TUC Congress Privacy Notice
At the
We are committed to:
- collecting and using your data in a way that you would reasonably expect, in line with relevant data protection / privacy legislation
- providing you with clear and transparent information about how we use your personal data, what we use it for and what your rights are in relation to this
- only using your data for the purposes described in this document.
This notice explains:
- what personal data we collect about you for Congress and the lawful basis for this
- how we use this data
- how long we keep the data
- who we share your data with
- how we protect your data
- your rights, and how to enact them in relation to the personal data we hold about you.
This privacy notice applies to everyone who attends Congress – delegates, stewards, exhibitors, visitors (including media, external speakers, sponsors and guests), contractors and fringe organisers. It is important you read and understand this notice so you are aware of how and why we use your data.
You should also read the TUC’s main privacy notice (https://www.tuc.org.uk/tuc-privacy-notice), which explains how we use your data for activity outside of annual Congress, including case studies you provide at Congress and signing up to receive information about TUC campaigns.
About the
The Trades Union Congress (
If you have any queries about how we gather, and use your personal data then you can get in touch with our data protection officer via email on info@tuc.org.uk (please put ‘for the attention of the data protection officer’ in the subject line of your email) or by post at:
Data Protection Officer
Trades Union Congress
Congress House
Great
Your privacy rights
You have a number of rights (although not all are absolute rights and some may be subject to a few legal exemptions) relating to your personal data. You have the right to:
- be informed about the collection and use of your personal data (e.g. in this privacy notice)
- object to the processing of your data where we are relying on our legitimate interests as the legal basis for processing
- withdraw your consent at any time
- ask us to change incorrect or incomplete data
- ask us to delete your personal data where it is no longer necessary for us to use it, when you have withdrawn consent, or where we have no lawful basis for keeping it
- ask us to restrict the personal data we use about you where you have asked for it to be deleted or where you have objected to our use of it
- ask us to provide you or a third party with some of the personal data we hold about you in a structured, commonly used, electronic form, so it can be easily transferred
- request access to a copy of your personal data, along with information on what personal data we use, why we use it, who we share it with, how long we keep it for and whether it has been used for any automated decision making. You can make a request free of charge by contacting our Data Protection Officer in writing at the address above. Please provide us with evidence of your identity
- not be subject to a decision based solely on automated processing, including profiling
- make a complaint to us about how we have used your personal data.
To learn more about these rights please see the Information Commissioner’s Office website https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/
If you would like to exercise any of these rights, please contact the data protection officer by post or email as detailed above. We will need to ask you to confirm your identity before we can deliver on a number of these rights.
The personal data that you supply with your enquiry/complaint may be retained by us for the purposes of processing your enquiry/complaint, and for statistical and audit purposes and will be stored in accordance with our standard procedures.
If you believe that we have not complied with your data protection rights, you can complain to the Information Commissioner’s Office (the regulator for privacy and data protection legislation). The Information Commissioner’s Office (ICO) can be contacted at:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Tel: 0303 123 111
What do we do with the information you give us?
We need to collect and process personal data relating to everyone who attends Congress in order to plan a safe and well-managed event. This information is used to:
- register you for Congress, so you receive credentials that allow entry
- communicate with you about attending Congress in advance and during Congress
- communicate with you about TUC campaigns (see the TUC’s main privacy notice https://www.tuc.org.uk/tuc-privacy-notice).
- organise any tailored requirements you have for attending Congress such as access or childcare requirements (delegates only)
- undertake anonymised equality monitoring (delegates only)
- make a record of your attendance, in service of the TUC’s democratic structures (delegates only)
- fulfil our contractual obligations to you (exhibitors, fringe organisers and sponsors only)
- manage the employment or contracting relationship with you (stewards and contractors)
- retain a central approved attendees record for emergency situations
We may be required to transfer your data outside the European Economic Area. The information you provide is held securely by us and/or our data processors (whether the information is held in an electronic or physical format).
What information do we need to collect from you?
We only collect information that we need to manage your registration and attendance at Congress, and fulfil TUC requirements around equality monitoring.
The information we collect could include:
- your name, and contact details, including postal and email address, and telephone number
- photograph
- your union membership (delegates, union visitors and stewards only)
- your employer, position or sponsoring organisation (everyone except delegates)
- your accessibility and childcare requirements (delegates only)
- the name and age of any children accompanying you to Congress (delegates only)
- equality monitoring information, including information about your ethnic origin, sex, gender identity, age, sexual orientation and whether you consider you have a disability (delegates only)
- information about your work history and union career, to form a case study (delegates only)
- your bank details (stewards and contractors)
- your IP address and how you use our websites and online registration, captured via Google Analytics
- data on how you respond to emails that we send you
- the content of interventions that you make as a speaker at Congress or audience participant in filmed events
- your contribution to any campaign events at Congress
- your image as part of filmed or photographed records of Congress
- your social media identity
We collect this information from:
- you (if you register yourself)
- your union (if a union staff member registers you or if your union shares accessibility or childcare information about you with us)
- your company or sponsoring organisation (if your company or sponsoring organisation registers you)
Data is stored in the TUC’s registration database provided by Jonas Event Technology, by our AV production company QED Productions, in the TUC’s email provider Mailchimp and in other IT systems (eg the TUC’s staff email system and internal server).
Why do we need to process your personal data?
We process your data under the ‘contract’ lawful basis for processing, for the following purposes:
- to register you for Congress
- to send you information by post, email or SMS to help make Congress a successful event for you
- to respond to queries about your registration and attendance
- to ensure there are reasonable adjustments in place to facilitate your participation at Congress (eg in relation to access requirements)
- to ensure childcare provision is in place to support your attendance at Congress
- to share information about your access and childcare requirements with your union so that they can help meet your requirements too
To provide you with services related to Congress, we may sometimes need to contact you. That would most likely be by email, but could be by post, telephone, instant message or SMS text message, depending on the situation. For example, we may contact you by SMS in case of an emergency situation happening at Congress, or by telephone or email if it appears you are having problems registering for Congress.
In some cases, we need to process data to ensure we are complying with our legal obligations, which are binding on us. We only do this when strictly necessary. We also process your data to respond to and defend against legal claims.
We have a legitimate interest in processing personal data before, during and after Congress. Processing your data under legitimate interest allows us to:
- take photos of groups of people at Congress to use during and after the event.
- to display your name and union on screen if you speak at Congress
- to list your name and union in the Congress Report if you speak at Congress
- to publish your name and union in the list of attendees at Congress in the Congress Guide and Congress Report
- to seek your feedback on Congress
- analyse the performance of different aspects of Congress, with a view to evaluation and improving our events for the future
- analyse the performance of our online communications about Congress, with a view to tailoring communications to be more relevant to different users
- understand opinions voiced about Congress online and on social media, and answer questions about Congress
Where we rely on our legitimate interests as a reason for processing data, we have considered whether or not those interests are overridden by the rights and freedoms of attendees at Congress and have concluded that they are not.
Please note that other delegates, broadcasters and professional photographers make take pictures or film of delegates during Congress. Concerns about this should be raised with the delegate or visitor concerned in the first instance.
The following are examples of where we use consent to process your data:
We write news about Congress on our website and social media, so it may be that we publish information that mentions you, or a picture that includes you. We will seek to get your consent to publish any case study content or portrait that identifies you personally, and you have the right to request we remove it at a later date. Contact our Data Protection Officer if you have concerns or questions about this.
Some special categories of personal data, such as information about health or medical conditions, are processed to carry out our obligations in relation to attendees with disabilities, and for health and safety purposes. Information about trade union membership is processed to allow us to fulfil statutory requirements in relation to the workings of Congress.
Where we process other special categories of data, such as information about ethnic origin, disability, age, gender identity, sexual orientation and gender, this is for diversity monitoring purposes. Data that we use for these purposes is separated from your contact details for analysis. You are entirely free to decide whether or not to provide this data and there are no consequences of deciding not to supply the data.
Where we obtain information concerning certain “special categories” of sensitive data such as health information, extra protections apply under the data protection legislation. We will only process this data by your consent, unless we can lawfully process it for another reason permitted by the legislation. You have the right to withdraw your consent to the processing at any time by notifying us in writing. But if you do not give consent, or subsequently withdraw it, we may not be able to make decisions based on it, including decisions which could support your participation at Congress.
Who has access to your data?
If you are a delegate we may share your data with your union, in order to ensure that we meet any childcare and access requirements.
We also share your data with third parties that process data on our behalf as listed below.
Your data may be transferred outside the European Economic Area (EEA) where we have satisfied ourselves that the appropriate safeguards are in place. By submitting your personal data you agree that we may transfer, store and process your information outside of the European Economic Area.
We may need to disclose your information to regulatory bodies, government bodies, or law enforcement agencies. This will be upon request only, and only when required to do so in order to satisfy legal obligations which are binding on us.
How do we protect your data?
We take the security of your data seriously. We have policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by relevant staff or agencies in the proper performance of their duties.
Access to systems that contain personal data are restricted by role and the systems are password protected.
We have a number of data processors involved in processing personal data in relation to Congress. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do so in writing. They are obliged to implement appropriate technical and organisational measures to ensure the security of your data. They will not share your personal information with any organisation apart from us. They will only retain your data for the period we instruct.
Jonas Event Technology (JET)
JET provide our registration system. This holds the following information:
- your name, and contact details, including postal and email address, and telephone number
- photograph
- your union membership (delegates and union visitors only)
- your employer or sponsoring organisation (everyone except delegates)
- your accessibility and childcare requirements (delegates only)
- equality monitoring information, including information about your ethnic origin, sex, gender identity, age, sexual orientation and whether you consider you have a disability (delegates only)
- information about your work history and union career (delegates only)
Here is a link to their privacy notice: https://jonas.events/legal/privacy
Mailchimp
Your email address is contained within the Mailchimp system in order for us to deliver communications about Congress and about TUC campaigns. Here is a link to their privacy notice: https://mailchimp.com/legal/privacy/
QED Productions
We pass your name and union to QED Productions in order for them to display this information about speakers on screen during Congress. Here is a link to their privacy notice: http://www.qed-productions.com/privacy-policy
Photography
We contract a number of freelance photographers during Congress to take photos of speakers and delegates. If you have any queries about how our contracted photographers use your data, please contact the TUC information stand.
How long do we keep your data?
We do not retain your data for longer than is necessary. Our retention periods are:
|
Data type |
Retention period |
|
Registration data as listed above about all types of attendees at Congress |
Kept until October of the year following the relevant Congress (ie for Congress in September 2018, from date of collection until October 2019) |
|
Equality monitoring data about delegates to Congress |
Separated from contact data for analysis by October immediately following Congress |
|
Photographs of groups of attendees at Congress |
In perpetuity |
|
Name and union of delegates attending Congress, listed in the Congress Guide and Congress Report |
In perpetuity |
|
Name and union of all speakers at Congress, listed in the Congress Report |
In perpetuity |
|
Case studies |
|
|
Email address, mobile phone number and localisation information, if opted in to receive info about TUC campaigns |
|
|
Rota for stewards |
Kept until October of the year following the relevant Congress (ie for Congress in September 2018, from date of collection until October 2019) |
|
Invoices / payment data processed by TUC staff to include union visitors, freelancers, stewards, companies, charities and all others who have been involved in a financial transaction in relation to Congress |
Retained for a maximum of 10 years |
|
Name, address, email and phone numbers of individuals and representatives of organisations who the TUC may approach to sponsor, exhibit at or provide services for future Congress events |
Retained for two years |
|
Data about your children, provided to us in order to arrange childcare during Congress |
Deleted after Congress |
Do we use automated decision-making tools?
Currently no decisions about Congress attendees involve automated decision-making.
Changes to this policy
We keep our privacy notice under regular review. Any changes we make to our privacy notice will be advertised through appropriate channels (e.g. TUC website).
This policy was last updated on 11 June 2018.