Last updated: 2026
š The short version
We collect the minimum data we need to run our research, our website, and our community. We never sell your data. We design our data practices the same way we design everything else at DDLL: with disabled and neurodivergent people, not just for them. You can ask us what we hold about you, correct it, or ask us to delete it, at any time.
1. Who we are
Digital Diversity Living Lab (DDLL) is a non-profit research and development lab working on inclusive digital practices, systems, online resources built through lived-experience-led co-production.
| Data controller | Digital Diversity Living Lab |
| Registered address | 128 City Road, London, United Kingdom, EC1V 2NX |
| Company number | 16291526 |
| Contact for privacy queries | info@digitaldiversitylab.org |
2. Our commitment to you
This policy is written under the UK GDPR and the Data Protection Act 2018. Beyond legal compliance, we hold ourselves to DDLL's own values:
- Transparency ā plain language over legal jargon, wherever the law allows it.
- Proportionality ā we collect what we need for a stated purpose, not "just in case."
- Co-production ā where we use your data in research, you're treated as a partner in that research, not a subject of it.
- Accessibility ā you can ask us for this policy in another format (e.g. Easy Read, audio) and we will provide it.
3. What data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Contact details | Name, email, organisation | You, directly (forms, email, sign-up) |
| Account/community data | Login details, profile info, forum or workshop contributions | You, directly |
| Research & lived-experience data | Survey responses, interview/workshop notes, feedback on prototypes | You, directly, with separate research consent |
| Accessibility & access needs | Any access requirements you tell us about (e.g. for events) | You, directly ā only ever used to meet that need |
| Technical data | IP address, browser/device type, pages visited | Automatically, via our website |
| Communications | Emails, support requests | You, directly |
We do not knowingly collect special category data (e.g. health, disability status) unless you choose to share it with us ā for example, as part of a research study you've opted into. Where we do hold this kind of data, it is subject to extra safeguards described in Section 6.
4. Why we process your data, and our legal basis
| Purpose | Legal basis (UK GDPR Art. 6) |
|---|---|
| Running our website and responding to enquiries | Legitimate interests |
| Delivering research projects you've joined | Consent (and Art. 9(2)(a) for special category data, where relevant) |
| Sending newsletters or updates you've signed up for | Consent |
| Keeping records for funders, grants, or legal obligations | Legal obligation / legitimate interests |
| Improving accessibility of our own services | Legitimate interests |
You can withdraw consent at any time ā see Section 8.
5. How we use your data
We use your data only for the purpose you gave it to us for, unless we ask you again. In practice this means:
- Contact details are used to reply to you, not to build a marketing list unless you've opted in.
- Research data is used for the specific study or project it was collected for, and reported only in anonymised or aggregated form unless you've agreed otherwise.
- Technical/website data is used to keep the site running and secure, and to understand broad usage patterns.
6. Special category data (e.g. disability, health)
Where lived-experience research means you share information about disability, health, or similar sensitive topics:
- This is always collected under explicit, specific consent for that project.
- It is stored separately from general contact/account data wherever practicable.
- It is anonymised or pseudonymised for any published output unless you've explicitly agreed to be identified.
- You can withdraw from a study and ask for your data to be removed, up to the point it's been anonymised or published.
7. Who we share data with
We do not sell your data. We may share it with:
- Partner organisations, only where a project requires it, and only data relevant to that project (anonymised).
- Service providers who process data on our behalf (e.g. hosting, email delivery) under data processing agreements.
- Regulators or authorities, where we're legally required to.
We do not transfer your data outside the UK/EEA and we only use servers based in Europe (EU).
8. Your rights
| Right | What it means |
|---|---|
| Access | Ask us what data we hold about you |
| Rectification | Ask us to correct inaccurate data |
| Erasure | Ask us to delete your data ("right to be forgotten") |
| Restriction | Ask us to limit how we use your data |
| Portability | Get your data in a portable format |
| Objection | Object to processing based on legitimate interests |
| Withdraw consent | Withdraw consent at any time, without affecting past processing |
| Complain | Complain to the Information Commissioner's Office (ICO) ā ico.org.uk |
To use any of these rights, contact us at info@digitaldiversitylab.org. We'll respond within one month.
9. How long we keep data
| Data type | Retention period |
|---|---|
| Contact/enquiry data | [3 years / until no longer needed] |
| Research data | As set out in the specific project's consent form, typically [3 years] |
| Website technical logs | [12 months] |
| Financial/grant records | As required by funders/law, typically 6ā7 years |
10. Security
We use appropriate technical and organisational measures to protect your data (e.g. encryption, access controls, staff training). No system is 100% secure, but if we ever become aware of a data breach affecting you, we'll notify you and the ICO as required by law.
11. Cookies
Our website uses essential cookies to function, such as to allow you to access your profile and manage any subscriptions to newsletters. We don not use cookies for web analytics.
12. Children
DDLL's services are not directed at children under 13. If you believe a child has given us data without appropriate consent, contact us and we'll remove it.
13. Changes to this policy
We'll update this page when our practices change, and post the date at the top. For significant changes, we'll let you know directly where we can.
14. Contact us
Email: info@digitaldiversitylab.org
Post: Digital Diversity Living Lab Ltd, 128 City Road, London, United Kingdom, EC1V 2NX
If you're unhappy with our response, you can complain to the ICO at ico.org.uk or 0303 123 1113.