Company Investors Customer Support Region Login Privacy Policy General information Use of your data Accuracy Data retention Transfers outside the EEA Contacting us Visitors to our website Visitors to our offices Job applications Data security Your GDPR rights Contacting us if you're not happy Supervisory Authority Details Your California Privacy Rights GBG has regional privacy policies where appropriate – please click for APAC, Australia and New Zealand and California. All Privacy Resources are available here. GB Group Plc (‘GBG’) Website Privacy Policy GBG has offices in 16 locations; our registered head office is located within the United Kingdom. GB Group Plc The Foundation Herons Way Chester Business Park Chester United Kingdom CH4 9GB Company Registration Number: 02415211 This policy was last updated on 25 March 2021. General information and contact details This Privacy Policy explains to you how GB Group plc ('GBG') together with its subsidiaries and affiliates (collectively, “us,” “we,” or “our”) is committed to the responsible management, use, and protection of personal information. GBG use and secure your personal data whilst you are using the GBG website www.gbgplc.com or www.loqate.com, when you enter into a contract with GBG to provide services to your organisation, you visit one of our offices, or you apply for a job at GBG. If you are interested in how we collect and process personal information about you through our products and services, please see our Products & Services Privacy Notice. GBG take the protection and security of your personal data very seriously and this policy sets out our responsibilities under the General Data Protection Regulation 2016 (‘GDPR’) and other applicable laws in England and Wales relating to the processing and security of personal data. We have offices in 16 locations, and our registered head office is located within the United Kingdom. GB Group Plc The Foundation Herons Way Chester Business Park Chester CH4 9GB United Kingdom Company Registration Number: 02415211 If you have any questions about how your personal data is used by GBG, please contact our Data Protection Officer using this form. Our EEA representative is located in Spain at the following address GBG Edifici El Triangle 4a planta Placa de Catalunya 1 08002 Barcelona Spain T: +34 (0) 935 451 156 GBG review our Privacy Policy on an annual basis, sooner if changes to regulation require it or GBG change the way we process personal data. Use of your Data What personal data do GBG collect and why? Browsing our website: When you browse our website www.gbgplc.com, we will collect the Internet Protocol (IP) address of the device you are using, but will be unable to identify you at this point. We collect this data so that we can identify where customers are dropping out of the website and to identify areas of improvement to make the experience more engaging for our customers. We use cookies on our website, so please see our Cookie Policy for more information. Requesting a brochure: When you request a brochure from us, we will collect the following information from you: Email address (so that we can send the brochure to you). The name of your organisation (so that we can identify which sectors are showing the most interest in our products/services). Your IP address (which will no longer be anonymous; we will therefore be able to identify you). Requesting a call back: when you request a call back from us, we will collect the following information from you: Your name (so that we contact the right individual). Your contact telephone number (so that we contact the right individual). Your reason for contact (so that we can direct your call back to the right team who will respond to you directly). Your IP address (which will no longer be anonymous; we will therefore be able to identify you). Subscribing to our marketing lists: Where you have asked to receive marketing from GBG, we will collect the following information from you: Your name (so that we market to the right individual). Email address (so that we send the marketing to the right place). The marketing preferences indicated by yourself, such as your areas of interest and how you want to be marketed to. Your IP address (which will no longer be anonymous; we will therefore be able to identify you). When you receive an email from GBG, it will include an unsubscribe link, which you can click on if you wish to unsubscribe from our marketing lists. We will then add your email address to our suppression list, which will ensure you do not receive any further marketing from GBG. Please be assured we do not sell your personal data to third parties for marketing purposes. Requesting further information from us: Where you request further information from us by completing a form on our website in relation to our products and services, your details will be added to our marketing database to receive marketing from GBG relevant to the products and services you have an interest in. We will collect the following data from you: Your name (so that we market to the right individual). Email address (so that we send the marketing to right place). The marketing preferences indicated by yourself, such as your areas of interest and how you want to be marketed to. Your IP address (which will no longer be anonymous; we will therefore be able to identify you). Conferences and events: As a global organisation, GBG attends worldwide events and have marketing team members located around the world. GBG will obtain from the event organiser a delegate list of all attendees who will have been informed that their personal data will be shared with GBG. Entering into an agreement with GBG: During the process of entering into an agreement with GBG to provide products and services, we will collect additional information, which is necessary for: The performance of the contract with your organisation, such as billing information; and Providing service updates related to the product/service GBG will be providing to you. All personal data we collect is held electronically within our Customer Relationship Management systems (CRM) which are hosted in the United Kingdom. Purpose and legal basis for processing We process the information mentioned in this section in order to send you the brochure you requested, call you back, subscribe you to our marketing database or enter into an agreement with your organisation, as applicable. The legal basis we rely on to process this personal data is Article 6(1)(f) of the GDPR, which allows us to process personal data when it is necessary for the purposes of our legitimate interests subject to a balancing test to ensure our interests are not overridden by yours. Who will we share your personal data with and why? GBG will share your information with third party service partners who are acting on behalf of GBG as our data processor. Below are the details of whom GBG will share your personal data with and why: HubSpot Inc.: provides GBG with an email marketing solution, which delivers marketing emails on our behalf. HubSpot is headquartered in the US and their product infrastructure is hosted on Amazon Web Services in the United States, with some services being routed through the Google Cloud Platform in Germany. We share the following personal data with HubSpot: When you are browsing our website, HubSpot capture the anonymous IP address. At the point that you enter all of the required personal data relating to a free trial, demo, brochure request, or contact information for marketing, HubSpot will receive all of the personal data you provide via the website. For the purposes of marketing to our existing customer and prospect base and identifying which website visitors are already known to GBG, HubSpot will receive personal data relating to our primary contact at your organisation with whom we correspond as part of a sales process and/or in support and administration of customer contracts. Price Waterhouse Coopers: supports GBG with our CRM systems and, as a result, their teams located in Poland may access the live system for technical support. Microsoft: our Dynamics 365 CRM system is cloud-based and hosted by Microsoft in the UK. In addition, when you visit our website you will be directed to the Microsoft Azure instance in the region nearest to you (Ireland, Hong Kong, California, or London) and the data will be stored in Ireland. CustomerSure: carries out our Voice of the Customer surveys and is based in the UK. In order to determine customers’ level of satisfaction following their interaction with GBG at various pre-defined trigger points, CustomerSure will receive personal information from GBG's CRM systems. This is used to facilitate the sending of an email requesting completion of a survey and, following that, analysis of and appropriate reaction to the feedback received. The data is processed by CustomerSure in the UK with the exception of the disaster recovery backups, which are hosted in Ireland. GBG can assure you that we have taken all reasonable technical and organisational measures necessary to protect the personal information that our third party service partners may access. Accuracy Accuracy of your personal data As part of the account management process, GBG will on a regular basis enquire if the personal data we hold about you is correct. You can also ensure your personal data is correct by using this form. Alternatively, if your organisation has an agreement with GBG for the provision of services, you can contact your GBG account manager, who will ensure they update your record on our CRM system. Data retention How long do we retain your personal data for and why? Where we have collected your personal data for marketing purposes, we will retain your personal data for as long as you remain subscribed to our mailing lists or until you inform us that you no longer wish to receive marketing from us. GBG will retain the contact details for leads for up to 6 months, after which they will be deleted. For account management purposes, we will retain the personal data for as long as we have the relationship with your organisation. If GBG no longer has a relationship with your organisation, then we will only keep the relevant information, such as invoices, for audit purposes for 6 years after the relationship with GBG has ended. Once GBG is informed you are no longer the contact we need to liaise with or you leave your organisation, we will remove your details from our system. Transfers outside of the European Economic Area (EEA) GBG is able to transfer data to our processors located in the United States (i.e. HubSpot and Microsoft). We have taken appropriate safeguards to require that your personal information will remain protected in accordance with this privacy notice by implementing the European Commission’s Standard Contractual Clauses for transfers of personal information. In addition, as a global organisation, we have sales teams located all over the world. It will be necessary for your personal data to be transferred to them for account management activities or, where you have requested it, for marketing purposes. GBG will ensure the transfer of any personal data outside of the EEA is subject to appropriate safeguards. Contacting us Social media If you contact us through one of our GBG social media accounts by either a publicly visible message or a private direct message, this will be handled by our Communications Team. You will be asked to send your enquiry to the relevant team and provided with their email address. Messages received on social media containing personal data are deleted within one week. We do not track individuals and the analytics data we receive is not at a granular level. We do not scrape data from LinkedIn. GBG uses Sales Navigator to process personal data within LinkedIn. Obtaining personal data from LinkedIn by any other method is against the terms and conditions of LinkedIn and against GBG policy. Emails We use Office 365 encryption (TLS/SSL, IPSec, AES) and Mimecast to encrypt and protect email traffic. In addition, email filtering software is currently in place to monitor all incoming and outgoing emails for inappropriate or malicious content, spam, and unencrypted proprietary and/or personal data. Purpose and legal basis for processing We process the information mentioned in this section in order to be able to reply to any queries we receive and enhance the services we provide, which we believe also benefits our customers. The legal basis we rely on to process your personal data is Article 6(1)(f) of the GDPR, which allows us to process personal data when it is necessary for the purposes of our legitimate interests, subject to a balancing test to ensure our interests are not overridden by yours. Visitors to our website Analytics We use Google Analytics to measure how users interact with our website in order to understand which parts of our sites are doing well, how people arrive at our site and so on. We use this information to improve our website. Google will not associate your IP address with any other data held by it. You can learn more about Google Analytics here or opt out if you wish here. Cookies We use various types of cookies in order to identify and track users and to store information about your preferences. Users may disable cookies; however, please keep in mind that if you decide not to accept all of the cookies, some parts of the site might not work properly. You can read more about how we use cookies in our Cookie Policy. Search facility The search facility on our website does not collect any personal data. Search queries and results are logged anonymously to help us improve the website and search functionality, but we do not have the ability to identify any individuals. Security and performance We keep a record of traffic data, which is logged automatically by our server, such as your IP address and any error messages visitors may encounter. Any traffic data we process in order to monitor our website is anonymised when required for analytics. Purpose and legal basis for processing We process the information mentioned above for carefully considered and specific purposes mentioned in each section, which are in our legitimate interests to enable us to enhance the services we provide, which we believe also benefits our customers. This is in accordance with Article 6(1)(f) of the GDPR, subject to a balancing test to ensure our interests are not overridden by yours. Visitors to our offices Visitor book We meet visitors at our offices, including: Potential and existing customers External training providers Job applicants Suppliers and tradespeople Stakeholders Our visitors are asked to sign in and out at reception. The information collected will be name, company, who you’re visiting, time in/time out, vehicle licence plate number (if applicable), and date. This information will be contained in the visitor’s badge, which you will be required to wear throughout your visit. At the end of each working week, the visitor forms are securely destroyed. If your visit is planned, we will send your name and visit information to reception prior to your visit so they are expecting you. Purpose and legal basis for processing It is important GBG capture the details of visitors to our offices for various reasons, including but not limited to health and safety, fire safety, building security, and safety of our team members. To process visitor information, we rely on Article 6(1)(f) of the GDPR, which allows for processing on the basis of legitimate interests, subject to a balancing test to ensure our interests are not overridden by yours. Digital sign-in system If you visit our London office, you will be asked to use our digital sign-in system. We will require your full name, the company you are coming from, and date of visit. Visitor data is kept for a maximum of 6 months. Purpose and legal basis for processing We use this system to make signing in visitors more efficient and as a way of recording any invoice data necessary to handle our payments to suppliers related to use of our facilities. We rely on legitimate interests as the lawful basis for processing such data under Article 6(1)(f) of the GDPR, subject to a balancing test to ensure our interests are not overridden by yours. Wi-Fi In order to access our on-site guest Wi-Fi, you will need to be on the list of authorised users to access the network. When connecting to the GBG GUEST WI-FI network, you will be asked to enter in the email address of a GBG nominee, who will authorise your request for internet access. Once the GBG nominee has granted you permission, you will have access to the network. We monitor access to our internet, and log traffic information such as the IP address, sites visited, times and dates, log on times and log off times. This data is held for 12 months. Our purpose for processing this information is to provide you with access to the internet while visiting our office and ensuring it is accessed in accordance with our policies. We are able to process this data on the basis of our legitimate interests in accordance with Article 6(1)(f) of the GDPR, subject to a balancing test to ensure our interests are not overridden by yours. Purpose and legal basis for processing The purpose for processing this information is to provide you with access to the internet while visiting our office. We are able to process this data on the basis of our legitimate interests in accordance with Article 6(1)(f) of the GDPR, subject to a balancing test to ensure our interests are not overridden by yours. CCTV Closed-circuit television (CCTV) operates both inside and outside our Chester, Kuala Lumpur, London, Melbourne, Turkey, and Worcester offices. Generally, recordings will be retained for up to 30 calendar days, after which they will be deleted. Imagery required for investigative or evidential purposes may be retained beyond 30 days and is securely disposed of upon completion/conclusion of the purpose for which it was retained. Our Chester and Kuala Lumpur offices must retain the images for 90 days in order to comply with PCI-DSS requirements. Recordings are retained in a secure environment and are only accessible by authorised personnel who have a legitimate reason to do so. Any CCTV used in our Edinburgh, Liverpool or New York offices is not operated by us, so we are not the data controller. It will be under the control of the relevant building landlord. Purpose and legal basis for processing GBG uses CCTV imagery for the purposes of maintaining the safety and security of our building and team members, and for investigative purposes as evidence to support the effective management of any incidents. We rely on legitimate interests as the lawful basis for processing such data under Article 6(1)(f) of the GDPR, subject to a balancing test to ensure our interests are not overridden by yours. Job applications What personal data GBG collect and why When you apply online for a position with GBG we will use the information you provide to assist in the recruitment and selection process. There is information we require in order to process your application, which within the software is depicted as mandatory fields. GBG may also seek additional information from other sources, for example, by using your references in the final stages of the recruitment process. You have the opportunity to provide information in relation to additional adjustments required for the recruitment process to assist you. This is to ensure we enable all individuals to compete on equal terms. You may choose to provide some special category data here, such as ethnicity, religious beliefs or medical conditions, but it is not required and can be provided at a later date. Purpose and legal basis for processing Our purpose for processing your data in the event of a job application is to assess your suitability for the role. We rely on Article 6(1)(b) of the GDPR, which relates to processing necessary to perform a contract or to take steps at your request before entering into a contract. With regard to any special category data you provide, we collect this information to monitor equality and diversity to ensure we comply with legislation such as the Equality Act 2010. We therefore rely on compliance with a legal obligation under Article 6(1)(c) of the GDPR as the lawful basis for processing and Article 9(2)(a) of the GDPR, since we collect such special category data for the purposes of carrying out our obligations in the field of employment. Data retention Information provided on the application form and any information obtained from other sources will be retained in all cases in hard copy format and/or electronically only for as long as is required for the purposes of: the administration of your application future consideration where applicable (you will be notified separately if your application details will be retained for this purpose and provided with the opportunity to request deletion) if your application is successful this will form the basis of your employment records discharging any legal or regulatory requirements Your data is retained for 3 months within be/hired, our internal HR platform, then it is automatically deleted. If you would like your data deleted sooner, please contact by using this form so we can raise this as a request for Access UK Ltd to complete on our behalf. If your recruitment process goes beyond 3 months, you will be aware of this, with your personal data then held by GBG for the duration of the recruitment process. If you are successful with your application, the personal data you have supplied to us will form part of your employment record. Use of data processors GBG will share your information with third party service partners, who are acting on behalf of GBG as our data processor: Access UK Ltd: provides GBG with the software which controls the be/hired process. This is hosted in the UK. GBG is unable to change the questions which have been asked or the process within the system you are taken through. Whilst Access UK controls the “how” from a software perspective and hosts this platform, your personal data is gathered by GBG as the data controller, so we decide on why this is processed, who it is shared with, etc. The aCloud Recruitment Team at Access UK (Deployment/Development & support) appoints one individual in the hosting team with access to the server for support and maintenance purposes only. CEB Inc: provides GBG with a global talent assessment platform which is hosted in the US. As part of your application you may be requested to complete this assessment via a separate link. To generate this link, GBG will need to have shared your name and email address. The data entered is then determined by you. Other third parties Where you have engaged with an external recruitment agency they will have shared your details with GBG for a role they have notified you about. The recruitment agency also acts as a data controller. We are unable to be more explicit in this statement as to who they are as we work with a large number of agencies globally. If you would like more information regarding your personal data, please contact us using this form, or by writing to: Privacy and Data Compliance, GBG, The Foundation, Chester Business Park, Chester, CH4 9GB. We may also contact the named referee(s) you have supplied in order to provide a reference on you. Or once your application has been successful, your details may be shared with other third parties, such as a payroll provider. You will be notified of any further processing at the appropriate time. Accuracy of your personal data You enter your own information, so please ensure it is correct. If this needs to be updated, please contact behired@gbgplc.com who will be able to facilitate your request. International data transfers As a global organisation, a transfer taking place will depend on where in the world you are based and the role you have applied for. The platform on which be/hired is hosted by Access UK is in the United Kingdom, so if you only apply for a role in the European Economic Area (EEA) and do not complete a talent assessment, no international data transfer will have taken place. If you are in the EEA, and you do complete a talent assessment, your name and email address will have been transferred to CEB Inc., which is based in the US. GBG will ensure the transfer of any personal data outside of the EEA is subject to appropriate safeguards. Depending on the role you have applied for, we may need to transfer your personal data to other companies within GBG for administrative purposes. For example if you are based within the EEA, we may need to transfer your personal data outside of the EEA if you have applied for a role in a non-EEA country/territory. GBG will ensure the transfer of any personal data outside of the EEA is subject to appropriate safeguards. Data Security IS0 27001 Certification GBG are a global specialist in identity data intelligence for some of the largest organisations in the world, which is why GBG aim to set the highest standards of information security and in doing so, have developed an Information Security Management System (ISMS) to meet the requirements of the ISO 27001:2013 standard. Its aim is to protect the confidentiality, integrity and availability of GBG and client held information resources and assets, thus safeguarding GBG and its clients from unauthorised access, compromise and/or disclosure of data. PCI-DSS Certification Some of the services we provide are compliant with the Payment Card Industry Data Security Standard (PCI DSS). Being compliant with PCI DSS means that we are doing our very best to keep our customers’ valuable information safe and secure and out of the hands of people who could use that data in a fraudulent way. PCI ensure technical and operational strengths to raise the bar on our security. Cyber Essentials Certification In addition to the above, we have services that are Cyber Essentials accredited, this helps prevent the vast majority of cyber-attacks. Having a Cyber Essentials badge enables us to: Protect our organisation against common cyber threats. Demonstrate our commitment to information security. Your rights under the GDPR As an individual, you have rights under the GDPR regarding the use of your personal data, these are: The right to withdraw consent – you can withdraw consent at any time. The right to erasure – you can request that GBG remove your personal data from our systems. The right to restrict processing – you can request that GBG only process your personal data for the purposes you specify. The right to data portability – you can request that the personal data you have provided to GBG be ported to another organisation. The right to access your personal data – You have a right to know what personal data GBG hold on you and for what purpose we are processing your personal data. This is known as a Subject Access Request (SAR). The right to rectification – you have the right to ask us to rectify any information you believe is inaccurate. You also have the right to ask us to complete information you think is incomplete. The right to object to processing – you have the right to object to processing if we are able to process your information because the processing is in our legitimate interests. The right to obtain information upon request on the balancing test we have carried out when determining we are able to rely on legitimate interest as our lawful basis for processing your personal data. Please keep in mind that some of these rights are subject to an internal assessment that one of the grounds under the GDPR is satisfied. You can send these requests using this form, or by post to: Privacy & Data Compliance Team GB Group Plc The Foundation Herons Way Chester Business Park Chester CH4 9GB United Kingdom Or you can call +44 (0)1244 657277. You are not required to pay any charge for exercising your rights. We have one calendar month to respond to you. If GBG are unable to comply with your request, we will provide you with an explanation. How to contact us if you're not happy We appreciate that at GBG we may not always get things right and it is regrettable for us as an organisation when we receive a complaint. We take all complaints seriously and can assure you we will do our best to deliver a satisfactory outcome. If you do wish to complain about how your personal data is used by GBG then please use this form, alternatively please write to us at: Privacy & Data Compliance Team GB Group Plc The foundation Herons Way Chester Business Park Chester CH4 9GB United Kingdom GBG will investigate and respond within 10 working days, this allows us time to investigate your complaint thoroughly. Your right to lodge a complaint with the Supervisory Authority Where you believe that GBG has not taken our responsibilities with your personal data seriously, you have the right to complain to a Supervisory Authority. In the UK, GBG's regulator is: The Information Commissioner's office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF Telephone number: 0303 123 113 or 01625 545 745 Email: casework@ico.org.uk Your California Privacy Rights If you are a California resident, this section applies. As a California resident you have certain rights, subject to legal limitations and applicable exceptions, regarding the collection, use, and sharing of your personal information. California residents may exercise the following rights by emailing using this form, or by calling (001) 800 313 3910. Right to Know. You have the right to request information about the categories of personal information we have collected about you, the categories of sources from which we collected the personal information, the purposes for collecting the personal information, the categories of third parties with whom we have shared your personal information, and the purpose for which we shared your personal information (“Categories Report”). You may also request information about the specific pieces of personal information we have collected about you (“Specific Pieces Report”). Right to Delete. You have the right to request that we delete personal information that we have collected from you. Right to Opt Out. You have the right to opt out of the sale of your personal information. We will not discriminate against you, in any manner prohibited by applicable law, for exercising these rights. Verification: In order to exercise your rights, we will need to obtain information to locate you in our records or verify your identity depending on the nature of the request. If you are submitting a request on behalf of a household, we will need to verify each member of the household in the manner set forth above. More information about our verification process is available here. Authorized Agents: You may use an authorized agent to exercise your rights on your behalf. If you are making any of the requests above through an authorized agent, we will request written authorization from you and will seek to verify as described here or we will accept a legal Power of Attorney under the California Probate Code to the authorized agent. To make a request using an authorized agent use the webform and upload documentation demonstrating you have authorized the agent to exercise rights on your behalf. Timing: We will respond to a Request to Opt Out within 15 days. We will respond to Requests to Delete and Requests to Know within 45 days, unless we need more time in which case we will notify you and may take up to 90 days total to respond to your request. Pursuant to the California Consumer Privacy Act of 2018, below is a summary of the personal information we collect, the sources from which we collect the personal information, the business or commercial purpose for which the personal information is collected and the categories of third parties with whom we share consumer personal information. GBG About us Newsroom Awards & Recognition Careers Partners Investors Solutions Identity data verification Identity document verification Identity investigation Know your customer (KYC) Anti-money laundering (AML) Application fraud Transaction fraud Address verification & geocoding Use cases Solutions by business need Solutions by industry Solutions by job role Resources Resource Library Blog Events Podcasts Case studies Legal Legal and regulatory centre Privacy policy Products and services privacy policy Modern slavery statement Cookie Policy Contact us Sales Enquiries Customer Support General Enquiries Office Locations Individual data requests © Copyright 2021 GB Group plc (‘GBG’) Cookie preferences Cookie Policy We use cookies to deliver our online services set out in our Cookie Policy including ads and social media features. We use analytical and targeted media cookies to enhance your experience. To proceed to the site and consent to our cookies, click Accept. To modify your cookie preferences, click "Change Preferences". For the full details of each of the cookies we use please see our cookie policy here. Change Preferences Settings Accept Cookies