Privacy Policy

Last updated: 28 August 2026
This policy explains what personal information 12 Degrees collects, why we collect it, and what rights you have over it.

1. Who we are

12 Degrees Limited (“12 Degrees”, “we”, “us”) is an independent corporate event management agency. We are the data controller for the personal information described in this policy, except where section 7 says otherwise.

2. Who this policy covers

We handle personal information about several different groups of people:

• Clients and prospective clients — the people who commission events from us, and people at organisations we approach about our services.
• Event attendees and delegates — people attending an event we are running. In most cases we handle this information on our client’s behalf rather than our own (see section 7).
• Suppliers, venues and freelancers — our contacts at the businesses we work with.
• Website visitors — anyone browsing 12-degrees.co.uk.
• Applicants — anyone applying to work with us, including work experience placements.

3. The information we collect

Depending on who you are, this may include:

• Contact details — name, job title, employer, email address, telephone number, and postal or billing address.
• Correspondence — the enquiries, emails, call notes, briefs and messages exchanged between us.
• Event information — booking details, delegate lists, travel and accommodation arrangements, and on-the-day logistics.
• Dietary requirements and accessibility needs — where you give them to us for an event. See section 6, because some of this counts as health information and gets extra protection.
• Payment and billing information — invoice details and payment records. We do not store card numbers.
• Website and technical data — IP address, browser type, pages visited and referral source. See our Cookie Policy.
• Professional and publicly available information — job role, company and business contact details, taken from sources such as LinkedIn, company websites and industry directories, where we are researching potential clients.

4. Where we get it from

• Directly from you — when you enquire, email, call, complete a form on our website, meet us at an event, or exchange business cards with us.
• From our client — where you are attending an event they have commissioned, they will usually give us your details.
• From publicly available sources — LinkedIn, company websites, industry directories and professional networks, when researching organisations that may need our services.
• From referrals — where a mutual contact introduces us.

5. Why we use it, and our lawful basis

Data protection law requires us to have a valid reason (“lawful basis”) for each thing we do with your information. Ours are set out below.

Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights and freedoms, and concluded that it is not. You can ask us to explain that assessment.

6. Dietary requirements, allergies and accessibility needs

Information about allergies, intolerances, medical conditions, disabilities and mobility needs is “special category data” and is given extra protection in law. We only collect it so we can cater for you properly and keep you safe at an event.

We rely on your explicit consent to handle this information. You do not have to give it to us. If you do, we will share it only with the venue, caterer or supplier who needs it to meet your requirement, we will share the minimum necessary, and we will delete it once the event has finished and any follow-up is complete. You can withdraw your consent at any time by emailing us, though we may not then be able to accommodate the requirement.

7. When we act for our client rather than for ourselves

Where we are running an event for a client organisation and handling their delegates’ information, that client decides what happens to that information. In data protection terms they are the controller and we are their processor. We act on their written instructions under a contract that meets Article 28 of the UK GDPR.

If you are a delegate at an event and want to know how your information is being used, or want it corrected or deleted, please contact the organisation that invited you. If you contact us instead, we will pass your request on to them promptly and help them respond.

8. Who we share your information with

We do not sell your personal information, and we do not share it for anyone else’s marketing. We share it only where we need to:

• Venues, hotels, caterers, transport providers, production companies, activity providers and other event suppliers — with the details they need to deliver your event.
• Our client — where you are attending an event they have commissioned.
• Our professional advisers — accountants, insurers and legal advisers, where necessary.
• Regulators and law enforcement — where we are legally required to.

We also use these service providers, who process personal information on our behalf under contract:

9. Marketing, and how to stop it

We market our services to businesses. Where we contact a named individual at a company or LLP about services relevant to their role, we rely on our legitimate interests, as permitted for corporate subscribers under the Privacy and Electronic Communications Regulations.

You have an absolute right to object to direct marketing. If you tell us to stop, we will stop, with no need to give a reason. Use the unsubscribe link in any marketing email, or email events@12-degrees.co.uk. We keep a minimal suppression record of who has opted out so that we do not contact you again by mistake.

10. How long we keep it

Where we need to keep something longer to defend a legal claim or meet an insurance obligation, we will keep only what is necessary for that purpose.

11. Your rights

Under the UK GDPR you have the right to:

• Be informed about how we use your information — this policy.
• Access a copy of the information we hold about you.
• Rectification — have inaccurate information corrected, or incomplete information completed.
• Erasure — ask us to delete your information, where there is no good reason for us to continue holding it.
• Restrict processing — ask us to pause using your information while a concern is resolved.
• Data portability — receive information you gave us in a machine-readable format, or have it sent to another organisation.
• Object to processing based on legitimate interests, and to object to direct marketing at any time — which we will always honour.
• Withdraw consent at any time, where we rely on consent. This does not affect anything we did before you withdrew it.

We do not make decisions about you by automated means alone, and we do not carry out profiling that produces legal effects.

To exercise any of these, email events@12-degrees.co.uk. We will respond within one month. There is normally no charge. We may ask you to confirm your identity before we release information.

12. Complaining

Please come to us first — we would rather put something right than have you take it further. But you have the right to complain to the UK’s data protection regulator at any time:

13. Storing and transferring information

Your information is stored on systems within the UK and the European Economic Area wherever possible. Some of our providers are based in, or store data in, the United States and other countries outside the UK.

Where information is transferred outside the UK, we make sure it is protected by one of the safeguards the law recognises — an adequacy regulation covering the destination country, the UK’s International Data Transfer Agreement, or the UK Addendum to the European Commission’s Standard Contractual Clauses. You can ask us for details of the safeguard used for a particular provider.

14. Keeping it secure

We use multi-factor authentication on our business systems, encrypted storage and transmission, access controls limiting information to those who need it, and reputable providers with their own security certifications. No system is completely secure, but if a breach occurs that is likely to risk your rights and freedoms, we will report it to the ICO within 72 hours and tell you where the law requires it.

15. Children

Our services are aimed at businesses and our website is not directed at children. We do not knowingly collect information about anyone under 18, except where a client’s event includes family attendees, in which case we handle it on our client’s instructions and keep it to the minimum needed.

16. Changes to this policy

We review this policy at least annually and whenever our systems or the law change. The date at the top shows when it was last updated. If we make a significant change we will say so on this page.