Privacy Policy

Unibots CIC privacy notice

This privacy notice tells you what to expect us to do with your personal information. Unibots CIC is the controller responsible for the uses described here. All event attendees must be 18 or older. Last updated: 02/11/2026.

Contact details

Email: contact@unibots.uk
Postal address: Office 482, 18 Young Street, Unit Lge, Edinburgh, Scotland, EH2 4JB.

What information we collect, use, and why

We collect or use the following information to provide services and goods, run events, coordinate volunteers and manage Unibots Hub accounts:

Names and contact details - to contact you and remind you about events you have signed up to or your account.
Photographs and match video recordings - to review games and, for photographs where you agree, promote our activities.
Presentation recordings from participant briefings, volunteer training and participant training - presenter voice or image, shared slides or screen, and any incidental attendee voice, image, name or chat captured while recording. We use these to make training available to the relevant participants or volunteers.
Service use history - events attended, volunteer participation, team participation and performance, and contact history.
Account and team activity - account use, invitations sent or received, when a member joins a team, and related timestamps - to run teams, show relevant history and resolve support or security issues.
Dietary information, including allergies - to provide food safely and manage relevant risks at events.
Information about access requirements and evacuation assistance, including health or disability details where needed - to arrange access, request a stage ramp, plan safe evacuation or respond to an emergency. We collect these through an event-specific secure form in the Hub. If an organiser needs to clarify a practical arrangement, they may email you individually from our Google Workspace account, and your reply may contain further access or health details.
Information about work and study, including your organisation (such as a university or college) and your course and year of study if you are a student - to connect teams and tailor the help we provide to students at different stages. We also use these details to produce aggregate impact statistics.
Information about interests and feedback - to improve the rule book, game and events.
Compliments and complaints - to respond and improve our services. We collect venue representatives’ names, roles and work contact details, event arrangements and brief meeting minutes to organise venues and follow up agreed actions. We collect or use the following information to receive donations or funding and organise fundraising:
Names, contact details, payment information supplied for the transaction, and donation or payment history - to process payments, keep financial records and meet applicable tax or accounting duties.
For sponsorship, a representative's name, role and work contact details, their organisation's financial or in-kind support (such as tools), report delivery and brief meeting notes - to manage the relationship, send agreed impact reports, discuss events and, where permitted, invite a discussion about future sponsorship.

We collect names, contact details, roles, proposals or portfolios, brief meeting notes and contract details from prospective and engaged freelancers and suppliers to consider and manage work for Unibots.

We collect or use the following information for service updates or marketing:

Names, contact details and marketing preferences - to send the updates you have requested and, where permitted, information about future events, newsletters, products, feedback, or fundraising.
Photos and videos - to promote the organisation, its causes and events. At check-in we ask whether you agree to be photographed. A blue lanyard indicates agreement; a red lanyard tells photographers not to photograph you. If someone with a red lanyard is captured, we blur them in any retained image and delete the unblurred original. You may change your choice by telling the event staff.
Records of consent and objections - to respect your choices.

We collect or use the following information for event safety, safeguarding and legal compliance:

Names and attendance records - to account for attendees in an evacuation.
Contact details, safeguarding information and relevant health or care information, where necessary - to respond to concerns or emergencies and meet applicable legal duties.

We collect or use names, contact details and correspondence to deal with queries, complaints or claims.

We arrange Google Meet calls with sponsors, prospective and engaged freelancers, participants and volunteers. We use names, email addresses, meeting dates and invitees, live audio and video, any in-meeting chat and brief notes to arrange and follow up. Routine sponsor and freelancer calls are not recorded. We do not use Meet transcription or AI meeting notes for these sessions. You may leave your camera off. We may record only the presentation or demonstration in a participant briefing, volunteer training or sponsor-led CAD session. We tell invitees in advance and announce the start and stop. Meet can capture the active speaker, shared screen and anyone who speaks during recording; it may also save chat or captions. We stop recording before Q&A, review the file and associated chat or captions, and remove any incidental attendee contribution before sharing. You can keep your camera off and hold questions until the unrecorded Q&A. Tell the host in advance if you object. We do not use these training recordings for promotion.

When you use our website or Unibots Hub, we automatically collect IP addresses, dates and times, full URLs visited, and aggregate activity such as knowledge base articles viewed. We use these records to protect and troubleshoot the service and to understand which help articles need improvement. URLs may contain information entered in a link, so we restrict access to raw logs. All sensitive information is sent over secure connections.

If you interact with our Instagram account or Discord server, we may see your profile name, public posts, comments, messages, server membership and moderation information. We use this to respond, run the community and enforce its rules. Meta and Discord also process information under their own Meta privacy policy and Discord privacy policy.

Team leads may choose to join our optional WhatsApp group to ask questions and receive updates about current and future events. If you join, we see your phone number, profile name, group membership and messages. Other members can see your phone number, profile details subject to your settings, and messages you post. You can leave at any time and still participate in events. WhatsApp LLC also processes information under its own UK privacy policy. We use team leads’ mobile numbers for one-to-one WhatsApp messages about events their team has registered for, including reminders, venue directions and quick practical help. This is separate from the optional group.

Health, disability, and allergy information is special category data, which receives extra legal protection. Please tell us the access or evacuation assistance you need; a diagnosis is usually unnecessary. We share only the practical requirements needed by the venue, such as a ramp request or evacuation assistance, and limit access to those who need it. We ask only for the practical detail needed; you may update the secure form instead of describing health details by email.

Lawful bases and data protection rights

Under UK data protection law, we must have a lawful basis for using your personal information. The basis depends on the particular use:

Events and accounts: contract where processing is necessary to provide a service you have requested; otherwise legitimate interests in running safe events, managing participation and improving our activities. Our legitimate interests include one-to-one WhatsApp coordination of registered events and practical help for team leads.
Optional participant check-ins: legitimate interests in answering questions and supporting participation; contract where a call is necessary to provide a requested service.
Volunteering: legitimate interests in coordinating volunteers, contacting them about event roles and running events safely. This includes optional Google Meet check-ins about event roles and support.
Limited training and briefing recordings: legitimate interests in making the presentation or practical demonstration available to relevant adult participants and volunteers who missed it or need to revisit it. We arrange permission to record and share a sponsor-led presentation separately with the sponsor and inform its individual presenter.
Access and evacuation planning: legal obligation where needed to make reasonable adjustments; otherwise legitimate interests in planning a safe event. Dietary health details: consent when volunteered.
Event photographs for promotion: consent, indicated by your choice at check-in. You can withdraw it by contacting us; we will stop new uses and remove images under our control where reasonably possible. Withdrawal does not undo use that was lawful before it. Match filming for game review: legitimate interests in reviewing play and improving events. Signs at the venue explain that filming takes place and link to this notice. We angle the cameras and footage to focus on the gameplay, rather than the audience. Footage may be used for promotion. Any red lanyards that are in the match footage will be cut and deleted promptly after the event (before uploading to Google Workspace Drive).
Website security, team activity and service improvement: legitimate interests in protecting our systems, operating teams, resolving disputes and improving help articles. We use identifiable activity only where needed and analyse article usage in aggregate where possible.
Course and year of study: legitimate interests in providing relevant support and measuring the reach and impact of our activities. We use individual details for support and report grouped results, combining or omitting small groups where a person could otherwise be identified.
Instagram and Discord interactions: legitimate interests in responding to enquiries, managing our communities and moderating content.
Optional team-lead WhatsApp group: legitimate interests in coordinating current events and responding to questions. We ask for your consent to receive announcements about future events through the group. Before you choose to join, we explain that it includes those announcements; we record your choice and you can leave at any time.
Donations and payments: contract where needed to process a transaction; legal obligation for records we must keep; legitimate interests for managing sponsor representatives, delivering agreed reports, discussing events and proportionate renewal contact. A contractual reporting promise to a sponsor organisation does not itself make legal obligation the basis for processing its representative's details. Arranged sponsor calls and brief follow-up notes are part of that relationship.
Freelancers and suppliers: contract or steps requested before a contract where necessary for an individual freelancer; otherwise legitimate interests in choosing and managing suppliers and their representatives. Legal obligation applies to records we must keep.
Venue representatives: legitimate interests in arranging event spaces and safety, managing venue contacts and documenting agreed actions.
Electronic direct marketing to individuals: consent where required by the Privacy and Electronic Communications Regulations. Operational messages about an event you have booked are sent as part of providing that service. We will not treat a service message as permission to send marketing. Inviting a sponsor to discuss supporting us again is marketing, including when it accompanies an impact report. We may email existing corporate sponsors' work contacts about renewal on the basis of legitimate interests, with a simple opt-out; for personal addresses, sole traders and relevant partnerships, we seek consent unless a valid exception applies. A required number is not WhatsApp marketing consent; we send such marketing only with separate, specific permission for this channel.
Event safety and legal compliance: legal obligation where a specific law requires the processing; otherwise legitimate interests in keeping attendees safe. In a serious emergency, vital interests may apply where processing is necessary to protect someone's life and they cannot give consent.
Safeguarding: recognised legitimate interests where necessary to safeguard a vulnerable individual under the applicable condition; legal obligation if a specific law requires us to act.
Queries, complaints and claims: legitimate interests in responding and establishing, exercising or defending claims; legal obligation where applicable.

For access, evacuation and allergy information that reveals health or disability, we ask for your separate, explicit consent under Article 9(2)(a) when you provide the details. In an emergency where you cannot consent, we may use relevant information to protect vital interests under Article 9(2)(c). If you choose to reply with further health or disability information, we use it for the same event access purpose under the explicit consent requested with the form. The form explains the email follow-up option.

Our legitimate interests are providing and improving events and online services, responding to people, protecting attendees and users, and managing our communities. We consider the impact on individuals before relying on these interests.

Your rights depend on the circumstances and the lawful basis. They include:

Access - to ask for copies of your personal information.
Rectification - to ask us to correct inaccurate or incomplete information.
Erasure - to ask us to delete information where the law allows.
Restriction - to ask us to limit its use.
Objection - to object to processing based on legitimate or recognised legitimate interests.
Data portability - to ask us to transfer information you gave us where processing is automated and based on consent or contract.
Withdrawal of consent - to withdraw consent at any time without affecting earlier lawful use.

You can object to direct marketing at any time. We will stop using your information for that purpose. You can also use the unsubscribe link in a marketing message or email us.

To exercise your rights, email contact@unibots.uk. We will respond without undue delay, normally within one month. If a request is complex or you have made several requests, the law may allow up to two further months; we will tell you within the first month if that applies.

Where we get personal information from

Directly from you.
From a team member who invites you to join a team.
Charities, voluntary organisations, schools, colleges, universities or other education organisations when they register or refer participants.
From a sponsor organisation if it gives us a representative's contact details or information about its support.
From venue representatives and their organisations when we arrange or discuss events.
From freelancers, suppliers, organisations they represent, and proposals or portfolios they give us when discussing work.
From sponsor organisations and individual presenters for their training sessions and materials.
Photographers, event recordings and CCTV where it is used.
Our own website, Hub and security logs, and your interactions with our Instagram account, Discord server or optional WhatsApp group.
Suppliers and service providers in connection with your booking, payment or enquiry.
Publicly available sources such as student union websites.

How long we keep information

We keep information only as long as needed for its purpose, subject to legal duties and necessary claims. We review records and delete or anonymise them sooner if no longer needed:

Account and identifiable event participation and volunteering records, including course and year of study: while you use your account and for five years after your last event registration, volunteering activity, or direct account activity. We review study details when updated and then delete or anonymise them unless a particular record is needed for a legal claim or financial duty.
Unaccepted team member and external organisation invitations: If an invite is not accepted within 30 days, the invite will expire and the email address used to invite is deleted from our server.
Raw security and website usage logs: 90 days, except for a documented incident, in which case it is kept until the security breach is fixed, + 180 days to document and improve procedure. Aggregate article statistics may be kept longer once individuals can no longer be identified.
Access, evacuation and dietary details: until 30 days after the relevant event, unless an incident requires us to keep a related record for longer, in which case it is kept until the incident is resolved + 90 days to improve procedure. We ask again for future events so arrangements remain current. We apply this same period to access-clarification emails and attachments in our Google Workspace mailboxes, including sent and received copies. We remove them from active mailboxes and Trash; residual provider backups follow Google's deletion process.
Routine Calendar invitations, persistent Meet chat and participant or volunteer check-in notes: up to one year after the call. We keep a relevant summary in an account or sponsor relationship record only when needed under its separate period. Access or health details follow the shorter event-specific period above.
Training and briefing presentation recordings: up to five years after the session, reviewed at least annually and deleted sooner if no longer useful or accurate. Any unedited copy containing an attendee contribution is removed once an approved version is ready, or discarded if it cannot be made suitable for sharing.
Event photographs: up to ten years after the event for promotion and documenting our activities, reviewed at least every two years and removed earlier if no longer needed or consent is withdrawn. If your photo is included in a report, we will ask for your explicit consent for it.
Match recordings: up to two years after the event and documenting our activities.
Marketing records: while you receive marketing; we keep a minimal record of an objection or unsubscribe to respect it.
Social media messages and moderation records: while needed to respond or manage the community, subject to the platforms' own retention practices.
WhatsApp group: we keep our own membership and opt-in records while needed to run the group and respect your choices, and messages while needed to manage event communications or queries. Copies of messages may remain with other group members or under WhatsApp's own retention practices after you leave. We keep direct event messages until the event and related query are resolved, unless a documented complaint or claim requires longer.
Sponsor relationship records: up to five years after sponsorship ends or the last substantive two-way sponsorship discussion, whichever is later. We review them at least annually and delete or anonymise them sooner if no longer needed. Sending an unanswered report or renewal email does not restart this period.
Venue relationship records and meeting minutes: up to five years after our last event with the venue or last substantive two-way discussion, reviewed at least annually and removed sooner if no longer needed. Sponsor and contractor minutes follow their respective periods in this notice.
Financial and donation records: six years from the end of the company financial year to which they relate, or longer where an applicable tax enquiry or legal duty requires. We do not use that period as a reason to retain full card details.
Freelancer and supplier proposals: if we do not engage them, up to one year after our decision. For those we engage, routine working notes are kept during the engagement and up to one year afterwards, unless a documented claim requires longer. Contracts and payment records follow the relevant financial or claims period.
Raw feedback: one year then anonymised.

At the end of the relevant period we delete or anonymise the information, unless we need to keep it for a documented legal reason.

Charities and voluntary organisations - we may share aggregated information about nearby teams, participation, courses and years of study in impact reports. We combine or omit small groups where a person could otherwise be identified. We share identifiable contact details for a referral only with your consent or another appropriate basis explained to you.
Venues and safeguarding organisations - the minimum information needed for access, ramp provision, evacuation and safety, ordinarily the practical requirement rather than a diagnosis.
Emergency services - relevant contact, health or care information when needed to respond to an incident.
HMRC, Companies House and the CIC Regulator - information required for accounts, CIC reporting, tax or other legal duties; routine reports do not necessarily include individual attendees' payment histories.
Funders, sponsors and the public may receive impact reports containing grouped course, year-of-study and participation figures, with small groups combined or omitted to prevent identification. In some cases, we may wish to do a case study or include a quote from you, in this case, we will ask for your explicit consent to be included in a report, and limit to first names and universities.
The Co-operative Bank and Sage receive transaction and accounting information. Hetzner hosts the Hub on a server in Germany, including the account, team, event, access, usage and security information described above. MailerSend receives recipient addresses, service-message content, and delivery information to verify email addresses, send account and event emails with no link tracking. Google Workspace (Gmail and Drive) stores correspondence, documents, event photographs and match footage, including names, email addresses, messages, attachments, agreements, invoices and receipts. These services receive information relevant to their role under the applicable service arrangements. Google Workspace Calendar and Meet process invitations and live calls; Google Chat may retain messages if continuous meeting chat is enabled. Other meeting invitees may see your display name and what you say or share. Google Workspace Gmail may also hold event access clarification emails and replies; access is limited to organisers who need them for the event.
Google Workspace Drive stores training and briefing recordings. We share approved files only with the relevant participants or volunteers and organisers through restricted access, not publicly. A sponsor presenter may appear in the approved recording under the agreed training arrangements.
Notion may hold sponsor, venue, and contractor contact records and brief meeting minutes. We limit access to organisers who need the records and do not store attendees’ access or health details in Notion.
Meta (Instagram) and Discord host our social spaces. Posts and messages you send there may be visible to their users or our moderators according to the platform and server settings.
WhatsApp LLC provides the optional team-lead group. Other group members can see your phone number and the messages you post. It also handles one-to-one event messages and may process team leads’ numbers, messages and delivery information.

We disclose information to other organisations where the law requires it or where a proportionate disclosure is needed to protect people or handle a legal claim. We do not share more than is necessary.

International transfers: the Hub information described above is hosted by Hetzner in Germany. MailerSend documents hosting in Belgium, but its agreement also allows processing in the United States and elsewhere. Google Workspace may process information in the United States and other countries. UK adequacy regulations cover EEA countries including Germany and Belgium. WhatsApp LLC provides the optional group from the United States and may process group information in other countries. Notion stores workspace content in the United States by default and may process it in other countries through its service providers.

Some providers may process data outside the UK/EEA (e.g., in the US). For restricted transfers we rely on UK adequacy regulations where applicable, including the UK Extension to the EU–US Data Privacy Framework for covered transfers to Google LLC and Notion Labs, Inc. Otherwise we use an appropriate safeguard, such as the UK Addendum to EU Standard Contractual Clauses, with a transfer assessment where required. We do not sell or share your data for advertising purposes.

We use MailerSend, Inc. to verify email addresses are legitimate, alongside sending account, team invitation, and event emails. It receives recipients' email addresses, the content of those emails and delivery information; we do not send accessibility information through MailerSend. MailerSend states that it hosts service data in Belgium, but its US-based entity may also process this information in the United States. For transfers to MailerSend in the United States, we rely on the 2021 EU standard contractual clauses, as modified by the UK International Data Transfer Addendum incorporated into MailerSend's Data Processing Addendum. You can request a copy of the applicable safeguards by contacting us.

Information you must provide: we need your name and contact details to set up an account or register you for an event, and the information needed to complete a payment if you buy something or donate. Without these, we may be unable to provide the relevant service. Information about adjustments is optional, but without relevant details we may be unable to arrange the adjustment or plan for a known risk. Team leads must also provide a mobile number for WhatsApp reminders and practical help about registered events; without it, they cannot complete team setup.

We do not make solely automated decisions about you that have legal or similarly significant effects.

How to complain

If you have concerns about our use of your personal information, contact us at unibots.uk/contact or contact@unibots.uk.

If you remain unhappy after raising a complaint with us, you can complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

We will update this notice when our practices change and show the latest revision date above.

Back to site Cookie policy