Your invitation response and privacy

Together Events PH Limited, company number 16276995, is the data controller. PHA UK operates sPHere on our behalf to collect and manage these responses.

Contact hello@togetherevents.uk about your response, an accessible alternative to the Form or a privacy question.

We ask for your name, email, centre or organisation and whether you can attend. These required details identify your response and let us plan the meeting, send a receipt and contact you about arrangements. Without them, we cannot register a response through this Form.

You can optionally suggest an agenda item. Its title and description are linked to your response for the programme team to consider. A receipt does not mean that a proposal is accepted or approved for publication.

We rely on legitimate interests under Article 6(1)(f) UK GDPR: administering this professional meeting and considering voluntary programme contributions. We balance those interests against your privacy through limited questions, restricted access and the retention limits below.

Please do not include patient names, identifiable case histories, health information or other sensitive details. If you need an adjustment, contact us initially without medical information so we can agree an appropriate route.

Authorised event staff and programme reviewers use the information needed for their work. PHA UK provides the sPHere service as our processor; Hostinger runs the application and Supabase provides its database and related storage. BYOP provides technical administration and the Brevo account used to send your confirmation email from hello@togetherevents.uk.

The receipt contains the event name and response reference, not your agenda proposal. Email suppliers process delivery and security records and may record email interaction metadata. These are separate from your registration record.

Your response does not subscribe you to marketing or authorise disclosure to sponsors. Registration answers and unapproved proposals are not public website or app content. We will agree any proposed public use of your contribution separately. We may disclose limited information where required by law or to deal with a legal claim.

The primary sPHere database is in London. The application remains on Hostinger. Supplier support and infrastructure can involve processing outside the UK. The suppliers publish data-processing terms covering subprocessors and international-transfer safeguards, including standard contractual clauses and UK provisions where applicable. Contact us for information about safeguards relevant to your response.

Connections are encrypted in transit and submitted records are restricted to authorised staff and service processes. The service uses technical request information and salted network-address hashes to prevent abuse. It does not store the raw network address in the Forms database. Hosting and email providers maintain their own operational logs.

• Invitation responses and submitted proposals are deleted or anonymised within 12 months after the meeting, by 6 October 2027. Any separately agreed public programme material has its own retention arrangements.
• Clearly identified colleague acceptance-test records are removed after testing, no later than 30 days after that testing finishes.
• sPHere confirmation-queue records, including the recipient address, expire after 30 days from creation. Technical submission logs expire after 12 months.
• If progress saving is enabled, a copy may remain in your browser and a server draft supports returning to the Form. Inactive server drafts expire after 7 days. You can clear the browser copy using your browser's site-data controls.

A documented complaint or legal obligation may require a limited relevant record to be kept longer. Supplier logs, backup copies and copies in email inboxes have separate retention arrangements; deletion from the Form does not immediately erase every such copy. Contact us for details or to request erasure.

You can ask us to correct your response or record apologies by email. You can request access to your personal information, correction, erasure or restriction, and object to processing based on legitimate interests. These rights depend on the circumstances; we will explain any reason we cannot fulfil a request. Data portability applies where its legal conditions are met.

There is no automated decision-making with legal or similarly significant effects in this invitation-response process.

You can raise a concern with us or complain to the Information Commissioner's Office, the UK data-protection regulator.