Privacy Policy

We use cookies on our website, so please see our Cookie Policy for more information.

Requesting a brochure: When you request a brochure from us, we will collect the following information from you:

• Email address (so that we can send the brochure to you).
• The name of your organisation (so that we can identify which sectors are showing the most interest in our products/services).
• Your IP address (which will no longer be anonymous; we will therefore be able to identify you).

Requesting a call back: when you request a call back from us, we will collect the following information from you:

• Your name (so that we contact the right individual).
• Your contact telephone number (so that we contact the right individual).
• Your reason for contact (so that we can direct your call back to the right team who will respond to you directly).
• Your IP address (which will no longer be anonymous; we will therefore be able to identify you).

Subscribing to our marketing lists: Where you have consented to receive marketing from GBG, we will collect the following information from you:

• Your name (so that we market to the right individual).
• Email address (so that we send the marketing to the right place).
• The marketing preferences indicated by yourself, such as your areas of interest and how you want to be marketed to.
• Your IP address (which will no longer be anonymous; we will therefore be able to identify you).
• A record of your consent to confirm what you have consented to and when.

When you receive an email from GBG it will include an unsubscribe link, which you can click on if you wish to unsubscribe from our marketing lists. We will then add your email address to our suppression list, which will ensure you do not receive any further marketing from GBG.

Please be assured we do not sell your personal data to third parties for marketing purposes.

Requesting further information from us: Where you request further information from us by completing a form on our website in relation to our products and services, your details will be added to our marketing database to receive marketing from GBG relevant to the products and services you have an interest in. We will collect the following data from you:

• Your name (so that we market to the right individual).
• Email address (so that we send the marketing to right place).
• The marketing preferences indicated by yourself, such as your areas of interest and how you want to be marketed to.
• Your IP address (which will no longer be anonymous; we will therefore be able to identify you).

Email pixels: GBG uses pixels in some of our HTML email messages. Pixels are hyperlinks in remote images that are embedded in the email. The technology provides GBG with analytical information about the user experience and help us customise our marketing activities by monitoring ‘clicks’. No additional personal data is collected. For the avoidance of doubt, this does not include any sharing or selling of any data or any cross context behavioural advertising under US privacy laws.

Conferences and events: As a global organisation, GBG attends worldwide events and have marketing team members located around the world. GBG will obtain from the event organiser a delegate list of all attendees who have consented to their personal information being shared with GBG. 

Entering into an agreement with GBG: When your organisation enters into an agreement with GBG to provide products and services, we will collect additional information, which is necessary for:

• The performance of the contract we have with your organisation, such as billing information; and
• Providing service updates related to the product/service GBG are providing to you.

All personal information we collect is held electronically within our Customer Relationship Management systems (CRM) which are hosted in the United Kingdom.

Who will we share your personal data with and why?

GBG will share your information with third party service partners who are acting on behalf of GBG as our data processor. Below are the details of whom GBG will share your personal information with and why:

HubSpot Inc.: provides GBG with an email marketing solution, which delivers marketing emails on our behalf. HubSpot is headquartered in the US and their product infrastructure is hosted on Amazon Web Services in the United States, with some services being routed through the Google Cloud Platform in Germany. We share the following personal information with HubSpot:

• When you are browsing our website, HubSpot capture the anonymous IP address.
• At the point that you enter all of the required personal information relating to a free trial, demo, brochure request, or contact information for marketing, HubSpot will receive all of the personal information you provide via the website.
• For the purposes of marketing to our existing customer and prospect base and identifying which website visitors are already known to GBG, HubSpot will receive personal information relating to our primary contact at your organisation with whom we correspond as part of a sales process and/or in support and administration of customer contracts.

Price Waterhouse Coopers: supports GBG with our CRM systems and, as a result, their team located in Poland may access the live system for technical support.

Microsoft: our Dynamics 365 CRM system is cloud-based and hosted by Microsoft in the UK. In addition, when you visit our website you will be directed to the Microsoft Azure instance in the region nearest to you (Ireland, Hong Kong, California, or London) and the data will be stored in Ireland.

CustomerSure: carries out our Voice of the Customer surveys and is based in the UK. In order to determine customers’ level of satisfaction following their interaction with GBG at various pre-defined trigger points, CustomerSure will receive personal information from GBG's CRM systems. This is used to facilitate the sending of an email requesting completion of a survey and, following that, analysis of and appropriate reaction to the feedback received. The data is processed by CustomerSure in the UK with the exception of the disaster recovery backups, which are hosted in Ireland.

GBG can assure you that we have taken all reasonable technical and organisational measures necessary to protect the personal information that our third party service partners may access.

As part of the account management process, GBG will on a regular basis enquire if the personal information we hold about you is correct. You can also ensure your personal information is correct by:

• Contacting our Data Protection Officer by email by using the data request form
• Alternatively, if your organisation has an agreement with GBG for the provision of services, you can contact your GBG account manager, who will ensure they update your record on our CRM system.

Where we have collected your personal information for marketing purposes, we will retain your personal information for as long as you remain subscribed to our mailing lists or until you inform us that you no longer wish to receive marketing from us.

GBG will retain the contact details for leads for up to 6 months, after which they will be deleted.

For account management purposes, we will retain the personal information for as long as we have the relationship with your organisation. If GBG no longer have a relationship with your organisation, then we will only keep the relevant information, such as invoices, for audit purposes for 7 years after the relationship with GBG has ended. 

Once GBG are informed you are no longer the contact we need to liaise with or you leave your organisation, we will remove your details from our system.

Social media
If you contact us through one of our GBG social media accounts by either a publicly visible message or a private direct message, this will be handled by our Communications Team. You will be asked to send your enquiry to the relevant team and provided with their email address. Messages received on social media containing personal information are deleted within one week.

We do not track individuals and the analytics data we receive is not at a granular level. We do not scrape data from LinkedIn. GBG uses Sales Navigator to process personal information within LinkedIn. Obtaining personal information from LinkedIn by any other method is against the terms and conditions of LinkedIn and against GBG policy.

Emails
We use Office 365 encryption (TLS/SSL, IPSec, AES) and Mimecast to encrypt and protect email traffic. In addition, email filtering software is currently in place to monitor all incoming and outgoing emails for inappropriate or malicious content, spam, and unencrypted proprietary and/or personal information.

Purpose and legal basis for processing
We process the information mentioned in this section as reasonably necessary, in order to be able to reply to any queries we receive and enhance the services we provide, which we believe also benefits our customers.

Analytics
We use Google Analytics to measure how users interact with our website in order to understand which parts of our sites are doing well, how people arrive at our site and so on. We use this information to improve our website. Google will not associate your IP address with any other data held by it. Learn more about Google Analytics or opt-out if you wish.

Cookies
We use various types of cookies in order to identify and track users and to store information about your preferences. Users may disable cookies; however, please keep in mind that if you decide not to accept all of the cookies, some parts of the site might not work properly. You can read more about how we use cookies in our Cookie Policy.

Search facility
The search facility on our website does not collect any personal data. Search queries and results are logged anonymously to help us improve the website and search functionality, but we do not have the ability to identify any individuals.

Security and performance
We keep a record of traffic data, which is logged automatically by our server, such as your IP address and any error messages visitors may encounter. Any traffic data we process in order to monitor our website is anonymised when required for analytics.

Purpose and legal basis for processing
We process the information mentioned above for carefully considered and specific purposes mentioned in each section, which are in our legitimate interests to enable us to enhance the services we provide, which we believe also benefits our customers. This is in accordance with the data protection law(s) applicable in your country, which allows us to collect personal information when it is reasonably necessary for one or more of GBG’s functions or activities. 

Visitor book
We meet visitors at our offices, including:

• Potential and existing customers;
• External training providers;
• Job applicants;
• Suppliers and tradespeople; and

Our visitors are asked to sign in and out at reception. The information collected will be name, company, who you’re visiting, time in/time out, vehicle licence plate number (if applicable), and date. This information will be contained in the visitor’s badge, which you will be required to wear throughout your visit.

At the end of each working week, the visitor forms are securely destroyed.

If your visit is planned, we will send your name and visit information to reception prior to your visit so they are expecting you.

Purpose and legal basis for processing
It is important for GBG to capture the details of visitors to our offices for various reasons, including but not limited to health and safety, fire safety, building security, and safety of our team members.

Wi-Fi
In order to access our on-site guest Wi-Fi, you will need to be on the list of authorised users to access the network. When connecting to the GBG GUEST WI-FI network, you will be asked to enter in the email address of a GBG nominee, who will authorise your request for internet access. Once the GBG nominee has granted you permission, you will have access to the network. We monitor access to our internet, and log traffic information such as the IP address, sites visited, times and dates, log on times and log off times. This data is held for 12 months.

Purpose and legal basis for processing
The purpose for processing this information is to provide you with access to the internet while visiting our office and ensuring it is accessed in accordance with our policies.

CCTV
Closed-circuit television (CCTV) operates both inside and outside our Kuala Lumpur office.

Generally, recordings will be retained for 90 days in order to comply with PCI-DSS requirements. Imagery required for investigative or evidential purposes may be retained beyond 90 days and is securely disposed of upon completion/conclusion of the purpose for which it was retained.

Recordings are retained in a secure environment and are only accessible by authorised personnel who have a legitimate reason to do so.

Purpose and legal basis for processing
GBG uses CCTV imagery as it is necessary for the purposes of maintaining the safety and security of our building and team members, and for investigative purposes as evidence to support the effective management of any incidents.

IS0 27001 Certification
GBG are a global specialist in identity data intelligence for some of the largest organisations in the world, which is why GBG aim to set the highest standards of information security and in doing so, have developed an Information Security Management System (ISMS) to meet the requirements of the ISO 27001:2013 standard. Its aim is to protect the confidentiality, integrity and availability of GBG and client held information resources and assets, thus safeguarding GBG and its clients from unauthorised access, compromise and/or disclosure of data.

PCI-DSS Certification
Some of the services we provide are compliant with the Payment Card Industry Data Security Standard (PCI DSS). Being compliant with PCI DSS means that we are doing our very best to keep our customers’ valuable information safe and secure and out of the hands of people who could use that data in a fraudulent way. PCI ensure technical and operational strengths to raise the bar on our security.

Cyber Essentials Certification
In addition to the above, we have services that are Cyber Essentials accredited, this helps prevent the vast majority of cyber-attacks. Having a Cyber Essentials badge enables us to:

• Protect our organisation against common cyber threats.
• Demonstrate our commitment to information security.
  
  

As an individual, you have rights regarding the processing of your personal information, these are:

• The right to access your personal information – you have a right to know what personal information GBG hold on you. This is known as a Subject Access Request (SAR).
• The right to opt out – you have the right to stop receiving unwanted direct marketing.
• The right to correction – you have the right to ask us to correct any information you believe is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• The right to stop processing – you have the right to request that we stop processing your personal information if we are processing it because the processing is in our legitimate interests.
• The right to complain to the relevant supervisory authority about a breach by us of the applicable data protection law(s), if you think we’ve mishandled your personal information.

Please keep in mind that some of these rights are subject to an internal assessment that one of the grounds provided under the applicable data protection law(s) is satisfied.

You can send these requests using our data request form.

You are not required to pay any charge for exercising your rights. We will always aim to provide you with access within 30 days but in some cases, it may take longer. If GBG are unable to comply with your request, we will provide you with an explanation within 21 days of receipt of your request.

We appreciate that at GBG we may not always get things right and it is regrettable for us as an organisation when we receive a complaint. We take all complaints seriously and can assure you we will do our best to deliver a satisfactory outcome. If you do wish to complain about how your personal information is used by GBG then please email us using our data request form.

GBG will investigate and respond within 10 working days of receipt of your complaint. This allows us time to investigate your complaint thoroughly.