1. Data Controller

For the purposes of UK GDPR and the DPA 2018, DBC UK is the Data Controller of personal data processed through our Services.

DBC UK is a subsidiary of Diversified Communications (headquartered in Portland, Maine, USA). Where personal data is transferred to the parent company or other group entities, appropriate safeguards are in place as described in our Privacy Policy.

2. Data Protection Principles

DBC UK is committed to processing personal data in accordance with the following principles under UK GDPR (Article 5):

• Lawfulness, fairness and transparency: We process personal data lawfully, fairly and in a transparent manner.
• Purpose limitation: We collect personal data for specified, explicit and legitimate purposes and do not process it in ways that are incompatible with those purposes.
• Data minimisation: We only collect personal data that is adequate, relevant and limited to what is necessary for the purposes for which it is processed.
• Accuracy: We take reasonable steps to ensure personal data is accurate and kept up to date where necessary.
• Storage limitation: We retain personal data for no longer than is necessary for the purposes for which it is held (see Section 5 below).
• Integrity and confidentiality: We process personal data in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing, accidental loss, destruction or damage, using appropriate technical and organisational measures.
• Accountability: We are responsible for, and can demonstrate compliance with, these principles.

3. Lawful Bases for Processing

DBC UK relies on the following lawful bases under UK GDPR Article 6 to process personal data:

• Contract: Where processing is necessary to perform a contract with you, or to take steps at your request prior to entering into a contract – for example, processing your registration for an event or subscription.
• Legitimate interests: Where processing is necessary for our legitimate business interests (or those of a third party), provided those interests are not overridden by your rights and interests. For example, we may process data for direct marketing, fraud prevention, or improving our Services.
• Consent: Where you have given clear, freely given and informed consent – for example, when opting in to marketing communications. You may withdraw consent at any time (see Section 6).
• Legal obligation: Where processing is necessary to comply with a legal obligation to which DBC UK is subject.

Where we rely on legitimate interests as a lawful basis, we carry out a Legitimate Interests Assessment (LIA) to ensure your rights are not overridden. You have the right to object to processing based on legitimate interests at any time (see Section 6).

4. Transparency and Consent

DBC UK is committed to being open and transparent about how and why we use personal data. We operate the following practices:

• All registration forms, subscription pages and event sign-up forms clearly explain the purpose for which data is collected and how it will be used.
• Where processing is based on consent, individuals are asked to actively opt in; pre-ticked boxes are not used.
• All marketing communications include clear unsubscribe instructions. You may withdraw consent at any time by clicking the “unsubscribe” link in any marketing email or by contacting us at [email protected].
• Visitors to our events are informed – via signage at the entrance and notices in the show guide – that by allowing an exhibitor or sponsor to scan their badge, or by otherwise providing their details, they are giving consent for that exhibitor or sponsor to contact them about their services. Individuals may withdraw this consent at any time by contacting the relevant exhibitor or sponsor directly.
• DBC UK maintains records of where personal data was obtained, the lawful basis on which it is held, and the consents given by individuals.

5. Data Retention

DBC UK retains personal data only for as long as is necessary for the purposes for which it was collected, and in line with our legal obligations. Our standard retention periods are as follows:

• General contacts (no transaction): Where we have had no transaction or meaningful activity with a contact, their data will be deleted after a maximum of 3 years.
• Biannual event contacts: Where contact relates to a biannual event, the retention period may be extended to a maximum of 5 years to allow for the full event cycle.
• Financial transaction records: In accordance with HMRC requirements, records relating to customers with whom a financial transaction has taken place must be retained for 6 years.
• Staff and job candidate records: Retained for the duration of employment plus applicable statutory periods; unsuccessful candidate records are typically retained for 6 months unless consent is given for longer retention.

When personal data is no longer required, it is securely deleted or anonymised. These retention periods apply to all categories of personal data held by DBC UK, including data relating to customers, website visitors, event attendees, staff and job applicants.

6. Your Rights as a Data Subject

Under UK GDPR, you have the following rights in relation to your personal data. We will aim to respond to all requests within one calendar month of receipt. Where a request is complex or there are multiple requests, we may extend this period by up to two additional months, but we will inform you promptly if this is necessary.

Please note that we may ask you to verify your identity before processing a request, to protect your data from unauthorised access.

The Right of Access (Data Subject Access Request – DSAR)

You have the right to obtain confirmation of whether we process your personal data, and to receive a copy of that data together with information about how and why we process it. See Section 7 for full details of how to submit a DSAR.

The Right to Rectification

You have the right to have inaccurate personal data corrected, or incomplete data completed. If you believe data we hold about you is incorrect, please contact us at [email protected].

The Right to Erasure (Right to Be Forgotten)

You have the right to request the deletion of your personal data in certain circumstances – for example, where the data is no longer necessary for the purpose it was collected, where you withdraw consent, or where you object to processing and there is no overriding legitimate interest. See Section 8 for full details of how to submit an erasure request.

The Right to Restriction of Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances – for example, while the accuracy of your data is being contested, or where you have objected to processing pending verification of legitimate grounds.

The Right to Data Portability

Where processing is based on consent or contract and is carried out by automated means, you have the right to receive the personal data you provided to us in a structured, commonly used and machine-readable format, and to transmit that data to another organisation.

The Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will stop processing your data for that purpose without exception. Where you object on other grounds, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms.

Rights Related to Automated Decision-Making

You have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal or similarly significant effects on you. DBC UK does not currently make automated decisions of this nature, but please contact us if you have any concerns.

The Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before the withdrawal. To withdraw consent, please contact [email protected] or use the unsubscribe link in any marketing communication.

The Right to Complain to the ICO

If you believe DBC UK has not handled your personal data in accordance with UK GDPR, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection:

We would, however, appreciate the opportunity to address any concerns before you approach the ICO, so please contact us in the first instance at [email protected].

7. Data Subject Access Requests (DSAR)

What is a DSAR? A Data Subject Access Request allows you to confirm whether we process your personal data, obtain a copy of that data, and understand how and why we use it.

How to Submit a DSAR

You can submit a DSAR in any of the following ways:

• Online form: Use our dedicated DSAR submission form at www.divcom.co.uk/dsar/
• By email: [email protected]
• By post: Data Protection Officer, Diversified Business Communications UK Ltd, Ground Floor, The Brinell Building, 30 Station Street, Brighton, BN1 4RB

Information to Include

To help us locate the relevant data efficiently, please include the following where possible:

• First name and surname
• Company name and address (including postcode)
• Business email address
• Personal address and personal email address (if relevant)
• Details of the specific information or processing you are enquiring about
• Proof of identity (if we consider it necessary for security purposes)

Timeframe and Response

We will respond to your DSAR within one calendar month of receiving your request. Where the request is complex or there are multiple requests, we may extend this period by up to two additional months. We will notify you within the first month if an extension is required, explaining the reason for the delay.

DSARs are handled free of charge. However, where a request is manifestly unfounded or excessive (including where it is repetitive), we may charge a reasonable fee or refuse to act on the request, as permitted by UK GDPR Article 12(5). We will inform you if this applies.

8. Right to Erasure (Right to Be Forgotten)

What is the Right to Erasure? Under UK GDPR Article 17, you have the right to request that we delete your personal data from our records in certain circumstances.

When You Can Request Erasure

You may request erasure of your personal data if:

• Your personal data is no longer necessary for the purpose for which it was originally collected or processed;
• You withdraw consent and there is no other lawful basis for processing;
• You object to processing based on legitimate interests and there are no overriding legitimate grounds to continue;
• Your personal data has been unlawfully processed; or
• Your personal data must be erased to comply with a legal obligation.

When We May Be Unable to Comply

We may not be able to fulfil an erasure request in full where we are required to retain your data for:

• Legal compliance: To meet legal or regulatory obligations (for example, HMRC financial record-keeping requirements).
• Contractual purposes: To fulfil contractual obligations or pursue or defend legal claims.
• Public interest: Where processing is necessary for reasons of public interest, journalistic, academic, scientific or historical research purposes.

Where we are unable to fulfil an erasure request in full, we will explain which data we are required to retain and why.

How to Submit an Erasure Request

• By email: [email protected]
• By post: Data Protection Officer, Diversified Business Communications UK Ltd, Ground Floor, The Brinell Building, 30 Station Street, Brighton, BN1 4RB

Timeframe and Response

We will respond to erasure requests within one calendar month of receipt. Where the request is complex, we may extend this by up to two additional months and will inform you promptly if so.

9. Personal Data Breaches

DBC UK has procedures in place to detect, investigate and respond to personal data breaches. In the event of a breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of the breach, where feasible;
• Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms; and
• Document all breaches, including those that do not require notification, in our internal breach register.

10. Staff Training and Accountability

DBC UK recognises that compliance with UK GDPR is a shared responsibility. To support this:

• All staff who handle personal data receive appropriate training on their data protection obligations;
• Data protection considerations are embedded into the design of new processes and systems (“privacy by design and by default”);
• DBC UK maintains records of processing activities as required by UK GDPR Article 30;
• Where third-party processors handle personal data on our behalf, appropriate data processing agreements are in place in accordance with UK GDPR Article 28; and
• This policy is reviewed regularly and updated in response to legislative or operational changes.