Privacy Policy
1. Introduction
This privacy policy (the “Policy”) explains how Resolute Mining Limited, its subsidiaries and related entities
(“Resolute”) processes your Personal Information in connection with your use of https://www.rml.com.au/ (the “Site”)
and the provision of our services to you (the “Services”). Resolute is committed to protecting and taking all
reasonable steps to securely manage the Personal Information that it holds.
Resolute is a company registered in Australia (company number: 097 088 689) with its registered office at Level
17, Exchange Tower, 2 The Esplanade, Perth, Western Australia 6000.
Resolute is bound by the Privacy Act and the Australian Privacy Principles and other international privacy laws.
The Privacy Act defines “personal information” as: “information or an opinion, whether true or not, and whether
recorded in a material form or not, about an identified individual, or individual who is reasonable identifiable”.
This Privacy Policy is intended to meet the requirements of privacy laws of Australia, the European Union (“EU”) and
the United Kingdom (“UK”). If you are located in or a resident in the EU or the UK, Schedule A sets out specific
information which may be applicable to you under the GDPR/UK GDPR.
2. Purpose of the Policy
This Policy explains how Resolute processes your Personal Information what we do with it, how you can access it
and how we protect it in accordance with the Australian Privacy Principles set out in the Privacy Act.
Any changes we make to this Policy will be posted on our Site, including to reflect any changes to our use of Personal
Information or to comply with applicable law or regulatory requirements. Where possible, we may notify you of these
changes by email, but we encourage you to check this page regularly to keep up to date.
3. How we collect Personal Information
Resolute collects Personal Information that you provide to us which may be via email, telephone, social media, face-
to-face contact or otherwise in writing. We may also obtain Personal Information when you interact with our website
as we may automatically collect technical data about your equipment browsing actions and patterns by using cookies
and other similar technologies. Please refer to our Cookies Policy for further details.
Resolute may also obtain Personal Information from third party sources including publicly available sources of
information.
Any non-identifiable Personal Information that is collected from your visits to our website is used internally solely for
the purpose of gauging visitor traffic, trends and delivering personalised content to you while you are on our website.
In some circumstances we may anonymise Personal Information or use pseudonyms where necessary so that the
information can no longer be associated with you, in which case we may use such information without further notice
to you.
4. Types of Personal Information Resolute collects and holds
Resolute collects and holds Personal Information which includes the following types of information:
- Identity Data. Name (first, middle, and last); and title.
- Contact Data. Email address; telephone number; social media handle; and postal/delivery address.
- Professional Data. Job title; and organisation that you represent (where you or your organisation supplies products or services to us).
- Usage Data. Data observed or collected in relation to browsing activity on our Site or interaction with our emails. This may include information about pageviews and events on our Site; information about the webpage or other source that users were previously on before reaching our Site; information about when a browsing session started and ended.
- Technical Data. IP address; details of the Site that you are viewing, such as full web page URL; browser type, device type and operating system and any other information available to us about the device you are using; location data, including the geographic location (which may be approximate, like the city or region you are in, or more precise) of a device derived from IP address, GPS signals or information about a device’s connection with local Wi-Fi equipment; diagnostic data (including crash logs, launch time, hang rate and energy use, and any other data collected for technical diagnostics purposes), and any relevant unique identifiers assigned to a device or browser (including cookie identifiers).
- Social Media Data. Information that is logged by third-party providers of social media platforms in relation to events that users take in relation to our social media pages or content. Events can include views, clicks, following or unfollowing, and any other types of interaction with our page or content, and the data that is recorded by the third-party providers of social media platforms may include information about the person taking the action and the device they are using, such as social media handles, the date and time of the event, the country/city (derived from IP address or social media profiles) of the user, age/gender information and the type of device used. Unless specified otherwise in this Privacy Notice, this personal data is not shared with us, but third-party social media providers may use it to provide us with anonymous and aggregate statistics about our social media pages and content, and we may be a joint controller of this personal data, as described in the Social media pages and insights and Advertising and Social Media Partners sections.
- Incident Data. Information about any injury that you suffer or incident you may be involved in (including witness if you visit our premises), including any personal data you or others provide (including any factual description and opinions); details of any injury suffered; actions taken by us or others in response to the incident or injury, including details of any medical assistance or treatment that has been provided or advised (e.g. first aid applied, onsite paramedic or paramedic technician attended, advised to visit hospital, hospitalised); and any other personal data collected during the process of completing our incident report.
- Communications Data. Marketing preferences; and service communication preferences.
- Recruitment Data. Profile Data (to the extent that it is relevant to our recruitment activities or you volunteer it during our recruitment process), together with other information including details of your eligibility to work (including documents and information that we may collect to verify this); your work preferences (including areas and dates where you are available for work); skills, qualifications, training and work history; any personal data which appears in your curriculum vitae or application; and any other personal data that you volunteer during our recruitment process.
Resolute does not collect Sensitive Information about you without first obtaining your informed consent.
For further details about the Personal Information we process, please see Schedule B.
5. Why we collect Personal Information and how we use it
Resolute collects and uses Personal Information necessary for operating its business.
The purposes for which Resolute collects and uses Personal Information may include:
- to ensure that content from our website is presented in the most effective manner for you and for your computer;
- to provide you with information that you request from us or which we feel may interest you, where you have
consented to be contacted for such purposes; - to allow you to participate in interactive features of our website, when you choose to do so;
- to provide Resolute News and ASX announcements upon your request;
- to communicate with you and conduct our activities, including to respond to your inquiries, complaints or
feedback; - for quality assurance purposes, and to assist with compliance of applicable laws and regulations;
- to comply with our corporate social responsibility obligations including reporting to our stakeholders and other organisations;
- for considering the suitability of job applicants for employment with Resolute;
- to administer the employment of staff and contractors and in order to meet occupational health and safety
needs; - for the performance of any contract with you; and
- where we are required or authorised by law.
We may also process your Personal Information without your knowledge or consent, in accordance with this Policy,
where we are legally required or permitted to do so.
If you refuse to provide us with certain Personal Information when requested, we may not be able to provide you with
services you request or require. In addition, we may be unable to comply with our legal or regulatory obligations.
Schedule B provides further information on why we collect Personal Information and how we use it.
6. Data sharing and disclosure of Personal Information
Resolute may, from time to time, disclose your Personal Information to the following people or organisations:
- our Employees, subsidiaries, affiliates, controlled or related entities, contractors (or sub-contractors) or other
third-party service providers in order to provide our services; - share registry services who have an arrangement with Resolute;
- third party conference or event organisers;
- our professional providers or advisors (e.g. lawyers, accountants, business advisors, auditors);
- third parties with whom Resolute has sponsorship, commercial or other contractual arrangements with to provide
its products or services, marketing, business or other related purposes; - credit reporting agencies, courts, tribunals and regulators if you fail to pay for the services provided to you;
- law enforcement or other government and regulatory agencies or other third parties as required by, and in
accordance with, applicable law or regulation; - Resolute’s related entities;
- Business partners. We may also disclose personal data to third parties:
- if we sell or buy any business or assets, in which case we may disclose personal data to the prospective
seller or buyer of such business or assets; or - if we or substantially all our assets are acquired by a third party, in which case personal data held by us
will be one of the transferred assets; and
- if we sell or buy any business or assets, in which case we may disclose personal data to the prospective
- any other individual or third party for any authorised purpose, with your consent or when authorised or required
by law.
7. Why might you share my Personal Information with third parties?
We will share your Personal Information with third parties where you have consented to us doing so, when we are
required by law, when it is necessary to administer the relationship between us or where we have another legitimate
interest in doing so (for example in the context of a possible sale or restructuring of the business). When we share
Personal Information with others, we put contractual arrangements and security mechanisms in place to protect the
Personal Information and to maintain the confidentiality and security of it.
8. Which third party service providers may process
my Personal Information?
Third party service providers may carry out the following activities: IT and cloud services, professional advisory
services, administration services, marketing services, banking services, payroll, recruitment and employment
screening services, share registry and investment services.
All our third-party service providers are required to take commercially reasonable and appropriate security measures
to protect your Personal Information. We only permit our third-party service providers to process your Personal
Information for specified purposes and in accordance with our instructions
9. Storage and security of Personal Information
Resolute takes reasonable steps to protect Personal Information from misuse, loss, modifications and unauthorised
access. We have put in place commercially reasonable and appropriate security measures to protect your Personal
Information and to prevent your Personal Information from being accidentally lost, used or accessed in an
unauthorised way, altered or disclosed.
Resolute stores Personal Information in various systems, databases and cloud services. Resolute’s security
measures include restricting access to Resolute computer systems through the use of usernames and passwords,
firewalls and virus scanning tools to protect against unauthorised persons and viruses from accessing the information,
and other security measures as implemented from time to time. Where paper records containing Personal
Information exist, locked storage is utilised.
In addition, we limit access to your Personal Information to those Employees, agents, contractors and other third
parties who have a business need to know. Third parties will only process your Personal Information on our
instruction and where they are subject to confidentiality obligations.
We have put in place procedures to deal with any actual or suspected data security breach and will notify you and
any applicable regulator of a breach where we are legally required to do so.
10. Direct Marketing
Marketing products, services or securities is important for us to meet our business objectives. We may use various
direct marketing strategies and channels including via our website, email, mail, SMS, social media and telephone to
provide you with information relating to our securities which we reasonably think may be of interest to you.
We will provide you with a way of opting out of receiving direct marketing communications or you can opt out by
contacting our Privacy Officer (see contact details in section 17).
Resolute’s contracted third parties may use similar marketing strategies and channels as Resolute. Please refer to
the relevant third parties website for further details.
Resolute will never sell, trade, lease or rent any personally identifiable information to other organisations except as
stated and agreed when collecting information from members or other persons.
11. Data retention
We will only retain your Personal Information for as long as is necessary to fulfil the purposes for which it is collected.
We assess what retention period is appropriate for your Personal Information by taking into consideration:
- our business requirements;
- the purposes for which we originally collected the Personal Information;
- the lawful grounds on which we based our processing;
- the types of Personal Information we have collected;
- the amount and categories of your Personal Information; and
- whether the purpose of the processing could reasonably be fulfilled by other means.
Personal Information that is no longer needed or required to be retained by law or court order will be destroyed in a
secure manner, deleted or de-identified as appropriate.
12. Analytics
Resolute uses Google Analytics to collect and process data. Details and information about Google Analytics and how
Google uses the collected data is available at www.google.com/policies/privacy/partners/
13. Cross-border disclosure of Personal Information
The Personal Information of users of our website is held in the Cloud by third party customer relationship management
systems providers (or other systems) that may be located overseas. Any overseas disclosures will only be made once
Resolute has taken all reasonable steps to ensure the Personal Information will be treated at least in accordance with
the Privacy Act and other applicable privacy laws.
Resolute may disclose your Personal Information to entities or third parties located in the following
countries/jurisdictions: Africa and the United Kingdom.
Resolute’s agreements with third party providers address compliance with the Privacy Act and any amendments to
those laws. We are confident that the providers will maintain administrative, technical, and physical safeguards to
help protect the security, confidentiality and integrity of member and customer data consistent with applicable
requirements of Australian privacy laws.
14. Access, correction and updating Personal
Information
It is important that the Personal Information we hold about you is accurate and current. If your Personal Information
changes, please notify us by contacting our Privacy Officer (see contact details in section 17).
Resolute will take reasonable steps to ensure that Personal Information held is current, accurate and complete.
Unless specific exceptions apply by applicable law, you may request access to the Personal Information that we hold
about you, and to request its correction. You can request to access and correct your Personal Information by
contacting our Privacy Officer in writing or by email (see contact details in section 17). Upon receiving such a request,
we will take steps to verify your identity before granting access or correcting the information. If we do not agree to
provide access or make the correction of Personal Information as requested, we will notify you.
15. Contracted service providers
Contracts with all service providers or consultants whose service involves access to Personal Information must be
subject to contract terms that are compliant with this Privacy Policy and the Office of the Australian Information
Commissioner guidelines and rules that are legally binding.
Where necessary, formal non-disclosure agreements are in place. Third parties, such as mailing houses, which
receive Personal Information in order to provide a service for Resolute, are required to sign an undertaking that the
information will only be used for the purpose for which the information was provided.
16. Complaints
Complaints concerning the collection, disclosure or handling of your Personal Information by Resolute or breaches
of the Australian Privacy Principles should be addressed to our Privacy Officer (please refer to contact details in
section 17). Any complaint should be first made in writing and include the date, details of your complaint or the alleged
breaches, and how you would like your complaint resolved.
Our Privacy Officer will attempt to resolve the complaint within 30 business days, but this timeframe may be extended
if further information is required from the complainant and/or an involved third-party.
If the complaint is not resolved to your satisfaction, you can refer it to the Office of the Australian Information
Commissioner on 1300 363 992 or online at www.oaic.gov.au. Such complaints are generally resolved through
conciliation.
17. Privacy Officer/Contact
You have a right to access your Personal Information, subject to some exceptions allowed by law. Resolute’s Privacy
Officer is your first point of contact in relation to privacy-related matters and to assist in our compliance with privacy
obligations. Please refer to the following contact details if you have any queries or wish to contact our Privacy Officer:
privacy@rml.com.au or +61 8 9261 6100.
18. Definitions
Australian Privacy Principles means the Australian privacy principles set out in the Privacy Act.
Director means a director of RSG.
Employee means employee of, or consultant to, Resolute.
GDPR means the EU General Data Protection Regulation or the UK GDPR (where applicable).
Personal Information means information or an opinion about an identified individual, or an individual who is
reasonably identifiable whether the information or opinion is true or not, and whether the information or opinion is
recorded in material form or not, or as defined in the GDPR (where applicable).
Personnel means all Directors and Employees.
Policy means this Privacy Policy, as amended from time-to-time.
Privacy Act means the Privacy Act 1988 (Cth).
Privacy Officer means the senior executive or manager of RSG designated to act as Resolute’s privacy officer from
time to time.
Resolute means Resolute Mining Limited ACN 097 088 689, and its subsidiaries and related entities.
Sensitive Information means information concerning your religion, ethnic origin, political opinions, religious beliefs
or affiliations, union membership, sexual preferences or health information.
Shareholder means a shareholder of RSG.
You means any sub-contractor, contractor, Personnel, Shareholder or any other person with whom Resolute may
have dealings with, including anyone who visits our website.
19. Related documents
- Code of Conduct
- Information Security Policy
- Cookies Policy
20. Approval and review
This document is to be reviewed annually by the Board.
Version 1.0
RIGS Document Category: Board
Date: 23/08/2018
Status: Reviewed
RIGS Document Owner: Amber Stanton General Counsel & Company Secretary
Reviewer: John Welborn Managing Director & CEO
Approver: Martin Botha Chair
Approval Date: 23/08/2018
Version 2.0
RIGS Document Category: Board
Date: 21/02/2019
Status: Reviewed
RIGS Document Owner: Amber Stanton General Counsel & Company Secretary
Reviewer: John Welborn Managing Director & CEO
Approver: Martin Botha Chair
Approval Date: 21/02/2019
Version 3.0
RIGS Document Category: Board
Date: 19/02/2020
Status: Amended
RIGS Document Owner: Amber Stanton General Counsel & Company Secretary
Reviewer: John Welborn Managing Director & CEO
Approver: Martin Botha Chair
Approval Date: 19/02/2020
Version 4.0
RIGS Document Category: Board
Date: 23/02/2023
Status: Reviewed
RIGS Document Owner: Richard Steenhof General Counsel & Company Secretary
Reviewer: Terence Holohan Managing Director & CEO
Approver: Martin Botha Chair
Approval Date: 23/02/2023
Version 5.0
RIGS Document Category: Board
Date: 20/03/2024
Status: Reviewed
RIGS Document Owner: Bianca Depres & Sam Wright and Tim Whyte General Counsel & Company Secretaries
Reviewer: Terence Holohan Managing Director & CEO
Approver: Martin Botha Chair
Approval Date: 20/03/2024
Version 5.0
RIGS Document Category: Board
Date: 31/12/2025
Status: Reviewed
RIGS Document Owner: Bianca Depres General Counsel & Company Secretary
Reviewer: Chris Eger Managing Director & CEO
Approver: Martin Botha Chair
Approval Date: 31/12/2025
Schedule A – EU and UK
This Schedule A is to be read in conjunction with the Privacy Policy and provides additional privacy information as
required under the GDPR/UK GDPR, as to how Resolute collects, holds, uses or otherwise processes the Personal
Information of individuals who are located in the EU/UK. Resolute is committed to upholding these practices when
dealing with the Personal Information of EU/UK residents.
In most cases, Resolute is primarily the “data controller” of Personal Information and will be responsible for deciding
how we hold and use Personal Information about you, and ensuring Personal Information will be processed fairly,
lawfully and in a transparent manner, and collected and processed only for specified and lawful purposes.
1. Legal basis for processing
Resolute will only collect and process your Personal Information where we have a legal basis for doing so. Depending
on the services you seek or use, Resolute may rely on the following legal bases for processing Personal Information:
- when it is necessary for the performance of a contract to which you are a party, or to respond to your inquiries
before entering into such a contract; - for the purposes of our own legitimate interests provided that those interests do not override any of your own
interests, rights and freedoms which require the protection of Personal Information. This includes processing
for marketing, business development, statistical and management purposes; - for certain additional purposes with your consent and in these limited circumstances where your consent is
required for the processing of your Personal Information then you have the right to withdraw your consent to
processing for such specific purposes; and - where Resolute must process the Personal Information to comply with its legal obligations.
Schedule B provides detail on which legal basis we rely on for which processing activity. Note that we may process
your Personal Information for more than one lawful ground depending on the specific purpose for which we are using
your data.
Third parties will only process your Personal Information in accordance with Resolute’s instructions and where the
third party complies with the GDPR requirements or other data protection laws for the processing and transfer of
Personal Information.
2. Change of purpose
Where we need to use your Personal Information for another reason, other than for the purpose for which we collected
it, we will only use your Personal Information where that reason is compatible with the original purpose.
If it is necessary to use your Personal Information for a new purpose, we will notify you and communicate the legal
bases which allows us to do so before starting any new processing.
3. Profiling and automated processing of Personal Information
Resolute does not make decisions or predict personal aspects of an individual using automated processing of
Personal Information. However, we may collect certain information from you in relation to your website visits and
online activity. This may in some circumstances constitute ‘profiling’ under the GDPR. Furthermore, Resolute may
undertake ‘profiling’ to personalise your website experience, our communications with you and improve our service
offerings to you.
4. Cookies
Our website uses cookies to provide a number of services to you, such as data on user access on webpages and
session management. Cookies in use may identify individuals who log into our website. For further details on
cookies, please refer to our Cookies Policy.
5. Direct marketing
Resolute will not use direct marketing as outlined in the Privacy Policy to market its products and services to you
unless:
- Resolute has received express consent from you to use your Personal Information for that purpose; or
- as otherwise permitted by law.
If an individual has agreed to receive marketing, the individual may always opt out at a later date. Refer to the Privacy
Policy for the process in which this can be done.
6. Transferring information outside of the EEA/UK
Transfers to us – where we receive personal data
We are located in Australia. Therefore, your personal data may be processed by us in Australia for the purposes
set out in this Policy. In addition, it may be transferred by us to other countries (as described below).
Transfers by us – where we send personal data
We may transfer personal data to third parties (as described in the Data sharing and disclosure of Personal
Information section) that are located in countries that do not have data protection laws that protect personal data to
the same standard as the GDPR. These third countries may not give you the same rights as under the GDPR in
relation to your personal data and may not have a data protection supervisory authority to help you if you have any
concerns.
When transferring personal data to third countries, we usually rely on one of the following:
a) Adequacy decisions: We may transfer your personal data to countries or organisations that have been
deemed to provide an adequate level of protection for personal data by the European Commission, the UK
Government, or any other relevant government body. This may include transfers to organisations that
participate in the Data Privacy Framework listed here.
b) Contractual safeguards: We may use specific contracts approved by the European Commission, the UK
Government, or any other relevant governmental body to safeguard personal data. The contracts that we
usually rely on are referred to as “Standard Contractual Clauses” or “SCCs”, although we may from time to
time use other approved mechanisms. To find out more about the SCCs we use, please see here (EU) and
here (UK). You can also contact us using the contact details set out in the How to contact us section.
Please contact us using the details in section 17 of the Privacy Policy if you want further information on the specific
mechanism used by us when transferring your Personal Information out of the EU/UK.
7. Your rights regarding your Personal Information
You have the following rights in relation to your personal data:
- Your right of access. If you ask us, we will confirm whether we are processing your personal data and, if so,
provide you with a copy of that personal data (along with certain other details). If you require additional copies,
we may charge a reasonable fee for producing those additional copies. - Your right to rectification. If the personal data we hold about you is inaccurate or incomplete, you are entitled
to have it rectified. If we have shared your personal data with others, we’ll let them know about the rectification
where possible. If you ask us, where possible and lawful to do so, we will also tell you who we’ve shared your
personal data with so that you can contact them. - Your right to erasure. You can ask us to delete or remove your personal data in some circumstances, such
as where we no longer need it or where you withdraw your consent (where applicable). If we have shared your
personal data with others, we will let them know about the erasure where possible. If you ask us, where it is
possible and lawful for us to do so, we will also tell you who we have shared your personal data with so that
you can contact them directly. - Your right to restrict processing. You can ask us to “block” or suppress the processing of your personal data
in certain circumstances such as where you contest the accuracy of that personal data or you object to us
processing it for a particular purpose. This may not mean that we will stop storing your personal data but, where
we do keep it, we will tell you if we remove any restriction that we have placed on your personal data to stop us
processing it further. If we’ve shared your personal data with others, we’ll let them know about the restriction
where it is possible for us to do so. If you ask us, where it is possible and lawful for us to do so, we’ll also tell
you who we’ve shared your personal data with so that you can contact them directly - Your right to data portability. You have the right, in certain circumstances, to obtain personal data you have
provided to us (in a structured, commonly used and machine-readable format) and to reuse it elsewhere or to
ask us to transfer it to your chosen third party. - Your right to object. You can ask us to stop processing your personal data, and we will do so, if we are: (i)
relying on our own or someone else’s legitimate interest to process your personal data, except if we can
demonstrate compelling legal grounds for the processing; or (ii) processing your personal data for direct
marketing purposes. - Your rights in relation to automated decision-making and profiling. You have the right not to be subject to
a decision when it is based on automatic processing, including profiling, if it produces a legal effect or similarly
significantly affects you, unless such profiling is necessary for the entering into, or the performance of, a contract
between you and us. - Your right to withdraw consent. If we rely on your consent (or explicit consent) as our legal basis for
processing your personal data, you have the right to withdraw that consent at any time. You can exercise your
right of withdrawal by contacting us using our contact details in the contact us section or by using any other
opt-out mechanism we may provide, such as an unsubscribe link in an email. - Your right to lodge a complaint with the supervisory authority. If you have a concern about any aspect of
our privacy practices, including the way we have handled your personal data, please contact us using the
contact details provided in the contact us section. You can also report any issues or concerns to a national
supervisory authority in the Member State of your residence or the place of the alleged infringement. You can
find a list of contact details for all EU supervisory authorities at http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm. In the UK, our regulatory authority is the Information Commissioner’s Office (“ICO”). Contact details for the ICO can be found on its website at https://ico.org.uk. - UK only – your right to lodge a complaint to us. If you are in the UK, you also have the right to complain to
us if you have concerns regarding our handling of your Personal Information. You can make a complaint by
contacting us via the Contact section.
8. Contact
If you want more information or have any questions about our processing of your Personal Information or this
Policy you can contact us using the following methods:
Email: privacy@rml.com.au
Post: 2nd Floor, 14 Waterloo Place, London, SW1Y 4AR, UK
Schedule B – Processing Activities
This Schedule sets out detailed information about the purposes for which we process the personal data described
Personal data we control section and the lawful bases we rely on to do so.
This Schedule is split into the following sections – please click on the link below to be taken to the relevant section:
1. Providing our Site and carrying out other online activities
| Purpose and Personal Data Processed | Description | EU/UK Lawful Basis |
| Delivery of our Site
Technical Data |
To provide our Site to you, including ensuring that we are showing you the correct notices and information, and recording your preferences in relation to our Cookies.Essential Cookies are used on our Site for this purpose. Please see the Cookies section for further information. | Legitimate interests – to provide our Site effectively. Compliance with a legal obligation.Performance of a contract. |
| Support, maintenance and security
Identity Data |
To administer and protect our Site and users (including troubleshooting, fixing errors, analysis, testing, system maintenance, support, and security, including for fraud monitoring and prevention).To respond to user enquiries/offer support to users. We may use your information to respond to your enquiries and solve any potential issues you mighthave with the use of our Site.To request feedback and to contact you about your use of our Site.Essential Cookies are used on our Site for this purpose. Please see the Cookies section for further information. | Legitimate interests – to run our business and to protect us and our users from harm.Compliance with a legal obligation. |
| Provision of location-based and other special features
Technical Data |
To provide you with location-based and other special features through our Site by accessing your device’s location or other functions. For example:
|
Consent through permissions granted on your device.Consent can be updated or withdrawn at any time through your browser or device settings, as follows:In relation to our Site, you can change permissions through your browser settings. For example, in Chrome go Settings > Privacy and Security > Site settings. Please note that other browsers may differ. |
| Set up and manage user accounts Identity Data |
To set up and manage user accounts, including to verify users when logging into accounts and secure areas of our Site, which may be required to access to certain features, functionality, or benefits of our Site.To contact users about their accounts. | Performance of a contract.
Legitimate interests – to provide secure and effective access to the Site. |
| Site development and improvement
Usage Data |
To develop and improve our Site, including content that we make available, through insight and analysis that we carry out in relation to the use of our Site.Non-essential Cookies are used on our Site for this purpose. Please see the Cookies section for further information. | Consent (where non-essential Cookies are used on our Site).Legitimate interests – to improve and enhance our Site (where non-essential Cookies are not used). |
| Personalisation of our Site
Usage Data |
To personalise user experiences when using our Site, such as showing our users content and Site features that we think may be of interest or relevance to our users.Non-essential Cookies are used on our Site for this purpose. Please see the Cookies section for further information. | Consent (where non-essential Cookies are used on our Site).Legitimate interests – to give users of our Site the best experience (where non-essential Cookies are not used). |
2. Provision of Services
| Purpose and Personal Data Processed | Description | EU/UK Lawful Basis |
| Supply of our Services
Identity Data |
To register you as a customer (as an individual or corporate customer).
To process and deliver your order for our Services, including to manage and collect any fees or charges from you (or your organisation). To maintain our customer databases. To keep a record of transactions for our Services. |
Legitimate interests – to provide our Site effectively.Compliance with a legal obligation.Performance of a contract. |
| Administration of Events
Identity Data |
To register you as a visitor or exhibitor at one of our events. If you are a speaker at our event, we may publish your name in association with the event.
To provide you with important information about our events. To facilitate your travel to our events, if you are a speaker or exhibitor. To make other logistical arrangements with you in connection with your attendance at the event (e.g. in respect of your exhibitor space). Photographs and video footage may be taken at our events and published for promotional and advertising material. We may send you SMS for operational purposes and the smooth running of an event, e.g. to inform of a travel update. |
Performance of a contract.
Legitimate interests – to provide information about speakers at an event. Legitimate interests – to promote our events. You can opt out of your image being used at any time. Legitimate interests – to provide necessary information about our events. Explicit consent (in respect of any special category data). |
3. Customer Services, Feedback and Relationship Management
| Purpose and Personal Data Processed | Description | EU/UK Lawful Basis |
| Customer services and general enquiries
Identity Data |
To manage and respond to any enquiry that you submit to us. | Legitimate interests – to help with your enquiry, provide a good standard of service and improve our customer services. |
| Social media pages and insights
Identity Data |
To publish pages on social media (including LinkedIn, Facebook, X, Telegram, YouTube or Instagram) relating to our Site, Services and business. These pages help social media users discover and engage with us, and help us promote, and keep social media users updated about, our business.
To gain insight into our social media pages, we may receive insights from the third-party provider of the social media In addition, we may also see who has ‘liked’ or shared content that we post on social media (including when you interact with any ‘like’ or similar embedded feature on our Site). Note, we may be joint controllers with the relevant social media platform in relation to the insights that we receive. |
Legitimate interests – to improve our online presence and promote our Site and Services via social media. Legitimate interests – to improve the content that we post on social media, including to ensure that our content is relevant to persons that we would like to engage with on social media. |
| Managing our relationship with you or the organisation you work for Identity Data |
To manage our relationship with you or the organisation you work for (where your organisation is a supplier to, us), including to contact our suppliers about goods or services that we have purchased or may purchase from them, and to provide you with other important information (including about changes to our terms and conditions or this Privacy Notice). |
Performance of a contract.
Legitimate interests – to provide those that we work with the best experience and to ensure effective business administration. Legitimate interests – to effectively manage our supply chains. Compliance with a legal obligation – to comply with our consumer rights and privacy obligations. |
| Survey and feedback
Identity Data |
To help us to monitor and improve our Site and Services, and to train our personnel, we may carry out surveys or ask you for feedback. | Legitimate interests – to improve our Site and Services and provide them in an effective way. |
| Public Relations and Media
Identity Data |
To respond to media enquiries and requests (including interview requests, requests for comment, and requests for information) that we receive, or address reports in the media that concern us, we may process personal data relating to journalists, reporters and other media professionals.
We may also send these persons corporate communications and other information by email for media and public relations purposes. |
Legitimate interests – to ensure that our business is fairly and accurately represented in the media.
Legitimate interests – to provide the right information to those who request it or otherwise have an interest in receiving it. |
4. Recruitment
| Purpose and Personal Data Processed | Description | EU/UK Lawful Basis |
| Recruitment
Identity Data |
To assess your suitability for any of our positions that you apply for.
To communicate with you about the recruitment process. To keep records about our recruitment process. To comply with our legal and regulatory obligations in relation to recruitment. To review our equal opportunity profile in accordance with applicable legislation. |
Legitimate interests – to ensure that we can make the best recruitment decisions.
Performance of a contract or to take steps at your request prior to entering into a contract. Compliance with a legal obligation. |
5. Business Administration, Compliance and Legal Affairs
| Purpose and Personal Data Processed | Description | EU/UK Lawful Basis |
| Business administration and legal compliance
Identity Data |
To comply with our legal obligations. To enforce our legal rights or defend against potential legal claims. To protect the rights of third parties. To facilitate a business transition such as a merger, reorganisation, acquisition by another company, or sale of any of our assets. |
Legitimate interests – to operate our business effectively.
Compliance with a legal obligation. |
| Security
Identity Data |
To implement and manage physical security measures.
Security measures are in place at our premises, including CCTV and building access controls. There are signs in place showing that CCTV is in operation. The images captured are securely stored and only accessed on a need-to-know basis (e.g. to look into an incident). CCTV recordings are typically automatically overwritten after a short period of time unless an issue is identified that requires investigation (such as a theft). Visitors to our premises may be required to sign in on arrival and where that is the case, we will keep a record of visitors for a short period of time. Our visitor records are securely stored and only accessible on a need-to-know basis (e.g. to look into an incident). |
Legitimate interests – to keep our premises secure and provide a safe environment for our personnel and visitors to our premises. |
| Health, Safety and Incidents
Identity Data |
To report or manage a health and safety or other type of incident that occurs at our premises. | Compliance with a legal obligation.
Legitimate interests – to effectively manage an incident, including to assess our handling of an incident to help us improve our processes. Necessary to protect vital |