Privacy Policy

What is this policy?

This is our data protection and privacy policy. It explains who we are, and why and how we process personal data. If you are the subject of any of the personal data that we process, this policy explains what rights you have, and how to get in touch with us if you wish to.

Who are we?

We are Engine Partners UK LLP (Engine) and Transform UK Consulting Ltd, trading as Transform. Our contact and other details are set out at the end of this policy. We are the controller in relation to the personal data processed in accordance with this policy, except where this policy explains otherwise.

What do we do?

We are an integrated creative and media agency that provides a range of services to our clients including:

How do we process personal data?

How we process personal data depends on the purpose for which we obtain it and the individual to whom it relates. We will normally only process personal data relating to you if:

We explain our personal data processing in more detail, below, in relation to each of these categories.

If you are a client of ours, or you work for a client of ours:

Purpose of processing - The purpose of the processing is to enable us to provide, and to manage and administrate the provision of, the relevant services by us to you or the person that you work for, and to communicate with you in relation to the provision of services concerned. In the course of providing our services, we may share relevant information with third parties to the extent necessary to facilitate the provision of the relevant services to you or the person that you work for. For example, if we are engaging a third party to provide goods or services in relation to our provision of services to you, we may share your contact details with them if that is necessary to facilitate communications between you and them as part of service provision (see also other disclosures we may make, below).

Information processed - Your name. Who you work for (if applicable).Your address, phone number, email address or other contact details (these details may relate to your work or to you personally, depending on the nature of our relationship with you or the person that you work for).Bank account or other financial details (if you are an individual client)Personal description and photographAny other information relating to you that is included in any communications between us and you or anyone you work with in the course of provision of the services.

Legal basis - The processing is necessary for the performance of a contract to which you are a party or to take steps at your request to enter into such a contract (if you are an individual client) – article 6(1)(b) GDPR. The processing is necessary for the purpose of legitimate interests pursued by us in providing our services – article 6(1)(f) GDPR

How long we keep it - We keep the personal information that you give to us throughout the time during which we provide our services to you or the person that you work for, and for a reasonable period after the provision of services ends, after which we will delete it or archive it (if there is a appropriate reason to maintain an archive copy of it for future reference).

If you are a customer, potential customer or other contact of one of our clients:

Purpose of processing - If requested to do so by a client, we may collect your individual contact information or other information relevant to your communications, contacts or other dealings with our client. For example, we may process information relating to goods or services that you have obtained from our client or information contained in communications between you and our client. We need this information for the purpose of assisting our client in dealing with you or contacting you on our client's behalf. In doing this, we may in some circumstances be acting as a data processor on behalf of the relevant client, in which case any processing of your personal data by us will be solely in accordance with our client's instructions and under our client's control. Other than our client (where relevant), no third parties will have access to your personal information other than as set out in this policy (see other disclosures we may make, below).

Information processed - Your name. Who you work for (if applicable).Your address, phone number, email address or other contact details (these details may relate to your work or to you personally, depending on the nature of our client's relationship with you or the person that you work for). Information about transactions or communication between you and our clientInformation that you communicate to our client (for example, by email or social media)

Legal basis - The processing is necessary for the purpose of legitimate interests pursued by us in providing our services – article 6(1)(f) GDPR

How long we keep it - We keep the personal information relating to you for as long as is necessary in order to enable us to provide the relevant services to our client, after which we will delete it.

If you interact with us or any of our clients via social media:

Purpose of processing - If we are carrying out social media monitoring and/or reporting on our client's behalf and you interact with, or mention or tag our client on social media, we may process details regarding that interaction and your social media ID for the purposes of informing our client of the interaction concerned and, if so instructed by our client, communicating with you on our client's behalf. We will use this information to inform our client (for example, via reports and analyses, which will normally be composed of anonymised, aggregated data) about your interactions with, or relating to, our client (which may include reporting on interactions with, or mentions or tags of our client by you). Other than our client (where relevant), no third parties will have access to your personal information other than as set out in this policy (see other disclosures we may make, below).

Information processed - Your name (if available on the relevant social media platform). Your user ID. Other information relevant to our client that you communicate via social media or other public forum.

Legal basis - The processing is necessary for the purpose of legitimate interests pursued by us in providing our services – article 6(1)(f) GDPR

How long we keep it - We keep the personal information relating to you for as long as is necessary in order to enable us to provide the relevant services to our client, after which we will delete it. Normally, we will not keep this information for more than 6 months following its collection.

If you provide goods or services (or we are considering you as a provider of goods or service) to us or our clients:

Purpose of processing - If you provide goods or services to us or our clients. You work for, or are agent for or otherwise represent, someone who provides or is being considered as a provider of such goods or services. We are assessing your suitability (or that of the person you work for) to provide such goods or services. We may process information relating to you to enable us, our clients or other suppliers of ours or our clients to manage and administer the provision of goods or services by you or the person that you work for and to communicate with you and our client in relation to that provision. This may include (where relevant) processing any information necessary to enable us to provide or arrange any facilities, resources, travel, accommodation, insurance or anything else necessary to enable or assist you to provide goods or services to us or our clients.

Information processed - Name. Contact details (name, address, email address, phone number). Communications sent or received goods or services purchased and/or delivered. Other personal details relevant to your involvement in the services being provided (for example, your CV if you are talent who is contracting to provide services). Professional or other accreditation details. Passport details. Age verification details. Bank account or other financial details. Details relevant to hospitality being organised or provided (e.g. dietary requirements). Details relevant to travel or other facilities being organised or provided in order to assist you in providing the goods or services. Consent forms (where relevant to events or other activities in which the data subject is participating). Images of you. Records of public statements

Legal basis - The processing is necessary for the performance of a contract to which you are a party or to take steps at your request to enter into such a contract (if you are an individual client) – article 6(1)(b) GDPR. The processing is necessary for the purpose of legitimate interests pursued by us in providing our services – article 6(1)(f) GDPR

How long we keep it - We will keep the information for as long as necessary to facilitate the provision by you of the relevant goods or services and then for a period of up to 6 years afterwards, after which we will normally delete it. If we consider you, but decide not to select you, to provide such goods or services, then we will normally keep any relevant information provided by you for a period of 6 months, after which we will delete it (unless you have agreed to allow us to retain it in case, for example, we may wish to contact you in future regarding other opportunities to provide goods or services).

If you participate (or are invited to participate) in an event organised by us:

Purpose of processing - We may information relating to you (as well as that of anyone who is attending the event with you) as necessary to enable you and any other relevant individuals to be invited to, and to participate in, the event and to facilitate your attendance (for example, dietary or special access requirements). Other than our client (where relevant), no third parties will have access to your personal information other than as set out in this policy (see other disclosures we may make, below).

Information processed - Name. Contact details (email address, phone number, address). Other personal details relevant to your involvement in the event. Professional or other accreditation details. Passport details. Age verification details. Physical details such as body measurements where required (for example, where clothing or equipment is being provided for use by you). Bank account or other financial details. Details relevant to hospitality being organised or provided (e.g. dietary requirements). Consent forms (where relevant to events or other activities in which you are participating). Medical details relating to you where this is necessary in order to verify that you are fit to participate in a given event or activity.

Legal basis - The processing is necessary for the performance of a contract to which you are a party or to take steps at your request to enter into such a contract (if you are an individual client) – article 6(1)(b) GDPR. The processing is necessary for the purpose of legitimate interests pursued by us in providing our services – article 6(1)(f) GDPR

Medical details relating to you will only be processed with your prior explicit consent – article 9(2)(a) GDPR

How long we keep it - As long as reasonably necessary for the purposes of organising the event and then for up to 6 years afterwards, after which we will delete it.

If you are a respondent to any survey, research, interview or other enquiry carried out by us:

Purpose of processing - We may collect personal information from you as part of surveys or other research carried out by us, although in that case we will normally provide you at the time with more detailed information about how we will process the personal information concerned (and the processing of your personal data may be subject to a more specific policy which will be provided to you at the time). Information collected from you as part of a survey or research will normally not be disclosed to a third party without your prior consent, and any relevant disclosures will be explained to you in advance. Otherwise, disclosures will only be made in accordance with this policy (see other disclosures we may make, below) or with the relevant policy that is provided to you prior to the relevant information being collected from you.

Information processed - Name. Contact details (email address, phone number, address). Other personal details relevant to the market research being conducted. Age verification details. Consent forms (where relevant to market research in which the data subject is participating). Audio recordings of telephone surveys. IP addresses of online respondents. Other information dependent on the survey or research – this will be communicated to you at the time. Special categories of personal data relating to you may be processed where this forms part of the market research being conducted and you have consented.

Legal basis - You give consent to the processing – Article 6(1)(a) GDPR The processing is necessary for the performance of a contract to which you are a party or to take steps at your request to enter into such a contract (if you are an individual client) – article 6(1)(b) GDPR. The processing is necessary for the purpose of legitimate interests pursued by us in providing our services – article 6(1)(f) GDPRSpecial categories of personal data relating to you will only be processed with your prior explicit consent – article 9(2)(a) GDPR

How long we keep it - For as long as necessary to enable us to conduct the survey or research, and then normally for a period of 2 years after which we will delete it (or anonymise it if it is required for further research after that point)

If we wish to contact you when we are providing public relations or related services for our clients:

Purpose of processing - We will process information relating to you if we wish to contact you in the course of providing public relations or corporate communications services on behalf of our client (for example, if you are a public official, otherwise act in official capacity, work for a public body, are a journalist or otherwise involved in the media, and you are likely to have an interest in receiving communications on behalf of our client).Other than our client (where relevant), no third parties will have access to your personal information other than as set out in this policy (see other disclosures we may make, below).

Information processed - Name. Contact details (email address, phone number, address). Professional or other accreditation details. Areas of interest (for example, if you are a journalist)Information relating to you that is made public by you and which is relevant to the subject about which we wish to contact you.

Legal basis - The processing is necessary for the purpose of legitimate interests pursued by us in providing our services – article 6(1)(f) GDPRIf any special categories of personal data relating to you (for example, a relevant medical condition or political affiliation) are processed, this will be on the basis that the relevant information has been manifestly made public by you (article 9(2)(e) GDPR) or you have given your explicit consent to the processing (Article 9(2)(a) GDPR)

How long we keep it - We keep the personal information relating to you for as long as is necessary in order to enable us to provide the relevant services to our client, after which we will delete it. Normally, we will not keep this information for more than 6 months following completion of provision of the relevant services to our client.

If we wish to send you advertising, marketing or promotional material on our own behalf:

Purpose of processing - We may process your individual contact details in order to send you direct marketing material in order to advertise, market or promote our services (either to you or the person that you work for, as appropriate). We may combine this with other information we obtain about the things you are interested in and that are relevant to the services provided by us (for example, when you browse our website and view particular content) in order to help us ensure that marketing material that we send you is relevant to what you are interested in.

Information processed - Name. Job function; department. Work contact details (email address, phone number, address). Personal contact details (email address, phone number, home address). Events to which invited or which are attended. Communications sent or received. Use of websites (e.g. tracking data from use of Transform websites)

Legal basis - You give consent to the processing – Article 6(1)(a) GDPRThe processing is necessary for the purpose of legitimate interests pursued by us in providing our services – article 6(1)(f) GDPR

How long we keep it - We will keep the personal information for a reasonable period consistent with sending you marketing communications, after which we will either confirm that you are happy for us to continue to do so, or delete it (except to the extent we need to retain it for the sole purpose of supressing further marketing communications to you).

If you browse any of our websites:

Purpose of processing - We may collect information on your visits to our website and how you move around different sections of our website for analytics purposes to understand how people use our website so that we can make it more intuitive. We may keep a record of the content on our website that you have clicked on and use that information to target advertising on this website to you that is relevant to your interests and which we have identified based on content you have looked at. This may involve the use of cookies, which is explained in our cookies policy.

Information processed - You name and/or other identifier Who you work for Your visits to our website Content viewed by you Links followed by you Information downloaded by you.

Legal basis - You give consent to the processing – Article 6(1)(a) GDPRThe processing is necessary for the purpose of legitimate interests pursued by us in providing our services – article 6(1)(f) GDPR.

How long we keep it - We will keep the information for a reasonable period and then delete it.

If you apply for a position with us:

Purpose of processing - We may collect personal information in relation to you in connection with any application by you for a position with us. In that case, we will explain in more detail at the time how and for what purposes we intend to process the relevant personal information.

Information processed - Information dependent on the position you are applying for– this will be communicated to you at the time.

Legal basis - The processing is necessary for the performance of a contract to which you are a party or to take steps at your request to enter into such a contract (if you are an individual client) – article 6(1)(b) GDPR. The processing is necessary for the purpose of legitimate interests pursued by us in providing our services – article 6(1)(f) GDPR.

How long we keep it - If you are employed by us, for the duration of your employment and then for a further period of 6 years, after which the information will normally be deleted. If you are an unsuccessful applicant, for up to 12 months after your application, after which we will delete it unless we have agreed otherwise with you.

Other disclosures of your information we may make

Where appropriate, we may disclose your personal data to third parties:

Any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries.

Appropriate third parties including:

our auditors, legal advisors and other professional advisors or service providers;

In relation to information obtained via our website:

In the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets subject to the terms of this privacy policy.

If we or substantially all of our assets are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets.

If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of supply terms and other agreements with you; or to protect the rights, property, or our safety or that of our customers or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

Where do we process personal data?

The data that we process in relation to you may be transferred to, and stored at, a destination outside the European Economic Area (“EEA”) that may not be subject to equivalent data protection law. It may also be processed by staff who are situated outside the EEA who work for us, for a company in the same group as us or for one of our suppliers. This includes staff engaged in, among other things, the fulfilment of service delivery, the processing of payment details and the provision of support services.

Where personal data is transferred in relation to providing our services we will take all steps reasonably necessary to ensure that it is subject to appropriate safeguards, such as relying on a recognised legal adequacy mechanism which may include by entering into EC approved standard contractual clauses relevant to transfers of personal information (see http://ec.europa.eu/justice/dataprotection/internationaltransfers/transfer/index_en.html) and that it is treated securely and in accordance with this privacy policy.

All personal data processed by us is stored securely. Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our website and any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

Your rights

Under data protection law, you have certain rights. Your rights depend on our reason for processing your personal information.

If you have a complaint about any processing of your personal data being conducted by us, you can contact us or lodge a formal compliant with the Information Commissioner.

How to withdraw your consent to processing

You can withdraw your consent to any relevant processing of personal data:

How to exercise your right of access to your personal data

You can exercise your right of access to your personal data:

Please note that we may be required to ask you for further information in order to confirm your identity before we provide the information requested.

Our details - contacting us

Please contact our DPO Amanda Hamiltondpo-hub@next15.com Attn. - Data Protection Officer

Updates to this policy

Any changes we make to our privacy policy in the future will be posted on this page. Please check back frequently to see any updates or changes to our privacy policy.

Date of this policy

This policy was last updated in Jan 2023