This Privacy Notice describes how Mace Consult and its subsidiaries (hereinafter referred to as “Mace Consult” "we," "us," or "our") collects, uses, discloses, and protects information relating to you (your “Personal data”) in relation to our website at Mace Consult and related webpages (our “Website”). Please read this privacy notice carefully to understand your rights and our views and practices regarding your personal data.
This notice should be read alongside our Cookies Policy and notices and Terms of Use.
Mace Consult is made up of different legal entities. When we refer to ‘Mace Consult’, we are referring to the relevant company in the Mace Consult group responsible for processing your personal data. A reference to ‘you’ or ‘your’ is to you as an individual.
For further definitions please see our Definitions section below.
Within the UK and the EEA, the Data Controller responsible for processing your Personal data is Mace Consult Limited of 155 Moorgate, London EC2M 6XB. In some circumstances, other Mace Consult companies will also be Data Controllers in respect of your Personal data. For example, if you apply for a job with us, the relevant Data Controller will be the Mace Consult company that is considering your application. If you have any queries about which Mace Consult company is a Data Controller in respect of your Personal data, please contact PrivacyQueries@macegroup.com.
This notice is overseen by the Mace Consult Global Privacy Team (Privacy Team). If you have any queries, complaints or requests please contact the Privacy Team at PrivacyQueries@macegroup.com.
Mace Consult have appointed a European Representative.
Our European Representative is: A&L Goodbody 25 North Wall Quay, Dublin 1, D01 H104
All EU Representative correspondence, queries or enquires should be emailed to PrivacyQueries@macegroup.com.
Privacy Notice Updates
We may update this Privacy Notice from time-to-time by posting a new version on our websites. You should check this page occasionally to ensure you are happy with any changes. Where changes are material, we may also notify you of them by email.
Contents
What information do we collect from you?
We will collect and process the following data about you:
- Information you give: This is information about you that you give us directly. You may do this by filling in forms on our website or by corresponding with us by phone, email or otherwise. Information you send to us may be stored and processed by Mace Consult. This will include any emails or other electronic messages and any documents, photos or other files stored on or processed through our systems or devices. Please be aware that by entering information onto these systems you are sharing that information with Mace Consult.
- Website forms: Mace Consult currently operates the website for the benefit of Mace Consult and as a Data Processor for Mace Group Limited. This means that when you share Personal data during your visit to the Mace website, such as filling out forms or surveys, or where you agree to allow us to collect cookies on behalf of Mace Group Limited (via the cookie banner and notices), this Personal data will be shared with Mace Group Limited.
- Information we collect throughout our relationship: We will collect information throughout your time with us. This may include information about location, employees, projects, working hours and other relevant information.
- Information we receive from others: We receive information about you from third parties, including:
-
- Tax and regulatory authorities such as HMRC
-
- Previous employers
-
- Recruitment or vetting agencies
-
- Security clearance/ pre-employment check providers
-
- Publicly available resources including online
- The type of information we collect: This may include the following (and may include Special category personal data as defined below)
-
- Identification information: your name, title, date and place of birth, gender, photograph, marital status, nationality, identification documents such as copies of passport and government identification numbers.
-
- Contact details: address, telephone number, mobile telephone number, email address.
-
- Employment related information: job title, company, business contact information, CV and employment application, eligibility to work, employment history, references, qualifications and other educational history, employment contract information and driving licence.
-
- Browsing behaviour: when you visit our website, we may collect information about your online browsing behaviour and any devices you have used to access our site (including your IP address, browser type and mobile device identifiers).
-
- Location: we may collect your location data through your IP address.
-
- Preferences: we collect what Mace Consult services you are interested in and the sectors that you wish to be updated on through our preference centre, where you agree, we will also share this information with Mace Group Limited.
-
- Dietary requirements: in some cases, such as for attendance at catered events, we may collect and process special dietary requirements for reasons of health or religion.
-
- Information about your health: in some cases, we may collect information which is categorised as health data, for example: where you provide us or we ask for access requirements, medical history or vaccination status (where required). This information will be treated as highly confidential.
-
- Equality and diversity: you may choose to share information about your ethnicity, parental status, sexuality or beliefs with us for inclusion purposes. This information will be treated as highly confidential.
-
- Images and video footage: images and footage are collected from our use of CCTV and similar technologies at our premises or sites (including client sites where our role requires us to either process or access this information). Footage may also be collected via drones, body worn cameras, headcams and webcams when you visit one of ours or a client site. In some instances, this may also include audio footage.
-
- Other data: which we may notify you of from time to time.
-
- Opinion: Mace Consult may also contact you to ask you to take part in voluntary surveys to hear your opinion of current services or of potential new services on offer. If you choose to take part in these surveys, we will collect the information you provide. We also collect data you provide in emails and phone calls for example, your questions to customer support.
We also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data could be derived from your Personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.
Why do we collect this information?
We collect and share your Personal data for different purposes. We must have a valid legal reason to collect, use, or share your personal information under data protection or privacy laws. The legal grounds that we most commonly rely on include:
- Where we need to perform the contract, we are about to enter into or have entered into with you.
- Where we need to comply with a legal obligation.
- Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
- Where you have given your consent.
We have set out below in the table the purposes that we use your personal data for and the associated legal grounds.
|
Purpose |
Types of personal data processed |
|
Legal ground: Based on performance of our contract with you, or in order to take steps at your request to enter into a contract with you, for example: |
|
|
In performing our obligations under our contract to which you are a party |
|
|
When applying for a vacancy advertised on our website |
|
|
Apply for or renew your visa if being sponsored by Mace |
|
|
Legal ground: To comply with legal requirements relating to: |
|
|
The provision of products and services |
|
|
Complying with mandatory reporting obligations and other legal requirements (e.g. under tax, health and safety, data protection, fraud investigations, anti-money laundering and anti-discrimination laws) and disclosures required by law to enforcement agencies |
|
|
Legal ground: For our legitimate interests for the purposes of: |
|
|
Inform you of our services through email, mail, telephone, or SMS text message |
|
|
Informing you about employment-related opportunities |
|
|
Hiring and recruitment and the processing of job applications including any employment background checks, reference checks and qualifications and training checks |
|
|
Send you information on promotional content (you can amend your marketing preferences in our preference centre) |
|
|
Keep our site and systems safe and secure |
|
|
For our legitimate interest in respect of litigation, including bringing or defending legal claims and investigating complaints |
|
|
Remember you when you visit our website and see how you journey through it by using cookies |
|
|
Remember you when you use our forms to download content or sign up for a newsletter |
|
|
Supply, improve and support the services we provide |
|
|
Understand our customer base and purchasing trends |
|
|
Ensure that our recruitment practices are fair and inclusive and that we are recruiting a diverse workforce |
|
|
Understand the effectiveness of our marketing |
|
|
Legal ground: We may also process data on the basis of your consent which you will be notified of from time to time |
|
We may inform you of additional purposes for processing your information when that information is collected from you.
How we use special category personal data
Special category personal data attracts a higher level of protection. Data protection law requires us to have an additional condition where we are collecting, storing and using special category personal data.
The conditions that we most commonly rely on to collect, use or share your special category personal data include:
- In limited circumstances, your explicit consent.
- Where we need to carry out our legal obligations or exercise rights in the field of employment.
- Where it is needed in the public interest, such as for equal opportunities monitoring.
Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your vital interests (or someone else's vital interests) and you are not capable of giving your consent, or where you have already made the information public.
Purposes for which we use your special category personal data
In general, we will not process Special category personal data about you unless it is necessary for performing or exercising obligations or rights in connection with your relationship with us. There may also be other reasons for processing, such as where it is in the public interest to do so. We have indicated below the purpose or purposes for which we are processing or may process your special category personal data.
- We will use information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting, testing providers.
- We may use information about your physical or mental health, or disability status, to comply with health and safety obligations, to provide appropriate workplace adjustments, and to administer benefits including sick pay and other health-related benefits.
- We may use information about your health and medical history, where necessary for pre-employment screening, visa applications, and to meet client or site-specific requirements.
- We may use dietary requirements information relating to health or religion where necessary to provide appropriate catering at events and meetings.
Where we process special category personal data, we may share this information with:
- Sub-processors and service providers, including our pre-employment screening check providers or other providers (details of which can be provided upon request).
- Client site operators and regulators where necessary to comply with site specific health, safety or security requirements.
- Occupational health providers for pre-employment screening and ongoing health assessments.
- Where contractually required to do so or where required by applicable laws.
- For visa and immigration status including with third parties such as clients (where required for the purposes of working with that client), regulatory authorities, immigration authorities or other such authorities.
- Where being sponsored, including by a client, sponsorship and visa applications and details
How can you choose and control what information we send you?
We encourage you to keep your personal settings and personal data accurate and up to date.
If you are accessing our site from the United States of America, we process your data in accordance with the California Consumer Privacy Act (CCPA). You can opt out of the sale or sharing of your personal information by clicking “Do Not Sell My Personal Information”. To do so, please see Cookie preferences.
How long do we keep hold of your information?
We only store your information for as long as is required for the purpose it was collected. Should you wish to have more information about how long we retain your data, please contact the Privacy Team at PrivacyQueries@macegroup.com.
Information stored generally on IT systems, such as email history, will be deleted regularly in line with our policies.
Automated decision making
- Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. We are allowed to use automated decision-making in the following circumstances:
- Where we have notified you of the decision and given you 21 days to request a reconsideration.
- Where it is necessary to perform the contract with you and appropriate measures are in place to safeguard your
- In limited circumstances, with your explicit written consent and where appropriate measures are in place to safeguard your rights.
If we make an automated decision on the basis of any particularly sensitive personal information, we must have either your explicit written consent or it must be justified in the public interest, and we must also put in place appropriate measures to safeguard your rights.
Who might we share your information with?
Where information is shared with third parties we will only share the information required for the purpose it is being shared.
For the purposes set out in the ‘Why do we collect this information?’ section above, we have the right to share your personal information with:
- We use a third party provider, Hootsuite to manage our social media If you send us a private or direct message via social media the message will be stored by Hootsuite. It will not be shared with any other organisations.
- Our clients and prospective
- Our suppliers and sub-contractors
- Other companies within Mace Consult
We will also disclose your personal information to the relevant third party in the event: (i) we sell or buy any business or assets, in which case we may disclose your Personal data to the prospective seller or buyer of such business or assets;
(ii) to third parties when it is necessary for the establishment, exercise or defence of legal claims;
(iii) if we are acquired by a third party, in which case Personal data held about customers will be one of the transferred assets.
If we choose to exercise a legal power to do so.
If we are under a duty to disclose or share your Personal data in order to comply with any legal obligation, or in order to enforce or apply contractual terms or other agreements; or to protect the rights, property, or safety of ourselves our customers, our regulator, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and prevention of money laundering and credit risk reduction.
How your data is stored and kept secure?
We have put in place appropriate security measures to prevent your Personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your Personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality. Details of these measures may be obtained from the Mace Consult Global Privacy team.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
International transfers
Due to the way that Mace Consult operates, we transfer Personal data globally. This means that companies within Mace Consult may be subject to the UK GDPR and/or the EU GDPR and/or other jurisdictions.
When you provide us with your Personal data on the website (for example, completing a survey or using the “Contact Us” page to ask us a question), your personal will be processed by Mace Consult in the UK. By providing your personal data to us on our website, you acknowledge your data will be transferred and processed in the UK.
Where the UK GDPR applies
We share your Personal data within Mace Consult; this may involve transferring your Personal data outside the UK. We share Personal data within Mace Consult based on approved model contractual clauses.
We may also transfer your Personal data outside the UK to other third parties. We will only do so if adequate protection measures are in place in compliance with the applicable Data protection laws. We use the following protection measures:
- transferring to countries that have been deemed to provide an adequate level of protection;
- using approved model contractual clauses; or
- transferring when one or more of the conditions set out in Article 49 UK GDPR are met.
Where the EU GDPR applies
We share your personal data within Mace Consult. This may involve transferring your personal data outside the European Economic Area (“EEA”). We share personal data within Mace Consult on the basis of model contractual clauses which have been approved by the European Commission.
We may also transfer your personal data outside the EEA to other third parties. We will only do so if adequate protection measures are in place in compliance with the applicable data protection laws. We use the following protection measures:
- transferring to countries that have been deemed to provide an adequate level of protection;
- using approved model contractual clauses; or
- transferring when one or more of the conditions set out in Article 49 EU GDPR are met.
What are your rights?
You have the following rights. You can exercise these rights at any time by contacting the Mace Consult Global Privacy team. You can make a subject access request verbally or in writing, via email or post.
To allow us to deal with your request effectively, it would be helpful if you could contact the Mace Consult Global Privacy team directly, in the first instance. The Global Privacy team may be contacted in the following ways:
By post:
Mace Consult Global Privacy Team
Mace Consult Limited
155 Moorgate, London EC2M 6XB
By email:
Your rights
You have the right:
- to ask us not to process your personal data for marketing purposes;
- to ask us not to process your personal data where it is processed on the basis of legitimate interests provided that there are no compelling reasons for that processing;
- where processing of your personal data is based on consent, to withdraw that consent at any time.
- to request from us access to personal information held about you;
- to ask for the information we hold about you to be rectified if it is inaccurate or incomplete;
- to ask for data to be erased provided that the personal data is no longer necessary for the purposes for which it was collected, you withdraw consent (if the legal basis for processing is consent), you exercise your right to object, set out below, and there are no overriding legitimate ground for processing, the data is unlawfully processed, the data needs to be erased to comply with a legal obligation;
- to ask for the processing of that information to be restricted if the accuracy of that data is contested, the processing is unlawful, the personal data is no longer necessary for the purposes for which it was collected or you exercise your right to object (pending verification of whether there are legitimate grounds for processing); or
- to ask for data portability if the processing is carried out by automated means and the legal basis for processing is consent or contract.
Should you have any issues, concerns in relation to your Personal data, or wish to notify us of data which is inaccurate, please let us know by contacting us using the contact details above.
If you are not satisfied with our processing of your Personal data, and the UK GDPR applies to you, you have the right to lodge a complaint with us, and we will respond to your complaint within 30 calendar days. In the event you are still unhappy with our response or the outcome to your complaint, you may contact the relevant supervisory authority. However, before doing so please make sure you have first made your complaint to us or asked us for clarification if there is something you do not understand. The ICO will expect you to have done this before reviewing your complaint.
The relevant supervisory authority in the UK is the Information Commissioner’s Office (ICO).
The ICO’s contact details are available here: https://ico.org.uk/concerns.
What we ask of you
- Keeping your information accurate and up to date: If your information changes for any reason, for example if you change your name, address, then you should inform us of the change as soon as possible so that we can ensure your information is kept accurate and up to date.
- Business cards. If you issue business cards to us your Personal data will be processed by those who you share the business cards with. It is reasonably expected that your Personal data will only be processed to contact you in relation to your role and your business.
Definitions
Data Controller: A data controller as the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal data.
EU GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing directive 95/46/EC as updated, superseded or repealed from time to time.
UK GDPR: The retained EU law version of the General Data Protection Regulation ((EU) 2016/679) as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018, as modified by Schedule 1 to the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019, as updated, superseded or repealed from the time to time.
Personal data: Any information relating to an identifiable person who can be directly or indirectly identified by reference to an identifier, such identifiers including name, location data or online identifier.
Special category personal data: Includes data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
Changes to our privacy notice
This notice may be updated from time to time. Please check this page on our website for any changes.
Further Privacy Notices
If you are a sub-contractor or supplier, please see our sub-contract and supplier privacy policy here.
If you are an employee of Mace Consult, please see our employee privacy policy.
Alternatively, you can contact the Global Privacy team for copies of these policies.
Contact us
Questions, comments and requests regarding this privacy notice are welcomed and should be addressed to:
Global Privacy Team,
Mace Consult Ltd,
155 Moorgate,
London EC2M 6XB or email us at PrivacyQueries@macegroup.com