Privacy Policy

Ossia is a service for brass bands and deputy players across the UK. It is operated by Ben Churchill. When this policy says “we”, “us”, or “our”, it means Ossia.

For data protection purposes, Ossia is the data controller for the personal information described in this policy.

If you have questions or requests about your data, email privacy@ossia.uk.

We collect the following types of information:

• Account information - your name, email address, town or county, and the instruments you play.
• Band activity - the bands you belong to, your role (player or admin), and the dep requests your band posts.
• Communications - messages exchanged between you and other users on Ossia.
• Dep contact records - if a band admin adds you to their contacts list before you have an Ossia account, they may have entered your name, email address, and instrument. You will receive an invitation email explaining this, with the option to opt out.

We do not collect payment information, precise location, or any information unrelated to banding activity.

We use your information to:

• Operate your account and let you use Ossia.
• Match bands with dep players and send notifications about relevant dep requests.
• Send you messages from bands or players you interact with.
• Send transactional emails (account verification, dep request alerts, replies).

We process your data on the basis of legitimate interest (operating the service) and performance of a contract (your use of Ossia). Dep contact records added by band admins are processed under legitimate interest, based on the pre-existing relationship between a band and its deps.

We do not use your data for advertising and we do not sell it to anyone.

We share your data only with the services that power Ossia, all of which are bound by data processing agreements:

• Amazon Web Services (AWS) - hosting, database storage, authentication, and email delivery. Data is stored in AWS regions within the EU.

Your display name and instruments are visible to other Ossia users in the context of dep requests and band membership. Your email address is never shown publicly.

We do not share your data with any third party for marketing or commercial purposes.

• Account data - kept until you delete your account or request deletion.
• Messages and dep requests - kept while your account is active. Deleted with your account.
• Dep contact records - deleted when the band admin removes them, when you opt out, or when your account is deleted.

Under UK data protection law, you have the right to:

• Access - request a copy of the personal data we hold about you.
• Rectification - ask us to correct inaccurate information. Most account details can be updated directly in your profile.
• Erasure - ask us to delete your account and personal data.
• Restriction - ask us to limit how we use your data in certain circumstances.
• Portability - request your data in a portable format.
• Object - object to our processing of your data where we rely on legitimate interest.

To exercise any of these rights, email privacy@ossia.uk. We aim to respond within 30 days.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO).

Ossia uses session cookies for authentication only. These are strictly necessary for the service to work. We do not use tracking, advertising, or analytics cookies.

If we make significant changes to this policy, we will update the date at the top of this page. Continued use of Ossia after changes are posted means you accept the updated policy.

For any privacy-related queries or requests: privacy@ossia.uk