Marwood operates the following website: marwoodgroup.com (the “Site”), which is hosted in the United States. Marwood is an international consulting firm, and any information received by us through this Site, including personal information, may be transferred to or shared across our integrated computer networks with one or more of our affiliated offices in other countries that may not be subject to data protections laws similar to those prevailing in the jurisdiction in which such information is provided to or received by us.
Information we collect
You may use this Site without disclosing to us any personal information, such as your name, address, email address, phone number, and certain other information. We collect personal information about you only if you choose to provide it to us.
Although our web server does log certain technical information automatically, such as the identity of your Internet Service Provider and your computer’s IP address, none of this technical information reveals your identity to us, and it is not associated with any personal information you may choose to provide.
You may choose to provide us with personal information via this Site or other means, including but not limited to in person, over the phone and by mail, email, online job postings and recruiters. As such, Marwood may process, collect, use and share certain personal information about you, including but not limited to your name, job title, physical address, email address, phone number, social and professional profile, education, skills, certifications and work experience.
Use and disclosure of information
Marwood uses personal information: (i) to maintain contact lists for the purposes of sharing our latest notes, analyses and publications, inviting you to join events and conference calls, and advising on policy updates; (ii) to provide goods and services and deliver invoices to clients pursuant to executed agreements; (iii) to communicate with and respond to requests, inquiries and complaints from current and prospective clients; (iv) to consider hiring a candidate for a position at Marwood; (v) to process payments; (vi) to collect data that analyzes how current and prospective clients interact with our products and services; (vii) to comply with applicable laws and regulations and Marwood’s internal policies and procedures; and (viii) for any other relevant purposes relating to Marwood’s business.
We do not disclose, share or sell any user or personal information gathered on this Site or collected by Marwood in any other manner with third parties for their marketing purposes, but we may use third-party software and services to assist us with collecting, storing and analyzing information for Marwood’s purposes listed above. Third-party services include data analytics on how current and prospective clients engage with our marketing and our products and services based on tracking technology that records, on an individual and aggregated basis, email delivery status, email open rates, the products clicked on and the number of times such products are accessed, and geographic location. Third-party service providers utilized by Marwood agree not to disclose or sell any personal information without Marwood’s permission, or to use such information for any purpose other than its intended purposes.
We may disclose your personal information to our services providers that perform administrative or marketing services on behalf of Marwood, our professional advisors, or as required by applicable law, rule, regulation, legal process or governmental request to do so.
Our legal basis for processing data
Depending on the purposes for which Marwood uses your personal information, we may process, collect, use and share your personal information pursuant to each of the following legal bases described in Article 6 of the GDPR:
1) Legitimate Interests: We have a legitimate interest in: (i) marketing, promoting and sharing our products and services that may be of interest to you; (ii) developing, supporting and improving our business, including expanding our client base; (iii) communicating with prospective and current clients to address and respond to any requests, inquiries and complaints; (iv) recruiting candidates to be considered for a position at Marwood; and (v) complying with applicable legal, accounting or reporting requirements, including, but not limited to, U.S. federal and state laws with respect to employment record retention requirements; provided that such interests are not overridden by your interests or fundamental rights and freedoms.
2) Contract Performance: We must perform our contractual obligations to clients, including, but not limited to, providing products and services, delivering invoices, and processing payments. We must also perform our contractual obligations to our employees pursuant to employment contacts, including, but not limited to, processing payroll information, benefits, leave/medical information and maintaining personnel files.
3) Consent: You have expressly given us consent to process your personal information for one or more specific purposes, in which case you may withdraw such consent at any time. Withdrawing your consent does not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.
4) Legal Obligations: We must comply with laws, regulators, court orders, or other legal obligations, or pursuant to legal process.
Marwood aims to retain your personal information for only as long as it is necessary for us to do so for the purposes for which we are using it and in compliance with our internal policies and procedures. In some circumstances, it may be necessary to keep your information for a longer time period for purposes of satisfying any legal, accounting or reporting requirements. To determine the appropriate retention period for personal information, Marwood considers the amount, nature and sensitivity of your personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.
With respect to Marwood’s recruiting process for candidates located in the United Kingdom or European Union to whom GDPR applies, we will retain your personal information for recruiting purposes only and for only as long as it is necessary for us to consider hiring you for a position at Marwood, unless: (i) we have obtained your consent to retain your personal information for a longer period of time, in which case we may retain your personal information for that time period and process it in consideration for future open positions at Marwood; or (ii) we are required or permitted to retain your personal data pursuant to our internal policies and procedures or any applicable legal, accounting or reporting requirements, including, but not limited to, U.S. federal and state laws with respect to employment record retention requirements. If we have not obtained consent from you or we are not retaining your personal data pursuant to our internal policies and procedures or any applicable legal, accounting or reporting requirements, we will delete your personal information when the position that you are being considered for is filled or no longer available. Marwood will review, on at least an annual basis, all candidate personal information that we maintain, and ensure that any personal information that is no longer being used for recruiting purposes or is not being retained pursuant to candidate consent, internal policies and procedures or applicable legal, accounting or reporting requirements is deleted. Marwood may store your personal information in our employees’ email accounts, our internal server, including our back-up system (which stores data in the United States), and third-party Amazon Web Services (AWS) data centers (which store data in the United States and Germany and are GDPR-compliant).
Your rights under GDPR
The GDPR sets forth a number of rights that you may exercise with respect to the processing of your personal information, subject to certain limitations and exceptions, which include, but are not necessarily limited to:
1) Right of access: You have the right to confirm whether your personal information is being processed, to receive information about that processing and to have a copy of your personal information provided to you.
2) Right to rectification: You may correct or revise any of your personal information that is incorrect or incomplete.
3) Right to erasure/Right to be forgotten: Under certain circumstances, you may request the deletion or removal of your personal information.
4) Right to restrict processing: Under certain circumstances, you may request limited use of your personal information.
5) Right of portability: Under certain circumstances, you may receive your personal information in a structured, commonly used and machine-readable format.
6) Right to object: You may object to your personal information being used for direct marketing or certain other purposes.
Changes to this policy
Links to other websites
Marwood will take reasonable steps to protect your personal information from loss, misuse and unauthorized access, disclosure, alteration, and destruction. Marwood has put in place appropriate physical, electronic, and managerial procedures to safeguard and secure your personal information from loss, misuse, unauthorized access or disclosure, alteration, or destruction. Please do not disclose any private or confidential information to us via this Site. Third-party service providers utilized by Marwood are also required to employ reasonable industry-recognized technical, administrative and physical safeguards, such as firewalls, to protect the confidentiality and security of your personal information, and to adopt and implement security procedures to protect your personal information from loss, misuse or unauthorized alteration. Marwood cannot guarantee the security of information on or transmitted via the Internet.
Marwood will only process personal information in a way that is compatible with and relevant to the purpose for which it was collected or authorized by the individual. To the extent necessary for those purposes, Marwood will take reasonable steps to ensure that personal information is accurate, complete, current, and reliable for its intended use.
You also have the right to lodge a complaint with your national data protection supervisory authority at any time if you believe that Marwood is using your personal information in a way that breaches data protection law, including the GDPR. The United Kingdom supervisory authority for data protection issues is the Information Commissioner’s Office.