Data Access, Export & Deletion

Your rights Under UK GDPR you may request access, correction, export (portability) or deletion of the personal data we hold about you, subject to the legal limits set out below.

How to exercise them Both of these are self-service and take effect immediately. Neither is a ticket, and neither waits for anyone to read an inbox.

1. **Export** — sign in and go to **Account → Your data → Download my data**. You get a JSON file containing your account record, your orders and their metadata, your messages, reviews, disputes, ledger entries, payouts, notifications, saved gigs and support tickets. Files are listed with their name, type, size and a download link rather than embedded, so the export stays openable. 2. **Deletion** — sign in and go to **Account → Your data → Close my account**. That page tells you, before you confirm, exactly which of your records will be deleted and which must be kept.

You can also email privacy@gig-blend.com from your registered address with the subject “Data rights request”. We aim to respond within one month, extendable for complex requests as permitted by law.

What closing your account deletes Immediately and permanently: - your sessions, on every device - your notifications and saved gigs - the bodies and attachments of messages you sent, and conversation previews - your name on any review you left (the review itself stays published — it is about the gig) - the recipient address and subject line on our record of emails we sent you - files you uploaded with a brief, and the free-text answers in your briefs

If you have never placed or fulfilled an order, your account record itself is deleted outright and nothing is kept.

What we must keep, and for how long If you have transacted, some records carry a retention duty we cannot waive. We keep those rows and replace your name and email address with a permanent tombstone — the record still adds up, but it no longer identifies you. This is not a choice we are making: UK GDPR Article 17(3) provides that the right to erasure does not apply where processing is necessary for compliance with a legal obligation or for legal claims.

• Orders, invoices, ledger entries and payouts — **6 years** (Finance Act 1998 Sch 18 para 21; Limitation Act 1980 s.5)
• Seller identity and earnings records for platform reporting — **5 years** (SI 2023/817)
• Security and admin audit records — **12 months**, with your address removed

Deliverable files and brief content are deleted **90 days** after an order settles, whether or not you close your account. §7 of the Privacy Notice lists every period in force.

Verification We may ask you to verify your identity before acting on a request that does not come through the signed-in controls above.

Complaints If unsatisfied, contact us first. You may also complain to the Information Commissioner’s Office (ico.org.uk).