Privacy Policy – London Decompression Ltd

London Decompression Ltd (referred to as London Decompression or London Decom or Decom) is committed to safeguarding your privacy. Our collection and use of personal data is carried out in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy applies to our processing of your personal data, including when you become a member, attend one of our events, or volunteer with us.

Please read this policy to understand how your personal data will be treated. This policy may be amended in future.

Who do we collect data from?

Visitors to our website

We may collect a limited amount of data automatically from website visitors, such as demographic data, location data, device categories and settings, and browsing patterns. Where we collect this information, we use it in aggregate form so that it does not identify you.

We use cookies for the above purpose – see the Cookies section below.

Volunteers

If you volunteer with London Decompression in any capacity (we don’t employ people, though we do engage contractors), we may collect information necessary to process your application and assess your suitability. This may include relevant previous experience, safety and risk information for monitoring purposes, and any other personal information you provide to us. Safety and risk information may include, for example:

  • dietary requirements
  • physical capability for a role
  • emergency contact information
  • medical conditions or allergies relevant to on-site safety (e.g. epilepsy, or allergies that require specific first-aid protocols)
  • relevant certifications or qualifications for a role (e.g. first aid, working at height, manual handling)
  • accessibility or support needs

We generally collect your data directly from you – for example, when you sign up to volunteer online (including submitting an activity to bring to our events via our online submission form), attend one of our events, or volunteer to help at a meeting.

We may also collect and process information provided by third parties (e.g. other people or organisations).

Personal data we process is likely to include (but is not limited to):

  • your name
  • your contact details
  • information relating to your health, collected solely for health and safety purposes (for example, if you are not able to climb ladders)

Certain types of personal information are subject to extra protection under data protection law because they are more sensitive – for example, information about health. We only collect this type of information where there is a clear reason to do so, such as health information for a health-and-safety-relevant activity, or where needed to provide appropriate facilities or support.

Members

We are a members’ based organisation and collect information on our members in order to understand who our members are and to provide the services they sign up for.

We generally collect your data directly from you – for example, when you register as a member to attend one of our events. This is likely to include:

  • your name
  • your contact details

We also receive your information indirectly, where you give it to a third party who shares it with us with your consent – for example, our current ticketing partner, Eventbrite.

How does London Decompression use your information?

We may use your information to:

  • provide you with the services, items or information you asked for
  • keep you informed about relevant events
  • respond to or fulfil requests, complaints or queries you make to us
  • send you correspondence and communicate with you
  • personalise our communications (for example, pre-filling forms with information you’ve already given us)
  • improve our communications and website through reporting and segmentation
  • keep a record of our relationship with you
  • manage our events
  • conduct due diligence
  • process an application for a volunteering position
  • audit and administer our accounts
  • meet our legal obligations
  • invite you to participate in surveys or research
  • monitor and maintain event safety

Regardless of your communication preferences, we may still contact you for administrative purposes – for example, local entry requirements for an event.

If you’ve indicated you’re happy for your details to be passed to selected third parties that we think will interest you, they may contact you by email or we may contact you on their behalf.

If you no longer wish to receive marketing communications from us, you may:

Who do we share your information with?

We disclose information to third-party service providers who need access to it to provide specific services to us, or to process data for reporting, communications, or order fulfilment. These third parties may only use your information to provide their services to us, not for their own purposes. We enter into contracts with these providers requiring them to comply with data protection law and maintain appropriate safeguards.

Our key third-party processors currently include:

  • Google (Google Drive/Workspace) – for internal file storage, collaboration, and organisational administration.
  • Eventbrite – our ticketing partner, for event registration and ticketing.
  • Anthropic (Claude) – an AI assistant used for internal administrative tasks. See “Use of AI tools” below for detail.
  • MailChimp – our email platform, used to send newsletters and other communications to members and volunteers.

We may also disclose your information to professional advisors (such as legal advisors or accountants) for the purpose of providing professional services to us.

Legal disclosure

We may disclose your information if required to do so by law – for example, to comply with applicable laws, regulations, or a valid request from a competent authority – or to enforce our conditions of sale or other agreements.

Use of AI tools

We currently use Claude, an AI assistant provided by Anthropic, to help with internal administrative work – for example, organising volunteer/leadership rosters, drafting communications, and troubleshooting our internal systems and membership platform.

  • Access is limited. Where Claude is connected to our systems (for example, our Google Drive), access is scoped to what’s needed for the specific administrative task at hand, and is used only by authorised organisers in leadership roles.
  • Anthropic acts as a data processor for this purpose, and we (London Decompression) are the data controller. This is set out in Anthropic’s Data Processing Addendum, which forms part of our agreement with them.
  • No use for model training. Under Anthropic’s Commercial Terms of Service, which govern our Team plan, Anthropic may not train its models on the data we submit through Claude.
  • International transfer. Anthropic may process data outside the UK. Where this occurs, the transfer is covered by the UK International Data Transfer Addendum, incorporated into Anthropic’s Data Processing Addendum. Anthropic publishes its current list of subprocessors, and notifies customers before adding new ones.
  • No solely-automated decisions. We do not use AI tools to make decisions about individuals that produce legal or similarly significant effects without human review.
  • Special category data is kept out of AI tools. We do not knowingly input special category data into Claude or any AI tool as part of routine administration.

How do we keep your data safe?

We take reasonable precautions to protect your personal data from misuse, interference, loss, unauthorised access, modification, or disclosure. We work to ensure data is encrypted in transit and storage, and access is limited to a minimum number of individuals.

Volunteer details are available only to those actively volunteering with London Decompression to help organise events.

There is always some risk in sending information over the internet, and you do so at your own risk. While we do our best to protect your information, we cannot guarantee the security of data transmitted to us online.

What are my rights?

You have a number of rights in relation to the data we hold about you. To exercise any of these, contact us at info@londondecom.org. We will respond without undue delay and within one month (subject to any lawful extension). We may keep a record of your communications with us to help resolve any issues you raise.

Right to object

You have the right to object to processing of your personal data where we rely on legitimate interests as our lawful basis for that processing.

If you object, we will stop processing your data for that purpose unless we can demonstrate compelling legitimate grounds for continuing that override your interests, rights and freedoms, or we need to continue processing the data for the establishment, exercise or defence of legal claims.

You also have an absolute right to object to the use of your personal data for direct marketing. If you object to direct marketing, we will stop using your data for that purpose.

If we process your data based on your consent, you can withdraw your consent at any time. See “Right to withdraw consent” below.

Right to withdraw consent

Where we rely on your consent (for example, for marketing), you may withdraw it at any time. We will stop processing for that purpose unless we have an alternative lawful basis, in which case we’ll tell you.

Data subject access requests

You may ask for a copy of the information we hold about you, and ask us to correct, update, or delete it. We won’t charge for an initial request unless permitted by law; further copies may incur a reasonable administrative fee. Where legally permitted, we may refuse a request – if so, we’ll explain why.

Right to erasure

You can ask us to erase your data where, for example: it’s no longer necessary; you’ve withdrawn consent and there’s no other lawful basis; it’s been processed unlawfully; erasure is required for legal compliance; or you’ve objected and we can’t demonstrate an overriding legitimate ground. We will only refuse in limited circumstances, and will explain our reasoning.

Right to restrict processing

You can ask us to restrict processing – for example, if you dispute accuracy or have objected to processing on legitimate interest grounds. We’ll notify any third parties we’ve shared your data with, unless impossible or disproportionately difficult, and we’ll tell you before lifting any restriction.

Right to rectification

You can ask us to correct inaccurate or incomplete data. We’ll notify third parties we’ve shared it with, unless impossible or disproportionate, and can tell you who those third parties are on request.

Right to data portability

You can ask us to provide your data in a commonly used, machine-readable format, or to transfer it directly to another organisation on your behalf.

Right to complain

If you’re unhappy with how we handle your data, contact us at info@londondecom.org – we want to hear about it. You also have the right to complain to the UK’s data protection regulator:

Information Commissioner’s Office (ICO)

  • Phone: 0303 123 1113
  • Email: casework@ico.org.uk
  • Live chat: via ico.org.uk
  • Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Do we transfer your personal data overseas?

We use a small number of overseas service providers as part of running London Decompression, including:

  • Google, for file storage and collaboration tools.
  • Eventbrite, for event ticketing.
  • Anthropic, for our use of Claude (see “Use of AI tools” above).
  • MailChimp, for email communications.

Where we transfer data outside the UK, we ensure this is done securely and in a way that complies with UK GDPR, using an appropriate safeguard such as:

  • the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (or an equivalent approved mechanism); or
  • transfer to a country the UK government has found to offer an adequate level of data protection; or
  • your explicit consent to the transfer.

How long will we keep your personal data?

We do not keep personal data longer than necessary for the purpose it was collected, unless the law requires us to, or we need it to enforce an agreement.

Our standard retention period is no more than three years across most data categories. This is useful, for example, to retain contact details of past volunteers so incoming organisers can reach out with questions about a role they previously held. You can request deletion of your data at any time via the “Right to erasure” process above, regardless of the standard retention period.

When personal data reaches the end of its retention period, we delete it from our systems. Where we carry out a data cleanup or migration, we may retain a temporary encrypted archive of the superseded records for a limited period – currently up to six months – so that we can restore data if a technical fault is discovered during or shortly after the process. The encryption key for this archive is held only by our trustees; no one else has access to or use of its contents. Once this period has passed without issues being identified, the archive is permanently deleted.

What legal conditions do we rely on for processing your personal data?

Legitimate interests

We rely on our legitimate interests to process data where our interests aren’t outweighed by potential harm to you, including:

  • enabling events and services run for the benefit of our community;
  • keeping a record of people interested in our organisation who may wish to attend, help organise, or bring activities to our events;
  • protecting our organisation and our physical and digital assets;
  • developing our volunteer base;
  • enabling us to communicate with you.
  • maintaining safety for the event, organisation, its members and volunteers.

We don’t believe any activity described in this policy will prejudice you, but you have the right to object – see “What are my rights?” above.

Consent

We rely on your consent for certain processing. For this to be valid: it must be freely given, without pressure; you must know what you’re consenting to; we avoid bundling multiple consents together; and you must take a clear, affirmative action (e.g. ticking a box).

For example, we ask for your consent to contact you for communication purposes. You can withdraw consent at any time – see “What are my rights?” above.

Contractual necessity

We process data where necessary to perform our contract with you – for example, collecting your contact details so we can send you information about an event you’ve signed up to attend.

Legal obligation

We process data where necessary to comply with our legal obligations.

Cookies

We use cookies to give you the best experience on our website and in our online communications. Where a cookie is not strictly necessary for the site to function, we ask for your consent before it is set, and you can change your choice at any time via the cookie settings link in our website footer.

What are cookies?

Other than being an American biscuit, cookies are small text files stored on your device by websites, widely used to make sites work (or work better) and to give site owners information about visitors.

How does London Decompression use cookies?

We use cookies to understand how our site is used and to enhance your experience – for example, remembering whether you’ve visited before, or your progress through a ticket-buying process.

Types of cookies

  • First-party cookies – served directly by us, used to recognise your device on return visits and remember preferences.
  • Third-party cookies – served by a service provider on our behalf, most commonly for analytics.
  • Session cookies – removed automatically when you close your browser.
  • Persistent cookies – remain until an expiry date set in the cookie.

Cookie categories

  • Strictly necessary cookies – essential for using the site’s core features. These don’t require consent, but we still tell you about them here.
  • Performance/analytics cookies – collect anonymised information about site usage. Requires your consent, unless used solely for aggregated, first-party statistical purposes that qualify for the statutory exemption under UK law.
  • Functionality cookies – remember your choices and preferences (e.g. language, location). Requires your consent.
  • Targeting/advertising cookies – collect information about browsing habits. Requires your consent.

Your consent choices

When you first visit our site, a cookie banner lets you Accept all or Reject non-essential cookies, with both options equally easy to choose. No non-essential cookie is set until you’ve made a choice, and we don’t use pre-ticked boxes for optional categories.

You can change your choice at any time via the cookie settings link in our website footer, which reopens the banner. You can also manage cookies through your browser settings – though refusing cookies there may limit some site functionality without giving you the same category-by-category control our banner offers. Most browsers’ “Help” menu explains how to manage cookie settings, and www.aboutcookies.org has general information.

Questions

If you have any questions about this privacy policy, email us at info@londondecom.org.

This Privacy Policy supersedes all previous versions. Last updated: 28 August 2026.