Who we are
The Professional Association of Assistive Technologists CIC ("PAAT", "we", "us", or "our") is a Community Interest Company registered in England and Wales, company number 16756875. This policy explains how we collect, use, and protect personal data when you visit our website, apply for membership, or otherwise interact with us.
Our data protection contact is Dawn Green, who can be reached at dawn.green@pa-at.org.
What personal data we collect
We collect personal data in the following ways:
- Membership application data: when you apply for membership, we collect the information you provide on the application form, including contact details, professional background, and supporting evidence you choose to upload.
- Technical and log data: our website records IP addresses and basic technical information (such as browser type) when you submit forms, as part of normal website operation, security, and fraud prevention.
- Payment data: when you make a payment, this is processed by Stripe, our payment provider. We do not see or store your full card details. See the Sharing your data section below for more on Stripe.
- Correspondence: if you contact us by email or through the website, we keep a record of that correspondence to respond to you and maintain a history of our communications.
Drafting note: This list reflects what is currently known about the site's data collection. If any further data sources are added before launch, such as analytics tools, this section will need updating before publication.
Why we collect it, and our lawful basis
We process personal data for the following purposes:
- To assess and process membership applications. Lawful basis: performance of a contract, and our legitimate interests in operating a credible professional register.
- To process payments for application and membership fees. Lawful basis: performance of a contract.
- To maintain the security and proper functioning of our website, including preventing fraud and misuse. Lawful basis: legitimate interests.
- To respond to enquiries and correspondence. Lawful basis: legitimate interests, or performance of a contract where you are already a member or applicant.
How long we keep your data
[TO CONFIRM: PAAT needs to agree retention periods before this policy can be published. A suggested starting point: (a) successful membership records: duration of membership plus 6 years after it ends, in line with standard UK record-keeping practice; (b) unsuccessful applications: 1 year after the decision; (c) payment records: 6 years, in line with HMRC requirements. Please confirm or adjust before publication.]
Sharing your data
We share personal data with the following third parties, only as needed to provide our services:
- Stripe: our payment processor, to handle application and membership fee payments. Stripe processes your payment details directly; PAAT does not store full card numbers.
- Assessors: members of our assessment team review application data as part of the membership process. Assessors only see the information necessary to assess your application.
- Microsoft: we use Microsoft 365 for email and file storage. All Microsoft 365 data for our organisation is stored in UK data centres (confirmed via the Microsoft 365 admin centre data location report).
We do not sell your personal data or share it with third parties for marketing purposes.
Transfers outside the United Kingdom
Stripe, our payment processor, may transfer payment data outside the United Kingdom. Stripe uses standard contractual clauses to ensure your data is protected to UK standards. For more information, see Stripe's Data Processing Agreement at stripe.com/gb/legal/dpa.
Microsoft 365 data is stored in UK data centres and is not transferred outside the United Kingdom for storage or processing.
Cookies and similar technologies
This website uses a small number of strictly necessary cookies, used to allow the membership application form to work correctly and to remember your cookie preference. We do not use analytics, advertising, or tracking cookies. Full details, including what each cookie does and how long it lasts, are set out in our Cookie Notice.
Your rights
Under UK data protection law, you have the following rights in relation to your personal data:
- The right to access: you can ask us what personal data we hold about you and request a copy.
- The right to rectification: you can ask us to correct inaccurate personal data.
- The right to erasure: you can ask us to delete your personal data in certain circumstances.
- The right to restrict processing: you can ask us to limit how we use your personal data in certain circumstances.
- The right to data portability: where we process your data by automated means on the basis of your consent or a contract, you can ask for a copy in a structured, commonly used format.
- The right to withdraw consent: where we rely on consent as our lawful basis, you can withdraw it at any time. This will not affect the lawfulness of processing carried out before withdrawal.
The right to object. You have the right to object to our processing of your personal data where we rely on legitimate interests as our lawful basis. If you wish to object, please contact us using the details below and explain your concern. We will consider your objection and respond to you.
To exercise any of these rights, please contact us using the details below.
How to make a complaint
If you are unhappy with how we have handled your personal data, please contact us first using the details below so we can try to resolve your concern directly. We will acknowledge your complaint within 30 days and aim to respond as soon as possible.
Drafting note: As of 19 June 2026, UK law requires organisations to give individuals the opportunity to complain to PAAT directly before escalating to the ICO. This section reflects that requirement. A fuller internal process is set out in the separate Complaints Procedure document; the two should stay consistent with each other.
How to contact us
For any questions about this policy or your personal data, please contact our data protection contact, Dawn Green, at dawn.green@pa-at.org. Our registered office address is Clamarpen, 17 Napier Court, Barlborough, Chesterfield, Derbyshire, England, S43 4PZ.
Changes to this policy
We may update this privacy policy from time to time. This was last updated on 29 June 2026.