Privacy Policy

Last Updated: October 14, 2026

1. Who we are

How we collect, use and protect personal data.

Principal Promotions Limited (“Principal”, “we”, “our” or “us”) trades as Principal. Global Events and Principal. London DMC. We are an events, incentives and conference management company. Our registered office is Unit 2.15 Barley Mow Centre, 10 Barley Mow Passage, London W4 4PH, and our company number is 02922228. We have offices in London and Austin, Texas.

We respect your privacy. This policy explains what personal data we collect, why, how we use and protect it, who we share it with, how long we keep it and what rights you have. It applies to delegates, travellers and event attendees, the people who arrange events with us, our business contacts and suppliers, and visitors to our website.

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 and, where they apply, the EU General Data Protection Regulation and other data protection laws in the countries where we work. Please read this policy together with any privacy information we give you for a specific event.

2. Our role: controller or processor

Our responsibilities depend on who decides how your personal data is used.

Situation	Our role
We manage an event on behalf of your employer or another organisation (our client), and handle your data as a delegate or attendee.	Usually a processor. Our client is the controller and decides why your data is collected. We use it only on our client’s instructions and under contract. Our client’s privacy notice also applies.
We deal with you as a client contact, supplier or business contact, or you visit our website or receive our marketing.	Controller. We decide how your data is used, in line with this policy.
Hotels, venues, airlines, transport companies and other event suppliers receive your data to provide their services.	Each supplier is usually a separate controller of the data it receives, under its own privacy policy.

3. The personal data we collect

We collect only what is needed for the event or service concerned. Depending on the event, this may include:

names and contact details, such as job title, company, email address, phone number and address;
emergency contact names and details;
travel and event details, such as arrival and departure dates, flight and rail details, rooming requests, transfers and programme choices;
preferences, such as seating, room type and activity choices;
passport and visa details, occasionally, and only when our client asks us to book flights;
dietary and accessibility requirements, occasionally, so we can arrange catering and access. These may reveal information about your health;
billing details for client organisations and suppliers; and
information collected when you visit our website, such as your IP address and browsing information, as set out in section 11.

Health data and passport details

Dietary and accessibility details that reveal information about your health are special category data under UK GDPR. We collect them only when they are needed for your event, with your explicit consent or on our client’s instruction, and handle them with extra care. Passport details are received only by encrypted email, shared only with the people making the booking and deleted once the booking is complete.

4. How we collect personal data

Directly from you, for example when you register for an event, complete a form or contact us.
From the organisation you work for or are attending an event on behalf of, or from someone it has asked to send us your details.
From event registration platforms used for your event.
Automatically when you visit our website, through cookies and similar technologies.

5. How we use personal data and our lawful bases

We use personal data only for specified, explicit and legitimate purposes, and not in a way that is incompatible with those purposes. We rely on the following lawful bases under UK GDPR. Where we act as a processor, our client decides the lawful basis.

Purpose	Lawful basis
Planning and delivering events, travel and accommodation, and providing support before, during and after an event.	Performance of a contract, and our legitimate interest in delivering the services our clients engage us for.
Handling dietary and accessibility requirements.	Your explicit consent, or our client’s instruction where we act as its processor.
Communicating with clients, suppliers and business contacts, and managing our business relationships.	Legitimate interests.
Billing, accounting and meeting our legal and regulatory obligations.	Legal obligation, and performance of a contract.
Responding to emergencies and protecting someone’s safety during an event.	Vital interests, where needed.
Sending business marketing about our services.	Legitimate interests for business contacts, or consent where the law requires it. You can opt out at any time.
Running and improving our website.	Consent for non-essential cookies. Legitimate interests for essential website operation.
Establishing, exercising or defending legal claims.	Legitimate interests.

]We do not sell personal data, and we do not make decisions about you based solely on automated processing.

6. Who we share personal data with

We share personal data only where needed, and only the minimum required:

the client organisation that engaged us for your event, for event delivery and reporting;
event suppliers needed to deliver your event, such as hotels, venues, airlines, rail and ground transport companies, destination management companies and activity providers;
service providers that support our business, such as our IT provider, cloud services, registration platforms and professional advisers. They act on our instructions under contract and must keep the data secure; and
regulators, law enforcement or other authorities where the law requires it, or to protect someone’s safety.

7. International transfers

We hold our core business data in Microsoft’s UK data centres. Because we deliver events around the world, some personal data must be shared with suppliers in the country where the event takes place, and with our team in the United States.

When we transfer personal data outside the UK, we make sure it is protected as UK law requires. We rely on UK adequacy regulations where they exist, or on the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Some transfers, such as passing your details to a hotel abroad to make your booking, are necessary to deliver the service you or your organisation has asked for. Contact us if you would like more information about the safeguards we use.

8. How we protect personal data

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, disclosure or alteration. These include:

multi-factor authentication on our accounts, and access limited to the people who need it;
encrypted, centrally managed company devices with anti-malware protection and security monitoring;
secure, UK-hosted cloud systems with independent backup;
encrypted email for sensitive details such as passport information;
security and data protection training for our team; and
contracts requiring our suppliers to protect the data they handle for us.

No method of sending data over the internet is completely secure. To protect yourself, please do not send payment card details to us by email. We will never ask for your password or card details in an unsolicited call or email. If you believe your personal data has been misused, please tell us straight away.

9. How long we keep personal data

We keep personal data only as long as it is needed for the purpose it was collected for, unless the law or a contract requires us to keep it longer.

Data	How long we keep it
Delegate and event data	Deleted after the event once its purpose is complete, or in line with our client’s instructions.
Passport details	Deleted once the flight booking is complete.
Dietary and accessibility details	Deleted after the event.
Financial and accounting records	Six years, as UK tax law requires.
Business contact and marketing data	Until you ask us to stop, or the relationship ends and the data is no longer needed.

10. Your rights

Under UK GDPR you have the right to:

be informed about how we use your personal data;
access the personal data we hold about you;
have inaccurate data corrected;
have your data erased in certain circumstances;
restrict how we use your data in certain circumstances;
object to our use of your data, including for direct marketing;
data portability in certain circumstances; and
withdraw your consent at any time, where we rely on consent.

We respond to requests within one month and do not usually charge a fee. We may need to confirm your identity first. Where we hold your data as a processor for a client, we will pass your request to that client and help it to respond. If you live in a US state with its own privacy law, you may have similar rights, and you can contact us in the same way.

If you choose not to provide certain details, we may not be able to provide some services, such as booking your travel.

11. Our website and cookies

Our website uses cookies and similar technologies. Essential cookies make the website work. We use any other cookies, such as analytics, only with your consent, which you can give or withdraw through the cookie settings on our website or in your browser. Our website may link to other websites. Their own privacy policies apply, and we are not responsible for them.

12. Children

Our services are aimed at adults. We do not knowingly collect personal data from children under 18 unless a client event requires it, and then only with the consent of a parent or guardian.

13. Contact us and complaints

To ask a question about this policy or exercise your rights, please contact our GDPR Owner:

Contact	Detail
Email	gdpr@principalge.com
Correspondence address	GDPR Owner, Principal Promotions Limited, 2 Wilmot Place, London NW1 9JS, United Kingdom

We will always try to resolve any concern you raise. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113. If you live outside the UK, you may also complain to the data protection authority in your country.

14. Changes to this policy

We review this policy every year and may update it from time to time. The latest version is published on our website, and the “Last updated” date shows when it last changed. Where a change significantly affects you, we will tell you.