Privacy Notice

This notice explains how UK Event Communications handles personal data across everything we do. The temporary event WiFi service, two-way radio and networking equipment hire, engineering services for event organisers, and visits to ukeventcommunications.co.uk. If anything in here isn’t clear, email or call us and we’ll talk it through.

1. Who we are

UK Event Communications (“UKEC”, “we”, “us”, “our”) is the data controller for personal data collected through the WiFi service, equipment hire, engineering services and this website. We carry out our processing in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Contact:

• Email: hello@ukeventcommunications.co.uk
• Phone: +44 1482 693204
• Address: 1b George Street, Hedon, Hull, HU12 8JH

We don’t have a statutory obligation to appoint a Data Protection Officer, but the named contact above is responsible for privacy matters and will handle any request or complaint.

2. Personal data we collect

The personal data we collect depends on how you interact with us. We’ve grouped it by role below.

2.1 Event WiFi Guests

When you connect to a temporary WiFi network we operate at an event, we log operational network data but no identifying information about you.

What we log:

• Device MAC address. Recorded while your device is connected so we can issue it an IP address. Held only for the duration of the event.
• Captive portal acceptance. Whether you tapped “agree”. Held only for the duration of the event, then purged.
• DNS requests made through our network resolver. The domain names devices look up. We use these to traffic-shape fairly, maintain QoS for critical services, and detect abuse or bad-actor behaviour.
• Protocol metadata and remote endpoints. The protocol used (HTTP, HTTPS, video streaming etc.) and the remote server the device connected to. Used to monitor capacity and the mix of traffic on the network.
• Aggregate technical data. The number of connected devices and the brands of devices on the network. Used for compatibility monitoring, capacity planning and roaming optimisation.
• Email address. Only where you choose to provide one in the captive portal, and only where the portal is configured to capture it. Optional. Where collected, this is the only piece of data we hold that could identify you as an individual.

What we don’t log:

• The content of your traffic. Messages, page contents, app payloads, payment data or anything else you send or receive.
• Identifying information beyond the optional captive-portal email. We don’t link DNS lookups, protocol metadata or device records to your name or any account.
• Persistent fingerprints, browser tracking signals or cross-event linking.
• Anything we don’t need to operate, secure or plan the network.

DNS resolver logging and traffic metadata logging happen at the network level. They’re used to operate the service and aren’t tied to individual people in our systems.

2.2 Customers and event organisers

When you engage us to hire equipment or provide services:

• Name, role and the organisation you act for.
• Business email, business phone and the address for delivery / install.
• Event details. Dates, location, expected attendance, layout, power and access information.
• Quote, contract and invoice records.
• Payment information. Bank transfer references, card payment confirmations. We don’t store full card numbers; payment processing is handled by regulated third parties.
• Correspondence with us before, during and after the event.

2.3 Suppliers and contractors

When you supply equipment, software or services to us, we hold name, business contact details, supplier records, contracts and invoices needed to manage the relationship.

2.4 Website visitors and enquirers

When you visit the marketing site or contact us:

• Standard server logs. IP address, user-agent, request paths, timestamps, referer.
• The content of any enquiry you send by email or contact form.

We use Plausible Analytics (analytics.enst.uk) for anonymous visitor statistics on both the marketing website and the captive portal. Plausible sets no cookies, stores no personal data, and does not build a profile of you or follow you across other sites. It counts visits; it does not identify visitors. We run no marketing or advertising tracking of any kind.

2.5 Two-way radio recording and metrics

Where the Customer has contracted our channel recording service alongside radio hire, we record audio from the staff channels we operate, for the duration of the event. Recordings are made available to the Customer’s nominated staff and to no one else. We require the Customer to inform people using the channel that calls are recorded as part of their pre-event briefing.

Regardless of whether audio recording is contracted, we record aggregate channel utilisation metrics for all radios we operate. Transmission counts, channel busy time, signal quality, technical performance. These are operational technical metrics and don’t identify individual radio users.

2.6 Temporary CCTV

Where the Customer has contracted temporary CCTV, we deploy and operate cameras on the event site. The footage captures images of people in the areas covered. That is personal data, and surveillance is higher-risk processing, so we treat it differently to everything else on this page.

• The Customer is normally the data controller for CCTV footage and we act as processor on their written instructions. Where that is not the case, it is agreed in writing before any camera is installed.
• Every camera has a documented purpose agreed before deployment. We decline camera positions that have no stated purpose, and positions covering places people would reasonably expect privacy.
• Signage is mandatory. Notices go at every entrance and in covered areas, stating that recording is taking place and giving a contact. We treat this as a condition of providing the service, not an optional extra.
• Retention is agreed in advance and enforced. Footage is deleted at the end of the agreed period unless it has been lawfully preserved for a specific incident, disclosure request or legal claim.
• Access is restricted to a named list agreed with the Customer. Views, exports and disclosures are logged with the reason and the person.
• Disclosure to police or other authorities is made on a lawful request, logged, and notified to the Customer unless we are legally prevented from doing so.
• We do not run analytics on footage. No facial recognition, no biometric processing, no automated identification of individuals.

If you have been recorded by a camera we operate and want a copy, or want it deleted, see section 10 on your rights. We will normally need to route the request to the Customer as controller, and we will tell you when we do.

3. Why we use it. Purposes and lawful bases

Under UK GDPR we must have a lawful basis for each purpose we use personal data for. Here’s ours:

• To provide the WiFi Service to Guests. We can’t hand out IP addresses, authenticate devices or route traffic without connection metadata. Lawful basis: legitimate interests (operating the network) and the Guest’s acceptance of the captive portal terms.
• To keep the network secure and healthy. Spotting misuse, abuse, faults and capacity issues. Lawful basis: legitimate interests.
• To provide equipment hire and engineering services. Quoting, scheduling, delivering, installing, supporting, invoicing and following up. Lawful basis: performance of a contract (or steps to enter into one) with the Customer.
• To send event-related emails to Guests who provided an email at the portal. Only with consent, and only where the captive portal was configured to collect for that purpose. Lawful basis: consent. You can unsubscribe at any time.
• To respond to enquiries from the website or by direct email. Lawful basis: legitimate interests / pre-contractual steps.
• To manage supplier and subcontractor relationships. Lawful basis: legitimate interests / performance of a contract.
• To meet legal, regulatory and tax obligations. Including HMRC record-keeping, statutory accounts, and responses to lawful requests from law enforcement, regulators or the courts. Lawful basis: legal obligation.
• To defend or pursue legal claims if a dispute arises. Lawful basis: legitimate interests / legal obligation.

4. Where the data comes from

• Directly from you. When you enter it into the captive portal, send us an enquiry, sign a quote, or talk to us.
• From our network equipment. Access points, routers and management systems generate connection metadata automatically.
• From web server logs for visits to the marketing site.
• From event organisers where they share contact details for the on-the-day site lead or supplier contacts.

5. Who we share data with

The operational data we log on the WiFi network (DNS requests, protocol metadata, MAC addresses, captive portal events, device counts) stays with us. It’s stored on the network equipment on site at events and mirrored to our secure servers in the United Kingdom. It is not shared with any third party.

Delivering the service does necessarily involve other parties handling either traffic or business records as part of how things work. Categories below, with what each one does:

• Internet upstream providers. Starlink (Space Exploration Technologies Corp.) for satellite, UK mobile carriers (EE, Vodafone, O2 and others) for 4G/5G backup. Internet traffic transits their networks because that’s how the internet works. We don’t share our operational logs or metrics with them.
• enhost.uk. UK-based hosting and email infrastructure for the marketing website, internal tooling and business correspondence.
• Plausible Analytics (analytics.enst.uk) for anonymous visitor statistics on the marketing website and the captive portal. Cookieless, no personal data stored, no cross-site tracking.
• Microsoft 365 (Office 365) for business email, document storage and productivity tools.
• Accounting, invoicing and payment processors for quotes, invoices, payments and statutory accounting records.
• Subcontractors and regional engineers, bound by confidentiality, where engaged to support a specific event.
• Event organisers may receive aggregated, anonymised usage data (e.g. peak concurrent device counts, total bandwidth used in a zone, top device-brand mix). We don’t share MAC addresses, DNS logs, or email addresses with organisers unless you’ve specifically consented.
• Law enforcement, regulators and courts, only where legally required (valid court order, warrant or statutory request).
• Professional advisers (accountants, insurers and legal advisers) where needed to run the business or defend a claim.

We don’t sell your data to anyone, ever.

6. International transfers

The data we collect is processed primarily in the United Kingdom. Some of the providers we rely on (notably satellite and cloud services) operate infrastructure outside the UK or EEA, including in the United States.

Where personal data is transferred outside the UK we ensure appropriate safeguards are in place. Typically the UK International Data Transfer Agreement, the UK Extension to the EU Standard Contractual Clauses, or an applicable adequacy decision. You can request more detail on a specific transfer by emailing or calling us.

7. How long we keep it

We keep personal data only as long as we need it for the purpose we collected it for, or as long as the law requires.

WiFi guest data:

• Captive portal acceptance and MAC address. Held only for the duration of the event, then purged.
• DNS query logs. Up to 30 days after the event for security and abuse investigation, then deleted.
• Protocol metadata and remote endpoints. Up to 30 days after the event, then deleted.
• Aggregate usage metrics (device counts, brand mix, throughput summaries). Retained as anonymised technical data to support future event planning. These don’t identify individuals.
• Email addresses captured at the captive portal. Until you unsubscribe, or 24 months of inactivity, whichever is sooner.

Radio service data:

• Audio recordings of staff channels (where contracted by the Customer). Per the Customer’s agreement, typically 30 to 90 days, then deleted.
• Channel utilisation metrics. Retained as aggregate technical data for future event planning.

Customer and business data:

• Customer records, quotes and contracts. 7 years after the end of the relationship (HMRC).
• Invoices and payment records. 7 years from the end of the relevant accounting year (HMRC).
• Email correspondence. While there’s an active conversation, then archived for up to 6 years.
• Supplier records. Active relationship plus 7 years.

Website data:

• Server logs. 30 days.

Where data is held beyond these defaults to defend a legal claim, the period reflects the relevant limitation period and is reviewed at least annually.

8. Cookies and tracking

The captive portal uses minimal session cookies required for the captive portal to function and for the network to authenticate your device. These aren’t used for tracking and they expire when the session ends. Our analytics set no cookies of any kind.

The marketing website sets no cookies at all and runs no advertising tags. Both it and the captive portal run Plausible Analytics for anonymous visitor statistics, and Plausible sets no cookies and stores no personal data. That is why there is no cookie banner on this site: there is nothing to consent to. Standard web server logs are kept for security and operational purposes (see retention above). If we ever add tools that do require consent, we’ll update this notice and add a banner.

9. Marketing communications

If you provided an email at the captive portal and the portal was configured to collect for event marketing, we’ll only send communications you can reasonably expect (event-specific follow-ups, future events of interest). Every email includes an unsubscribe link, and you can opt out at any time by replying to any email or emailing hello@ukeventcommunications.co.uk.

Customers and business contacts may receive operational emails (booking confirmations, quotes, invoices, on-site updates) as part of the contract or pre-contract relationship. These aren’t marketing. You can’t unsubscribe from these while there’s an active engagement, but you can ask to be removed once the relationship has ended.

10. Children

The marketing website is not directed at children under 13 and we don’t knowingly collect personal data from anyone under 13 through it.

The WiFi service is open at events where the organiser permits it. Parents and carers are responsible for the use of the WiFi by anyone in their care. We don’t set out to collect personal data from children at events. The email field at the captive portal is for adults to receive event updates, and where we become aware that an email was provided by a child, we’ll delete it on request.

11. Automated decision-making and profiling

We don’t use automated decision-making or profiling that produces legal or similarly significant effects on people. Network-level technical decisions (e.g. rate-limiting a device that’s consuming disproportionate bandwidth, blocking a device that’s scanning the network) are operational not commercial, and a human reviews any suspension that’s contested.

12. Security

We use technical and organisational measures appropriate to the data and to the risks of how we use it, including:

• Access controls and role-based permissions on our internal tools.
• Encryption in transit for all administrative interfaces.
• Strong passwords and multi-factor authentication on critical systems.
• Logical separation of guest, vendor, organiser and management networks (VLANs) at events.
• Regular review of access logs and security events.
• Vetting of suppliers and subcontractors who handle personal data.

If we become aware of a personal data breach that’s likely to result in risk to people, we’ll notify the ICO within 72 hours where required and inform affected individuals where the law requires.

13. Your rights under UK GDPR

Where we hold personal data about you, you have the following rights:

• Access. Ask us for a copy of the personal data we hold about you.
• Rectification. Ask us to correct data that’s inaccurate or incomplete.
• Erasure. Ask us to delete data we hold about you, subject to legal exceptions (e.g. statutory retention).
• Restriction. Ask us to limit how we process your data in certain circumstances.
• Objection. Object to processing carried out under legitimate interests, including direct marketing.
• Data portability. Receive the data you provided in a portable, machine-readable format.
• Withdraw consent at any time, where processing was based on consent. Withdrawing consent doesn’t affect processing already carried out.

14. How to exercise your rights

Email hello@ukeventcommunications.co.uk or call +44 1482 693204 with what you’d like to do. We may need to verify who you are before acting on a request. That protects you from someone else asking for your data. We’ll respond within one month of receiving a verified request, or let you know if we need an extension (we can extend by two more months for complex requests). There’s no charge unless your request is repetitive or excessive, in which case we’ll explain the reasonable fee.

15. Complaints

If you’re not happy with how we’ve handled your data please email or call us first so we can fix it. If you’re still unhappy, you can complain to the UK Information Commissioner’s Office:

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

16. Changes to this notice

We may update this notice from time to time. The latest version always lives at this URL, and the “Last updated” date at the top reflects the most recent change. Where changes are material (affecting why we use your data, who we share it with, or your rights), we’ll flag them at the next reasonable opportunity, for example in a follow-up email to people on our list.

17. Contact

Privacy enquiries, requests and complaints:

• Email: hello@ukeventcommunications.co.uk
• Phone: +44 1482 693204
• Address: 1b George Street, Hedon, Hull, HU12 8JH