Privacy Policy

UX for Change (Wayta Group Ltd)Version 0.5Last updated 7 November 2026

This policy explains what personal data UX for Change collects, why, and your rights over it. It applies from the date shown above and covers everything from our newsletter and event sign-ups to the forms we use to ask how you want to be credited on social media.

1. Who we are and how to contact us

UX for Change is the trading name of Wayta Group Ltd, a private limited company registered in England and Wales. Wayta Group Ltd (“we”, “us”) is the data controller for all personal data described in this policy, and UX for Change is the brand under which it runs the community. Wherever this policy says “UX for Change” it means Wayta Group Ltd trading as UX for Change. We are a community-led organisation of UX, design and research practitioners who run events, a newsletter, the Fellowship programme and opportunities for community members to join our Leadership Collective (the group of community members who help run UX for Change), with chapters in the UK and other countries.

• Legal entity: Wayta Group Ltd, trading as UX for Change
• Registered office: 4 Comet House, Calleva Park, Aldermaston, Berkshire, RG7 8JA
• Company number: 09629009 (England and Wales)
• ICO registration: applied for on 7 November 2026 (application C2081388); registration reference to follow
• Privacy Contact: Sandra Gonzalez, Founder and Director — privacy@waytagroup.com

We have not appointed a Data Protection Officer, and are not required to under Article 37 UK GDPR. The Privacy Contact above is the person responsible for handling data protection questions, rights requests and complaints; the title does not carry the statutory role, duties or independence of a Data Protection Officer.

2. What this policy covers

This policy applies to everyone whose personal data we handle, wherever you are based, and to every way you interact with us:

• Visiting our website or social media pages
• Subscribing to our newsletter or mailing list
• Completing any of our forms or surveys (Google Forms and event registration forms), including the form that asks how you would like to be credited on social media
• Registering for or attending an event, meetup, workshop or Fellowship programme (in person or online)
• Speaking, hosting, facilitating or being photographed or recorded at an event
• Applying to join the Leadership Collective, to lead a chapter or to join a programme
• Donating, sponsoring or paying for a ticket
• Emailing, messaging or otherwise contacting us
• Being featured, quoted or credited in our content

It is written to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications Regulations 2003 (PECR). If you are in the EU/EEA, the EU GDPR gives you equivalent rights and we honour them in the same way.

Third-party platforms we use (Meetup, Eventbrite, LinkedIn, Instagram, Google and others) have their own privacy policies for the data they collect as independent controllers. This policy covers what we do with the data they pass to us.

3. The personal data we collect

We collect only what each activity needs. Most of it comes directly from you; a little comes from the platforms you use to reach us.

We do not knowingly collect personal data from anyone under 16, and we do not buy or scrape personal data from third parties.

4. Why we use your data and our lawful basis

UK GDPR requires a lawful basis for every use of personal data. This table sets out ours.

Where we rely on legitimate interests we have weighed them against your rights, and you can object at any time (section 13). Where we rely on consent you can withdraw it at any time without affecting what we did before.

We do not use your data for automated decisions that have legal or similarly significant effects on you, and we do not sell personal data.

5. Newsletter and marketing

You will only get marketing emails from us if you asked for them, and every message has an unsubscribe link.

Signing up. When you subscribe (on our website, at an event, or by ticking a box on one of our forms) we record your email, the date, where you signed up and, where available, your IP address. This is our proof of consent. Pre-ticked boxes are never used, and subscribing is never a condition of attending an event or completing a form.

Where your consent comes from. We add you to our newsletter list only when you have opted in to hear from UX for Change, in one of these places:

• The subscribe form on our website or in our newsletter platform
• The “receive emails from this organiser” tick box when you register for one of our events on Eventbrite or a similar ticketing platform
• A newsletter tick box on one of our own forms or at an event sign-in
• The “subscribe to emails from this network” setting on our Meetup Pro network. Meetup shares your email with us only if you have turned this on, and we sync those subscribers into our newsletter platform (Kit). Members who have not subscribed are never added, and the first email you receive from us explains where your consent came from and how to unsubscribe.

We do not rely on the PECR “soft opt-in”, because UX for Change is run by a limited company and the soft opt-in is for charities or for details collected during a sale.

What we send. Event announcements, community news, calls for community members to take on roles, and for speakers, Fellowship updates, and occasional sponsor or partner messages that we send ourselves. We never hand your email to sponsors or partners so they can email you directly.

Engagement tracking. Our email platform (Kit) records opens and link clicks so we can see which content is useful and remove inactive subscribers. You can object to this by emailing us; we will still send you the newsletter.

Unsubscribing. Click the unsubscribe link in any email and you are removed immediately and automatically. If you prefer to email privacy@waytagroup.com instead, we action your request by hand within 15 working days and keep your email on a suppression list so we do not accidentally re-add you. Operational messages about an event you booked (joining links, cancellations) are not marketing and will still be sent.

Text, WhatsApp and social DMs. We only send marketing by these channels with your separate, specific consent.

6. Forms, surveys and research responses

Every form we publish says at the top what it is for, whether it is anonymous, and links to this policy. We treat answers as confidential unless the form says otherwise.

Tools. We mainly use Google Forms. We also ask questions through the registration forms on Meetup, Eventbrite and Luma when you sign up for an event (for example dietary needs, accessibility requirements or what you hope to get from the event). Google Forms responses are stored in the form tool and in a linked spreadsheet in our Google Workspace account; event-registration answers are stored in the event platform and exported to that same account when we need them. Both are accessible only to the Leadership Collective members who need them.

Anonymous surveys. Where a form is described as anonymous we do not ask for your name or email and we turn off email collection in the form settings. Free-text answers may still identify you if you include personal details, so please avoid doing so unless you want us to know who you are. If you tell us about accessibility or dietary needs by email instead, we will ask you to add them to the registration form and will then delete the email.

Named forms. Where we ask for your name or email it is because we need to act on your answer: to credit you, contact you, confirm a place, or follow up. We say why on the form.

How we use responses. To understand what the community wants from events, content and programmes; to plan and improve what we do; to record your preferences; and, in aggregated and anonymised form, to report to sponsors, partners and the wider community (for example “62% of respondents prefer evening events”). We do not publish individual responses without your consent.

Research and testing. Occasionally we run user research or usability sessions. Those always have their own consent form covering recording, quotes, and how long we keep the material; that consent form takes precedence over this section for that study.

Retention. Named responses are kept for the period in section 10 and then deleted or anonymised. You can ask us to delete your response at any time.

7. Social media, crediting and public attribution

We only name, tag, quote or show you in our public content in the way you have told us you are comfortable with. This section explains how that works.

The attribution preference form. Before we feature speakers, community members, Fellows, contributors or attendees on our social channels, website or newsletter, we ask you to complete a short form telling us:

• How you want to be credited: full name, first name only, social handle, a pseudonym, or not at all
• Which platforms we may tag or mention you on (e.g. LinkedIn, Instagram, YouTube, Meetup)
• Which handles to use on each
• Whether we may use your photo, video, voice or slides
• Whether we may quote things you said in talks, panels, Q&A, surveys or community channels
• Whether we may link to your employer, portfolio or website
• Any other conditions (for example, “no photos of my face”, “only after the event”, “ask me each time”)

Your answers are consent. Publishing your name, image, handle or words is based on the consent you give on that form. We store your answers alongside your name and email so the Leadership Collective members who run our social media can check them before posting. Where you say “not at all” or “anonymous”, we will not tag you, and we will blur or crop you out of images where that is practical, or not use the image.

Default if we have no form from you. If you speak, host or are a named contributor and we do not have your preferences, we will ask you before posting. For general attendees we rely on the event photography notice (section 3 and below) and do not tag individuals.

Changing your mind. You can update or withdraw your preferences at any time by completing the form again or emailing privacy@waytagroup.com. We will stop using your name or image in new posts straight away and will take down or edit existing posts on the channels we control. To help us act quickly, please send us links to the specific posts, pages or images you want changed; we will deal with those within 15 working days of receiving them. We will also carry out a reasonable and proportionate search of our own channels for other content featuring you, but as we are a small team we cannot guarantee that search will find every item, so if you later spot something we missed, tell us and we will remove it. We cannot recall copies that other people have already shared or re-posted, and some platforms keep deleted content in caches for a time.

Event photography and recording. Our events display a notice that photographs and recordings may be taken for community and promotional use. At in-person events we offer a specific colour lanyard to anyone who prefers not to be photographed or filmed. Wearing it signals your choice to everyone in the room, not just our photographers, so other attendees can respect it too; our photographers are briefed to leave lanyard-wearers out of their shots and we check images against this before publishing. You can also tell any Leadership Collective member on the day. We will do our best to exclude you from published images, and will remove any that slip through if you tell us. At online events, you can keep your camera off and we will not publish recordings that show participants’ video tiles without their agreement. Recordings of talks are published only with the speaker’s agreement.

Tagging and public profiles. When we tag or mention you, the platform processes that interaction under its own privacy policy. When you tag or mention us, your post is public under that platform’s rules; we may reshare it in line with the platform’s norms, and we will remove a reshare if you ask.

Sponsors and partners. Where an event or programme is co-run with a sponsor or partner, we tell you on the attribution form whether they may also use your name or image, and you can say no to them while still saying yes to us.

8. Special category data and children

Special category data. Some information is given extra protection by law: health (including accessibility needs and dietary requirements that reveal a medical condition or religion), racial or ethnic origin, religion, sexual orientation, trade union membership, political opinions, and biometric or genetic data. We ask for this only when there is a clear reason:

• Accessibility and dietary needs for events: we ask for these only through an optional question on the event registration form, which explains that your answer is used solely to arrange that event. Answering is your explicit consent. We share the answer only with the venue or caterer where needed, never copy it into attendee lists or profiles, and delete it within 30 days after the event. Please use the form rather than emailing us, so we can look after the information properly.
• Pronouns: our Leadership Collective, Fellowship and some event forms ask for your pronouns, always optionally, so we can address and introduce you correctly. Pronouns are not special category data, but we treat them with the same care: we use them only for that purpose and never report or share them. We do not currently run equality and diversity monitoring; if we introduce it in future it will be optional, anonymous where possible, reported only in aggregate, and this policy will be updated first.
• Anything you volunteer in free-text answers or messages: we will not use it for any other purpose and will delete it on request.

Children. Our events, newsletter and forms are intended for adults and people aged 16 or over. We do not knowingly collect data from anyone under 16. If we learn that we have, we will delete it. If an event is open to younger people (for example a schools outreach session), we obtain parental or guardian consent separately and run it under a specific safeguarding procedure.

Criminal records. We do not ask for criminal records information. If a Leadership Collective role ever requires a DBS check, we will tell you in advance and explain how that data is handled.

9. Who we share your data with

We never sell personal data, and we never give sponsors or partners your contact details so they can market to you. We share data only with the service providers below (who act on our instructions under written contracts), and in the limited other cases listed.

We also share data:

• With our Leadership Collective members and chapter leads, who only see the data they need for their role and sign a Leadership Collective agreement covering confidentiality.
• With the independent contractors and consultants who support our operations.This covers the self-employed contractors and consultants who help us with things like content, newsletters, event administration, enquiries, training and operational support. They work inside our own systems under written contracts that require them to use your data only on our instructions, keep it confidential and not pass it on. Where a contractor or consultant is based outside the UK, this is an international transfer covered by the UK International Data Transfer Agreement or an equivalent safeguard; see "International transfers" below.
• With venues and caterers: attendee names for security lists, and accessibility or dietary needs where you have asked us to accommodate them.
• With co-organisers, sponsors or partners of a specific event: only aggregate numbers, unless you consented on the registration or attribution form to be named to them.
• With HMRC for VAT and Corporation Tax records, and with our accountants or auditors.
• With regulators, courts or the police when the law requires it, or to protect our community from serious harm.
• With a successor organisation if UX for Change merges, incorporates or transfers its activities; this policy would continue to apply.

International transfers. We are UK-based and most of our providers store data in the UK, EU or USA. Some of the people who help run UX for Change — contractors, chapter leads and other team members — may be based in other countries; they access our UK-held systems remotely rather than holding copies of their own. Where data leaves the UK we rely on the UK–US Data Bridge for US providers that are certified under it, and otherwise on the UK International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses with the UK Addendum; the IDTA is the safeguard we use for contractors and team members based outside the UK. Before any such transfer begins we complete a transfer risk assessment to check that the protection for your data will not be materially lower than in the UK. Our chapters outside the UK (for example in the USA) run their own local events; where UK data is shared with them for a global programme, the same safeguards apply. Contact us if you would like to know which countries are currently involved or to see a copy of the relevant safeguard.

10. How long we keep your data

We keep personal data only as long as the activity needs, then delete or anonymise it. Our standard periods are below; we review them annually.

When we delete data, our service providers (Google Workspace, Kit, the event platforms) may keep a copy in their routine backups for a short period, typically up to 30 days, before it is overwritten. That copy is not used for anything in the meantime.

11. Cookies and similar technologies

Our website uses a small number of cookies. We ask for your consent before setting any that are not strictly necessary, except where the law allows us to set them with an opt-out instead.

Managing cookies. Use the cookie banner or the “Cookie settings” link in the footer to change your choices at any time, or block cookies in your browser (some parts of the site may then not work).

Email tracking pixels. Our newsletter platform uses a tracking pixel to record opens; see section 5 for how to object.

Social media buttons. Share buttons on our site link directly to the platforms and do not load their scripts until you click them.

12. How we keep your data secure

We are a community-led organisation, so our security rests on a few simple rules that every Leadership Collective member follows.

• Data lives in our organisational accounts (Google Workspace, email platform, event platforms), never in community members’ personal accounts or on personal devices beyond what a role needs.
• Access is granted by role and removed within 14 days of a Leadership Collective member stepping down; we review access lists every 6 months.
• Form responses and spreadsheets are shared with named people only, never by open link.
• Sensitive data (accessibility and dietary needs, equality monitoring, emergency contacts) is kept in restricted folders.
• We use providers that encrypt data in transit and at rest.
• Leadership Collective members and chapter leads complete a short data protection briefing and sign a Leadership Collective agreement that includes confidentiality.

If something goes wrong. We keep a breach log. If a breach is likely to risk your rights or freedoms we will tell the ICO within 72 hours of becoming aware of it, and we will tell you directly, without undue delay, if the risk to you is high.

13. Your rights

You have the following rights over your personal data. They are free to exercise, and we will respond within one month (extendable by two months for complex requests, in which case we will tell you why).

How to ask. Email privacy@waytagroup.com or write to Wayta Group Ltd, 4 Comet House, Calleva Park, Aldermaston, Berkshire, RG7 8JA. You do not need to use a form or cite the law. We may ask for information to confirm your identity or to locate the data; the one-month clock starts when we have what we need, and we will search our records reasonably and proportionately. If a request is clearly unfounded or excessive we may charge a reasonable fee or decline, and we will explain why.

Someone acting for you. A friend, relative or solicitor can make a request on your behalf if they show us your written authority.

Content already published. If you ask us to remove your name or image from content, see section 7 for what we can and cannot do.

14. Complaints

If you think we have handled your data badly, please tell us first so we can put it right. Email privacy@waytagroup.com with “Data protection complaint” in the subject line. As the Data (Use and Access) Act 2025 requires, we will acknowledge your complaint within 30 days, look into it, and tell you the outcome and any steps we have taken without undue delay.

You also have the right to complain to the UK regulator at any time:

• Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
• Helpline: 0303 123 1113
• ico.org.uk/make-a-complaint

If you are in the EU/EEA you may instead complain to your local data protection authority.

15. Changes to this policy

We review this policy at least once a year and whenever we add a new tool or activity. The date at the top shows when it was last updated. For significant changes, for example a new purpose for your data or a new category of recipient, we will email subscribers and post a notice on our website and community channels before the change takes effect. Earlier versions are available on request.