1. Who we are
Manchester AI Guild ("the Guild") helps Greater Manchester organisations adopt AI responsibly. The Guild is not-for-profit. We are the data controller for the personal data in this notice. A data controller decides why and how personal data is used.
Legal form: Manchester AI Guild Ltd, a private company limited by guarantee (company number 17490801, incorporated 30 September 2026).
Registered office: 1 Southern Road, Sale, England, M33 6HP.
ICO registration: we are registered with the Information Commissioner's Office (ICO) as a data controller. Registration reference ZC266348, registered 5 October 2026, renewal due 4 October 2027. You can check this on the ICO's public register: https://ico.org.uk/ESDWebPages/Search
Data Protection Lead: Trevor Roberts, report@manchesteraiguild.com.
Reporting contact for Code of Conduct, risk and compliance matters: Edwin Luther, report@manchesteraiguild.com.
Defined terms
Personal data: information that identifies you, or could do so with other information we hold.
Processing: anything we do with personal data, such as collecting, storing, using, sharing or deleting it.
Lawful basis: the reason UK GDPR Article 6 allows us to process your data.
2. What this notice covers
This notice covers personal data we collect through manchesteraiguild.org, at Guild events, in the Guild's community channels, and in the Guild's own governance work. That includes reports, surveys and business engagement. It does not cover other organisations we link to, such as LinkedIn, Slack or Venture Café Manchester. Those organisations have their own notices.
3. What personal data we collect and where it comes from
Almost everything we hold comes directly from you.
| Where | What | Source |
|---|---|---|
| The join page: membership interest and newsletter | Name, email, organisation (optional), which part of The Manchester Way is holding you back, and whether you ticked the consent box | You |
| The join page: workshop feedback | Which workshop, a rating from 1 to 5, an optional comment, and an optional email if you want a reply. Feedback is anonymous unless you add an email. | You |
| The join page: speaker booking enquiry | Name, email, organisation, event, date (optional) and topic | You |
| Bot protection on the join page | Cloudflare Turnstile checks your browser and may process your IP address. We store only a hashed (one-way) form of your IP address, for up to one hour, to limit repeat submissions. The raw IP address is not kept with your submission. | Your browser, via Cloudflare |
| Email and other correspondence | What you send us, and our replies | You |
| Events | Registration details held by the event host (for example Venture Café Manchester), and photographs of the room and speakers | You, the event host, the Guild photographer |
| Community channels | Your Slack profile and messages. Slack's terms and privacy policy apply once you join. | You |
| Code of Conduct reports and complaints | What you tell us, and our record of how we handled it | You, witnesses |
| Surveys, readiness assessments and polls | Your answers, stated on each form | You |
| Business engagement intake | Organisation contact, need and budget band, when an organisation asks to be matched to a practitioner | You |
| Website visits | Cloudflare serves the site. It does not keep HTTP request logs for the site by default, and the Guild keeps none. The site sets no cookies. See the Cookie policy. | Your browser |
We do not collect special-category data on purpose. If a form needs it, for example to arrange access for an event, we ask separately and with your explicit consent. We delete it after the event.
4. Why we use it and our lawful basis
| Purpose | Data | Lawful basis (UK GDPR Article 6) |
|---|---|---|
| To reply to you and route you to the Guild member or sponsor best placed to help | Name, email, organisation, which part of The Manchester Way | Legitimate interests, 6(1)(f): running a membership community you have asked to hear from |
| To email you about Guild membership, workshops and news | Name, email | Consent, 6(1)(a), given by ticking the box on the join page. You can withdraw it at any time. |
| To plan workshops | Aggregated counts of which part of The Manchester Way people pick, with no names attached | Legitimate interests, 6(1)(f) |
| To improve workshops | Workshop feedback (rating, comment, optional email) | Legitimate interests, 6(1)(f) |
| To reply to a speaker booking enquiry and arrange the booking | Name, email, organisation, event, date, topic | Legitimate interests, 6(1)(f), and steps at your request before a contract, 6(1)(b) |
| To run membership once you have joined | Membership record (name, email, organisation, join date, role) | Contract, 6(1)(b): the Membership terms |
| To investigate and resolve Code of Conduct reports and complaints | Reports, correspondence, decisions | Legitimate interests, 6(1)(f): safety of the community |
| To assess readiness and improve the Guild's support | Survey answers. Results are published only in aggregate. | Consent, 6(1)(a), stated on each form |
| To match an organisation to a practitioner | Business engagement intake | Legitimate interests, 6(1)(f), and pre-contract steps, 6(1)(b) |
| To keep the website and form safe from bots and abuse | Turnstile signals, hashed IP address | Legitimate interests, 6(1)(f): security |
| To handle rights requests and legal obligations | Correspondence and records of the request | Legal obligation, 6(1)(c), and legitimate interests, 6(1)(f) |
We do not make decisions about you by automated means that have legal or similar effects. We do not profile you. Member and organisation data is not used to train AI models (Data governance policy, section 6).
5. Who we share it with
We do not sell personal data. We do not pass your details to sponsors or other members unless you ask us to make an introduction. We use these processors and services:
Cloudflare: hosts the website, runs the join form, stores submissions in a Cloudflare D1 database, and provides Turnstile bot protection.
Slack: the Guild's community channel. A new sign-up sends a notification to a private Guild Slack channel. It says that a sign-up happened and which part of The Manchester Way was picked. It does not include your name, email or comment.
LinkedIn: if you follow the Guild's page, LinkedIn processes that under its own notice.
Google Fonts: the site loads its typefaces from Google's servers, so Google receives your IP address with the font request.
Fastmail: hosts the Guild's mailboxes (hello@, and report@manchesteraiguild.com).
GitHub: hosts the Guild's public and private repositories. No personal data is stored in them (Data governance policy).
We may also share data where the law requires it, for example with the ICO or a court.
Our record of processing activities, which UK GDPR Article 30 requires, combines the tables in this notice with the Guild's technology register. Each processor is listed in the technology register with its owner.
6. International transfers
Cloudflare, Slack, LinkedIn, GitHub and Google are based in the United States. When personal data goes to a US provider certified under the UK Extension to the EU-US Data Privacy Framework, the transfer is covered by UK adequacy regulations (the UK-US data bridge, 2023). Otherwise we rely on the provider’s UK International Data Transfer Agreement or the UK Addendum. The join-form database (Cloudflare D1) is created with the Western Europe location hint. Submissions are therefore stored in Western Europe.
7. How long we keep it
| Record | Retention |
|---|---|
| Raw join-page submissions in the Cloudflare database | 90 days, then purged. Within that time the details move to the membership or newsletter list. |
| Membership-interest and newsletter details | 24 months from your last contact with us, then deleted |
| Membership records | Duration of membership plus 12 months |
| Workshop feedback | 12 months, then anonymised (the rating is kept; everything identifying is removed) |
| Speaker booking enquiries | 24 months after the enquiry or event closes |
| Hashed IP counters | 1 hour |
| Cloudflare server logs | Not retained |
| Email correspondence with members and enquirers | 24 months after membership ends or the thread closes |
| Complaints, Code of Conduct reports and rights-request records | 3 years after the matter closes |
| Survey responses | Raw responses 24 months; aggregates kept |
| Business engagement intake | Duration of the engagement plus 6 years, for accounting records |
| Photographs | Until consent is withdrawn |
| Slack content | 24 months for messages, as set by the workspace admin |
The full list, with triggers and owners, is in the Data retention schedule.
8. Your rights
Under UK GDPR you have these rights. Using them is free. We respond within one month of receiving your request. For complex or numerous requests we may extend that by two further months (UK GDPR Article 12A, inserted by section 76 of the Data (Use and Access) Act 2025). The Information Commissioner's Office (ICO) says organisations usually have one month to respond to a subject access request.
To be informed: this notice.
Access: a copy of the personal data we hold about you, and the details in sections 4 to 7.
Rectification: correction of inaccurate data, or completion of incomplete data.
Erasure: deletion of your data when we no longer need it, when you withdraw consent, or when you object and we have no overriding reason to keep it.
Restriction: a pause on processing while we resolve a question about accuracy or our lawful basis.
Portability: the data you gave us under consent, in a machine-readable form.
Objection: to processing based on legitimate interests, and to direct marketing. We always stop direct marketing when you object.
Automated decision-making: the right not to be subject to a solely automated decision with legal or similar effect. We do not make such decisions.
To use any of these rights, email the Data Protection Lead at report@manchesteraiguild.com or write to the registered office. You do not need to use any particular words. We may ask you to confirm your identity. The one-month clock pauses until we receive it. The steps we follow are in the Complaints and data rights procedure.
9. How to withdraw consent
If you ticked the box to hear from us, you can change your mind at any time. Click unsubscribe on any email we send, or email report@manchesteraiguild.com. Withdrawing consent does not affect what we did before you withdrew it. It does not remove you from the community Slack. You can leave Slack yourself at any time.
10. Security
The website is served over HTTPS only. The join form is protected by Cloudflare Turnstile, input limits and a rate limit. Submissions are stored in a Cloudflare database. Only Guild SLT members with Cloudflare access can read it. Notifications to Slack never include your name, email or free text. Secrets are held in a secrets manager, never in repositories.
If we discover a personal data breach that is likely to risk your rights, we will tell the ICO without undue delay and, where feasible, within 72 hours. We will also tell you without undue delay (Incident response procedure).
Keep your own account secure. Use a unique password, do not share your sign-in details, and turn on multi-factor authentication (MFA) wherever a platform offers it. We never ask you for your password.
11. Children
This website and Guild membership are for adults. We do not knowingly collect personal data from anyone under 16. For online services offered directly to children, consent is valid from age 13 (UK GDPR Article 8(1)). If you believe a child has given us data, email us and we will delete it.
12. Changes to this notice
We review this notice at least every 12 months, and whenever our processing changes. The version and date at the top show which version you are reading. We announce material changes on the website. Where we have your consent to email you, we also send an email.
13. How to complain
If you are unhappy with how we have handled your data, tell us first. Email the Data Protection Lead at report@manchesteraiguild.com and we will try to put it right. If you are not satisfied, the matter goes to Edwin Luther and then to the Guild SLT, as the Complaints and data rights procedure explains.
You also have the right to complain to the Information Commissioner's Office (ICO):
Online: https://ico.org.uk/make-a-complaint/data-protection-complaints/
Phone: 0303 123 1113, or live chat on the same page
14. Roles and responsibilities
| Role | Holder | Responsibilities |
|---|---|---|
| Data Protection Lead | Trevor Roberts | Maintains this notice. Answers rights requests. Advises on breach notifications. Reports to the Senior Leadership Team (SLT). |
| Primary responsibility | Edwin Luther, Risk & Governance Director | Handles escalations. Keeps the technology register current. |
| Secondary responsibility | Trevor Roberts, Data Protection Lead | Acts when the primary holder is unavailable, or where the matter concerns the primary holder. |
| Senior Leadership Team (SLT) | Manchester AI Guild SLT | Approves this notice and every review of it. Receives it yearly. |
| Independent QA reviewer | Any SLT member | Reviews this notice before it goes to the Senior Leadership Team (SLT). Must be a Manchester AI Guild member who did not draft it. |
15. Review
This notice is reviewed as often as is reasonable and, as a minimum, once every 12 months. It is reviewed sooner whenever something changes that affects it, for example when our processing changes or we add a new processor.
The Senior Leadership Team (SLT) approves every review.
Before a review goes to the Senior Leadership Team (SLT), a Manchester AI Guild member who did not draft this notice QA reviews it. The reviewer is never the author. The reviewer's name and the date of the QA review are recorded in the version history.
16. Related policies
Cookie policy · Data retention schedule · Complaints and data rights procedure · Data governance policy · Incident response procedure · Code of conduct
17. References and sources
Information Commissioner's Office (n.d.) Make a complaint: data protection complaints. [online]. Available at: https://ico.org.uk/make-a-complaint/data-protection-complaints/ [Accessed 2 November 2026]. Quote: "call us on 0303 123 1113 or live chat with us".
Information Commissioner's Office (n.d.) Search the register. [online]. Available at: https://ico.org.uk/ESDWebPages/Search [Accessed 2 November 2026]. Quote: "Search for organisations and people registered with the Information Commissioner's Office".
UK General Data Protection Regulation, Article 6(1)(a). Available at: https://www.legislation.gov.uk/eur/2016/679/article/6 [Accessed 2 November 2026]. Quote: "the data subject has given consent to the processing".
UK General Data Protection Regulation, Article 12(1). Available at: https://www.legislation.gov.uk/eur/2016/679/article/12 [Accessed 2 November 2026]. Quote: "using clear and plain language".
UK General Data Protection Regulation, Article 13. Available at: https://www.legislation.gov.uk/eur/2016/679/article/13 [Accessed 2 November 2026]. Quote: "provide the data subject with all of the following information".
UK General Data Protection Regulation, Article 30(1). Available at: https://www.legislation.gov.uk/eur/2016/679/article/30 [Accessed 2 November 2026]. Quote: "shall maintain a record of processing activities under its responsibility".
UK General Data Protection Regulation, Article 33(1). Available at: https://www.legislation.gov.uk/eur/2016/679/article/33 [Accessed 2 November 2026]. Quote: "not later than 72 hours after having become aware".
UK General Data Protection Regulation, Article 34(1). Available at: https://www.legislation.gov.uk/eur/2016/679/article/34 [Accessed 2 November 2026]. Quote: "without undue delay".
UK General Data Protection Regulation, Article 8(1). Available at: https://www.legislation.gov.uk/eur/2016/679/article/8 [Accessed 2 November 2026]. Quote: "the child is at least 13 years old".
UK General Data Protection Regulation, Article 12A (inserted by the Data (Use and Access) Act 2025, section 76). Available at: https://www.legislation.gov.uk/ukpga/2025/18/section/76 [Accessed 2 November 2026]. Quote: "the period of one month beginning with the relevant time".
Information Commissioner's Office (n.d.) Getting copies of your information (subject access request). [online]. Available at: https://ico.org.uk/for-the-public/getting-copies-of-your-information-subject-access-request/ [Accessed 2 November 2026]. Quote: "Organisations usually have one month to respond to a SAR."
18. Version history
| Version | Date | Author | Reason for change | Presented to SLT | Signed off |
|---|---|---|---|---|---|
| v1.10 | 2 November 2026 | Edwin Luther | Rewritten in plain English for public readers. Sentences shortened. Time limit (Article 12A) and age of consent (Article 8(1)) verified and cited. Transfer basis (UK-US data bridge or IDTA/Addendum) verified. Cloudflare storage described as Western Europe, matching the location hint. ICO complaint page and helpline cited. Sources list added. | — | — |
| v1.9 | 12 October 2026 | Edwin Luther | Not-for-profit stated as how the company operates rather than as a filed characteristic; breach timing aligned to UK GDPR Article 33; account-security and MFA expectations added; orphaned citation fragment removed. | — | — |
| v1.8 | 12 October 2026 | Edwin Luther | Retention of correspondence split from complaints and rights requests, matching the Data retention schedule. Ownership clarified: the Risk & Governance Director owns the notice, the SLT approves it and the Data Protection Lead maintains it. Stale incorporation trigger and the not-for-profit fee exemption reference removed. | — | — |
| v1.7 | 12 October 2026 | Edwin Luther | Registered office corrected to the filed address; the Data Protection Officer label removed, the role being a Data Protection Lead and not a statutory DPO under UK GDPR Article 37. | — | — |
| v1.6 | 8 October 2026 | Edwin Luther | ICO registration added (ZC266348, registered 5 October 2026), replacing the not-for-profit fee exemption; legal form updated to Manchester AI Guild Ltd (company no. 17490801); registered office placeholder updated; Trevor Roberts named as DPO. | — | — |
| v1.5 | 24 September 2026 | Edwin Luther | Review cycle set to a minimum of once every 12 months, approved by the Senior Leadership Team (SLT), with QA review by a Manchester AI Guild member who did not draft the document. | — | — |
| v1.4 | 24 September 2026 | Edwin Luther | Reporting and escalation route changed to report@manchesteraiguild.com; ownership allocated to Edwin Luther, Risk & Governance Director, with Trevor Roberts as secondary. | — | — |
| v1.3 | 20 September 2026 | Edwin Luther | Data Protection Officer role replaced by Data Protection Lead (to be appointed) and the dpo@ mailbox by report@manchesteraiguild.com, following #75. Article 38 clause removed from the Data Protection Lead row; the role is not a statutory DPO. Holder now kept in step with the responsibilities register. | — | — |
| v1.2 | 17 September 2026 | Edwin Luther | Independent critique applied: IP-hash wording clarified; children's age threshold explained against the UK age of 13; DPO independence (Art. 38) and the record of processing activities (Art. 30) stated. Compliance lint (scripts/policy-tools.mjs) passed with 0 errors. | — | n/a |
| v1.1 | 17 September 2026 | Edwin Luther | MAIG standard applied; merged the operations privacy-policy.md v0.1 rows (reports, surveys, engagement intake, no model training) into the website notice; ICO fee exemption cited to the Regulations; references and version history added. | — | — |
| v1.0 | 16 September 2026 | Edwin Luther | First website draft against the ICO privacy-information checklist; assumptions register A1–A19. | — | — |