We aim to make our website as accessible as possible. However if you use a screen reader and require debt advice you may find it easier to phone us instead. Our phone number is 0 8 0 0 1 3 8 1 1 1 1. Freephone (including all mobiles).

Our privacy notice for events attendees and publicity participants

Making it clear how we handle your personal data

1. About our privacy notice

This notice is for anyone who attends or takes part in any event (either online or in person) organised by StepChange or who takes part in a StepChange publicity campaign.

This is someone who:

  • Attends a public event as a speaker or participant
  • Attends a public event as a guest, who may or may not contribute
  • Is the focus of StepChange photographic, video, or audio media

We recognise that individuals whose personal data we collect for these purposes may or may not be a StepChange client or colleague.

If you are a client of StepChange you should also read our Client Privacy Notice. If you are a colleague of StepChange you should also read our Colleague Privacy Notice.

This notice tells you:

  • What personal data we hold about you
  • How and why we use your personal data
  • What your legal rights are

We recommend you read this notice to understand your data protection rights and how to manage them.

'Personal data' means any data that:

  • Is about you
  • And which can be used to find out who you are

In some cases this data could be more sensitive. It may be data that is private to you. Find out more in Section 4.

2. Who is responsible for your personal data?

StepChange is made up of three companies. Find out more about them:

Trading as StepChange Debt Charity and StepChange Debt Charity Scotland

Registered Office:
123 Albion Street
Leeds
LS2 8ER

  • Registered In England no. 2757055
  • Registered charity in England and Wales: 1016630, Scotland: SC046263.
  • Authorised and regulated by the Financial Conduct Authority.
  • ICO registration No. Z743192X

Trading as StepChange Voluntary Arrangements

  • Registered Office as above
  • Registered in England no. 5659160
  • ICO registration No. Z9690343

Trading as StepChange Financial Solutions

  • Registered Office as above
  • Registered in England no. 6741879
  • ICO registration No. Z1721238

These companies are all known as 'Data Controllers'. As a Group, this means we are responsible for deciding:

  • Why we collect data about you
  • What data we collect
  • How we use your personal data
  • How we store your personal data

By law, we have to tell you this and make this privacy notice available to you.

To provide our services, we may need to share data across our Group.

Colleagues only have access to the data they need to do their job. We have controls in place to ensure this.

Our Data Protection Officer checks we are meeting the law and standards across the group.

Their contact details have been included in Section 9.

3. Where do we collect your personal data from?

We will usually collect your personal data directly from you if you register to attend an event organised by StepChange. Occasionally you may be registered by the company you work for or another organisation you are associated with. You may also be referred to us by an agency or another related organisation.

We also may record events. This means your data may be captured directly via photography, video, audio, or online recording.

4. What information do we collect about you and why?

We may collect data about you for the following reasons:

Types of personal data:

As part of our event registration process we will ask for personal data about you so that we know you’re coming to our event, know how to contact you to provide event updates, and to know a little bit about who you are.

This will differ depending on the event but typically will include:

  • Your first and last name
  • Your email address
  • Your telephone number
  • Your job title and organisation (if applicable)
  • Any additional personal data which you have voluntarily provided to us

Sensitive personal data:

Where relevant to you, we may request sensitive personal data to help us improve your experience at the event. This may include taking in to account any dietary or accessibility requirements.

Purposes:

  • To facilitate attendance at our event
  • To provide updates on any plans, changes or cancellations

This is because we have a legitimate interest to host events.

Where we process sensitive data, this is because we have a substantial public interest to ensure our events are accessible and safe for anyone who wishes to attend, and that we are ensuring the equality of treatment of attendees.

For any activities undertaken during the course of a StepChange event

Types of personal data:

  • Name badges, table plans, agendas or other organisational materials
  • Interactive activities (such as the use of Slido or, for online events, comments and interactions).
  • To assist venues in hosting the event (for example, fire safety registers)
  • A transcript of your speech (where you were a speaker at an event)

This is because we have a legitimate interest to facilitate events.

Where we process sensitive personal data, this is because this is personal data which you have chosen to make public.

When any material is to be recorded for publicity purposes. For example, recording photos, videos or audio for events, branding campaigns, professional headshots or charity campaigns.

In some cases we may ask you to sign a media agreement form, agreeing to the use of your data for promotional purposes.

Types of personal data:

  • Your appearance
  • Your first and last name
  • Your voice
  • Your personal views and opinions

Sensitive personal data:

If you openly share sensitive personal data about yourself (e.g. your health or other details personal to you) then this may be recorded and used for future publicity.

Purposes:

  • To raise awareness of our service and aims
  • To raise awareness of debt related issues
  • To publicise our events
  • To promote our brand

This is because we have a legitimate interest to promote our services and raise awareness of related issues.

Where we process sensitive personal data, this is because this is personal data which you have chosen to make public.

5. Who do we share your personal data with?

We may share your personal data with other organisations for a number of reasons.

Find out why we share your personal data and who with. There may be other examples than the ones listed:

We sometimes may need to share your personal data:

  • Where we have a compelling and legitimate business reason
  • Where we have to by law
  • Where you have told us we can do this

When we may share data and who with

  • Venues: to help with the smooth running of events
  • Event co-organisers (if this is a joint event)
  • Event sponsors (if you have allowed us to do so)
  • Law enforcement agencies: in the unlikely event we need to report a crime
  • Your employer (if the need arises e.g. unacceptable behaviour at an event)

We may also share your information if you have asked us to or told us we can.

Where we do share your personal data with third parties, we will:

  • Maintain records of what has been shared
  • Keep a written agreement

We also work with third party suppliers who help to deliver our services. These are known as ‘data processors’.

We only allow them to use your personal data when we allow it and to do what we have asked them to do.

We make sure your personal data is secure when it is with them. There are processes in place to check this.

Examples include:

  • If we need to use an agency to help us with hosting events, publicity or branding
  • If we use an online platform to help us host online events or publicity materials

There may be other examples.

We may share ‘statistical data’:

  • Internally within our organisation
  • With partners and funders
  • The wider public to support our campaign work

In this case, personal details are not included. For example, we may share details about the types of individuals who participate in our events.

You will not be identified from this personal data

6. How long will we keep your personal data for?

We will hold any personal data gathered at a publicity event, where you can be identified, for 6 years following the date of our event.

In some cases we may need to keep some personal data for longer. This would be if there is the need to comply with laws or standards. Such as, defending legal claims.

7. How do we keep your personal data secure?

We take appropriate technical and organisational measures to make sure that the data we hold is safe and secure.

We only allow your personal data to be used by individuals who need it to carry out their job. All our employees and contractors are subject to confidentiality rules.

We regularly review our security controls and monitor for security breaches. We have processes in place to handle security breaches if they do happen.

8. Will we transfer any of your personal data outside of the UK?

We may need to do this from time to time. For example, if a supplier stores data in another country.

But we will only do this if:

  • That country meets data protection standards, as laid out by UK law. Such as, countries in the European Economic Area. Or,
  • We, or one of our third party data processors, have entered into a contract with an organisation outside of the UK, on terms approved by the UK’s data protection regulator. We also have assessed that country’s laws. Or,
  • You have clearly asked us to share your personal data with an organisation outside of the UK and we have explained the risks of doing so to you

9. What are your data protection rights?

You have a number of rights relating to how we use your personal data. They depend on why we are using your personal data. We have listed these below.

Please contact us at DPO@stepchange.org to make a request.

We may need you to share extra detail so we can:

  • Check who you are
  • Establish your relationship with us
  • Understand what you need from us.
  • Ask for additional forms of identification, as we will not usually have a relationship with you

In most cases, we will respond within one calendar month. If there is a reason why it is taking us longer, we will let you know.

Your rights are:

  • To have access to, or a copy of, this notice
  • To get copies of the personal data we hold about you
  • To get confirmation of how we use and/or have used your personal data
  • To find out how long we will continue to store your personal data
  • To update any personal data that is wrong, incomplete, or out of date
  • To delete or destroy data we hold about you
  • To restrict the use of your personal data
  • To ask us to transfer your personal data to another organisation
  • To object to how we use your personal data
  • To take away any consent you have given us before
  • To ask for a human review where a decision has been made using a computer

There can be exemptions or restrictions for all of the above rights. This could mean we may not be able to do as you have asked. We will let you know if this is the case.

10. How can you complain about how we use your personal data?

If you are unhappy with how we have used your data there is a process you can follow.

If you are unhappy with:

  • How we have used or handled your personal data or
  • How we have handled your data protection rights request

Please email DPO@stepchange.org

You may also raise this with the Information Commissioner’s Office (ICO). They are the UK’s Data Protection regulator. Visit their website to find out more about this

Please note: The ICO expect you to have gone through our internal complaints process before raising a complaint with them.

11. How will we tell you about any changes in how your personal data is used?

We reserve the right to update this privacy notice at any time.

We may also tell you in other ways, from time to time, about how we use your personal data.

We will only use your personal data for the reasons why we collected it, unless:

  • We reasonably think we need to use it for another reason, and
  • That reason is compatible with the original purpose

If we need to use your personal data for a new reason, we will let you know. We will explain at this point why we are allowed to do this by law.

This notice does not form part of any contract with you. We may update this notice at any time.

Published: March 2025. (Version 1).