Conference DeskPrivacy
Privacy notice
What personal information Conference Desk collects, why, who else handles it, how long we keep it, and your rights.
In force from 27 October 2026. Last reviewed 27 October 2026.
Who we are
Conference Desk is a trading name of Dr Turan Mutallimov, sole trader, 53 Linksfield Gardens, Aberdeen AB24 5PF. For the information described in this notice, Dr Turan Mutallimov trading as Conference Desk is the controller. We are registered with the Information Commissioner’s Office under number ZC271731.
For anything about your personal information, email [email protected], or write to us at the address above.
What we collect and why
Organiser accounts
When you create an account or a conference, we collect your name, email address, your organisation’s name, the date you accepted our Terms, and the conferences you create or join. We use them to run your account, keep it secure and contact you about it, for example about a review of your conference, a change to our Terms, or a security issue.
Legal basis: performing our contract with your organisation, and our legitimate interest in dealing with the people who act for it.
Signing in
For anyone who signs in to Conference Desk, on the web or in the app, we keep your email address, a secure hash of your password if you set one, the sign-in method you use (email code, password, Apple or Google), and a record of sign-ins. With Apple or Google we receive only your name and email address, or Apple’s private relay address if you choose to hide yours.
Legal basis: performing the contract, and our legitimate interest in keeping accounts secure.
Checking you are a person
Our sign-up and request forms use Cloudflare Turnstile to tell people from automated abuse. It looks at technical signals from your browser, such as its characteristics and your IP address, only for that check. Legal basis: our legitimate interest in preventing spam, fraud and fake conferences.
Reviewing conferences before they go public
Before any conference goes public, we check that it appears genuine, using what the organiser entered and public information about the organisation. We keep a record of the review and of any reports made to [email protected]. Legal basis: our legitimate interest in protecting the people who might be misled by a fake conference.
Quote and notification requests
If you send the request form, we receive your name, work email, role, institution or society, conference details and any message. We use them to reply and, if you go ahead, to prepare your order. If you ask to hear when the Android app is out, we use your email only to tell you that. Legal basis: taking steps at your request before a contract, and our legitimate interest in answering enquiries.
Invoices and orders
For paid plans, we keep the order form, invoices, the billing contact and payment records. Legal basis: performing the contract, and our legal obligation to keep tax records.
Server logs
When you visit our websites or use the app, our hosting providers process technical data such as your IP address, browser type and the pages requested, to deliver the service and protect it from attack. Legal basis: our legitimate interest in running a secure service.
We do not sell personal information, use it for advertising, or make decisions about you by automated means that have legal or similarly significant effects.
Conferences that run on Conference Desk
Inside each conference, the organiser decides what is collected and how it is used: registrations, submissions, reviews, decisions, dietary and access needs, check-in and messages. For that information the organiser is the controller and we are its processor, acting only on its instructions under the data processing agreement in Schedule 1 of our Terms.
If you are a delegate, author or reviewer, the conference’s own privacy notice explains how it uses your information, and the organiser is the right place to send requests about it. If you write to us instead, we will pass your request to the organiser and tell you we have done so.
We do not use conference data for our own purposes, apart from counts that cannot identify anyone.
Who handles it for us
We use the following services. Each acts on our instructions under a data processing agreement. They are also the sub-processors for conference data under our data processing agreement, and we give organisers 30 days’ notice before adding or replacing one.
| Service | What it does | Where |
|---|---|---|
| Cloudflare | Website hosting and delivery, protection from attack, Turnstile checks | Global network; Cloudflare, Inc. is in the United States |
| Supabase | Database, file storage and sign-in | EU (Stockholm, Sweden); Supabase, Inc. is in the United States |
| Resend | Sending email: sign-in codes, invitations, confirmations and decisions | EU (Ireland); Resend is in the United States |
| Stripe | Card payments, once payments start. Not used yet | Stripe Payments Europe, Ireland, and Stripe, Inc. in the United States |
| Expo | Sending app alerts to Apple and Google | United States |
| Apple and Google | Delivering app alerts, and sign-in with Apple or Google if you choose it | United States |
App alerts never show names, paper titles or amounts on the lock screen.
Transfers outside the UK
Our database and files are held in the European Economic Area, which the UK recognises as giving adequate protection. Where information goes to the United States or elsewhere outside the UK, we rely on the UK–US data bridge for companies certified to it, or on the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. You can ask us for details of the safeguard for any service.
How long we keep it
| Information | How long |
|---|---|
| Account and sign-in data | While your account is open, then deleted within 30 days of closing it |
| Conference data | As the organiser decides; deleted 30 days after the organiser’s agreement ends, with backups overwritten within a further 30 days |
| Quote requests that do not lead to an order | 12 months |
| Android notification requests | Until we have told you the app is out, then deleted |
| Orders, invoices and payment records | Six years after the end of the tax year they relate to, as tax law requires |
| Conference reviews and abuse reports | Two years after the conference or report is closed |
| Server and security logs | Up to 90 days, unless needed to investigate an incident |
Cookies and browser storage
We use only what is strictly necessary to provide the service you ask for, so we do not show a cookie banner.
- Staying signed in: on app.conferencedesk.app and in the app, your sign-in session is kept in your browser’s or device’s storage so you are not asked to sign in on every page. Signing out removes it.
- Turnstile: Cloudflare’s check on our forms may store a short-lived item in your browser to complete the check.
We use no analytics, advertising or tracking cookies, and no third-party tracking code.
Your rights
You have the right to ask for a copy of your personal information, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on legitimate interests, you can object and we will stop unless we have a compelling reason to continue.
To use any of these rights, email [email protected]. We may ask you to confirm your identity. We reply within one month, and tell you if a complex request needs up to two months more. There is normally no charge.
Complaints
If you are unhappy with how we have handled your personal information, please tell us first, by email to [email protected], by post to the address above, or any other way you prefer.
- We acknowledge your complaint within 30 days, and usually much sooner.
- We look into it and reply with what we found and what we will do, within one month of receiving it, or tell you why we need longer.
- We keep a record of the complaint and how we resolved it.
You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection, at ico.org.uk/make-a-complaint or on 0303 123 1113. The ICO usually expects you to have raised the complaint with us first.
Changes to this notice
We will update this notice when what we do changes, and change the date at the top. If a change matters to account holders, we will email them before it takes effect.