Privacy and your data rights

1. Introduction

As is true of most companies, ISG needs to collect and use your personal information for various purposes.

ISG is a company registered in England and Wales under the registration number 10081578. Our registered address is Aldgate House, 33 Aldgate High Street, London EC3N 1AG. All references to ‘ISG’, ‘we’, ‘us’, ‘our’ are references to ISG Plc and its subsidiaries.

We understand that you care about your privacy, and we take that seriously.

This Privacy Notice describes ISG’s policies and practices regarding its collection and use of your personal data.

2. Data protection officer

ISG has appointed an internal data protection officer for you to contact if you have any questions or concerns about ISG’s personal data policies or practices. ISG’s data protection officer’s name and contact information are as follows:

Rich Yates
Data Protection Officer
ISG
Aldgate House
33 Aldgate High Street
London  EC3N 1AG
data.protection@isgplc.com

3. How we collect and use your personal information

3.1. How we collect your data

We collect your personal information through various channels including, but not limited to, the following:

  • Email marketing campaigns and communications
  • Social media communications
  • Search engine marketing (SEO/PPC/affiliates)
  • Offline marketing campaigns linked to ISG websites
  • Business cards
  • Face to face meetings when conducting our business
  • Forms you fill in
  • Records of CCTV and other security systems
  • Where we engage with our partners that enable you to register to visit our site, we may receive your personal data relevant to the visit
  • Where we provide repair services to our partners, we may receive your personal information from entities and organisations that manage your property.

3.2. The types of data we collect

Personal Data for Marketing: Mostly, the personal data we collect is limited to the kinds of information that can be found on a business card or can be retrieved from your email enquiries or face to face meetings, namely your first name, last name, job title, employer name, work address, work email, work phone number and content of communications. If you subscribe to our newsletter via a Preference Centre on our website or a Consent Page, we will collect your email, first name, last name, as well as information about your communication preferences and interests. If you choose to opt out of our mailing list, we will move your name and email address to our suppression list. We can also collect your name or nickname, a photo on social media and content of communications, when you send us a message or interact on our social media pages.

Personal Data for Events: When you register to attend an event organised by us, we may collect your first name, last name, job title, employer name, work address, work email, work phone number and content of communications. In some instances, only when appropriate, we may ask you for other personal data, although this will always be optional, for example, your dietary requirements.

Site Visitor’s Personal Data: When you register to visit any of our sites, we may collect your first name, last name, employer or school name, employer or school address, email, phone number, trade and CSCS Card Number. If you are provided with an induction, we will retain the information about it. We may also collect your photo, biometric data or CCTV footage necessary for health and safety and/or security purposes. If you are under age 13, we require your parents’ or guardians’ consent to process your personal data; this consent is to be collected by the school or educational authority prior to the visit commencing.

Tenants’ Personal Data: When a manger of your property requests us to repair it, we will obtain information with your first name, last name, phone number, address, email, time for availability, property defects, work orders, work completion information and content of communications.

For more information, please see the Appendix below.

4. Why we collect your information

4.1. Purposes

As is true of most companies, ISG plc needs to collect and use your personal information for various purposes, namely the following:

  • Marketing: Personal information we collect to provide you with relevant information about our services and events, and respond to your enquiries
  • Registration:Personal information we collect to register you for our events or site visits
  • Health and Safety:Personal information we collect for your safety and the safety of others on project sites
  • Security: Personal information we collect to ensure security on project sites
  • Legal reasons: Personal information we are required to collect by law
  • Tenancy repairs: Personal information we need to collect to arrange appointments for repairs at your property

4.2. Legal Basis for collecting and using your data

The legal basis for collecting and using your personal information for the above purposes are legitimate interests, consent and legal obligation.

For more information on ISG’s legal bases and legitimate interests please refer to the Appendix below or contact us at data.protection@isgplc.com

4.3. Automated decision making

We do not make any automated decision-making or profiling using your personal information.

4.4. How long we keep your personal information

The information we collect will be stored for the duration of your interest in ISG’s services, for the duration of events and visits on sites, provision of repairs, and in some instances longer, if required by regulatory authorities. Please see the Appendix for more information.

4.5. Our marketing policy

We will always exercise restraint and send you only materials that we feel are relevant to your interests.

If you consent via our Preference Centre on the website, we will send you free of charge marketing content which relates to the preferences you have set, until you tell us not to. If you consent via our Consent Page, we will send you marketing content which we select on your behalf, until you tell us not to. You can set/change your preferences or remove your consent at any time via the same Preference Centre.

We host events throughout the year. These include in-person conferences or meetings or sessions we arrange during industry events. We also publish news, insights and information on our services. If you have used our Preference Centre to confirm you want to receive information about events, news, insights or our services, we will send you information in line with your preferences, free of charge, until you tell us not to.

We may also include forms on our website which enable you to sign up for specific events if you wish to, or download content such as insights or information about our services. Any data we collect from these specific forms will only be processed and used for purposes relating to the event or topic that the form relates to. It will not be used as consent to send you any other unrelated marketing content, although we will also offer you an optional opportunity to consent for us to send you carefully selected marketing content that we think you might be interested in, free of charge, until you tell us not to. Alternatively, you can access our Preference Centre and specify which topics you would like us to send you information about, on an ongoing basis, until you tell us not to.

If you make an enquiry to ISG via our website, by email, or face-to-face (e.g. at an event), we may offer you an opportunity to consent to us storing your personal data, and also the option to use our Preference Centre to consent for us to send you information which reflects the preferences you select, on an ongoing basis, until you tell us not to.

5. Sharing your personal information

The personal information ISG collects from you is stored in one or more databases hosted by third parties located in the European Economic Area (EEA). These third parties do not use or have access to your personal information for any purpose other than cloud storage and retrieval.

We may share your information with other organisations or divisions within the ISG group located in the EEA. We may also have to share your personal information with law enforcement authorities where we are required to do so by law.

The list of parties is shown below:

Company Data shared Reason for sharing
CRM system provider Name, job title, email, telephone numbers, postal address, dietary requirements, marketing preferences and interests, marketing consent status (if consented), suppression list This cloud-based database is used to store your personal information in relation to marketing
Web, email, social media platforms Name, job title, email, telephone numbers, postal address, work, name or nickname on social media, photo on social media, content of communications These service providers help us to respond to any of your enquiries
Email, mail and surveys distribution providers First name, last name, job title, company name, work email, postal address These service providers help us to deliver email and mail communications to you, e.g. news and insights, information about events, CX surveys
Biometric systems providers Biometric data: fingerprints, retina scans This only applies to sites where biometric scanners are installed. This technology helps us to carefully identify persons accessing our sites
CCTV systems providers CCTV footage This only applies to sites where CCTV is installed for security reasons
Customer care database First name, last name, phone number, address, email, time for availability, property defects, work orders and work completion information This database is used to report information on property repairs
Sub-contractors First name, last name, phone number, address, email, time for availability, property defects, work orders and work completion information This only applies where we need to use sub-contractors to engage for property repairs

6. Your rights

Under the GDPR data subjects have the following rights:

  • The right to be informed of any data processing
  • The right of access to your personal data
  • The right to rectification of your personal data, in some circumstances
  • The right to erasure of your personal data, in some circumstances
  • The right to restrict processing of your personal data, in some circumstances
  • The right to data portability, in some circumstances
  • The right to object to the processing of your personal data, in some circumstances
  • The right to withdraw consent to the processing of your personal data, where applicable.

If you wish to exercise your rights as a data subject, please fill in the form here or contact us at data.protection@isgplc.com

If you wish to unsubscribe from our marketing communications, you can visit our Preference Centre, which is available via the footer on any page on our website (https://www.isgplc.com).

Additionally, if you are aged under 13, we may require your parents’ or guardian’s consent for you to exercise any of your rights.

7. Security of your information

To help protect the privacy and confidentiality of your personal information, we maintain physical, technical and administrative safeguards. We update and test our security technology on an on-going basis. We restrict access to your personal data to those employees who need to know that information to provide benefits or services to you. In addition, we train our employees about the importance of confidentiality and maintaining the privacy and security of your information. We commit to taking appropriate disciplinary measures to enforce our employees' privacy responsibilities.

8. Appendix 1 - Further details on your information

The following details the information we may collect (depending on a processing activity), the appropriate legal basis and justification and the retention period for such data.

Information collected Legal basis Justification Retention period
Name

Legitimate interest

Consent

This data may need be retained in order to identify you.

ISG has a legitimate interest to identify data subjects for various reasons including marketing, business development and provision of services to partners.

Subscribers – for the duration of the subscription

Enquirers - for the duration of the engagement

Social media users – for the duration of the engagement

Events attendees – for the duration of the event

Site visitors – for up to one year

Partners’ tenants – for up to one year

Company (School) Name

Legitimate interest

ISG has a legitimate interest to identify data subjects for various reasons including marketing and business development.

Subscribers – for the duration of the subscription

Enquirers - for the duration of the engagement

Events attendees – for the duration of the event

Site visitors – for up to one year

Email Address

Legitimate interest

Consent

This data may need to be retained in order to identify you and communicate with you.

ISG has a legitimate interest to identify and communicate with data subjects for various reasons including marketing, business development and provision of services to partners.

Subscribers – for the duration of the subscription

Enquirers - for the duration of the engagement

Events attendees – for the duration of the event

Site visitors – for up to one year

Partners’ tenants – for up to one year

Phone Number

Legitimate interest

This data may need to be retained in order to identify you and communicate with you.

ISG has a legitimate interest to identify and communicate with data subjects for various reasons including marketing, business development and provision of services to partners.

Enquirers - for the duration of the engagement

Events attendees – for the duration of the event

Site visitors – for up to one year

Partners’ tenants – for up to one year

Address

Legitimate interest

Consent

This data may need to be retained in order to identify you and communicate with you.

ISG has a legitimate interest to identify and communicate with data subjects for various reasons including marketing, business development and provision of services to partners.

Enquirers - for the duration of the engagement

Events attendees – for the duration of the event

Site visitors – for up to one year

Partners’ tenants – for up to one year

Job Title

Legitimate interest

This data may need to be retained in order to identify you.

ISG has a legitimate interest to identify data subjects for various reasons including marketing, and business development.

Enquirers - for the duration of the engagement

Events attendees – for the duration of the event

Communication Preferences

Interests

Legitimate interest

Consent

ISG has a legitimate interest to identify content relevant to you for various reasons including marketing, and business development.

Subscribers – for the duration of the subscription

Enquirers - for the duration of the engagement

Events attendees – for the duration of the event

Suppression list (including name and email address)

Legitimate interest

ISG has a legitimate interest to identify you in order cease sending to you marketing communications that you have chosen to opt out of.

Subscribers – for up to twenty years

Enquirers - for up to twenty years

Events attendees – for up to twenty years

Content of Communications

Legitimate interest

ISG has a legitimate interest to communicate with data subjects for various reasons including marketing, business development and provision of services to partners.

Enquirers - for the duration of the engagement

Events attendees – for the duration of the event

Site visitors – for up to one year

Partners’ tenants – for up to one year

Photograph (as part of security badge)

Legitimate interest

ISG has a legitimate interest to identify visitors on sites for security reasons.

Site visitors – for up to one year

CSCS Card Number/NI Number

Legal Obligation/ Legitimate Interest

In some cases, ISG is required by law or a duty of care to ensure the individual is aware of site risks and record whether they have a CSCS Card. This data is also retained to defend against legal claims.

Site Visitors – for the duration of project and up to 3 years to defend a legal claim

Trade

Legal Obligation/ Legitimate Interest

In some cases, ISG is required by law or a duty of care to ensure the individual is aware of site risks and record which trade they are involved in. This data is also retained to defend against legal claims.

Site Visitors – for the duration of project and up to 3 years to defend a legal claim

Induction Date and Course

Legal Obligation/ Legitimate Interest

In some cases, ISG is required by law or duty of care to ensure the individual is aware of site risks and demonstrate an induction was completed by a visitor. This data is also retained to defend against legal claims.

Site Visitors – for the duration of project and up to 3 years to defend a legal claim

Biometric Data

*This only applies to sites where biometric scanners are installed

Consent

ISG may collect biometric data, including fingerprints and retina scans for site security purposes.

Site visitors – for up to one year

CCTV Images

*This only applies to sites where CCTV is installed

Legitimate interest

ISG has a legitimate interest in collecting CCTV footage/CCTV images for purposes of security and the prevention of crime.

Site Visitors – up to 30 days, although may be longer if required by police or other authorities for criminal investigations

Time for Availability

Legitimate interest

ISG has a legitimate interest to arrange appointments in order to provide property repair services to partners.

Partners’ tenants – for up to one year

Property Defects

Work Orders

Work Completion Information

Legitimate interest

ISG has a legitimate interest to use this information to be able to provide property repair services to partners.

Partners’ tenants – for up to one year