Privacy Policy & Data Protection Statement

At Change Underground, we value your privacy and want to be clear about the data we collect, how we use it and your rights to control that information, which is why we have implemented strict updates to our Privacy Policy.

We made these updates to reflect the high standards established by the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. Because we believe all readers of https://change-underground.com have the right to these rigorous standards of protection, we implement these compliance measures globally.

We respect your personal data. We have never and will never sell it to third parties.

By using this site or our services, you consent to the processing of your personal data as described in this Privacy Policy. This policy is an integral part of our Terms and Conditions; by agreeing to our Terms and Conditions, you also agree to this policy. In the event of a conflict between terms used in the Terms and Conditions and this Privacy Policy, the latter shall prevail.

Context & Overview

Key Details:
Policy originally prepared by: Mark Betteridge
Last systematically reviewed and updated: 20 May 2026
Policy operational lead: Jamie Reed (Editor-in-Chief)

Introduction

Change Underground needs to gather and use certain information about individuals. This can include customers, suppliers, business contacts, contributors, readers and other people the organisation has a relationship with or may need to contact.

This policy describes how this personal data must be collected, handled and stored to meet the publication’s data protection standards and to comply fully with UK and international law.

Why This Policy Exists

This data protection policy ensures Change Underground:

• Complies with data protection law and follows definitive journalistic best practice regarding user data.
• Protects the rights and data of staff, customers, readers and partners.
• Is entirely transparent about how it stores and processes individuals’ data.
• Protects itself from the risks of data security breaches.

Data Protection Law

The UK GDPR and the Data Protection Act 2018 describe how organisations – including Change Underground – must collect, handle and store personal information. These rules apply regardless of whether data is stored electronically, on paper or via secure cloud systems.

To comply with the law, personal information must be collected and used fairly, stored safely and not disclosed unlawfully. Core principles dictate that personal data must:

• Be processed fairly, lawfully and transparently.
• Be obtained only for specific, explicit and legitimate purposes.
• Be adequate, relevant and limited to what is necessary.
• Be accurate and, where necessary, kept up to date.
• Not be kept in a form which permits identification of data subjects for longer than is necessary.
• Be processed in a manner that ensures appropriate security of the personal data.

The Right to be Forgotten: You hold the absolute right to request that your personal data is permanently deleted or restricted from our operational systems.

People, Risks and Responsibilities

Policy Scope

This policy applies to the main operations of Change Underground, including all editorial desks, staff, volunteers, contractors, suppliers and any persons working on behalf of the publication.

It applies to all data the company holds relating to identifiable individuals, including:

• Names of individuals
• Postal and billing addresses
• Email addresses
• Telephone numbers
• IP addresses, device tracking identifiers and automated metadata attributes

Responsibilities

Everyone who works for or with Change Underground carries individual responsibility for ensuring data is handled appropriately in accordance with compliance frameworks. However, key operational areas are segmented as follows:

• The Owner (Mark Betteridge) is ultimately responsible for ensuring that Change Underground meets its overarching structural and legal obligations.
• The Data Protection Officer (Jamie Reed) is responsible for the daily execution of our compliance mandate. This includes handling data protection queries from staff or readers, dealing with formal Subject Access Requests (SARs), checking data agreements with third-party partners, and reviewing editorial compliance schedules.
• The IT Infrastructure Lead (Mark Betteridge) is responsible for ensuring all servers, databases, security hard points, firewalls and encryption protocols meet high-tier industry safety standards. This includes maintaining automated backup routines and evaluating security compliance on third-party integrations.
• The Data Marketing Lead (Jamie Reed) is responsible for approving data protection statements attached to promotional communications, newsletters, and reader feedback flows, ensuring all marketing footprints strictly abide by opt-in mechanisms.

General Staff Guidelines

The only people authorised to access data covered by this policy are those who strictly require it to execute their professional workflows. Data must never be shared informally. Employees must use complex passwords and multi-factor authentication where available, and screens must be locked immediately when workstations are left unattended.

How We Use Your Personal Data

Change Underground processes data across distinctly defined user categories:

• Readers & Subscribers: Subscribers and newsletter readers are only contacted via email if they have actively and explicitly completed a double-opt-in tracking action.
• Commercial Partners & Advertisers: Customers and business clients agree to be contacted with transactional data, invoicing requirements, and crucial project milestones relevant to their commercial campaigns.
• Polls & Public Curation Panels: Voters participating in our public charts or tracking polls must consent to the collection of verification data (including names, emails, locations, and device footprints) to protect our editorial metrics from structural manipulation or automated botanical infiltration.

Data Storage and Security Protocols

When data is stored electronically, it is protected against unauthorised access, malicious hacking attempts, and accidental corruption. We implement secure transport pathways (such as HTTPS), along with rigorous database firewalls. Anonymisation and pseudonymisation protocols are deployed across reader datasets wherever applicable. Data is never saved locally to unencrypted mobile devices or laptops.

Cookies and Tracking Architecture

This website utilises cookies and analytical software to tracking usage patterns and enhance on-site user experiences. Cookies can be removed or rejected via your individual browser architecture without losing access to primary editorial content.

We segment cookies into the following operational nodes:

• Necessary Cookies: Required for fundamental site operations, user logins, and core interface rendering. They do not track personal identifying data.
• Functionality Cookies: Used to recognise your preferences, such as auto-filling name and email credentials on comment sheets to improve user workflow.
• Analytics Cookies: Track baseline traffic volume, reading footprints, and technical execution metrics to help us optimize server distribution. We use Google Analytics for these tasks. You can review their data handling models or actively choose to apply the Google Analytics Opt-out Browser Add-on at any time.
• Advertising Cookies: Managed alongside third-party ad networks to ensure displayed commercial campaigns are contextually relevant to our underground music audience and to limit repetitive ad exposure.

To control wider third-party cookies globally, users can manage parameters via optimization tools like optout.aboutads.info or youronlinechoices.com.

Data Accuracy and Subject Access Requests (SAR)

We keep central records clean and limited to minimal, essential datasets. Data sets are primarily contained within our direct secure WordPress database, alongside verified campaign distribution partners (such as Mailchimp or Inflyte).

Your Explicit Rights Under GDPR:
You maintain the right to information, access, rectification, erasure, restriction of processing, data portability, and the right to object to processing or automated decision-making.

If you wish to invoke a formal Subject Access Request or exercise your Right to be Forgotten, requests must be submitted directly to our Data Protection Desk at data@change-underground.com. Our desk processes verified requests within 14 business days without administrative charge.

Contact Information

Data Protection Officer & Newsroom Lead
For questions regarding your personal data rights, processing parameters, or policy details, direct communications to Jamie Reed at:
Email: data@change-underground.com

Editorial Infrastructure & Ownership
For structural corporate compliance issues, direct queries to Mark Betteridge at:
Email: mark@change-underground.com

Supervisory Authority Coordination
If you are located in the UK, your data rights are overseen by the Information Commissioner’s Office (ICO). For European territories, complaints can be registered alongside the relevant regulatory framework:
Email: info@dataprotection.ie | Phone: +353 57 868 4800

Changes to This Privacy Policy

We reserve the right to apply operational modifications to this policy framework as technology and editorial infrastructure demands shift over time.
Document baseline modified and authenticated: May 20, 2026.