Privacy policy
Last Updated: June 1, 2026
Introduction
1.1. About this Notice
1.1.1. This website, rcoa.odysseymediagroup.co.uk (the “Site”), is operated by Odyssey Media Group Ltd, a company registered in England and Wales under company number 10094720, whose registered office is at Waterside Drive, Arlington Business Park, Theale, Reading RG7 4SA (“Odyssey”, “we”, “us”, “our”).
1.1.2. Odyssey is the officially appointed media sales partner for the Royal College of Anaesthetists (“RCoA”), a registered charity in England and Wales (charity number 1013887) and in Scotland (charity number SC037737), whose registered office is at Churchill House, 35 Red Lion Square, London WC1R 4SG. Odyssey operates this Site on RCoA’s behalf to promote and sell advertising and sponsorship opportunities across RCoA-owned channels.
1.1.3. This Privacy Policy explains how personal data is collected, used, and shared when you visit this Site, submit an enquiry about advertising or sponsorship opportunities, or otherwise interact with us in connection with RCoA’s advertising and sponsorship programme.
1.1.4. This Privacy Policy does not apply to RCoA’s main website (www.rcoa.ac.uk) or to RCoA’s handling of membership, training, examination, or patient data. RCoA’s own privacy notice, which covers those activities, is available at www.rcoa.ac.uk/privacy.
1.2. Our Commitment
1.2.1. We are committed to protecting the privacy and security of your personal data and to being transparent about how we collect, use, and share it.
1.2.2. This Policy is written to comply with the UK General Data Protection Regulation (the “UK GDPR”) and the Data Protection Act 2018 (“DPA 2018”). Where we refer to “data protection law” in this Policy, we mean the UK GDPR and the DPA 2018, together with any other applicable UK data protection legislation in force from time to time.
Key Definitions
2.1. Defined Terms
2.1.1. Personal Data: any information relating to an identified or identifiable living individual (a “data subject”), including identifiers such as name, identification number, location data, an online identifier, or factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that individual.
2.1.2. Processing: any operation performed on personal data, whether or not by automated means, including collection, recording, organisation, structuring, storage, alteration, retrieval, use, disclosure, combination, restriction, erasure, or destruction.
2.1.3. Controller: the natural or legal person which, alone or jointly with others, determines the purposes and means of the processing of personal data.
2.1.4. Joint Controllers: two or more controllers who jointly determine the purposes and means of processing.
2.1.5. Processor: a natural or legal person which processes personal data on behalf of, and under the instructions of, a controller.
2.1.6. Data Subject: the identified or identifiable individual to whom personal data relates — in this Policy, principally you, as a visitor to the Site or a prospective or current advertiser/sponsor.
2.1.7. Consent: any freely given, specific, informed, and unambiguous indication of your wishes by which you signify agreement to the processing of your personal data.
3. Who Is the Controller of Your Personal Data?
3.1. Joint Controllers
3.1.1. Odyssey and RCoA act as joint controllers of the personal data collected through this Site in connection with the sale, fulfilment, and management of advertising and sponsorship opportunities on RCoA’s channels. This means that Odyssey and RCoA jointly determine the purposes and means of this processing.
3.1.2. We are joint controllers because:
3.1.2.1. Odyssey collects personal data directly from you through the Site (for example, when you make an advertising or sponsorship enquiry); and
3.1.2.2. Odyssey shares relevant personal data with RCoA where this is necessary for RCoA to approve sponsorship content, or to manage and fulfil advertising or sponsorship arrangements on RCoA’s own channels.
3.1.3. Odyssey and RCoA have entered into an arrangement under Article 26 of the UK GDPR which sets out our respective responsibilities for compliance with data protection law in relation to this joint processing, including in relation to the exercise of your rights under Section 10 below. A summary of this arrangement is available on request by contacting either Odyssey or RCoA using the details in Section 12.
3.1.4. You may exercise your data protection rights against either Odyssey or RCoA in respect of this joint processing, regardless of which of us holds primary responsibility for a particular aspect of compliance under our Article 26 arrangement.
3.2. Where Odyssey Is Sole Controller
3.2.1. Odyssey acts as the sole controller of personal data that we collect and use for our own purposes that are unconnected with the RCoA sponsorship/advertising relationship described in Section 3.1 — for example, where you contact Odyssey about Odyssey’s own services unrelated to RCoA, or where we collect website analytics data about your visit to the Site for our own internal purposes (see Section 5).
3.3. RCoA’s Own Privacy Notice
3.3.1. Where RCoA processes your personal data for its own purposes outside the scope of this joint processing arrangement (for example, if you separately become an RCoA member), that processing is governed by RCoA’s own privacy notice, available at www.rcoa.ac.uk/privacy, and RCoA’s data protection policy, available at www.rcoa.ac.uk/data-protection.
Information We Collect
4.1. Information You Provide Directly
4.1.1. Contact and enquiry information: name, email address, phone number, job title, organisation/company name, and any other information you choose to provide when you:
4.1.1.1. submit an advertising or sponsorship enquiry through the Site;
4.1.1.2. contact us by email, phone, or contact form;
4.1.1.3. request advertising specifications, rate cards, or media packs; or
4.1.1.4. subscribe to updates about RCoA advertising opportunities.
4.1.2. Communication records: records of correspondence between you and Odyssey (and, where relevant, RCoA) relating to your enquiry or booking.
4.1.3. Booking and account information: if you proceed to book advertising or sponsorship, billing details, invoicing information, and details of the specific advertising products or sponsorship packages purchased.
4.1.4. Sponsorship approval information: where you submit content for a sponsorship or advertising placement, the content and any related material submitted for RCoA’s review and approval.
4.2. Information Collected Automatically
4.2.1. When you visit the Site, we may automatically collect technical and usage information through cookies and similar technologies, including your IP address, browser type and version, device type, referrer URL, pages visited, and dates/times of access. See Section 9 (Cookies) for further detail.
How We Use Your Information and Our Legal Basis
5.1. Processing as Joint Controllers (Odyssey and RCoA)
5.1.1. The table below sets out the purposes for which Odyssey and RCoA process your personal data as joint controllers, and the legal basis relied on for each.
Purpose - Legal Basis
Responding to your advertising or sponsorship enquiry - Contractual necessity / steps prior to a contract (Art. 6(1)(b))
Assessing and approving sponsorship content with RCoA - Legitimate interests (Art. 6(1)(f)) — ensuring sponsorship content is appropriate for RCoA’s audience and brand
Managing and fulfilling advertising and sponsorship bookings - Contractual necessity (Art. 6(1)(b))
Invoicing and payment administration - Contractual necessity (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for tax/accounting records
Sending you information about advertising opportunities you have requested - Legitimate interests (Art. 6(1)(f)) / consent (Art. 6(1)(a)) where required
5.1.2. Where we rely on legitimate interests, we have considered that this processing is necessary for the operation of RCoA’s advertising and sponsorship programme and is not overridden by your rights and freedoms.
5.2. Processing Where Odyssey Is Sole Controller
5.2.1. The table below sets out purposes for which Odyssey alone is the controller.
Purpose - Legal Basis
Operating and maintaining the Site - Legitimate interests (Art. 6(1)(f))
Website analytics and performance monitoring - Legitimate interests (Art. 6(1)(f)); consent for non-essential cookies
Security and fraud prevention - Legitimate interests (Art. 6(1)(f)); legal obligation (Art. 6(1)(c))
Marketing communications about Odyssey’s own services (where unconnected to RCoA) - Consent (Art. 6(1)(a))
How We Share Your Information
6.1. Sharing Between Odyssey and RCoA
6.1.1. As joint controllers, Odyssey shares your personal data with RCoA, and RCoA shares relevant personal data with Odyssey, to the extent necessary to:
6.1.1.1. obtain RCoA’s review and approval of sponsorship or advertising content;
6.1.1.2. enable RCoA to manage and fulfil sponsorship and advertising arrangements on its own channels; and
6.1.1.3. enable RCoA to maintain its own records of sponsors and advertisers of its channels.
6.2. Service Providers
6.2.1. We engage third-party service providers who process personal data on our behalf as processors, including hosting providers, IT support, analytics providers, and CRM/email platforms. These providers are contractually bound to process data only on our instructions and to apply appropriate security measures.
6.2.2. Current categories of service provider include website hosting and analytics providers (for example, Google Analytics) and CRM/marketing platforms (for example, HubSpot).
6.3. Legal and Regulatory Disclosures
6.3.1. We may disclose personal data where required by law, court order, or a valid request from a public authority or regulator.
6.4. Business Transfers
6.4.1. If Odyssey is involved in a merger, acquisition, or sale of all or part of its business, personal data may be transferred as part of that transaction. We will notify you of any such change via the Site or by email where appropriate.
6.5. No Sale of Personal Data
6.5.1. We do not sell or rent your personal data to third parties for their own independent marketing purposes.
International Advertisers and International Data Transfers
7.1. Advertisers Based Outside the UK
7.1.1. We work with advertisers and sponsors based both inside and outside the United Kingdom. If you contact us from outside the UK, your personal data will be transferred to, and processed in, the UK in connection with your enquiry or booking.
7.2. Transfers of Personal Data Outside the UK
7.2.1. Some of our service providers (see Section 6.2) may store or process personal data outside the UK, including in the United States or elsewhere. Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place, which may include:
7.2.1.1. a UK adequacy regulation confirming that the destination country provides an adequate level of data protection;
7.2.1.2. the UK International Data Transfer Agreement (“IDTA”) or the UK Addendum to the EU Standard Contractual Clauses, as approved by the Information Commissioner’s Office (“ICO”); or
7.2.1.3. another lawful transfer mechanism recognised under UK data protection law.
7.2.2. Further information about these safeguards is available on request by contacting us using the details in Section 12.
Data Retention
8.1. Retention Periods
8.1.1. We retain personal data only for as long as necessary for the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements.
Type of Data - Retention Period
Advertising/sponsorship enquiries that do not proceed to booking - Up to 24 months from the last interaction
Booking, invoicing, and financial records - 7 years from the end of the relevant financial year, in line with UK tax record-keeping requirements
Sponsorship content submitted for approval - For the duration of the relevant campaign, plus 3 years thereafter
Website analytics data - In accordance with the retention settings of the relevant analytics provider (see Section 9)
8.1.2. Where data is processed jointly with RCoA, retention periods are agreed between Odyssey and RCoA as part of our Article 26 arrangement referred to in Section 3.1.3.
9. Cookies and Similar Technologies
9.1. Categories of Cookies
9.1.1. Strictly necessary cookies: required for the Site to function; these do not require consent.
9.1.2. Performance/analytics cookies: used to understand how visitors use the Site; require consent.
9.1.3. Functional cookies: remember your preferences; require consent.
9.1.4. Targeting/advertising cookies: used to deliver and measure the effectiveness of advertising; require consent.
9.2. Third-Party Cookies
9.2.1. Google Analytics — used to understand Site usage. See Google’s privacy policy.
9.2.2. HubSpot — used for CRM and marketing automation functionality. See HubSpot’s privacy policy.
9.3. Managing Cookies
9.3.1. You can manage your cookie preferences via the cookie settings tool on the Site, or through your browser settings. Disabling certain cookies may affect the functionality of the Site.
10. Your Rights Under UK GDPR
10.1. Your Rights
10.1.1. You have the following rights in relation to your personal data, subject to certain exceptions and conditions:
10.1.1.1. the right to be informed about how your data is used;
10.1.1.2. the right of access to a copy of your personal data (Art. 15);
10.1.1.3. the right to rectification of inaccurate or incomplete data (Art. 16);
10.1.1.4. the right to erasure in certain circumstances (Art. 17);
10.1.1.5. the right to restrict processing in certain circumstances (Art. 18);
10.1.1.6. the right to data portability, where applicable (Art. 20);
10.1.1.7. the right to object to processing based on legitimate interests or for direct marketing (Art. 21);
10.1.1.8. rights in relation to automated decision-making and profiling (Art. 22) — we do not currently carry out automated decision-making or profiling that produces legal or similarly significant effects on individuals; and
10.1.1.9. the right to withdraw consent at any time, where processing is based on consent.
10.2. How to Exercise Your Rights
10.2.1. To exercise any of these rights in relation to data processed jointly by Odyssey and RCoA, you may contact either Odyssey or RCoA using the details in Section 12, and your request will be handled in accordance with our Article 26 arrangement.
10.2.2. We may need to verify your identity before responding to your request, and we will respond without undue delay and within one month of receipt, in accordance with data protection law.
10.3. Right to Complain
10.3.1. If you have concerns about how your personal data has been handled, you have the right to lodge a complaint with the Information Commissioner’s Office:
10.3.2. Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
Website: www.ico.org.uk
Data Security
11.1. Our Measures
11.1.1. We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, and destruction, including encryption of data in transit and at rest where appropriate, access controls, staff training, and incident response procedures.
11.1.2. No method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.
12. Contact Us
12.1. Odyssey Media Group Ltd
By email: info@odysseymediagroup.co.uk
By post: Odyssey Media Group Ltd, Waterside Drive, Arlington Business Park, Theale, Reading RG7 4SA
12.2. The Royal College of Anaesthetists
12.2.1. By email: dpo@rcoa.ac.uk
12.2.2. By post: Churchill House, 35 Red Lion Square, London WC1R 4SG
12.2.3. RCoA’s data protection lead can be contacted via the details published at www.rcoa.ac.uk/privacy.
Changes to This Privacy Policy
13.1. Updates
13.1.1. We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated “Last Updated” date. We encourage you to review this Policy periodically.