Barcadia Events Limited (“Barcadia”, “we”, “us”) is the data controller for personal data processed through this platform, except where we act as a processor on behalf of a client organisation (an “Event Organiser”). This notice explains what we collect, why, how long we keep it, and the rights available to you under the UK GDPR and the Data Protection Act 2018.
1. Who we are and how to reach our DPO
- Data controller
- Barcadia Events Limited
- Registered address
- United Kingdom
- Data Protection Officer
- Data Protection Officer — privacy@barcadia.events
- Privacy requests
- privacy@barcadia.events
- Reporting a security or data incident
- privacy@barcadia.events
We maintain an Article 30 record of processing activities and a documented retention schedule. Both are available on request from the address above.
2. What we collect
- Account data: name, work email, organisation, role, sign-in activity, preferences.
- Event delegate data: name, contact details, dietary and accessibility needs, professional identifiers (e.g. FCA reference where applicable), attendance records, CPD outcomes. Where an Event Organiser invited you, they are the controller; Barcadia is the processor.
- Communications: emails, in-app messages, and support tickets.
- Technical data: IP address (hashed for security logs), device and browser information, cookies you have consented to.
3. Lawful bases
- Contract — to provide the platform to authenticated users.
- Legitimate interests — security monitoring, fraud prevention, service improvement, and internal reporting, balanced against your rights.
- Consent — for optional cookies, marketing emails, and any special-category data processing (e.g. dietary or accessibility information).
- Legal obligation — tax and financial record-keeping where applicable.
4. Sharing
We share personal data only with sub-processors that are contractually bound by Article 28 GDPR terms. A current list is available on request from privacy@barcadia.events. We do not sell personal data.
5. International transfers
Where sub-processors operate outside the UK/EEA, transfers are covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses or an equivalent adequacy mechanism.
6. Retention
Personal data is retained only as long as necessary for the purpose it was collected. Detailed retention periods are set out in our internal Retention Schedule, available on request. Account data is anonymised on account deletion; audit logs are retained for the periods required by our records-management obligations.
7. Your rights
You have the right to access, rectify, erase, restrict, port, and object to processing of your personal data. To exercise any right, email privacy@barcadia.events. You may also complain to the Information Commissioner's Office (ico.org.uk).
8. Changes
We will publish material changes to this notice at least 30 days before they take effect. Version history is maintained internally and available on request.