Privacy Policy

2. The data we collect about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth and gender.
• Contact Data includes billing address, delivery address, email address and telephone numbers.
• Financial Data includes bank account and payment card details.
• Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us.
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our website and applications.
• Profile Data includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.
• Usage Data includes information about how you use our website, applications, products and services.
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

In certain circumstances, our collection of the different categories of data set out above may include the collection of Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). We also may collect Criminal Convictions and Offences Data in certain circumstances.

If you fail to provide personal data

Where we need to collect personal data by law, or under the terms of our engagement with you, and you fail to provide that data when requested, we may not be able to perform the services set out in our engagement letter with you.

3. How is your personal data collected?

We use different methods to collect data from and about you including:

• In the process of carrying out work for you (or your business) where we will in almost all instances act as a controller. In very limited circumstances we may act as a processor, in which case we will let you know and ensure that an appropriate contract is put in place.
• When we communicate with you by email or other electronic correspondence, by telephone or using video conferencing software. You may give us your Identity, Contact and Financial Data by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you make a request for our services; create an account on one of our applications; subscribe to our publications; request marketing to be sent to you; complete a survey; or provide us with feedback.
• Networking (for example, at in-person or virtual events).
• By virtue of our access to CCTV footage.
• Otherwise through providing our services and operating our business.

We also collect data from and about you via our website:

• Through your actions, for example when submitting a contact, subscription or registration form, or when submitting a job application.
• Through automated technologies or interactions. As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies. Our website uses Google Analytics for site analytics and HubSpot to understand and manage interest in our services. Non-essential cookies are only set where you have consented through our consent manager (Termly), and you can change your choices at any time using Consent Preferences.
• Through third parties or publicly available sources. We will receive personal data about you from various third parties: Technical Data from analytics providers such as Google, advertising networks, and search information providers, which may be based outside the UK; Contact, Financial and Transaction Data from providers of technical, payment and delivery services, which may be based outside the UK; Identity and Contact Data from data brokers or aggregators, which may be based outside the UK; and Identity and Contact Data from publicly available sources such as Companies House and the Electoral Register based inside the UK.

4. How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• where we need to perform the contract we are about to enter into or have entered into with you;
• where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests — these legitimate interests include our interests in managing our relationship with our clients, prospective clients and their staff, hosting clients and others at our offices, hosting virtual and in-person events and ensuring appropriate standards and compliance with policies, practices or procedures;
• where we need to comply with a legal obligation; or
• where our services require us to process "special category data" and where we have obtained your explicit consent to do so. If we seek and obtain your consent, you may withdraw it at any time.

Generally, we do not rely on consent as a legal basis for processing your personal data, although we will get your consent before sending third-party direct marketing communications to you via email or text message, and before setting non-essential cookies on our website. You have the right to withdraw consent to marketing at any time by contacting us.

Purposes for which we will use your personal data

We have set out below a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate. We may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on.

Marketing

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising.

Promotional offers from us

We may use your Identity, Contact, Technical, Usage and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you (we call this marketing). You will receive marketing communications from us if you have requested information from us or purchased goods or services from us and you have not opted out of receiving that marketing.

Third-party marketing

We will get your express opt-in consent before we share your personal data with any third party for marketing purposes.

Opting out

You can ask us or third parties to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you or by contacting us at any time. Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a product or service purchase, warranty registration, product or service experience or other transactions.

Cookies

You can manage non-essential cookies on our website at any time using Consent Preferences. You can also set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of our website or applications may become inaccessible or not function properly.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

5. Disclosures of your personal data

As mentioned at the beginning of this privacy policy, Convergent consists of several international entities and any information that we collect or that you provide to us may be shared and processed by any Convergent entity. We may also share personal information with a variety of the following categories of third parties as necessary:

• our professional advisers such as lawyers and accountants;
• government or regulatory authorities;
• professional indemnity or other relevant insurers;
• regulators, tax authorities and corporate registries;
• third parties to whom we outsource certain services such as, without limitation, document processing and translation services, confidential waste disposal, IT systems or software providers, IT support service providers, and document and information storage providers;
• third parties engaged in the course of the services we provide to clients, such as relevant experts;
• third-party service providers that assist us with website analytics, client insight and relationship management, such as Google Analytics and HubSpot;
• third-party postal or courier providers who assist us in delivering documents related to a matter;
• third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.

Please note this list is non-exhaustive and there may be other examples where we need to share with other parties to provide our services as effectively as we can.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

6. International transfers

In order to provide our services to you, we may need to transfer your personal information to locations outside the jurisdiction in which you provide it. This may involve sharing your personal data within the Convergent group of entities located outside the UK. All the Convergent entities have signed a data sharing agreement to ensure we will comply with our legal and regulatory obligations in relation to personal information, including having a lawful basis for transferring personal information and putting appropriate safeguards in place to ensure an adequate level of protection for the personal information.

Some of our external third parties are based outside the UK so their processing of your personal data will also involve a transfer of data outside the UK. Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• transferring your personal data to countries that have been deemed to provide an adequate level of protection for personal data;
• implementing a suitable alternative such as EU standard contractual clauses; or
• where we use certain service providers, using specific contracts approved for use in the UK which give personal data the same protection it has in the UK.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK.

7. Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

8. Data retention

How long will you use my personal data for?

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

Details of retention periods for different aspects of your personal data are available in our retention policy, which you can request from us by contacting us.

In some circumstances we will anonymize your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

9. Your legal rights

Under certain circumstances, you may have rights under data protection laws in relation to your personal data, as follows:

• Your right of access: If you ask us, we'll confirm whether we're processing your personal information and, if necessary, provide you with a copy of that personal information (along with certain other details).
• Your right to rectification: If the personal information we hold about you is inaccurate or incomplete, you are entitled to request to have it rectified. If you are entitled to rectification and if we've shared your personal information with others, we'll let them know about the rectification where possible. If you ask us, where possible and lawful to do so, we'll also tell you who we've shared your personal information with so that you can contact them directly.
• Your right to erasure: You can ask us to delete or remove your personal information in some circumstances, such as where we no longer need it or if you withdraw your consent (where applicable). If you are entitled to erasure and if we've shared your personal information with others, we'll let them know about the erasure where possible. If you ask us, where it is possible and lawful for us to do so, we'll also tell you who we've shared your personal information with so that you can contact them directly.
• Your right to restrict processing: You can ask us to 'block' or suppress the processing of your personal information in certain circumstances, such as where you contest the accuracy of that personal information, or you object to us. If you are entitled to restriction and if we've shared your personal information with others, we'll let them know about the restriction where it is possible for us to do so. If you ask us, where it is possible and lawful for us to do so, we'll also tell you who we've shared your personal information with so that you can contact them directly.
• Your right to data portability: You have the right, in certain circumstances, to obtain personal information you've provided us with (in a structured, commonly used and machine-readable format) and to reuse it elsewhere or to ask us to transfer this to a third party of your choice.
• Your right to object: You can ask us to stop processing your personal information, and we will do so, if we are relying on our own or someone else's legitimate interests to process your personal information, except if we can demonstrate compelling legal grounds for the processing; or processing your personal information for direct marketing purposes.
• Your right to withdraw consent: If we rely on your consent (or explicit consent) as our legal basis for processing your personal information, you have the right to withdraw that consent at any time.
• Your right to lodge a complaint with the supervisory authority: If you have a concern about any aspect of our privacy practices, including the way we've handled your personal information, you can report it to the relevant supervisory authority.

Please note that some of these rights may be limited where we have an overriding interest or legal obligation to continue to process the data or where data may be exempt from disclosure due to reasons of legal professional privilege or professional secrecy obligations.

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

10. Additional privacy information for California residents

In this section, we provide additional information to California residents, as required under California privacy laws, including the California Consumer Privacy Act ("CCPA"). This section does not apply to publicly available information lawfully made available by state or federal government records, deidentified information, aggregate consumer information, or other personal information that is exempt under the CCPA (such as information covered by the Health Insurance Portability and Accountability Act). It applies solely to California consumers and addresses personal information we collect online and offline.

Notice of collection and use of personal information

We may collect the following categories of personal information about you:

• Identifiers: identifiers such as a real name, alias, postal address, unique personal identifier (such as a device identifier; cookies, beacons, pixel tags, mobile ad identifiers and similar technology; customer number, unique pseudonym, or user alias; telephone number and other forms of persistent or probabilistic identifiers), online identifier, internet protocol address, email address, account name, Social Security number, driver's license number, passport number, and other similar identifiers.
• Additional data subject to Cal. Civ. Code § 1798.80: signature, physical characteristics or description, state identification card number, insurance policy number, education, bank account number, credit card number, debit card number, and other financial information, medical information, and health insurance information.
• Protected classifications: characteristics of protected classifications under California or federal law, such as race, color, national origin, religion, age, sex, gender, gender identity, gender expression, sexual orientation, marital status, medical condition, ancestry, genetic information, disability, citizenship status, and military and veteran status.
• Commercial information: records of personal property, products or services purchased, obtained, or considered, and other purchasing or consuming histories or tendencies.
• Online activity: internet and other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding your interaction with websites, applications or advertisements.
• Sensory information: audio, electronic, visual and similar information.
• Employment information: professional or employment-related information.
• Education information: education information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).

We may use the categories of personal information listed above for the purposes described in this privacy policy. In addition, we may use these categories of personal information for certain business purposes specified in the CCPA.

California residents may exercise their privacy rights by contacting us at privacy@convergentds.com.

Sources of personal information

We collect the categories of personal information described above from the following sources: directly from you; automatically from your devices when you visit our website or use our applications; from our clients and their personnel in the course of providing services; from service providers such as analytics, payment and IT providers; from data brokers or aggregators; and from publicly available sources.

Business and commercial purposes

We use personal information for the purposes described in Section 4 of this policy, including: providing, performing and improving our services; managing client relationships; registering clients and meeting regulatory and compliance obligations; auditing and analytics relating to our website and applications; detecting security incidents and protecting against malicious, deceptive, fraudulent or illegal activity; debugging and repairing errors; marketing our services; and complying with legal obligations.

Disclosure of personal information

In the preceding 12 months, we may have disclosed each of the categories of personal information listed above for a business purpose to the categories of recipients described in Section 5 of this policy, including other Convergent entities, our professional advisers, service providers and contractors, insurers, and government or regulatory authorities where required.

Sale and sharing of personal information

We do not sell personal information for money. Our website uses cookies and similar technologies provided by third parties for analytics and marketing, and the use of some of these technologies may be considered a "sale" or "sharing" of personal information (such as identifiers and online activity) for cross-context behavioral advertising under California law. You can opt out at any time using Consent Preferences. We treat a Global Privacy Control signal sent by your browser as a valid request to opt out of the sale and sharing of personal information associated with that browser. We do not knowingly sell or share the personal information of consumers under 16 years of age.

Sensitive personal information

Where we collect sensitive personal information (for example, Social Security, driver's license or passport numbers, account and financial details, or health information in the course of background screening or client engagements), we use and disclose it only for purposes permitted under the CCPA, such as performing the services you request, ensuring security and integrity, and complying with law. We do not use or disclose sensitive personal information to infer characteristics about you.

Retention

We retain each category of personal information for as long as reasonably necessary for the purposes described in this policy, as explained in Section 8.

Your California privacy rights

Subject to certain exceptions, California residents have the following rights:

• Right to know: to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes for collecting, selling or sharing it, and the categories of third parties to whom we disclose it.
• Right to delete: to request that we delete personal information we have collected from you.
• Right to correct: to request that we correct inaccurate personal information we maintain about you.
• Right to opt out of sale or sharing: to direct us not to sell or share your personal information.
• Right to limit: to limit our use and disclosure of sensitive personal information to purposes permitted by the CCPA.
• Right to non-discrimination: we will not discriminate against you for exercising any of these rights.

How to exercise your rights

To submit a request to know, delete or correct, email privacy@convergentds.com with the subject line "California Privacy Request". To opt out of sale or sharing, use Consent Preferences or enable Global Privacy Control in your browser. We will verify your identity before fulfilling a request to know, delete or correct, which may require you to provide information that matches the information we hold about you. We will respond within 45 days, and may extend this by a further 45 days where reasonably necessary, in which case we will let you know.

You may use an authorized agent to submit a request on your behalf. We may require the agent to provide proof of your written authorization, and may require you to verify your identity directly with us.