Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, and protected when you use the OnePress website and related services (the “Service”).

OnePress is a UK-based presale platform for vinyl and associated merchandise. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy is provided for transparency. It does not constitute legal advice. If you need advice on your own obligations, you should consult a qualified professional.

For the purposes of UK data protection law, the data controller is SoundOnShape.com Ltd (trading as OnePress, company number 16464812), part of the SoundOnShape.com Ltd group, trading as “OnePress”.

You can contact us about privacy using the details at the end of this policy.

This policy applies if you:

• Browse or buy from the Service as a fan or customer;
• Upload a presale or offer merchandise as an artist or creator;
• Sign in to the creator portal or moderator admin area;
• Contact us for support.

The data we collect depends on how you use the Service. We may collect:

• Identity and contact data — for example name and email address when you upload a release, request a creator or admin sign-in link, or contact support.
• Creator and release data — presale title, artist name, bio, artwork, preview audio, merchandise configuration, and sales statistics linked to your creator email.
• Order and payment-related data — when you checkout, Stripe collects payment and delivery details. We receive order information such as customer name, email, items purchased, quantities, and Stripe reference IDs needed to fulfil orders and support you.
• Technical and usage data — such as page views or engagement counters associated with a presale (for example views and likes), and standard server or security logs where deployed.
• Communications — the content of emails you send us and messages we send you (for example magic-link sign-in emails or creator summary emails where enabled).

We collect personal data when you provide it directly (forms, uploads, email), when you complete checkout via Stripe, when you use sign-in links, and when the Service records activity necessary to run presales (for example order fulfilment or presale statistics).

We do not require fans to create a OnePress account to purchase. Checkout personal data is primarily collected by Stripe as payment processor.

We only process personal data where a lawful basis applies. Depending on the activity, we rely on one or more of the following:

• Contract — processing necessary to take steps at your request before a contract, or to perform a contract (for example fulfilling a presale order you place).
• Legitimate interests — operating, securing, and improving the Service; preventing fraud; managing creator and admin access; and communicating about orders, provided your rights do not override those interests.
• Consent — where required for optional processing (for example certain marketing, if offered separately with a clear opt-in).
• Legal obligation — where we must comply with UK law (for example tax or accounting record-keeping where applicable).

We use personal data to:

• List and display presales, previews, and merchandise;
• Process payments and record orders for production and dispatch;
• Authenticate creators and authorised administrators;
• Provide creator sales summaries and operational reporting;
• Respond to support requests and protect the security of the Service;
• Comply with legal and regulatory requirements.

We share personal data only where necessary, including with:

• Stripe — payment processing and checkout (Stripe acts as an independent controller/processor for payment data under its own privacy policy: stripe.com/gb/privacy).
• Resend (or similar email providers) — sending transactional emails such as magic links or creator notifications when configured.
• Wasabi or other cloud storage — hosting artwork, audio previews, and print files you upload.
• Hosting and infrastructure providers — to run the website and store application data securely.
• Professional advisers or authorities — where required by law or to protect legal rights.

Some service providers may process data outside the UK. Where personal data is transferred internationally, we aim to ensure appropriate safeguards are in place as required by UK law (for example UK International Data Transfer Agreement addenda, adequacy regulations, or equivalent protections offered by the provider).

Stripe, email, and cloud providers may process data in the United States or other countries according to their own terms.

We keep personal data only for as long as needed for the purposes described in this policy, including:

• Order and fulfilment records — for the period needed to produce, dispatch, and handle queries or legal claims (often several years for commercial records).
• Creator and presale content — while the release remains on the Service and for a reasonable period afterwards unless you request deletion where we can honour it.
• Sign-in and security logs — for a limited period appropriate to security and troubleshooting.
• Magic-link tokens — short-lived until used or expired.

We use a strictly necessary session cookie when creators or administrators sign in. This cookie is httpOnly, used to keep you signed in for a limited period (typically up to 7 days), and is not used for advertising.

Your shopping basket may be stored in your browser’s local storage on your device so items persist between visits. This is functional data, not shared with third parties except when you proceed to Stripe checkout with the items you chose.

We do not describe use of non-essential analytics or marketing cookies on the core shopping journey. If we introduce such technologies, we will update this policy and, where required, obtain consent before they are set.

Subject to conditions and exemptions in UK GDPR, you may have the right to:

• Request access to personal data we hold about you;
• Request correction of inaccurate data;
• Request erasure in certain circumstances;
• Request restriction of processing;
• Object to processing based on legitimate interests;
• Request data portability where processing is based on consent or contract and carried out by automated means;
• Withdraw consent at any time where processing is based on consent (without affecting prior lawful processing).

To make a privacy request, contact us at Support@onepress.uk or 020 3627 4240. We may need to verify your identity before responding.

We will respond within one month in most cases, as required by UK law. That period may be extended for complex requests; we will tell you if so.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint.

The Service is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has provided data to us, contact us and we will take appropriate steps to delete it where required.

We implement appropriate technical and organisational measures to protect personal data, including secure sign-in cookies, access controls for admin and creator areas, and use of reputable payment and hosting providers.

No online service can guarantee absolute security. You should keep sign-in links confidential and use a strong, private email account.

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will change when we do. Material changes may also be highlighted on the Service where appropriate.

Please review this page periodically. Continued use of the Service after changes take effect may constitute notice of the updated policy where permitted by law.

For privacy questions or to exercise your rights, contact OnePress:

• Email: Support@onepress.uk
• Telephone: 020 3627 4240
• Postal / registered office: contact us by email for the current registered office address of SoundOnShape.com Ltd (trading as OnePress, company number 16464812).