Legal
Privacy Notice
How personal data are handled by the UK Construction Industry Task Force and The Institute of Construction Management through this events platform.
Demonstration content. This Privacy Notice is a configurable draft. It must be reviewed and approved by both organisations' legal and data-protection advisers before launch.
Who we are
The UK Construction Industry Task Force — industry body convening events, guidance and workstreams across construction, building safety and competence. Data-controller contact: dataprotection@ukcitf.example.org.
The Institute of Construction Management (ICM) — professional institute delivering membership, standards and learning, and administering payments and banking for paid events. Data-controller contact: dataprotection@icm.example.org.
Platform-related privacy enquiries: dataprotection@ukcitf.example.org.
Controller status
The UK Construction Industry Task Force and The Institute of Construction Management are separate legal entities and registered data controllers. Where they jointly determine the purposes and means of processing personal data through this events platform, they act as joint controllers.
The parties have agreed arrangements governing their respective responsibilities for compliance with UK data-protection law. The essence of those arrangements is made available in this Privacy Notice.
Purposes of processing
- Managing event registrations, bookings and waiting lists
- Managing attendance and access to online events
- Payment and financial administration for paid events (ICM)
- Sending essential transactional communications
- Sending optional marketing communications where consent has been given
- Maintaining user accounts and communication preferences
- Cookies, privacy-conscious analytics and platform security
- Handling enquiries, complaints and data-subject rights requests
Lawful bases
- Contract — administering your booking and account
- Legitimate interests — running and improving the events programme and communicating essential event information
- Consent — optional marketing communications, newsletters and non-essential cookies
- Legal obligation — statutory financial records, tax and data-protection duties
Responsibility table
This table is configurable and is maintained by the data-protection administrators of both organisations.
| Processing activity | Task Force responsibility | ICM responsibility | Lawful basis | Retention period | Data-subject contact point |
|---|---|---|---|---|---|
| Event enquiries | Receives and responds to programme enquiries | Receives and responds to learning and finance enquiries | Legitimate interests | 12 months | events@ukcitf.example.org |
| Event registrations | Manages registrations for Task Force and joint events | Manages registrations for ICM and joint events | Contract / legitimate interests | 24 months after the event | events@ukcitf.example.org |
| Attendance records | Maintains attendance for its events | Maintains attendance for its events | Legitimate interests | 24 months after the event | events@ukcitf.example.org |
| Booking confirmations | Sends confirmations for its events | Sends confirmations for its events | Contract | 24 months | events@ukcitf.example.org |
| Event reminder emails | Sends reminders for its events | Sends reminders for its events | Contract / legitimate interests | 24 months | events@ukcitf.example.org |
| Event feedback | Collects feedback for its events | Collects feedback for its events | Legitimate interests | 12 months | events@ukcitf.example.org |
| Optional marketing and newsletters | Own marketing list | Own marketing list | Consent | Until withdrawn plus 24 months | dataprotection@ukcitf.example.org |
| Payment processing | Not a payment administrator | Collects and administers payments | Contract / legal obligation | 7 years | finance@icm.example.org |
| Finance and accounting records | No access | Maintains statutory records | Legal obligation | 7 years | finance@icm.example.org |
| Refunds | Refers requests to ICM | Processes refunds | Contract / legal obligation | 7 years | finance@icm.example.org |
| Website cookies | Joint responsibility for platform cookies | Joint responsibility for platform cookies | Consent (non-essential) | Up to 12 months | dataprotection@ukcitf.example.org |
| Website analytics | Joint responsibility | Joint responsibility | Consent | 14 months | dataprotection@ukcitf.example.org |
| User accounts | Joint responsibility | Joint responsibility | Contract | Closure plus 12 months | dataprotection@ukcitf.example.org |
| Data-subject rights requests | Handles requests relating to its processing | Handles requests relating to its processing | Legal obligation | 6 years | dataprotection@ukcitf.example.org |
| Security incidents | Joint responsibility | Joint responsibility | Legal obligation / legitimate interests | 24 months | dataprotection@ukcitf.example.org |
| Personal-data breach management | Joint responsibility | Joint responsibility | Legal obligation | 6 years | dataprotection@ukcitf.example.org |
Data processors and service providers
We use contracted service providers for hosting, database services, email delivery and payment processing. Providers are engaged under written terms that meet UK GDPR requirements. A current list of processors is maintained by the data-protection administrators and confirmed before launch.
Data sharing
Registration data for jointly delivered events are shared between the Task Force and ICM for the purposes of administering that event. Payment data are handled by ICM and its payment provider. We do not sell personal data or share it for third-party marketing.
External event links
Recommended external events are organised by other organisations. Selecting an external booking link takes you to the organiser's website, where its own terms and privacy information apply. We do not collect booking data for external events. Where analytics are enabled and consented to, only aggregated, non-identifying outbound click counts are recorded.
Retention
Retention periods are set out in the table above and are configurable by the data-protection administrators. Payment, finance and accounting records are retained for statutory periods with restricted access, and are not automatically deleted.
Your rights
You have the right of access, rectification, erasure, restriction, objection, data portability where applicable, and the right to withdraw consent at any time. See your data rights for how to make a request.
Complaints
If you are unhappy with how your personal data have been handled, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk, or by telephone on 0303 123 1113.
Cookies
See the Cookie Policy for the cookies used and how to change your preferences.