence of which is available on request. Backstreet International Merchandise Ltd acts as the lead contact point for privacy matters. You can contact our Data Protection Officer for either entity at dpo@bsimerch.com. Our UK ICO registration number is 00012249518. Whichever entity you deal with, you can exercise your rights against either of us.
2.The law we follow
If you are in the UK: the UK GDPR, the Data Protection Act 2018, PECR and the Data (Use and Access) Act 2025. If you are in the EU/EEA: the EU GDPR, the German Federal Data Protection Act (BDSG), German law implementing the ePrivacy Directive (the TDDDG) and, for electronic marketing, the German Act Against Unfair Competition (UWG).
3.The personal data we collect
This is a business-to-business website, so most of the personal data we handle is business contact data. We may collect:
- Business contact data: name, job title, company, business email address and telephone number, when you contact us, make an enquiry, request a call or meeting, or connect with us at an event.
- Correspondence: the content of your messages to us and our replies.
- Marketing data: newsletter and mailing list sign-ups, your preferences, and engagement data (such as opens and clicks) collected by our email and CRM platforms.
- Promotion data: entries to competitions, prize draws and other promotions we run from time to time. Each promotion has its own terms, which will tell you what we collect and why.
- Lead generation data: publicly available business information about prospective clients and partners, for example from company websites, LinkedIn, trade press, industry events and business cards, which we may add to our CRM.
- Technical and usage data: IP address, device and browser type, approximate location and how you use our site, via cookies and similar technologies (see our Cookie Policy).
Recruitment: job applications are handled through a separate process and are covered by our recruitment privacy information, not this policy. We do not knowingly collect special category data through this website.
Where we collect data about you from public sources rather than from you directly, we will provide you with privacy information (including a link to this policy) when we first contact you, or otherwise within one month.
4.How we use your data, and our lawful basis
We rely on the following lawful bases under Article 6 of the UK GDPR and the EU GDPR:
| Purpose | Data used | Lawful basis |
|---|---|---|
| Responding to enquiries and discussing potential work | Contact, correspondence | Legitimate interests (responding to you); steps prior to a contract, Art 6(1)(b), where relevant |
| Business development, CRM and lead management | Contact, lead generation | Legitimate interests (growing and promoting our business) |
| B2B marketing to corporate contacts — UK | Contact, marketing | Legitimate interests, with an opt-out in every message (PECR corporate subscriber rules) |
| B2B marketing — EU / Germany | Contact, marketing | Consent, Art 6(1)(a) |
| Newsletters and mailing lists you sign up to | Contact, marketing | Consent, Art 6(1)(a) |
| Running promotions and prize draws | Promotion entries | Performance of a contract (the promotion terms), Art 6(1)(b) |
| Site analytics and improving our website | Technical, usage | UK: consent or legitimate interests; EU: consent, Art 6(1)(a) |
| Advertising and retargeting (LinkedIn, Meta) | Technical, usage | Consent, Art 6(1)(a) |
| Security and fraud prevention | Technical | Legitimate interests, Art 6(1)(f) |
| Keeping business and legal records | Contact, correspondence | Legal obligation, Art 6(1)(c); legitimate interests |
5.B2B marketing: how we contact you
United Kingdom: under PECR we may send electronic marketing about our services to corporate email addresses (employees and officers of companies and LLPs) on the basis of our legitimate interests, always with a clear way to opt out in every message. Sole traders and unincorporated partnerships are treated as individuals, and we will only email them with consent or under the soft opt-in.
EU / Germany: we send electronic marketing only with your consent, even in a business context. We keep a record of the consents we receive, and every message includes an unsubscribe link.
You can opt out of our marketing at any time using the unsubscribe link in any message or by emailing dpo@bsimerch.com. Opting out does not affect messages we need to send you as part of ongoing work or correspondence.
6.Who we share data with
- Each other: the two joint controllers share data as needed to run the website and respond to you.
- Service providers (processors): website hosting and content management, CRM and marketing platforms (HubSpot and Klaviyo), email and productivity tools, and IT support.
- Analytics providers: Google Analytics 4.
- Advertising partners, where you have consented to the relevant cookies: LinkedIn and Meta.
- Embedded content providers: YouTube and Vimeo, where you play embedded video.
- Authorities and advisers where required by law, and any successor if our business is sold or reorganised (we will tell you if your controller changes).
7.International transfers
Some of our providers are outside the UK and EU/EEA, including in the United States. Where we transfer your data internationally we rely on appropriate safeguards:
| United Kingdom | European Union / EEA |
|---|---|
| We rely on a UK adequacy decision, including the UK Extension to the EU-US Data Privacy Framework (the "UK-US Data Bridge") where the recipient is certified; otherwise the International Data Transfer Agreement (IDTA), or the EU SCCs with the UK Addendum. | We rely on an EU adequacy decision, including the EU-US Data Privacy Framework where the recipient is certified; otherwise the EU Standard Contractual Clauses, with a transfer impact assessment where required. |
You can ask us for a copy of the relevant safeguard using the contact details above.
8.How long we keep your data
| Category | Retention | Reason |
|---|---|---|
| Enquiries and prospective client data | 24 months from our last meaningful contact with you | Business development |
| Marketing consent and preferences | Until you withdraw consent or opt out | Consent / suppression |
| Promotion entries | 6 months after the promotion ends (winner records as required by law) | Running the promotion |
| Client and supplier correspondence | Duration of the relationship, then 6 years | Contract, tax and accounting law |
| Cookie and analytics data | As set out in our Cookie Policy | Consent / legitimate interests |
9.Your rights
You have the right to access, rectification, erasure, restriction, data portability, to object to processing based on legitimate interests and to direct marketing at any time, and to withdraw consent where we rely on it. You also have the right not to be subject to solely automated decisions with legal or similarly significant effects; we do not make such decisions. To exercise any right, contact dpo@bsimerch.com.
Response times
| United Kingdom | European Union / EEA |
|---|---|
| We respond within one month. Under the Data (Use and Access) Act 2025 we may pause that period ("stop the clock") if we reasonably need more information, and may extend it by up to two further months for complex requests. | We respond within one month, extendable by up to two further months for complex or numerous requests, and will tell you if we extend. |
10.Complaints
Please contact us first and we will look into it. You also have the right to complain to a regulator: in the UK, the Information Commissioner's Office (ICO), ico.org.uk, 0303 123 1113; in the EU, your local supervisory authority. Our lead authority for BSI Merch GmbH is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).
11.Cookies, security and children
We use cookies as described in our Cookie Policy. We use appropriate technical and organisational measures to protect your data, and in the event of a personal data breach we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours, and affected individuals without undue delay where the risk is high. This website is aimed at business audiences and is not intended for children; we do not knowingly collect data from children.
12.Changes to this policy
We may update this policy and will post the updated version here with a new "last updated" date; where changes are significant we will take additional steps to tell you.