Who we are
The North West Endocrine Society (“the Society”, “we”) is the controller of the personal data described in this notice. That means we decide how and why it is used, and we are responsible for looking after it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and for cookies under the Privacy and Electronic Communications Regulations (PECR).
Our registered address is [Registered address — to be confirmed by the Society]. Our registration number with the Information Commissioner’s Office is [ICO registration number — to be confirmed]. How to reach us is under Contact us.
What we collect
- Your account: your name and title, email address, phone number, where you work and your role, and your password, which we store only in a form that cannot be turned back into the password. We also record which version of this notice you were shown when you created your account, and when.
- Your membership application: your workplace and department, your role, your professional registration body and registration number, your qualifications and interests, how you heard about us, the category and career stage you apply for, whether you work outside the UK, and the name and email address of a proposer if you give one.
- Concession requests: if you apply for a reduced fee, the reason you give. Please don’t include health information.
- Membership and payment records: your membership number, category and dates, the fees raised and the payments the Society records against them. This website does not take card details.
- Event bookings: the events you book, waiting-list places, cancellations and attendance.
- Server logs: when you use the site, our servers record technical details such as your IP address, the address requested, the time and your browser type.
If you are named as a proposer: an applicant has given us your name and email address so the membership secretary can contact you about their application. We use them only for that, and this notice is how we tell you about it. You have the same rights as anyone else whose data we hold, including the right to object.
How we use it
Data protection law requires a lawful basis for each thing we do with personal data. Ours are:
| Purpose | Lawful basis |
|---|---|
| Creating your account, considering your application and running your membership, including fees, renewals and emails about them | Contract: the steps you ask us to take before you join, and providing your membership |
| Booking you onto events, managing waiting lists and telling you about changes to events you booked | Contract; once an event is over, legitimate interests (keeping evidence of attendance for CPD) |
| Keeping records of fees and payments | Legal obligation: financial record-keeping |
| Checking applications against the category's criteria, including your professional registration | Legitimate interests: making sure members meet the criteria for the category they join |
| Contacting the proposer you name | Legitimate interests: confirming your application |
| Keeping the site and your account secure: sign-in sessions, limits on repeated sign-in attempts and server logs | Legitimate interests: protecting members' accounts and the service |
| Keeping an audit trail of changes Society staff make to records, and of the privacy notice you were shown | Legitimate interests: accountability for how the Society handles members' data |
Where we rely on legitimate interests, we do so only where your rights do not outweigh them, and you can object (see Your rights). We do not use your details for marketing, we do not sell them, and we make no decisions about you by automated means alone.
We do not ask for health information or any other special category data. Please leave it out of anything you write in a free-text answer.
Emails we send
When we email you, it is only about something you have asked us to do: your account, your application and its outcome, your membership and fees, and events you have booked. We do not send marketing or newsletters, and we do not track whether you open our emails or follow their links.
Transfers outside the UK
Personal data is stored in the UK. Our technology partner is based in India and may access it remotely when supporting the service. Whenever personal data is accessed from outside the UK we make sure it stays protected to UK standards: either the country is covered by UK adequacy regulations, or the transfer is covered by safeguards recognised under UK law, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguards that apply.
How long we keep it
We keep personal data only as long as we need it. These periods are applied automatically every day:
| Data | Kept for |
|---|---|
| Signed-out or expired sign-in sessions | Deleted 7 days after they expire or you sign out |
| Accounts that never applied, joined or booked an event | Erased 12 months after the account was created |
| Rejected or withdrawn applications | Deleted 12 months after the decision |
| The reason given for a concession | Cleared 13 months after the decision on the application |
| Lapsed or cancelled members (with no later membership, not suspended and not staff) | Erased 2 years after the membership ended |
| Payments | Deleted 6 years after the end of the calendar year they were raised in |
| Cancelled event bookings | Deleted 30 days after the event |
| Other event bookings | Deleted 6 years after the event, as evidence of CPD |
| Staff audit log | 6 years |
| Web server logs (IP address, page requested and time) | Deleted after 14 days |
| Database backups | Overwritten after 14 days |
When an account is deleted, we cancel the membership and any future bookings and remove the name and contact details straight away. Your membership number and dates, your payment records and past event bookings stay until their period above ends, because the law requires us to keep financial records, but they are no longer linked to your name.
Keeping it secure
We protect personal data with measures suited to the risk, including:
- encryption of everything sent between your browser and this website (HTTPS);
- passwords stored only as one-way hashes, and limits on repeated sign-in attempts;
- staff access limited to those who need it, with an audit trail of the changes they make;
- nightly backups of the database, kept for 14 days.
If a breach puts your personal data at risk, we will tell you and the ICO as the law requires.
Your rights
- Access: download a copy of the data in your account at any time from My details using Download my data, or ask us for everything we hold about you.
- Rectification: correct your details yourself in My details, or ask us to.
- Erasure: use Delete my account in My details, or ask us. Records the law requires us to keep stay until their period ends, as explained above.
- Restriction: ask us to stop using your data while a concern is looked into.
- Objection: object to anything we do on the basis of legitimate interests.
- Portability: the download is a machine-readable JSON file you can take elsewhere.
We answer requests within one month, and there is normally no charge.
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office, the UK regulator for data protection, at ico.org.uk.
Contact us
For anything about your personal data, including requests to use the rights above, contact:
- Controller
- North West Endocrine Society
- Address
- [Registered address — to be confirmed by the Society]
- [privacy contact email — to be confirmed]
- ICO registration
- [ICO registration number — to be confirmed]
Changes to this notice
We update this notice when the way we use personal data changes, and tell members about significant changes. This is version 2026-10, last updated in October 2026.