1. Who We Are
The AI Psychology Summit is a joint initiative between two organisations who act as joint data controllers for your personal data:
Illuminated Thinking Limited
Company number: SC713715
Registered address: Mearns Castle Golf Academy, Waterfoot Road, Glasgow, Scotland, G77 5RR
ICO registration: ZB859542
Data protection contact: Dr Aisha Tariq, aisha@aipsychology.co.uk
Lifespan Psychology Limited
Company number: 12229573
Registered address: 2-4 Kenway Road, Earls Court, London, England, SW5 0RR
ICO registration: ZB166866
Data protection contact: Dr Esther Cole, esther@aipsychology.co.uk
The two organisations have entered into a Joint Venture Agreement which records, in accordance with Article 26 of the UK GDPR, how their respective responsibilities are allocated. The essence of that arrangement is:
- Joint determination. Both organisations jointly decide the purposes and means of processing personal data collected through the AI Psychology Summit website, registration system, and Event.
- Lead contact for data subject rights. Illuminated Thinking Limited is the primary point of contact for data protection enquiries, subject access requests, and the exercise of your other rights under Section 7. You may, however, raise any request with either organisation, and we will route it appropriately.
- ICO and breach notification. Illuminated Thinking Limited is responsible for notifying the Information Commissioner's Office of any reportable personal data breach within 72 hours, in coordination with Lifespan Psychology Limited.
- Records of processing. Each organisation maintains its own Article 30 records of processing activities for the data it directly handles; a shared record covers jointly-controlled processing.
- Processors and sub-processors. Contracts with shared processors (Stripe, Zoho, Vercel) are entered into jointly or by Illuminated Thinking Limited on behalf of both organisations.
Regardless of how responsibilities are allocated between the two organisations, you may exercise your rights against either of us under Article 26(3) UK GDPR.
For any data protection queries, please contact: info@aipsychology.co.uk
2. What Data We Collect
2.1 When You Purchase a Ticket
We collect the following personal data when you register for the event:
- Name (required), used to identify you as an attendee, issue your CPD certificate, and manage your booking.
- Email address (required), used to send your booking confirmation, event access details, recordings, and CPD certificate.
- Professional role (optional), e.g. Clinical Psychologist, Counselling Psychologist, Psychotherapist. We collect this to understand our audience and tailor future events.
- Registration body (optional), e.g. HCPC, BPS, BACP, UKCP. We collect this for the same purpose as professional role.
- Marketing preference (optional), being whether you consent to receive emails about future events and resources.
2.2 When You Make a Payment
We do not collect or store your payment card details. All payment processing is handled by Stripe, Inc., which acts as an independent data controller for payment data. We receive from Stripe:
- Confirmation that payment was successful
- A Stripe payment reference ID
- The amount paid and currency
We store order records (amount, date, ticket type, discount codes used, refund status) for financial record-keeping purposes.
2.3 When You Attend the Event
The event is hosted via Zoho Webinar. When you join the webinar:
- Your name and email address are shared with Zoho Corporation Pvt. Ltd. to grant you access to the webinar
- Your attendance status and duration are recorded for CPD verification purposes
- Chat messages you submit during the event may be visible to other attendees and the hosts
- Sessions are recorded (see our Recording Policy for full details)
Attendee cameras and microphones are off by default. If you choose to enable them during interactive sessions, your image and/or voice may be captured in recordings.
2.4 When You Visit Our Website
Our website (aipsychology.co.uk) is hosted on Vercel, Inc. When you visit the site, the following data may be collected automatically:
- IP address
- Browser type and version
- Pages visited and time spent
- Referring website
This data is collected by our hosting provider as part of standard web server operation. See our Cookie Policy for further details.
2.5 When You Sign Up for Email Updates
If you subscribe to our mailing list (without purchasing a ticket), we collect:
- Email address
- Date and time of sign-up
- The consent wording shown at the time of sign-up
3. Lawful Basis for Processing
We process your personal data under the following lawful bases:
| Data | Lawful Basis | Explanation |
|---|---|---|
| Name, email, order details | Contract (Art. 6(1)(b)) | Necessary to fulfil your ticket purchase, provide access to the event, deliver recordings, and issue your CPD certificate |
| Professional role, registration body | Legitimate interest (Art. 6(1)(f)) | To understand our audience demographics and improve future events. You can decline to provide this information with no impact on your booking |
| Marketing emails | Consent (Art. 6(1)(a)) | Only sent if you explicitly opt in. You can withdraw consent at any time |
| Attendance records | Legitimate interest (Art. 6(1)(f)) | To verify attendance for CPD certification, which attendees expect and benefit from |
| Financial/order records | Legal obligation (Art. 6(1)(c)) | Required to comply with HMRC record-keeping obligations |
| Website server logs | Legitimate interest (Art. 6(1)(f)) | For website security, performance monitoring, and abuse prevention |
4. Who We Share Your Data With
We share your personal data with the following third parties, all of whom act as data processors on our behalf (unless otherwise stated):
Stripe, Inc. (Payment processing)
- Data shared: Name, email address, payment details (entered directly into Stripe's payment form)
- Role: Stripe is an independent data controller for the payment data you submit through its payment form. The order confirmation data Stripe returns to us (transaction reference, amount, status) is then held under our own controllership for our financial records.
- Location: United States (UK-US Data Bridge / EU-US Data Privacy Framework)
- Privacy policy: stripe.com/gb/privacy
Zoho Corporation Pvt. Ltd. (Webinar platform)
- Data shared: Name, email address
- Role: Data processor
- Location: Data processed in the EU (Zoho EU data centres)
- Privacy policy: zoho.com/privacy.html
Vercel, Inc. (Website hosting)
- Data shared: IP address, browser data (standard server logs)
- Role: Data processor
- Location: United States (Standard Contractual Clauses)
- Privacy policy: vercel.com/legal/privacy-policy
We do not sell your personal data to any third party. We do not share your data with any other organisations except where required by law (e.g. HMRC, law enforcement, or regulatory bodies).
5. International Data Transfers
Your personal data is primarily stored on servers located in the United Kingdom.
Where data is transferred to recipients outside the UK (Stripe and Vercel in the United States), these transfers are protected by the UK Extension to the EU-US Data Privacy Framework (commonly referred to as the UK-US Data Bridge). Both Stripe and Vercel are currently certified under that framework. We monitor their certification status and will fall back to ICO-approved Standard Contractual Clauses (International Data Transfer Agreement) if certification lapses.
Zoho processes data within the European Union, which is covered by the UK's adequacy decision for the EEA.
6. How Long We Keep Your Data
| Data | Retention Period | Reason |
|---|---|---|
| Order and payment records (financial) | 6 years from the end of the financial year of the transaction | HMRC requirement under corporation tax and record-keeping rules |
| Attendee account data (name, email; non-financial) | Until you request deletion, subject to other legal obligations (e.g. financial records). We will review accounts inactive for 3 years and delete unless you have requested ongoing contact. | To provide access to recordings, CPD certificates, and to respond to support requests |
| Professional role and registration body | 3 years from the Event date, or until deletion request | Audience analysis for future events; not required after 3 years |
| CPD certificates | 6 years from the Event date | To allow verification of CPD claims by attendees and their professional bodies |
| Event recordings (attendee access) | 90 days from the actual delivered Event date | After 90 days, attendee access is removed |
| Event recordings (archival) | 3 years from the Event date, then deleted or anonymised (chat metadata stripped) | Legitimate interest in maintaining a historical record of the Event and supporting any future complaints, queries, or regulatory enquiries |
| Marketing consent records | For as long as you remain subscribed, plus 12 months after unsubscribing | To evidence consent was given, in case of a complaint |
| Regulation 36 cooling-off consent record | 6 years from the date the consent was given | To evidence your express consent under the Consumer Contracts Regulations 2013, in case of a refund dispute |
| Website server logs | 30 days | Standard retention by hosting provider for security and performance |
After the relevant retention period, personal data is securely deleted or anonymised.
7. Your Rights
Under the UK GDPR, you have the following rights:
- Right of access: request a copy of the personal data we hold about you.
- Right to rectification: request correction of inaccurate data.
- Right to erasure: request deletion of your data, subject to our legal obligations to retain financial records.
- Right to restrict processing: request that we limit how we use your data.
- Right to data portability: request your data in a structured, machine-readable format.
- Right to object: object to processing based on legitimate interest.
- Right to withdraw consent: withdraw marketing consent at any time, without affecting the lawfulness of processing before withdrawal.
To exercise any of these rights, please email: info@aipsychology.co.uk
We will respond to your request within one calendar month. If your request is complex or you make multiple requests, we may extend this by a further two months, but we will inform you of any extension within the initial one-month period.
The right to erasure is not absolute. We may not be able to delete:
- Financial records: retained for 6 years under HMRC obligations.
- Marketing consent records: we retain a record of your consent (and any withdrawal) to evidence that we acted lawfully.
- Event recordings where another attendee's data is intertwined with yours, for example a back-and-forth chat exchange. In those cases we will mute, blur, or otherwise minimise your data rather than delete the recording outright. See our Recording Policy for full details.
- Regulation 36 cooling-off consent records: retained for 6 years to evidence the consent you gave at checkout.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: ico.org.uk/make-a-complaint
- Telephone: 0303 123 1113
- Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
8. Data Security
We take appropriate technical and organisational measures to protect your personal data, including:
- All data transmitted between your browser and our website is encrypted using TLS (HTTPS)
- Payment data is handled entirely by Stripe, which is PCI DSS Level 1 certified
- Access to attendee data is restricted to authorised personnel of both joint controllers
- The attendee database is hosted on a UK-based server with encryption at rest
- Administrative access to the event platform requires authenticated login
- We maintain data processing agreements with all third-party processors
9. Automated Decision-Making
We do not use your personal data for automated decision-making or profiling.
10. Children's Data
The AI Psychology Summit is a professional event aimed at qualified and trainee mental health professionals. We do not knowingly collect personal data from anyone under the age of 18. If you believe we have inadvertently collected data from a minor, please contact us immediately at info@aipsychology.co.uk.
11. Changes to This Notice
We may update this privacy notice from time to time. If we make significant changes, we will notify registered attendees by email. The "last updated" date at the top of this notice indicates when it was most recently revised.
12. Contact
For any questions about this privacy notice or how we handle your personal data:
Email: info@aipsychology.co.uk
You may direct your enquiry to either joint controller. Illuminated Thinking Limited acts as the primary point of contact for data protection matters.