General information and contact details

This notice was last updated on October 6, 2026 

This Privacy Notice covers GB Group Plc and our wholly owned subsidiaries ("GBG", "we", "us" or "our") and details how we collect and process personal data when you use the Unlocked webpages or register your interest in future Unlocked events. 

GBG’s wholly owned subsidiaries include, but is not limited to Acuant Inc, IDology Inc, Loqate Inc, GBG (Australia) Pty Ltd, Verifi Identity Services, Mastersoft Group Pty Ltd GBG (Malaysia) Sdn Bhd, GBG Singapore Pte Ltd and PT Fraud Solutions (GBG Jakarta). 

Please note, this is a global privacy policy.  It is recognised there is not a consistent standard for privacy across the globe but to confirm GBG complies with applicable data protection law and will review any request based on what is required for your jurisdiction.  Where additional disclosure is required for a jurisdiction, please select from the side menu for additional information. 

https://www.gbgplc.com/legal-and-regulatory/products-services-privacy-policy/ 

GBG have offices in several countries, which are detailed here.  See ‘Contact Us’ to contact a regional representative with any questions about how we use your personal data.  

This privacy policy is reviewed annually, or sooner if changes to regulation or how we process personal data require it. 

Use of your Personal Data

How do we collect your personal data?

How we collect your personal data will depend on how you interact with the Unlocked webpages and whether you register your interest in future Unlocked events. 

We may collect personal data from the following types of sources: 

• Information you Provide directly to us: If you are visiting our Sites or if you create an account with us, subscribe to our marketing communications, participate in our contests or sweepstakes, use any of our chat features, fill out our online forms, purchase our Services, download our software, use our support offerings, email us, or participate or interact with us at any of our events, conferences, and meetings. 

• Service Providers: We may receive your information directly from our service providers acting on our behalf, like when we conduct surveys and for our marketing activities, and often share some or all of this information with us. 

Our Use of Cookies and Other Technologies

Our Sites use cookies and other similar technologies like web beacons, pixels, embedded scripts, location-identifying technologies and logging technologies (collectively, “cookies”). Cookies are text files downloaded to your computer or mobile device that allow us and our cookie providers to collect certain information about your interactions with our email communications, Sites and other online services, and aim to improve your experience.  

Our Cookie Policies

Each of our GBG websites may deploy or enable different types of cookies (e.g., strictly necessary, performance, etc.). Our Sites provide individuals with full control over allowing our cookies to collect their personal data (if applicable) and make it easy for individuals to withdraw their consent through the Cookie Preference settings.   

Our Cookie Policies are available on each of our Sites. 

Our legal basis for processing personal data

If you are based in a jurisdiction that requires a legal basis for us to be able to process your personal data, we process your information on the following grounds: 

• Legitimate Interests (subject to balancing test), such as to market to you (B2B) and event management

• Consent

Who will we share your personal data with and why?

• Affiliates. We may share personal data with other companies owned or controlled by us, and other companies owned by or under common ownership as us.

• Service Providers: We grant our service providers access to personal information only to the extent needed for them to perform their functions, and we require them to protect the confidentiality and security of such information. Service providers may perform business or operational services for us or on our behalf, such as website hosting, infrastructure provisioning, IT services, analytics services, employment application-related services, cloud hosting services, payment processing services, and administrative services.

• Marketing Providers: We may coordinate and share personal data with our marketing providers in order to communicate with individuals about the Services we make available.

• Business Transaction or Reorganisation: We may take part in or be involved with a corporate business transaction, such as a merger, acquisition, joint venture, or financing or sale of company assets. We may disclose personal data to a third party in connection with such corporate business transaction. Personal data may also be disclosed in the event of insolvency, bankruptcy, or receivership.

• Legal Obligations and Rights: We may disclose personal data to third parties, such as legal advisors and law enforcement:

  • in connection with the establishment, exercise, or defence of legal claims;

  • to comply with laws or to respond to lawful requests and legal process;

  • to protect our rights and property and the rights and property of others, including to enforce our agreements and policies;

  • to detect, suppress, or prevent fraud;

  • to protect the health and safety of us and others; or

  • as otherwise required by applicable law.

• Otherwise with Consent or Direction: We may disclose personal data about an individual to certain other third parties or publicly, at the instruction of our customer, or with the data subject’s own consent or direction. For example, with an individual’s consent or direction we may post their testimonial on our Site or other publications.

https://www.gbgplc.com/en/contact/general-enquiry/individual-data-enquiry/

Data Retention

How long do we retain your personal data for and why?

We may retain personal data as required or permitted by applicable laws and regulations. Specifically, we retain information for our legitimate interests and essential business purposes (e.g., to provide, maintain and improve our Services, to comply with legal obligations, to exercise our legal rights and remedies, etc.).

Cross Border Transfers

Your personal data may be transferred to, and processed in, countries other than the country in which you are resident.  These countries may have data protection laws that are different to the laws of your country. 

Our group companies, business customers and third party service providers and partners operate around the world.  This means that when we collect your personal data, we may process it in any of these countries.  

However, we have taken appropriate safeguards to require that your personal data will remain protected in accordance with this privacy notice. 

Where appropriate, these include implementing the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Agreement for international data transfers between our group companies, which require all group companies to protect UK and EEA personal data in accordance with UK and European Union data protection law. 

We have implemented similar appropriate safeguards with our data suppliers, customers and third party providers and partners. 

Children’s Personal Information

We do not knowingly collect or solicit personal information from minors under the age of sixteen (16) via our Sites or during the course of doing business as we are a B2B organisation.

If you become aware that a child has provided personal information to us without permission, please Contact Us so we can promptly delete their information.

We do not sell, nor do we have actual knowledge that we sell personal information of consumers under 16 years of age or that we share personal information of consumers under 16 years for cross-context behavioural advertising.

Links to Third-Party Websites or Services

Our Services may include links to third-party websites, plug-ins and applications. This Privacy Notice does not apply to, and we are not responsible for, any personal information practices of third-party websites and online services or the practices of other third parties, including our business customers. To learn about the personal information practices of third parties, please visit their respective policies.

Your Privacy Rights

Your privacy rights vary depending on where you are based in the world. GBG will fulfil all data subjects’ rights requests in line with applicable data protection law.

If you are a resident of the United States, please refer to our US Privacy Addendum.

Your rights may include:

• The right to access/know your personal data – You have a right to know what personal data we hold on you and for what purpose we are processing your personal information.
• The right to data portability – you can request that the personal data you have provided to us be ported to another organisation or be provided to you (to the extent technically feasible) in a readily useable format that allows you to transmit it yourself.
• The right to opt-out of sale of your personal data – you have the right to stop us from “selling” your personal information to third parties. However, please note that GBG does not sell or share any of the categories of personal information, and we have not sold or shared any of your personal information in the past twelve (12) months.  
• The right to withdraw consent – you can withdraw consent at any time.
• The right to erasure/delete – you can request that we remove your personal data from our systems
• The right to restrict processing – you can request that GBG only process your personal data for the purposes you specify or limit processing of your sensitive personal data.
• The right to rectification/correction – you have the right to ask us to rectify/correct any information you believe is inaccurate. You may also have the right to ask us to complete information you think is incomplete.
• The right to object to processing – you have the right to object to processing if we are able to process your information because the processing is in our legitimate interests.
• The right to obtain information upon request on the balancing test we have carried out when determining we are able to rely on legitimate interest as our lawful basis for processing your personal information.
• The right to No Discrimination – You have the right not to receive discriminatory or retaliatory treatment for exercising your privacy rights.
• The right to complain if you think we’ve mishandled your personal information.

Please keep in mind that dependent upon the applicable law, some of these rights are subject to an internal assessment that one of the grounds thereunder is satisfied.

How to Make a Privacy Rights Request

Please use our webform, or send via phone or post using the information provided in our “Contact Us” section of this General Privacy Notice.

You are not required to pay any charge for exercising your rights. We usually have one calendar month to respond, but this may vary depending on your location (for example, if you are in the US we have 45 days depending on your state of residence). If we are unable to comply with your request, we will provide you with an explanation.

Verification. Due to the confidential nature of your personal information, we may ask you to provide proof of identity when exercising the above rights to verify your identity, in accordance with applicable data privacy laws. This can be done by providing a copy of a valid identity document issued by the authorised body where you are a resident and is exercised for the purpose of ensuring that the individual making the rights request is in fact who they claim to be.

Authorised Agents. As defined in the applicable privacy law, you may use an authorised agent to exercise your rights on your behalf. If you are making any of the requests above through an authorised agent, we will request written authorisation from you and will seek to verify you as described above or we will accept a legal Power of Attorney. To make a request using an authorised agent, have your agent use our webform and upload documentation demonstrating authorisation from you.

Complaints and Appeals. If you are a resident of a jurisdiction that allows you to appeal a decision we have made in connection with your attempt to assert a right under applicable Data Protection Laws, you may file an appeal of our decision by contacting us at DPO@gbgplc.com. Please ensure you provide us with the postal address in which you reside, accompanied with details for the basis of your appeal.

Your jurisdiction may allow you to file a complaint regarding any concerns with the result of your appeal request.

• For the UK Regulator, click here
• For other data protection authorities in the EU, click here
• an applicable privacy law may file a complaint with their corresponding state’s Attorney General or dedicated Agency if they have concerns about the result of the appeal.
• For Australia, Office of the Australian Information Commissioner, click here
• For New Zealand, Office of the Privacy Commissioner, click here

Consent

In jurisdictions where consent is required:

Your consent is deemed expressed when communicated electronically, or through unequivocal indications of your agreement (i.e., implied consent, if permitted). Furthermore, by receiving and accepting our General Privacy Notice and Cookie Policy and not objecting to it, you implicitly consent to the processing of your personal data.

Your consent can be revoked at any time without affecting your past actions. To withdraw your consent, please contact us through the methods and procedures described in our General Privacy Notice.

Contact Us

If you have any questions or requests in connection with this General Privacy Policy, please use this form or send an email to DPO@gbgplc.com. Alternatively, enquiries may be made to:

U.S. Privacy Addendum

This U.S. Privacy Addendum was last updated on 01 April, 2025

Application of U.S. Privacy Laws

This section has supplementary information on how we collect, use, disclose, and otherwise process personal information,, either online or offline, in accordance with applicable U.S. state privacy laws and regulations that are currently in effect (collectively, the “US Privacy Laws”). This U.S. Privacy Addendum may be periodically revised and updated as new state data protection laws go into effect.

Categories and sources of personal information, and purposes for collection under the CCPA:

The following is a list of categories of personal information we may have collected and disclosed for a business purpose to third parties (as defined by the CCPA).

Please refer to the section titled “Use of your Personal Data” in our General Privacy Notice (above) for additional information on our processing that may apply to you.

1. Categories of personal information sold in the preceding 12 months:

We do not sell any of the categories of personal information, and we have not sold any of your personal information in the past twelve (12) months.  

2. Categories of personal information shared (as defined under the CCPA) in the preceding 12 months:

Identifiers, Inferences, Internet and Other Electronic Activity information, which is shared or disclosed, as set out in the table above.

3. Contact information for submitting requests:

Please refer to “How to Make a Privacy Rights Request” in our main General Privacy Notice by clicking here.

4. Erasure rights of individuals:

We take measures to delete your personal information or keep it in a form that does not permit identifying you when this information is no longer necessary for the purposes for which we process it unless we are required by law to keep this information for a longer period.

When determining the retention period, we take into account various criteria, such as the type of products and services requested by or provided to you, the nature and length of our relationship with you, possible re-enrolment with our products or services, the impact on the services we provide to you if we delete some information from or about you, mandatory retention periods provided by law and the statute of limitations.

For Data Retention, click here

5. Your US Privacy Rights

Residents of states that currently have US Privacy Laws in effect, may have rights to know, access, correct, delete, limit/opt-out of certain type of processing, or as otherwise set out below:

California residents: Right of access, correct or delete personal information, right to opt out of “sale” and “sharing” of personal information for targeted advertising, limit the use and disclosure of sensitive personal information, and non-discrimination.

Colorado, Connecticut, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Virginia, Montana, Oregon, and Texas, Tennessee, Minnesota and Maryland residents: Right of access, correct or delete your personal information, right to opt out of sale of personal information and targeted advertising, right to opt out of profiling, no discrimination, right to appeal.

Utah Residents: Right of access or delete personal information, right to opt out of sale of personal information and targeted advertising, no discrimination.

6. Nevada Privacy Notice:

This Nevada Privacy Notice supplements our U.S. Privacy Addendum and applies to Nevada residents only. We do not sell “covered information” for monetary consideration. However, Nevada Law (NRS 603A.300 et seq.) requires us to post the following:

• Nevada consumers may opt out of the sale of “covered information” for monetary consideration to a person for that person to license or sell such information. “Covered information” means any one or more of the following items of personally identifiable information about a consumer: first and last name, home or other physical address which includes the name of a street and the name of a city or town, email address, telephone number, social security number, an identifier that allows a specific person to be contacted either physically or online, or other information maintained in combination with an identifier that makes the information personally identifiable.

• If you are a Nevada resident who has purchased Services from us, you may submit a request to opt out of any potential future sales under Nevada Law by contacting us on our webform to submit such request. Please use “Nevada Do Not Sell” in the subject line. Note we will take reasonable steps to verify your identity and the authenticity of your request.

7. California Shine the Light Law – Direct Marketing Lists:

California Civil Code §1798.83 (“STL”) gives California residents with who have established a business relationship with us the right to ask us to provide them with a list of certain categories of personal information that we have disclosed to certain third parties for their direct marketing purposes (during the immediately preceding calendar year) and the identity of those third parties.

This would apply where we share your personal data with third parties so they can promote their own products—for their direct marketing purposes.

GBG do not disclose customers’ personal information to third parties for direct marketing purposes.

In any case, if you are a California resident and would like to contact us about your rights under STL, please contact us on our webform to submit such request. Please use “CA Shine the Light” in the subject field of your request. Note we may take reasonable steps to verify your identity and the authenticity of your request.