This is a working draft. A fuller version, reviewed against UK GDPR and ICO guidance, will sit here once the Editorial Committee and operating team are formed. Until then, this page tells you what is actually happening.
What we collect
Newsletter signup
Email address only. The signup form emails it to the IRC operating team, who add you to the newsletter list. Used to send the IRC newsletter and event invitations. To come off the list, use the unsubscribe link in any newsletter or email us, and we remove you.
Member application form
Name, role, organisation, country, email address, and whatever else you choose to share in the free-text fields. Used to assess your membership application and, if you join, to keep a working member record. Held in the IRC operating database. The form emails to the operating team at Outbreach (the IRC partner that runs the day-to-day operation) and to whichever members of the Editorial Committee or Forum chairs need to assess it for the tier you applied to.
Analytics
Google Analytics 4, behind a cookie consent banner. If you do not accept analytics cookies, GA4 is not loaded and we do not learn anything about your visit beyond standard server logs. See our cookies page for the detail.
Server logs
Standard request logs from the host (IP address, user agent, requested URL, time). Retained for 30 days for security and abuse investigation, then deleted.
What we do not collect
No third-party advertising trackers. No Facebook pixel. No LinkedIn Insight tag on the public site. No session recording or heatmap tools. No data brokers.
Who can see it
- Operating team at Outbreach. The small team that runs day-to-day IRC operations. They can see your application data and member record.
- Editorial Committee. Once formed, sees member-submitted resources for editorial review, with the author attribution you provide.
- Forum chairs. For their forum only. See member tier and contact details for the members of the forum they chair.
- Formsubmit. The forms on this site are delivered to our inbox by Formsubmit (formsubmit.co), which relays the submission and does not retain a copy.
- Google. Analytics events go to Google if you have consented to analytics cookies.
How to get your data back, or remove it
Email hello@incidentresponse.com from the address on your record. We will:
- Send you a copy of the data we hold on you, within 14 days.
- Delete your record on request, within 14 days. We will keep a record of the deletion request itself so we can show that we acted on it.
Retention
- Newsletter list: held until you unsubscribe.
- Active member record: held while membership is current, plus two years after the last activity, then anonymised.
- Server logs: 30 days.
- Submitted resources: kept on the site indefinitely with the author attribution you provided. If you ask us to remove a resource, we will remove it.
Where the data lives
UK and EU. The IRC site is hosted on Cloudflare or Netlify (final hosting decision pending) which serves from EU edges. Form submissions are relayed to us by Formsubmit and then held by the operating team. The operating team is in the UK.
If something goes wrong
If there is a breach affecting member data, we will notify affected members within 72 hours of becoming aware, and notify the ICO as required.
Changes to this policy
If we change it materially, we will say so in the newsletter and date the new version below.
Version: Working draft. Last reviewed May 2026. Questions: hello@incidentresponse.com.