Privacy notice
Last updated 6 November 2026
This notice explains how personal data is collected and used through fromdatatodecisions.co.uk, the website for From Data to Decisions: Trustworthy AI for Every Sector on Thursday 10 December 2026. It is written to meet the requirements of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
Who we are
The data controller is the University of Huddersfield, Queensgate, Huddersfield, HD1 3DH, United Kingdom.
For questions about this website or to exercise your rights, contact the event team at gulger.mallik@hud.ac.uk. You can also contact the University's Data Protection Officer through the University's website.
Event registration (Eventbrite)
Tickets are booked through Eventbrite, not this website. When you register, Eventbrite collects your details and shares them with us as the event organiser so we can run the event. Eventbrite's own privacy policy applies to the data you give them.
Data Clinic booking (Microsoft Forms)
Data Clinic slots are booked through a Microsoft Form run by the University of Huddersfield. The form only loads on this site when you choose to open it. The details you enter go to the University through Microsoft Forms and are used only to arrange your clinic. Microsoft's privacy statement also applies.
What we collect through this website
AI & Data Readiness Self-Assessment
- Your name, work email address and (optionally) job title.
- Your organisation's name, sector and size, and whether you plan to attend.
- Your answers to the assessment questions and the scores calculated from them.
- Anything you choose to write about the decision or data problem you'd like help with, or about your organisation's datasets.
- A record of your consent choices, the date and time, and the version of this notice you saw.
Technical data
- To protect the service from abuse, we create a one-way, keyed hash of your IP address and email address to limit repeated submissions. The hash cannot be reversed and is deleted within 24 hours. We do not store your IP address.
- Our hosting provider keeps short-lived server logs (such as IP address, browser type and the page requested) for security and troubleshooting.
- Cookies: see our cookie policy. We do not use advertising or cross-site tracking cookies.
How we use it and our lawful basis
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Generating your readiness report, showing it to you and emailing you a copy | Public task (6(1)(e)): knowledge exchange with organisations is part of the University's public function. Where this does not apply, our legitimate interests (6(1)(f)) in providing the service you asked for. |
| Understanding AI readiness across sectors (aggregated, anonymised statistics) and improving the event | Public task (6(1)(e)) / legitimate interests (6(1)(f)) |
| Contacting you about collaborations (such as KTPs and funded projects), Data Clinics and future events | Consent (6(1)(a)), only if you tick the optional box. You can withdraw consent at any time by emailing gulger.mallik@hud.ac.uk or using the unsubscribe link in any email. |
| Keeping the website secure and preventing abuse | Legitimate interests (6(1)(f)) |
We do not ask for special category data. Your scores are calculated automatically, but this does not lead to any decision with legal or similarly significant effects on you (UK GDPR Article 22). We never sell your data or use it for advertising.
Who can see your data
Your data is available only to the University staff organising the event and following up on it. We use these service providers (processors), who act only on our instructions under data processing agreements:
| Provider | Purpose | Location and safeguards |
|---|---|---|
| Vercel Inc. | Website hosting and serverless functions (London region, lhr1) | UK (London) for processing; Vercel is a US company. Vercel Data Processing Addendum incorporating the UK International Data Transfer Addendum / UK Extension to the EU-US Data Privacy Framework. |
| Hostinger International Ltd. | MySQL database hosting for assessment submissions | Data centre selected for the server (use an EU/UK data centre). Hostinger Data Processing Agreement; data encrypted at field level before storage. |
Where data may be accessed from outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum.
How long we keep it
- Assessment submissions: 24 months from the date you submit, then deleted automatically. You can ask us to delete them sooner.
- Rate-limiting hashes: under 24 hours.
- Hosting logs: kept by our hosting provider for a short period in line with its standard retention.
- Consent records: for as long as we rely on your consent, plus a short period to evidence it.
How we protect it
- All traffic is encrypted with HTTPS (HSTS enforced); database connections are encrypted with TLS.
- Your name, email, job title and free-text answer are encrypted with AES-256-GCM before they are stored, using a key held separately from the database.
- The website's database account can add new submissions but cannot read personal data back.
- Strict security headers, a Content Security Policy, input validation and rate limiting.
- Reports are returned only to the person who completed the assessment; they are not available by link.
Your rights
You have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to our processing;
- receive your data in a portable format, where applicable;
- withdraw consent at any time, without affecting processing before withdrawal.
To use any of these rights, email gulger.mallik@hud.ac.uk from the address you used in the assessment. We will respond within one month. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
Children
This website and the assessment are intended for professionals aged 18 or over.
Changes to this notice
We may update this notice. The version and date at the top of the page show when it last changed, and we record which version applied when you submitted your assessment.
Notice version 2026-11-06.