Privacy notice
Last updated 11 August 2026 · Yorkshire Urology Audit Group
- We collect what we need to run the meeting: your name, email, grade and hospital.
- If you tell us about dietary or access requirements, that is sensitive information. We ask for your explicit consent, use it only for catering and venue arrangements, and delete it soon after the meeting.
- We do not use advertising or analytics cookies, and we do not track you across the web.
- We never sell your data and we do not share it with sponsors.
- You can ask us to show you, correct or delete your data at any time — email yuag.urology@gmail.com.
1. Who we are
The Yorkshire Urology Audit Group (“YUAG”, “we”) is a volunteer-run regional group of urology clinicians. We organise the YUAG Annual Audit Meeting, held on 2–3 November 2026 at the Hilton Leeds City.
For the purposes of the UK GDPR and the Data Protection Act 2018, YUAG is the data controller for the information described in this notice. We are not an NHS body, and this website is not an NHS system, although most of our delegates are NHS staff.
You can reach us about anything in this notice at yuag.urology@gmail.com.
2. What we collect and why
We only collect information you give us directly through this website. We do not buy lists or scrape contact details.
| What | Why we need it | Lawful basis |
|---|---|---|
| Name | To register you, produce your badge and issue your CPD certificate | Contract |
| Email address | To confirm your place and send joining instructions | Contract |
| Grade and hospital / institution | To plan the programme and confirm eligibility to attend | Legitimate interests |
| Whether you are attending the conference dinner | To give the venue accurate numbers | Contract |
| Dietary requirements | Catering — see section 3 | Explicit consent |
| Access requirements | Venue and accessibility arrangements — see section 3 | Explicit consent |
| Abstract submissions (title, authors, institution, body, uploaded file) | To review, score and publish accepted work in the abstract booklet | Contract and legitimate interests |
| Certificate records (name, certificate type, presentation title) | So a CPD certificate can be verified as genuine | Legitimate interests |
Where we rely on legitimate interests, our interest is running a regional educational meeting competently. We have considered whether this overrides your interests and concluded it does not, because the data is limited, expected in this context, and used only for the meeting.
3. Dietary and access requirements
These two fields need saying plainly, because the law treats them differently from the rest.
Telling us that you need a halal or kosher meal can reveal your religious belief. Telling us that you need step-free access, a hearing loop or a BSL interpreter can reveal information about your health or disability. Both are “special category data” under Article 9 of the UK GDPR, which means we need your explicit consent before we can process them.
That is why these fields are optional and separately ticked on the registration form. If you would rather not put them in writing on a website, leave them blank and email us instead — it makes no difference to your place at the meeting.
We use this information for one purpose only: telling the venue how many special meals to prepare and what access arrangements to make. It is never used to make any decision about you, never shared with sponsors, and deleted sooner than the rest of your registration (see section 6).
You can withdraw your consent at any time by emailing us, and we will erase those fields without affecting the rest of your registration.
4. Who we share it with
We do not sell your data, and we do not pass it to sponsors or exhibitors.
We share it only with the suppliers who make the meeting work:
- Cloudflare, Inc. — hosts this website and stores the registration database and uploaded abstract files.
- Resend — sends the confirmation and joining emails.
- The venue (Hilton Leeds City) — receives aggregate catering numbers and any dietary or access requirements needed to serve you. We give them the minimum necessary and, wherever possible, without names attached.
- Google — the committee’s contact mailbox is a Google account, so emails you send us are stored there.
If an accepted abstract is published in the meeting’s abstract booklet, the author names, institutions and abstract text appear in that booklet and may be circulated to delegates. That is the purpose of submitting, but it is worth being explicit about.
5. Where your data is processed
Our suppliers are US-headquartered companies operating global infrastructure. Your data may therefore be processed outside the United Kingdom.
We rely on the UK Extension to the EU–US Data Privacy Framework (the “UK–US Data Bridge”) and, where that does not apply, on the International Data Transfer Addendum, to give your data the protection UK law requires. You can ask us for details of these safeguards.
6. How long we keep it
| What | Kept for |
|---|---|
| Dietary and access requirements | Erased within 30 days of the meeting |
| Registration details (name, email, grade, hospital) | 12 months after the meeting, so we can handle CPD queries and tell you about the next one |
| Abstract submissions and uploaded files | 3 years, as they form the academic record of the meeting |
| Certificate records | 6 years, so a CPD certificate can still be verified for appraisal and revalidation |
| Administrative audit log | 12 months |
After these periods the data is deleted or irreversibly anonymised.
7. Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased — for registration data we can almost always do this immediately;
- object to, or ask us to restrict, what we do with it;
- receive your data in a portable, machine-readable format;
- withdraw consent for the dietary and access fields at any time.
To exercise any of these, email yuag.urology@gmail.com with “Data request” in the subject line. We will respond within one month, and it is free.
8. How we protect it
- The whole site is served over HTTPS, and the connection is encrypted in transit.
- The committee console that holds delegate details is behind single sign-on, restricted to named committee members, and every administrative action is written to an audit log.
- Registration and abstract data is stored in Cloudflare’s managed database and object storage, encrypted at rest.
- We use no advertising, analytics or profiling tools — see our cookie notice.
- We keep the number of people with access as small as the meeting allows.
No system is perfectly secure. If you believe your data has been put at risk, please tell us straight away so we can investigate and, where required, report it to the Information Commissioner within 72 hours.
9. Contact and complaints
Please come to us first — email yuag.urology@gmail.com and we will do our best to put things right.
If you are not satisfied, you have the right to complain to the UK supervisory authority:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline 0303 123 1113 · ico.org.uk/make-a-complaint
We may update this notice as arrangements for the meeting are confirmed. Material changes will be flagged on this page with a new “last updated” date. See also our terms and conditions and cookie notice.