Privacy Notice

Work the Room and Read the Room Privacy Notice

Last updated: 29 July 2026

1. Who we are

Work the Room and Read the Room are operated by Robert S J Lucas Ltd.

Robert S J Lucas Ltd is the data controller responsible for the personal information described in this notice.

Company number: 06182370
Email: hello@worktheroom.co
Postal address: 4/8 Paisley Close, 101 High Street, Edinburgh, EH1 1SP

Please contact us if you have questions about this notice or how we use personal information.

2. What Work the Room does

Work the Room helps people keep a private record of the professional events and activities they attend.

People can use it to:

• record events and activities;
• note why they attended;
• record outcomes, ratings and follow-up intentions;
• add private notes or photographs;
• set reminders;
• receive personal summaries and Momentum Reports;
• identify patterns across the events they attend.

Read the Room is the organiser-facing insight service within Work the Room. It uses anonymised or aggregated attendee responses to help participating organisers understand the role their event appeared to play, what attendees gained and what could improve future events.

Work the Room does not publicly rank attendees, organisers or events.

3. Information we may collect

Depending on how you use the service, we may collect:

Account and contact information

• your name;
• your email address;
• your subscriber or attendee identifier;
• your communication preferences;
• records of when and how you signed up or gave permission;
• correspondence and support requests.
• Information connected with prize draws, including eligibility, entry status, winner selection, correspondence and prize fulfilment.

Event information

• the event or activity attended;
• the event date;
• event type and attendance format;
• venue or general location;
• ticket price, where recorded;
• event organiser or partner identifiers;
• whether you had attended before.

Your event responses

• why you attended;
• what you gained from the event;
• ratings and likelihood of attending again;
• suggested improvements;
• answers to event-specific or occasional questions;
• reminders and follow-up intentions;
• photographs you choose to upload;
• private notes you choose to add;
• feedback about Work the Room or its reports.

Technical and administrative information

• submission dates and times;
• source links, campaign identifiers and survey versions;
• basic device, browser or website-use information where supplied by our providers;
• records used to detect errors, duplicate submissions, misuse or security problems.

We do not intentionally request special-category information such as health information, political opinions, religious beliefs, sexual orientation or ethnicity. Please avoid including this type of information in free-text answers or private notes unless it is genuinely necessary.

4. How personal event records are handled

Each registered attendee is assigned an identifier so that entries from different events can be connected to the correct personal record.

Contact details are stored separately from the main event-response dataset wherever reasonably practical. The event dataset normally uses an attendee identifier rather than an email address.

This reduces privacy risk, but information linked through an attendee identifier may still be personal information because it can be reconnected to the registered attendee.

Your personal event record may be used to:

• return your entries to you;
• calculate your event history and milestones;
• prepare Momentum Reports;
• identify changes and patterns across time;
• generate relevant reminders or prompts;
• improve the personal insights provided to you.

Your personal record, private notes and individual event history are not supplied to event organisers.

5. Information used for Read the Room

Where an event participates in Read the Room, relevant event responses may contribute to an organiser report.

Organisers may receive:

• combined response counts and proportions;
• anonymised themes and observations;
• patterns in attendee motivations and outcomes;
• ratings and return-intention summaries;
• broad improvement signals;
• anonymised extracts or paraphrased comments;
• trends across several events;
• practical questions or recommendations.

Organisers do not receive:

• attendee email addresses;
• named individual responses;
• personal event histories;
• private notes;
• attendee-level profiles;
• information intended only for an attendee’s Momentum Report.

We may apply minimum response thresholds, group small categories together, paraphrase free text or withhold details where reporting them could make an individual reasonably identifiable.

6. How we use information

We may use personal information to:

Provide the service

• register attendees;
• create and maintain personal event records;
• process event entries;
• send requested entry confirmations and Momentum Reports;
• provide reminders and other service messages;
• respond to questions and support requests;
• administer organiser enquiries and participating events.

Create event and organiser insight

• identify event-level patterns;
• prepare Room Reads and other organiser reports;
• compare an event with its own previous events;
• help organisers understand motivations, outcomes and improvement signals.

Analyse and improve Work the Room

• assess how the service is being used;
• test and improve survey questions;
• develop classifications, room types and reporting methods;
• check report quality and accuracy;
• identify technical problems;
• develop new features and related services;
• conduct internal research and service evaluation.

Create wider insight and benchmarks

We may combine information across events to:

• identify broader patterns in professional events and activities;
• create benchmarks and comparative statistics;
• understand differences between event types, formats, sectors, locations or audiences;
• prepare research, reports, presentations and editorial material;
• support commercial, partnership or sponsorship discussions;
• demonstrate the value and findings of Work the Room and Read the Room.

Where information is used publicly or supplied for these wider purposes, we will use anonymised, aggregated or otherwise appropriately protected information. We will not publish an attendee’s personal event history or identify them without separate permission.

Promote the service

We may use anonymised or aggregated findings in:

• website content;
• social-media posts;
• marketing materials;
• sales presentations;
• press releases;
• case studies;
• sponsor or partner reports;
• public research and commentary.

For example, we might publish a statistic about the proportion of attendees reporting a useful connection, provided the information does not identify individual attendees.

We will seek separate permission before using a person’s name, identifiable quotation, photograph or testimonial for promotional purposes.

Prize draws and promotions

From time to time, Work the Room may offer a free prize draw or promotional competition to encourage participation, collect feedback or support the launch and development of the service.

Where you enter a prize draw, we may use:

• your name;
• email address;
• attendee or entry identifier;
• confirmation that you completed the qualifying activity;
• information needed to check eligibility;
• correspondence relating to the draw;
• delivery details if you win a physical prize.

We use this information to:

• administer the prize draw;
• verify valid entries;
• select and contact the winner;
• deliver or arrange the prize;
• prevent duplicate, fraudulent or ineligible entries;
• meet legal, regulatory and record-keeping requirements.

Entering a prize draw does not, by itself, give us permission to send you marketing. Any optional marketing consent will be collected separately. The ICO specifically warns that consent given for a prize draw cannot automatically be reused for unrelated marketing.

We may need to provide limited winner information where required by applicable promotional rules. We will not publish a winner’s full contact details. Where reasonably possible, we will use limited information such as a first name, surname initial and broad location, or provide confirmation that a valid award was made.

Prize-draw records will normally be retained for a reasonable period after the draw has closed so that we can demonstrate that it was administered fairly and respond to any questions or complaints.

Each prize draw will also have separate terms explaining its eligibility rules, opening and closing dates, prize, selection process and any additional conditions.

7. Lawful bases

The lawful basis depends on what we are doing with the information.

Providing Work the Room to registered attendees

We process account details, event entries and related records because this is necessary to provide the service requested by the attendee and to manage our relationship with them.

Where applicable, our lawful basis is performance of a contract or taking steps at the attendee’s request before entering into a contract.

Operating and improving the service

We rely on our legitimate interests in:

• operating Work the Room and Read the Room;
• maintaining accurate records;
• improving our services;
• understanding how professional events function;
• producing useful organiser and attendee insight;
• developing aggregated research and benchmarks;
• protecting the service from error, misuse and security threats.

When relying on legitimate interests, we consider the likely impact on individuals and use safeguards including data minimisation, separation of contact details, access controls and anonymised reporting.

Marketing communications

We send promotional email or electronic marketing to individuals only where:

• they have given appropriate consent; or
• another lawful permission, such as the applicable soft opt-in, is available.

Service messages needed to deliver Work the Room are not treated as optional marketing.

You can unsubscribe from marketing at any time.

Legal requirements

We may process information where necessary to comply with a legal obligation or to establish, exercise or defend legal rights.

8. Anonymised and aggregated information

We may turn personal information into anonymised or aggregated information by removing or reducing details that could identify individuals.

Properly anonymised information is no longer personal information under UK data-protection law. We may retain and use that information for purposes including:

• research;
• trend analysis;
• benchmarking;
• service development;
• commercial reports;
• presentations;
• public commentary;
• marketing;
• partnership and sponsorship materials.

We take account of the possibility that someone could be identified indirectly from combinations of information, particularly where an event or response group is small.

Where information remains capable of being reconnected to an attendee, we continue to treat it as personal information.

9. Communications

We may send:

Service communications

These may include:

• your personal Work the Room link;
• entry confirmations;
• requested reports;
• milestone notifications;
• reminder messages;
• security or operational notices;
• important changes affecting the service.

These messages are part of providing Work the Room.

Marketing and optional updates

These may include:

• product news;
• new features;
• event suggestions;
• selected partner or sponsor content;
• research and insights;
• invitations and offers.

We send these where we have appropriate permission. You may unsubscribe at any time without losing essential service communications, although you may also ask us to close your Work the Room account.

We do not sell attendee contact details to advertisers or event organisers.

10. Photographs, notes and free text

Private notes are intended for the attendee’s own record and are not included in organiser reports.

Photographs uploaded to a personal record are not used publicly or supplied to organisers unless the attendee separately agrees.

Free-text responses intended for event feedback may be:

• grouped into themes;
• summarised;
• paraphrased;
• quoted anonymously where the risk of identification is sufficiently low.

Please avoid naming other individuals or including confidential or sensitive information in free-text responses.

11. Automated tools and artificial intelligence

We may use automation and artificial-intelligence tools to:

• classify event responses;
• group similar answers;
• identify themes and patterns;
• calculate summaries;
• draft attendee or organiser reports;
• generate observations, prompts and recommendations;
• check consistency and report quality;
• support research and service development.

We aim to exclude direct contact details from prompts used for organiser reporting and wider analysis.

AI-generated material may be checked, amended or rejected before it is issued. Automated tools are not used to make decisions about attendees that produce legal or similarly significant effects.

12. Who we share information with

We use third-party providers to operate the service. These may provide:

• website and domain hosting;
• forms and surveys;
• email and contact management;
• workflow automation;
• spreadsheets, databases and cloud storage;
• artificial-intelligence and analytical services;
• link management and QR codes;
• security, monitoring and technical support.

Providers may currently include:

• MailerLite;
• Tally;
• Make;
• Google;
• OpenAI;
• Microsoft and Microsoft 365;
• GoDaddy;
• Short.io.

Providers process information under their own contractual and security arrangements and may act as our processors or, in limited circumstances, independent controllers.

We may also disclose information:

• where required by law;
• to professional advisers;
• to protect the rights, security or operation of the service;
• in connection with a sale, restructuring or transfer of all or part of the business.

Where sponsors, partners or event organisations receive reports or statistics, these will normally be anonymised or aggregated unless an individual has separately agreed to an identifiable disclosure.

13. International transfers

Some providers may process information outside the United Kingdom.

Where UK data-protection rules apply to an international transfer, we use or rely on an appropriate legal safeguard. This may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved contractual clauses;
• another safeguard recognised under UK law.

You may contact us for further information about relevant safeguards.

14. How long we keep information

We keep personal information only for as long as reasonably necessary for the purposes described in this notice.

Our expected retention approach is:

• Raw form submissions: retained only while required for processing, checking, troubleshooting and recovery, then deleted or minimised;
• Active attendee accounts and event records: retained while the account remains active;
• Inactive attendee records: normally reviewed for deletion or anonymisation after 24 months without meaningful activity;
• Event-response data used for organiser reporting: normally retained for up to 24 months in identifiable or pseudonymised form, unless needed for an active attendee record or another stated purpose;
• Organiser enquiries and contracts: retained for the duration of the relationship and an appropriate period afterwards;
• Consent and communication-preference records: retained while relevant and for a reasonable period afterwards so we can demonstrate what was requested;
• Suppression records: retained where necessary to ensure people who have opted out are not contacted again;
• Fully anonymised statistics and research: may be retained indefinitely because they no longer identify individuals.

We may retain information longer where required by law or where reasonably necessary to establish, exercise or defend legal rights.

15. Security

We use reasonable technical and organisational measures designed to protect information. These may include:

• separating contact details from event-response data;
• using attendee identifiers rather than email addresses in working datasets;
• limiting access to operational files;
• restricting personal information from organiser reports;
• minimising contact details used in analytical and AI processes;
• access controls and account security;
• checking reports for identification risks;
• deleting or minimising raw submissions;
• maintaining consent and preference records;
• reviewing providers and processes as the service develops.

No online system can be guaranteed completely secure.

16. Your rights

Depending on the circumstances, you may have the right to:

• request access to your personal information;
• ask us to correct inaccurate information;
• ask us to delete information;
• ask us to restrict its use;
• object to processing based on legitimate interests;
• object to direct marketing;
• receive certain information in a portable format;
• withdraw consent where processing relies on consent;
• complain about how your information has been used.

Where a response has been genuinely anonymised, we may no longer be able to identify it as belonging to a particular person.

Where information remains linked to your attendee account, we will normally be able to locate it using your account details.

To exercise your rights, contact:

hello@worktheroom.co

You also have the right to complain to the Information Commissioner’s Office.

17. Closing an account and changing preferences

You may contact us to:

• update your details;
• change your marketing preferences;
• unsubscribe from optional communications;
• stop future reminder messages;
• withdraw any optional permission;
• close your Work the Room account;
• request deletion of eligible personal information.

Withdrawing consent does not affect processing that lawfully took place before it was withdrawn.

We may need to retain limited suppression, legal or administrative records after an account is closed.

18. Children

Work the Room is intended for adults attending professional events and activities. It is not designed for use by children.

If we become aware that personal information has been submitted by a child in circumstances where it should not have been collected, we will take appropriate steps to delete it.

19. Changes to this notice

We may update this notice as Work the Room and Read the Room develop, new services or commercial relationships are introduced, providers change or legal requirements evolve.

The latest version will be published on the Work the Room website. Where a change materially affects how we use existing personal information, we will take reasonable steps to bring it to the attention of affected users.