Guidance

Privacy Notice for Campaigns, Outreach, Educational and Engagement Activities

Updated 1 October 2026

This privacy notice will help you to understand what personal data the Intellectual Property Office (IPO) collects about you, how the IPO uses this personal data, and what rights you have regarding your personal data.

It is important that you read this notice together with the IPO Personal Information Charter and any other privacy notice provided to you when we are collecting or processing your personal data, so that you are aware of how and why we are using it.

This notice applies to individuals who participate in, engage with, or receive communications (whether digitally or in person) relating to:

• IPO campaigns
• outreach activities
• competitions
• educational programmes
• surveys
• consultations
• stakeholder engagement activities
• promotional initiatives
• case studies
• blogs
• press quotes
• awareness raising campaigns and related events

It also applies to parents, guardians, teachers and other responsible adults who provide information about children participating in these activities.

This notice does not form part of any contract.

Personal data is any information that can be used to identify a living individual, either on its own or when combined with other information. Data processing includes the collection, use, disclosure, sharing, storage and deletion of personal information.

The data controller is the Intellectual Property Office (IPO). This means that we are responsible for deciding how we hold, use and process personal information about you.

Use of Artificial Intelligence (AI)

The IPO may use AI-assisted technologies to support administrative, analytical and reporting activities associated with campaigns, outreach and engagement programmes.

This may include:

• analysing survey responses and feedback
• identifying themes, trends and insights
• supporting reporting and evaluation activities
• assisting with drafting communications and campaign materials
• improving the effectiveness of public engagement activities

Any use of AI will be undertaken in accordance with UK GDPR and Data Protection Legislation. Appropriate safeguards will be applied and the IPO will not make decisions that produce legal or similarly significant effects solely through automated processing.

The personal data we collect

We may collect the following when necessary for our purposes:

• full name
• organisation
• job title
• email address
• telephone number
• postal address
• age or age range
• school or educational establishment
• accessibility and support requirements
• dietary requirements
• feedback and survey responses
• competition entries
• photographs, audio and video recordings
• testimonials, quotes (verbal and/or written)
• case studies (which could include equality, diversity, inclusion, ethnicity data)
• social media handles where voluntarily provided
• details of IP rights

Necessary information relating to children may include:

• full name
• age or age range
• school, college or educational establishment
• educational submissions and competition entries
• accessibility and support requirements
• photographs, video recordings and audio recordings
• contact information for parents, guardians, teachers or responsible adults

Our lawful basis for processing

The lawful basis for processing personal data under Article 6 UK GDPR may include:

Consent – Article 6(1)(a)

Where individuals voluntarily provide information, subscribe to communications, register for an event or activity, participate in surveys or research, submit competition entries, provide testimonials, or agree to participate in promotional activities.

Public task – Article 6(1)(e)

Where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the IPO.

Legitimate interests – Article 6(1)(f)

Where processing is necessary to develop, improve and assess our campaigns and engagement activities, provided these interests do not override your rights and freedoms.

Special category data

In certain circumstances, we may need to process special category data to enable individuals to participate safely, fairly and effectively in our activities.

This may include:

• disability information
• accessibility requirements
• health information relevant to participation
• dietary requirements
• equality, diversity and inclusion monitoring information
• information revealing racial or ethnic origin where voluntarily provided
• information relevant to safeguarding or welfare considerations

We will only collect special category data where it is necessary, relevant and proportionate to the activity being delivered.

Article 9 Conditions

Where special category data is processed, the IPO will rely on one or more of the following conditions under Article 9 of the UK GDPR.

Explicit consent – Article 9(2)(a)

Where individuals voluntarily provide information relating to health conditions, disabilities, dietary requirements, accessibility needs or diversity monitoring activities.

You may withdraw your consent at any time.

Substantial public interest – Article 9(2)(g)

Where processing is necessary for reasons of substantial public interest and supported by a condition under Schedule 1 of the Data Protection Act 2018, including where necessary to:

• promote equality of opportunity
• facilitate participation and inclusion
• make reasonable adjustments for participants
• safeguard children and vulnerable individuals
• monitor and address inequalities in access to IPO services and activities

Employment, social security and social protection – Article 9(2)(b)

Where activities involve IPO staff, contractors, apprentices or volunteers and processing is necessary to meet employment, social security or social protection obligations.

Provision of special category data is generally voluntary unless it is necessary to ensure safe participation or compliance with a legal obligation.

Why we process your data

We process personal data for the following purposes:

• administering campaigns and outreach activities
• managing competitions and educational programmes
• providing information, resources and support
• communicating with participants and stakeholders
• processing registrations, applications and submissions
• delivering events and engagement activities
• monitoring participation and engagement
• evaluating campaign performance and effectiveness
• gathering feedback and improving services
• promoting awareness of intellectual property rights and services
• carrying out the statutory and public engagement functions of the IPO 
• case studies which could include intellectual property stories and individual personal journey stories
• capturing quotes for media in relation to corporate, education, or enforcement promotion

Processing children’s personal data

Some IPO campaigns, competitions, educational programmes and engagement activities involve children and young people under the age of 18.

Where children’s personal data is processed, the IPO will:

• collect only the information necessary for the purpose of the activity
• apply additional safeguards appropriate to the age of participants
• provide information in a clear and accessible manner where appropriate
• ensure data is only used for the purposes explained at the point of collection
• obtain parental or guardian consent where required

Photography, filming and social media

The IPO may take photographs, record audio, film video content, capture screenshots or create other digital media during campaigns, events, educational programmes and engagement activities.

These materials may be used to:

• promote IPO services and activities
• raise awareness of intellectual property issues
• showcase campaign outcomes and business, education or enforcement success stories
• publish reports, case studies and promotional content
• communicate with stakeholders and the public

Content may be published through:

• IPO website
• GOV.UK publications
• social media channels
• press and media communications
• subscriber email newsletter
• promotional and educational materials
• internal communications

Where photographs, recordings, testimonials or other identifiable content are used for promotional purposes, we will normally rely on consent under Article 6(1)(a) UK GDPR.

Where children are featured in photographs, videos, recordings or testimonials, appropriate consent will be obtained from a parent or guardian.

Participation in photography, filming or promotional activity is generally voluntary, and individuals may decline to participate or withdraw consent, subject to practical limitations where material has already been published or distributed.

When content is shared through social media platforms, the operators of those platforms may process personal data in accordance with their own privacy notices. Information published online may be accessible internationally and may remain available even after it is removed from IPO-controlled channels.

How we use your information

We use personal data to:

• register and manage participation
• administer competitions and campaigns
• communicate with participants and stakeholders
• provide educational programmes and resources
• assess applications and submissions
• deliver events and engagement activities
• provide support and reasonable adjustments
• evaluate participation and campaign effectiveness
• develop future outreach and engagement activities
• produce reports, statistics and case studies
• promote awareness of intellectual property and IPO services

Where possible, information used for reporting and evaluation purposes will be anonymised or aggregated.

Sharing information

We may share personal data with:

• suppliers and service providers acting on behalf of the IPO
• event, campaign and education delivery partners
• educational establishments participating in programmes
• government departments and public bodies where necessary
• technology providers used to administer campaigns, surveys, events and communications

Photographs, campaign materials and video recordings may also be shared through our social media channels for promotional and communications purposes.

All organisations processing information on our behalf will be required to process personal data securely and in accordance with applicable data protection legislation.

The IPO does not sell personal data.

International transfers

Where personal data is transferred outside the UK, the IPO will ensure appropriate safeguards are in place in accordance with UK data protection legislation.

Where information is published through social media platforms or other online services, personal data may be accessed or processed outside the UK.

How long we will keep your personal data

Personal data will only be retained for as long as necessary for the purpose for which it was collected and in accordance with the IPO’s retention and disposal policy.  A copy can be obtained from kim@ipo.gov.uk.

Retention periods may vary depending on the nature of the campaign, competition, educational programme or engagement activity.

Your rights

Under data protection law, you have rights including:

• right of access - you have the right to ask us for copies of your personal information
• right to rectification - you have the right to ask us to rectify personal information you think is inaccurate. you also have the right to ask us to complete information you think is incomplete
• right to erasure - you have the right to ask us to erase your personal information in certain circumstances
• right to restriction of processing - you have the right to ask us to restrict the processing of your personal information in certain circumstances
• right to object to processing - you have the right to object to the processing of your personal information in certain circumstances
• right to data portability - you have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances

If you make a request to exercise any of these rights, you should contact the Data Protection Team at the IPO; details of which are at the bottom of this notice. If you contact us, we have one month to respond to you. You do not have to pay anything for exercising your rights.

These are not absolute rights, and the IPO can use its discretion to refuse to comply with these rights if there are legitimate grounds for processing your personal data which override the interests, rights and freedoms of the individual, or the processing is for the establishment, exercise or defence of legal claims.

Change of purpose

We will process your personal data for the purposes for which we collected it. We may also process your personal data for another purpose that we reasonably consider to be compatible with the original purpose.  

Please note that we may process your personal data without your knowledge or consent, where this is required or permitted by law.

Changes to this privacy notice

We may change this privacy notice. In that case, the ‘last updated’ date at the top of this page will also change. Any changes to this privacy policy will apply to you and your data immediately.

Contact us or make a complaint

You can contact the IPO’s Data Protection Officer if you:

• have questions about this privacy notice
• wish to exercise your rights
• believe your personal data has been misused or mishandled

Email: dpo@ipo.gov.uk

Data Protection Officer
Intellectual Property Office
Concept House
Cardiff Road
Newport
South Wales
NP10 8QQ

The Data Protection Officer provides independent advice and monitoring of the IPO’s use of personal information.

You also have the right to make a complaint to the Information Commissioner’s Office (ICO) if you are unhappy with how your personal data has been handled.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Website: Information Commissioner’s Office