PLEKXA PRIVACY POLICY

Plekxa Group Limited · Effective 18 September 2026 · Last updated 18 September 2026

1. Who we are

Plekxa Group Limited is the controller for personal data described in this notice unless a separate notice says otherwise. Company number 16385292. Registered office: Izabella House, Office 1, 24–26 Regent Place, City Centre, Birmingham, B1 3NJ, United Kingdom. Privacy contact: privacy@plekxa.com.

2. Data we collect

• Account and identity data: name, stage name, email, authentication identifiers, profile details and contact information.
• Creator and professional data: creator type, biography, portfolio, skills, genres, applications, pitches, Project and Commission activity.
• Contract and rights data: legal name, signatures, contract status, Asset contributions, ownership/participation records, Index classifications and certificates.
• Financial data: project fees, revenue allocations, payout status, payment-provider references, tax or compliance information where required.
• Content and file data: deliverables, masters, stems, artwork, briefs, samples, reference files and associated metadata.
• Communications data: Commission messages, support requests, notifications and operational email records.
• Technical and security data: IP address, device/browser information, session information, logs, security events and audit records.

3. Why we use personal data and lawful bases

We process data to provide accounts and Creator Studio; administer applications, Projects, commissions, deliverables and contracts; maintain Asset, Index and certificate records; calculate and pay earnings; provide support; secure and audit the Platform; comply with legal, tax and accounting obligations; and improve our services.

Depending on the activity, our lawful basis is performance of a contract, steps requested before entering a contract, compliance with legal obligations, our legitimate interests in operating and securing Plekxa and managing creative rights, or consent where consent is required (for example certain marketing or non-essential tracking).

4. Who we share data with

We use service providers for cloud hosting, database/authentication, object storage, deployment, email delivery, payments, analytics and professional services. Current infrastructure includes Supabase for database/authentication, Cloudflare R2 for object storage and Vercel for application hosting/deployment. Payment or email providers may process information when those features are used.

We may also share information with professional advisers, rights/distribution partners, authorities where legally required, and counterparties where necessary to administer a Project or agreement. We do not sell personal data.

5. International transfers

Some service providers may process data outside the United Kingdom. Where UK data protection law requires safeguards, we use an applicable adequacy regulation, the UK International Data Transfer Agreement/Addendum or another lawful transfer mechanism.

6. Retention

We keep account and operational data only as long as reasonably necessary for the purposes described. Rights, Asset, Index, certificate, contract, audit, accounting, tax, fraud-prevention and payment records may be retained longer because they establish legal or financial history. File retention depends on whether a file is a temporary submission, Project reference file, accepted Asset master or legally required record.

7. Security

We use access controls, authenticated accounts, private object storage, signed download/upload links, audit logging and other technical and organisational measures. No system is completely secure, but we design controls proportionate to the information and risks involved.

8. Your rights

Subject to applicable law, you may have rights of access, rectification, erasure, restriction, portability and objection. Where processing relies on consent, you may withdraw consent. Some rights are limited where we must retain records for contracts, legal claims, accounting, rights management, security or other lawful reasons.

To exercise a right, contact privacy@plekxa.com. You may also complain to the UK Information Commissioner’s Office (ICO).

9. Automated decisions

Plekxa may automate operational calculations such as Index allocations, status changes and notifications. We do not currently intend those calculations alone to make solely automated decisions producing legal or similarly significant effects about a person without appropriate human or contractual controls.

10. Cookies and similar technologies

Our Cookie Policy explains storage and access technologies. Strictly necessary technologies may be used for authentication and security without consent where the law permits. Non-essential analytics, advertising or similar technologies should not be activated until the required consent has been obtained.

11. Changes

We review this notice when our processing changes. Material new uses of personal data will be brought to users’ attention where required before the new processing begins.