Privacy policy

Last updated: 18 July 2026

First Desk ("we", "us") connects amateur musicians with orchestras and ensembles across the UK. This policy explains what personal data we collect, why, and the rights you have over it. We are the data controller for the information described here. Questions and requests: privacy@first-desk.co.uk.

What we collect

Musicians:your email address, display name, the instruments you play, your experience level, and an approximate location. When you enter your postcode we store the postcode area's coordinates (a point covering roughly a street, not your exact address) so we can match you to groups within your chosen travel distance. We also store any applications and messages you send to groups.

Orchestras and ensembles:a contact email address, the group's name, town, website, rehearsal-area location, and the vacancies you post. The group's name, town, website, location, and vacancies are published publicly on this site — the contact email is not.

Everyone:account details (email, a securely hashed password — we can never see the password itself), and, if you arrived via one of our links, a short tag recording where you heard about us (e.g. "facebook").

What we use it for, and our lawful bases

Running the service (contract): matching musicians to vacancies by instrument and distance, showing your public listing (orchestras) or your profile to groups you apply to (musicians), and sending essential account email — verification, password resets, and updates about your applications.

Vacancy alerts and the weekly digest (legitimate interest): if you are a musician with a matchable profile we email you about nearby vacancies. Every such email has an unsubscribe link, and you can switch these off in your profile at any time.

Understanding what works (legitimate interest): we record which link brought you here so we know which communities to invest in. We do not use advertising trackers and we do not sell or share your data for marketing.

Who processes your data for us

We use a small number of service providers: Render (application and database hosting), Vercel (website hosting, plus its cookieless analytics which reports aggregate page statistics), and Resend (sending our emails). Some of these providers are US companies; transfers are covered by the UK extension to the EU–US Data Privacy Framework or the UK International Data Transfer Agreement. When you type a postcode we look it up via postcodes.io (a UK open-data service), and pages with maps embed OpenStreetMap, which receives your IP address like any embedded website content.

How long we keep it

Accounts that never verify their email address are deleted automatically after 30 days. Everything else is kept while your account exists and deleted when you delete your account. Vacancies, applications, and interest registrations belonging to a deleted account are removed with it.

Your rights

You can access, correct, export, and delete your data yourself: your profile page has edit controls, a "Download a copy of my data" button, and a "Delete my account" button that removes your data immediately and permanently. You also have the rights to object to or restrict processing, and to complain to the Information Commissioner's Office (ico.org.uk). For anything you can't do self-service, email privacy@first-desk.co.uk and we'll respond within one month.

Cookies and local storage

We use a strictly necessary session cookie to keep you signed in. We also store one small value in your browser ("where you heard about us") if you arrive through a tagged link; it is only ever attached to an account if you create one. We use no advertising or cross-site tracking cookies.

Age

You must be at least 13 to create an account on First Desk.

Changes

If we make material changes to this policy we will note it here and, for significant changes, email account holders. See also our terms of use.