LTUX Brighton Ltd is a company limited by guarantee, registered in England and Wales. Registered number: 16332702. Registered office: 83 Queens Road, Brighton, BN1 3XE.
Any profits are reinvested back into the continued operation of LTUX Brighton, as a professional community of practice. LTUX Brighton also operates as Let's Talk UX.
This privacy policy tells you what to expect us to do with your personal information.
Summary of changes since last version dated (30th October 2025):
- Talk UX conference specific information has been removed.
- Eventbrite has been removed as a scheduling site.
- Update to information about Let's Talk UX webinars.
Contact details
Our Data Protection Officer
Our Data Protection Officer (DPO) is Fiona MacNeill. You can contact Fiona at fiona.macneill@gmail.com. Please ensure that you address the email to ‘Data Protection Officer’.
What information we collect, use, and why
We collect or use the following information to provide services for those who acquire tickets or register for our events:
- Names and contact details
- Addresses
- Pronoun preferences
- Accessibility needs
- Dietary requirements
- Transaction data (including details about payments to and from you and details of products and services you have purchased)
- Usage data (including information about how you interact with and use our website, products and services)
- Information relating to compliments or complaints
We also collect or use the following information for services for those who acquire tickets or register for our events:
- Disability
- Gender identity
- Racial or ethnic origin
- Religious or philosophical beliefs
- Sexual orientation information
This information is collected on an opt-in basis with informed consent as outlined in the next section. This information enables us to ensure that we are serving individuals who are underrepresented in the technology careers and technology-related industry.
We collect or use the following information to receive donations or funding and organise fundraising activities:
- Names and contact details
- Addresses
- Donation history
We collect or use the following personal information for service updates or marketing purposes:
- Names and contact details
- Marketing preferences
- Website and app user journey information
- Records of consent, where appropriate
We collect or use the following personal information for research or archiving purposes:
- Names and contact details
- Records of consent, where appropriate
We also collect or use the following information for research or archiving purposes:
- Disability
- Gender identity
- Racial or ethnic origin
- Religious or philosophical beliefs
- Sexual orientation information
This information is collected on an opt-in basis if you choose to take part in research. The lawful basis for collecting this information will always be with informed consent as outlined in the next section.
We collect or use the following personal information for volunteer recruitment purposes:
- Contact details (e.g., name, address, telephone number or personal email address)
- Employment history (e.g., job application, employment references or secondary employment)
- Education history (e.g., qualifications)
We collect or use the following personal information for dealing with queries, complaints or claims:
- Names and contact details
- Correspondence
Lawful bases and data protection rights
Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.
Which lawful basis we rely on may affect your data protection rights, which are in brief set out below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:
- Your right of access — You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. You can read more about this right here.
- Your right to rectification — You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. You can read more about this right here.
- Your right to erasure — You have the right to ask us to delete your personal information. You can read more about this right here.
- Your right to restriction of processing — You have the right to ask us to limit how we can use your personal information. You can read more about this right here.
- Your right to object to processing — You have the right to object to the processing of your personal data. You can read more about this right here.
- Your right to data portability — You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. You can read more about this right here.
- Your right to withdraw consent — When we use consent as our lawful basis you have the right to withdraw your consent at any time. You can read more about this right here.
If you make a request, we must respond to you without undue delay and in any event within one month.
To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.
Our lawful bases for the collection and use of your data
Services for those who acquire tickets or register for our events
- Consent — we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
- Contract — we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
- Legitimate interests — we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
- Collecting preferences at registration will allow us to improve our services and to enhance the experiences of those attending our events.
Receive donations or funding and organise fundraising activities
- Consent — we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
- Contract — we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
- Legal obligation — we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
- Legitimate interests — we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
- When we are engaging organisations and individuals to gauge interest in sponsorship. Particularly in the case of small businesses and individual donors, sometimes a personal email will be used for initial contact through referral or by consent of the sponsor/donor. We will check the sponsor/donor’s contact preferences and use their preferred email address for continued correspondence.
- When we are engaging in crowdfunding and subscriptions, we use a third-party tool including Crowdfunder and Ko-Fi, which enable small donations and recurring memberships from individuals and organisations. We use these tools on an opt-in basis, gaining consent for the use of personal information as part of account sign-up. The sponsor/donor is also asked to define their communication preferences within the third-party tool as part of account setup.
Service updates or marketing purposes
- Consent — we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Research or archiving purposes
- Consent — we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Volunteer recruitment purposes
- Consent — we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Dealing with queries, complaints or claims
- Consent — we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
- Contract — we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
- Legal obligation — we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Where we get personal information from
- Directly from you
- Publicly available sources
- Suppliers and service providers
- Third parties: via online services, based on opt-in and/or informed consent. Users enter their own information into these services.
- Crowdfunder
- EmailOctopus
- FreeAgent
- Google Apps and Google Workspace
- Ko-Fi
- Luma
- Microsoft Teams Webinars
- Slack
- Stripe
- SumUp
- Ticket Tailor
The links above will take you to the appendix where we have included further information about each of these third-party services and any checks we have conducted on their business practices.
How long we keep information
| Information types | Description | Retention period |
|---|---|---|
| User research (e.g. community questionnaires, post-event surveys) · Volunteer/speaker sign-up form · Call for talks/proposals | Surveys, questionnaires, and interest forms. We typically collect user research anonymously. Where we do collect contact information e.g. volunteer/speaker form, the retention schedule will be clearly stated on the form. | 1 year |
| Original videos and audio recordings from talks (unedited) | Complete recordings of talks, presentations, and workshops in their raw form. | 1 year |
| Ongoing ticket purchases and event registrations | Information entered as part of event registration (paid tickets or free registration). | We retain this information for archival purposes. Subscription is opt-in and can be cancelled at any time by the individual or by request by contacting us. We retain transaction data for annual reporting and tax purposes. This does not affect your rights, so please contact ltuxbrighton@gmail.com if you would like us to remove your information from our systems. |
| Crowdfunding, paid subscriptions, collaboration tools (e.g. Slack) | Crowdfunding donations, recurring paid subscriptions, and associated contact details. | We must retain high-level information for tax-related reasons. Subscription is opt-in and can be cancelled at any time by the individual or by request by contacting us. |
| Sponsorship and donation records | A history of sponsorships, donations and associated contact details. | We must retain this information for tax-related reasons. In case of any queries, please contact us. |
| Newsletters · Let’s Talk UX Newsletter | Let’s Talk UX newsletters which you have optionally subscribed to yourself. | LTUX Brighton — retained until you unsubscribe. When you unsubscribe, we delete your email address within 1 month. |
| Edited talks and presentations in full · Edited compilations of audio, video, photos | Edited videos and audio podcasts created based on recordings made at our events. | These are retained indefinitely or until such time as they are out of date. This does not affect your rights, so please contact ltuxbrighton@gmail.com if you would like us to remove a video or podcast from our platforms. |
| Photo albums per event | Our photo library contains photos from each event as an archive of our activities. It is used by our volunteers to source publicity images for future events and for us to keep a record of the group’s events and history. | These are retained indefinitely for our archives. This does not affect your rights, so please contact ltuxbrighton@gmail.com if you would like us to remove a historical photo from our archives. |
| Contact details for MS Teams webinars | The customer enters their name and email address as part of signing up for the MS Teams webinars. Most webinars are now streamed to LinkedIn and YouTube, so sign-up information is only held in Luma. | This information is held by Macknowlogist to provide the webinar service. Macknowlogist receives no commercial benefit from the event and is providing webinar services pro bono. |
Who we share information with — data processors
Crowdfunder Crowdfunding / Donation Software
Allows for the management of micro-funding donations and donor information when we run crowdfunding campaigns.
EmailOctopus Email Newsletters
Management of our newsletter contact lists for the Let’s Talk UX newsletter.
FreeAgent Accountancy Software
Management of sponsorship contact details and donation history for tax purposes. For business sponsorships and larger sum individual donations we must retain records and contact details. Smaller donations are managed via crowdfunding platforms.
Google Apps and Google Workspace Calendar, Documents, Email, Surveys, Forms
Management of emails, calendar invites for organising, and forms for collecting data in the form of surveys from our community and event attendees. We also use Google Docs and Sheets for managing certain types of information related to organising for the LTUX Brighton group and for our events.
Ko-Fi Micro-donations and subscriptions
Allows us to accept small donations from our community and event attendees. This involves management of sponsorship and donation history. At some point Ko-Fi may be used to manage a small subscription to help offset the costs of running Let’s Talk UX.
Luma Event calendar and event registrations
Allows us to collect interest in our events using a shared calendar. It also allows us to accept and manage registrations, contact details, dietary, and accessibility requirements for attendees at our free events.
Microsoft Teams Webinars — Macknowlogist Ltd. Selected Webinars
Provides webinar sign-up links for some Let’s Talk UX events. You can review Macknowlogist’s privacy policy here. Data is used in order to provide the webinar service outlined in the table above.
Notion Documentation and databases
Manage our internal organising information, branding, and sponsorship contacts, historical sponsorship records and finances. Notion allows us to control who has access to different pieces of information and we routinely audit access permission based on membership of the core organising group.
Slack Online community and communications
Allows us to run our closed membership group, including community discussions and information sharing. Joining Slack is opt-in; some of our members choose not to join. In these cases we use our newsletter (EmailOctopus) to stay connected with these members and also supportive allies who subscribe.
Stripe Online ticket payments and merchandise sales
Processes payments and contact details for event tickets and merchandise payments. These purchases will largely be managed via Ticket Tailor, however physical merchandise may be sold using a separate card reader system (SumUp).
SumUp In-person card and digital wallet payments
Processes in-person card and digital wallet payments for us at events. This includes contact details for the purposes of emailed receipts.
Sharing information outside the UK
Where necessary, our data processors may share personal information outside of the UK. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place.
For further information or to obtain a copy of the appropriate safeguard for any of the transfers below, please contact us using the contact information provided above.
Crowdfunder
Category of recipient: Crowdfunding / Donation software
Country the personal information is sent to: unspecified outside the United Kingdom (UK) and European Economic Area (EEA) via third party service providers.
How the transfer complies with UK data protection law: “If we transfer your information outside of the UK and EEA in this way, we will take steps to ensure that appropriate security measures are taken with the aim of ensuring that your privacy rights continue to be protected as outlined in this policy. These steps include imposing contractual obligations on the recipients of your personal information or ensuring that the recipients are subscribed to ‘international frameworks’ that aim to ensure adequate protection.”
Source: crowdfunder.co.uk/privacy-policy
EmailOctopus
EmailOctopus is based in the UK and do not transfer information beyond the European Economic Area (EEA).
Source: EmailOctopus DPA
FreeAgent
Category of recipient: Accountancy software
Countries the personal information is sent to: European Union, United States, India
How the transfer complies with UK data protection law: Addendum to the EU Standard Contractual Clauses (SCCs)
Source: freeagent.com/privacy/general-privacy-notice
Google Apps and Google Workspace
Category of recipient: Email, Calendar, Surveys, Forms, Photo archive
Countries the personal information is sent to: Unspecified, information may be processed on servers located outside of the UK.
How the transfer complies with UK data protection law: UK Extension to the EU–U.S. Data Privacy Framework
Source: policies.google.com/privacy/frameworks
Ko-Fi
Category of recipient: Micro-donations and subscriptions
Countries the personal information is sent to: unspecified, but through disclosure of data to third parties, e.g. payment processors, authentication, and video providers as outlined in their privacy agreement.
How the transfer complies with UK data protection law: Standard Contractual Clauses endorsed by the UK Government or European Commission
Source: more.ko-fi.com/privacy
Luma
Category of recipient: Event calendar and event registrations
Countries the personal information is sent to: United States
How the transfer complies with UK data protection law: United Kingdom International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses for international data transfers (UK SCC Addendum).
Sources: lu.ma/privacy-policy & lu.ma/dpa
Microsoft Teams Webinars and Microsoft Stream
Category of recipient: Webinar sign-ups, video hosting, and interactions
Countries the personal information is sent to: United Kingdom
How the transfer complies with UK and EU data protection law: EU Data Boundary
Sources: Microsoft Privacy and Security Terms & Microsoft data residency
Notion
Category of recipient: Documentation and databases
Countries the personal information is sent to: United States and other unspecified countries.
How the transfer complies with UK data protection law: UK Extension to the EU–U.S. Data Privacy Framework
Source: Notion privacy policy
Slack
Category of recipient: Online community and communications
Countries the personal information is sent to: United States and other unspecified countries.
How the transfer complies with UK data protection law: Standard Contractual Clauses approved by the European Commission (and the equivalent standard contractual clauses for the UK, where appropriate)
Source: slack.com/trust/privacy
Stripe
Category of recipient: Online ticket payments, merchandise sales, sponsorship payments
Countries the personal information is sent to: European Union, United States, India (full list of sub-processors at the Stripe website).
How the transfer complies with UK data protection law: UK International Data Transfer Addendum
Source: stripe.com/gb/legal/dta
SumUp
Category of recipient: In-person card and digital wallet payments
Countries the personal information is sent to: Data is stored in the European Economic Area (EEA), but some of the third party processors are beyond the EEA.
How the transfer complies with UK data protection law: “SumUp will ensure they share data only with those organisations that satisfy an adequate level of data protection in line with applicable data protection legislation and that satisfactory contractual agreements are in place with any such parties.”
Source: sumup.com/en-gb/privacy
Ticket Tailor
Category of recipient: Ticket sales and online payments (used in conjunction with Stripe)
Countries the personal information is sent to: sub-processors outlined in their ‘Third party sub-processors’ list.
How the transfer complies with UK data protection law: as outlined on the page linked above, dependent on the third-party processor, processing is either facilitated via the UK addendum to the Standard Contractual Clauses or the UK–US Data Privacy Framework.
How to complain
If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.
If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.
The ICO’s address:
Information Commissioner’s OfficeWycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
Website: ico.org.uk/make-a-complaint
Appendix
More information about the third-party services that we use.
Crowdfunder
If you chose to donate to one of our crowdfunding campaigns, Crowdfunder is our chosen platform. Your contact information is stored within your own personal account which can be closed at any time. As outlined in the sections above, LTUX Brighton retain high-level information for tax reporting purposes. Their privacy policy details GDPR compliance and anti-spam measures, including opt-in requirements.
Crowdfunder are UK-based and have a woman Co-CEO, Dawn Bebe. Crowdfunder are registered at 3 Southview House, St Austell Enterprise Park, Carclaze, St Austell, Cornwall, United Kingdom, PL25 4EJ.
EmailOctopus
When you have opted into our mailing list, your contact information is stored securely in the Ladies that UX Brighton EmailOctopus account. For more information review EmailOctopus’s Terms of Use and Anti-Spam Policy, Privacy Policy, and GDPR Compliance information.
EmailOctopus is based in the UK (Three Hearts Digital Ltd, 86–90 Paul Street, London, EC2A 4NE). They are committed to ethical practices and supporting non-profits and environmental sustainability (‘doing good’).
FreeAgent
FreeAgent is a UK-based accounting software provider, with its registered office at One Edinburgh Quay, 133 Fountainbridge, Edinburgh, Scotland, UK EH3 9QG. Their privacy policy aligns with GDPR and includes anti-spam safeguards like opt-in consent.
FreeAgent emphasises flexible work arrangements and equality, diversity, and inclusion (EDI) initiatives, including tracking promotion rates for gender parity. While they do not explicitly state sustainability goals, their focus on small business support aligns with ethical economic practices.
Google Apps and Google Workspace
We use Google Workspace Apps, including Gmail, Google Calendar and Google Forms, to handle information provided by consent (e.g. volunteer interest forms and emails, sponsor enquiries, and research projects via forms), and Google Photos for our event archives.
Google Apps adheres to Google’s global privacy policy and GDPR compliance framework, ensuring data encryption and user control. Anti-spam policies include opt-in mechanisms. Google’s parent company, Alphabet, has faced criticism over data collection from users. Alphabet has also faced criticism on climate and renewable energy for operations, while also being a large consumer of resources through Gemini, their AI product (Hodgson & Morris, 2024). We will continue to monitor Google and Alphabet’s actions. Gender equality efforts are outlined in Google’s diversity reports, while sustainability is a core focus.
Ko-Fi
Ko-Fi is a UK-based platform for supporting creators, registered at Suite 501, The Nexus Building, Broadway, Letchworth Garden City, Herts, SG6 9BL. Its privacy policy confirms GDPR compliance and anti-spam safeguards like opt-in consent. The company emphasises ethical payment practices but lacks public commitments to gender equality or sustainability.
Luma
Luma, our main calendar and events tool, is based in the United States (548 Market St PMB 36143, San Francisco, CA 94104). Their privacy policy and security policy outline data handling practices, emphasising encryption and user consent. They state that they do not share any data with third parties. We will continue to use other platforms (including our Slack and newsletter) to advertise events, so that our members can opt out of using the tool.
Notion
We have used Notion for this privacy policy. It is also used for general administrative purposes such as keeping track of sponsorship records. Notion are based in the United States (685 Market Street, San Francisco, CA 94105). They have a clear privacy policy and associated guidance which states that they do not share information with third parties. They do not include any details of their ethical practices on their site.
Slack
When you have opted to join our Slack workspace, your account and contact information are associated with the Ladies that UX Brighton Slack workspace. For more information review Slack’s User Terms of Service and Privacy Policy.
Slack was acquired by Salesforce in 2021. They are based in San Francisco, California, USA (1 Market St., San Francisco, CA 94105). They have maintained a strong emphasis on privacy and accessibility. Slack’s CEO (at the time of writing) is Denise Dresser. Salesforce, the parent company, has environmental and social governance (ESG) measures in place, scoring a top score of 100 in the Human Rights Campaign’s 2025 index as a leader in LGBTQ+ workplace inclusion. Salesforce have also been a 16-time honouree on Ethisphere’s world’s most ethical companies list.
Stripe
Stripe is used to process card payments through TicketTailor. Stripe is headquartered in San Francisco, USA. Their privacy policy outlines GDPR compliance and data handling practices, emphasising encryption and user consent for data collection. Anti-spam safeguards include opt-in requirements and clear communication terms. They provide a clear anti-modern slavery statement on their website.
Stripe supports sustainability through carbon neutrality and renewable energy investments. Gender equality initiatives are detailed in their diversity reports, including pay equity and inclusive hiring practices.
SumUp
SumUp is a UK-registered company with its registered office at SumUp Payments Limited, 16–20 Shorts Gardens, London WC2H 9US, UK. Their privacy policy confirms GDPR compliance, detailing data encryption and user consent for marketing. Anti-spam safeguards include opt-in requirements and unsubscribe options. A Modern Slavery Statement is published, outlining their commitment to ethical supply chains and zero tolerance for forced labour.
Ticket Tailor
Ticket Tailor, our preferred ticket sales tool, is part of Zimma Ltd (Unit 222, Mare Street Studios, 203–213 Mare Street, London, E8 3LY). They provide GDPR-compliant data handling and anti-spam protections via user consent as outlined in their privacy policy and their GDPR statement. The platform focuses on ethical ticketing for events but does not explicitly address gender equality or sustainability.
Photography and video at our events
We may capture photographs and videos during our events for promotional and archival purposes. By attending, you consent to potentially being included in these recordings. We display a notice at each event’s entrance informing attendees about photography and video. You have the right to opt out by requesting a sticker to display visibly on your name badge if you do not wish to be filmed or photographed. We will make reasonable efforts to respect your request.
Photos and videos are held indefinitely as part of our archives on Google Photos and are periodically used as part of our event promotional materials. If you have any concerns about an image or video, please contact us at ltuxbrighton@gmail.com.