Data Protection Policy

This policy sets out how UK Event Communications meets its obligations as a data controller under the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018. It sits alongside the Privacy Notice (which describes what we do with personal data from a user’s perspective) and the Terms of Use.

1. Scope

This policy applies to all personal data processed by UK Event Communications in connection with:

• The temporary event WiFi service we provide at events across the UK.
• Two-way radio and networking equipment hire to Customers.
• Engineering services (survey, planning, install, on-site support, de-rig).
• The marketing website at ukeventcommunications.co.uk.
• Internal records relating to suppliers, subcontractors and team operations.

2. Data controller status

UK Event Communications is the data controller for all of the above processing. We determine why and how personal data is processed.

We carry out our processing in line with UK GDPR and the Data Protection Act 2018. We co-operate with the UK Information Commissioner’s Office (ICO) on matters within its remit, including breach notifications and any enquiries.

Our details:

• Name: UK Event Communications
• Phone: +44 1482 693204
• Address: 1b George Street, Hedon, Hull, HU12 8JH
• Email: hello@ukeventcommunications.co.uk

3. The data protection principles

We process personal data in line with the six principles of UK GDPR (Article 5).

• Lawfulness, fairness and transparency. Every processing activity has a documented lawful basis, and we explain in plain English what we do.
• Purpose limitation. We collect data for specific, explicit and legitimate purposes only, and don’t reuse it for incompatible purposes.
• Data minimisation. We collect only what we need. The WiFi service is built around logging operational metadata, not identifying information.
• Accuracy. We keep records accurate where they matter and correct them on request.
• Storage limitation. We keep personal data only as long as we need it. Retention periods are published in the Privacy Notice.
• Integrity and confidentiality. We apply technical and organisational measures appropriate to the data and its sensitivity.

We are accountable for compliance and able to demonstrate it on request.

4. Data protection contact

We don’t currently have a statutory obligation to appoint a Data Protection Officer (we’re not a public body, our core activities don’t involve large-scale monitoring of individuals, and we don’t process special-category data at scale). We do have a named privacy contact responsible for data protection matters:

• Email: hello@ukeventcommunications.co.uk
• Phone: +44 1482 693204
• Address: 1b George Street, Hedon, Hull, HU12 8JH

5. Lawful bases for processing

Each processing activity is mapped to one of the six lawful bases in Article 6 UK GDPR:

• Contract (Art 6(1)(b)). For the equipment hire and engineering services we provide to Customers, and for managing supplier relationships.
• Legal obligation (Art 6(1)(c)). For accounting, tax and statutory records (HMRC), and for responses to valid law-enforcement requests.
• Legitimate interests (Art 6(1)(f)). For operating the WiFi service securely, monitoring for abuse, managing the network, responding to enquiries, and defending legal claims.
• Consent (Art 6(1)(a)). Only where we collect an optional email at the captive portal for event-related marketing.

We don’t process special-category data (Article 9) in the ordinary course of business.

6. Records of Processing Activities (ROPA)

We maintain a Record of Processing Activities documenting our processing as required by Article 30 UK GDPR. The ROPA covers, for each activity: the purpose, the lawful basis, the categories of data subjects and data, the categories of recipients, transfers outside the UK, retention period and security measures.

The ROPA is an internal document but we’re happy to discuss any entry with a Customer or regulator on request.

7. Privacy by design and default

We bake privacy into how the services work, not on top of them:

• The captive portal collects an email only where the event configuration includes one, and the field is always optional.
• MAC addresses and acceptance records are purged at the end of the event.
• DNS logs and protocol metadata are kept for a fixed 30-day window, then deleted.
• Long-term retention is anonymised, aggregate technical data only.
• We do not link individual devices to identifying information unless an email has been voluntarily provided.
• Operational data isn’t shared with third parties.

8. Data Protection Impact Assessments (DPIAs)

Where we’re considering a new processing activity that’s likely to result in a high risk to people’s rights and freedoms (Article 35 UK GDPR), we carry out a DPIA before starting. The DPIA describes the processing, assesses necessity and proportionality, identifies and mitigates risks, and records the outcome. We’ll consult with the ICO if a residual high risk can’t be mitigated.

Temporary CCTV always triggers a DPIA. Systematic monitoring of a publicly accessible area is listed by the ICO as high-risk processing, so we complete an assessment before any camera is deployed, jointly with the Customer as controller. It records the purpose of each camera position, what it covers and what it deliberately does not, the retention period, who may access footage, and the alternatives considered. A camera position that cannot be justified in that document does not get installed.

9. Data subject rights

The Privacy Notice describes the rights under UK GDPR available to individuals whose data we hold. They are:

• Right of access (Art 15)
• Right to rectification (Art 16)
• Right to erasure (Art 17)
• Right to restriction (Art 18)
• Right to data portability (Art 20)
• Right to object (Art 21)
• Rights related to automated decision-making (Art 22). We don’t use automated decision-making with legal or similarly significant effects.
• Right to withdraw consent (Art 7(3)), where processing was based on consent.

10. Subject Access Requests

A subject access request (SAR) can be made by emailing hello@ukeventcommunications.co.uk, by calling +44 1482 693204, by post to the address above, or in any other reasonable form. You don’t need to use a particular format, but please include enough detail for us to identify what you’re asking for.

Our process:

• We acknowledge receipt promptly.
• We verify identity where required, usually with confirmation of details we already hold. We won’t ask for more identification than we need.
• We respond within one month of receiving a verified request. For complex or numerous requests we may extend by up to two further months; if we do, we’ll tell you within the first month.
• There’s no fee unless the request is manifestly unfounded or excessive, in which case we’ll explain any reasonable fee or refusal.
• Where we hold relevant data, we provide a copy in a portable format where reasonably possible.

11. Data breach response

We treat any incident affecting the confidentiality, integrity or availability of personal data as a potential breach.

Our process:

• Containment as fast as possible.
• Assessment of risk to people’s rights and freedoms.
• Notification to the ICO within 72 hours of becoming aware of the breach, where it’s likely to result in risk (Article 33 UK GDPR).
• Notification to affected individuals without undue delay where the risk to them is high (Article 34).
• Documentation of the breach, its effects and the remedial actions taken, even where no notification is required.

12. Third-party processors

Where we use processors (sub-processors) to handle personal data on our behalf, we use written contracts that meet Article 28 UK GDPR. These bind processors to act only on our instructions, maintain confidentiality, apply appropriate security, support data-subject rights, notify us of breaches, and delete or return data at the end of the engagement.

We review our processor list periodically and remove processors that aren’t needed. A current, plain-English list of categories is published in the Privacy Notice and the Trust & Security page.

13. International transfers

The personal data we collect is processed primarily in the United Kingdom. Some providers we rely on (notably satellite and certain cloud services) operate infrastructure outside the UK or EEA, including in the United States. Where personal data is transferred outside the UK we ensure appropriate safeguards are in place under Chapter V UK GDPR. Typically the UK International Data Transfer Agreement (IDTA), the UK Extension to the EU Standard Contractual Clauses, or an applicable adequacy decision.

14. Security measures

We apply technical and organisational measures appropriate to the data and to the risks. Specific measures are described in the Trust & Security page and include:

• Access controls, role-based permissions and MFA on critical systems.
• Encryption in transit for all administrative interfaces.
• Logical separation of guest, vendor, organiser, staff and EPOS networks at events.
• UK-based mirror storage for operational data.
• Periodic review of access logs and security events.
• Vetting of suppliers and subcontractors who handle personal data.

15. Team training

Everyone in our team who handles personal data receives training on data protection appropriate to their role at onboarding and periodically afterwards. Engineers who work on captive portals and network logging receive specific training on what may and may not be inspected.

16. Review

This policy is reviewed at least annually and whenever there’s a material change to how we process personal data. The “Last updated” date at the top reflects the most recent review.

17. Complaints

If you believe we’ve handled your data in a way that doesn’t meet our obligations under UK GDPR, please email or call us first so we can put it right. You also have the right to lodge a complaint with the Information Commissioner’s Office at ico.org.uk.

18. Contact

Data protection queries, including SARs and breach reports:

• Email: hello@ukeventcommunications.co.uk
• Phone: +44 1482 693204
• Address: 1b George Street, Hedon, Hull, HU12 8JH