Privacy Policy

1. Who we are

nudge Global Limited ("nudge", "we", "us") is the data controller for the personal data described in this policy. That means we decide why and how your personal data is used when you visit nudge-global.com, contact us, or deal with us as a business contact.

• Registered company number 08711475, registered in England and Wales
• Registered office: 68 Greencoat Place, London SW1P 1PL, United Kingdom
• ICO data protection registration number ZA046765
• Data Protection Officer: privacy@nudge-global.com

We process personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where it applies to people in the European Economic Area, the EU GDPR. Our use of cookies and similar technologies is also governed by the Privacy and Electronic Communications Regulations 2003 (PECR).

2. What this policy covers

This policy applies to personal data we collect through nudge-global.com and in the course of our business relationships: website visitors, people who contact us or download our content, attendees at our events and webinars, contacts at current and prospective clients, partners and suppliers, and people who apply to work with us.

It does not cover the nudge financial wellbeing platform. If your employer provides nudge as a benefit, your employer is the data controller and nudge processes your data on their behalf. How we do that is explained in the separate nudge platform privacy notice, which is also available inside the platform.

Our website may link to third-party sites. We are not responsible for their privacy practices and recommend you read their policies.

3. The personal data we collect and where it comes from

We collect only what we need for the purposes in section 4. Most of it comes directly from you; some comes from your employer, our partners, or public sources.

‍

‍

We do not knowingly collect personal data from children through this website, and we do not collect special category data (such as health or ethnicity) through it. We do not sell personal data.

4. Why we use your data and our lawful basis

UK GDPR requires a lawful basis for each use of personal data. Ours are set out below. Where we rely on legitimate interests, we have balanced our interest against your rights and concluded that our use is proportionate and within your reasonable expectations; you can object at any time (section 9).

‍

‍

Where we rely on consent you can withdraw it at any time, which will not affect anything we did before you withdrew it.

5. Who we share your data with

We share personal data only where there is a proper reason to, and never by selling it. Each service provider acts on our written instructions under a data processing agreement.

• Service providers that host and run our website and business systems: web hosting and content management, customer relationship management and email marketing, analytics and cookie consent, webinar and event platforms, recruitment tools, IT and security monitoring.
• Professional advisers such as lawyers, accountants, auditors and insurers, where they need it to advise us.
• Regulators, courts and law enforcement where we are legally required to, or to protect our rights or someone's safety.
• A buyer or successor if we sell, merge or restructure our business, under confidentiality terms.

A current list of the categories of service provider, and the main providers in each, is available from privacy@nudge-global.com on request.

6. International transfers

We are based in the UK and store the data covered by this policy in the UK and the European Economic Area wherever we can. Some of our service providers, for example analytics, advertising and marketing platforms, are based in or support their services from the United States.

When personal data leaves the UK or EEA we make sure one of the following safeguards is in place: a UK adequacy regulation or EU adequacy decision for the destination country; the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; or the recipient's certification under the UK Extension to the EU-US Data Privacy Framework. You can ask us for details of the safeguard that applies to a particular transfer.

7. How long we keep your data

We keep personal data only for as long as we need it for the purpose we collected it, and then delete or anonymise it. The periods below are our standard retention periods; we may keep data longer where the law requires it or a legal claim is in progress.

‍

For data processed on behalf of your employer through the nudge platform, retention is set by your employer and described in the platform privacy notice.

8. How we protect your data

nudge operates an information security management system certified to ISO/IEC 27001, with a designated Data Protection Officer responsible for data protection across the business. Personal data is encrypted in transit and at rest, access is restricted to people who need it for their role and protected by multi-factor authentication, and our systems are monitored around the clock for security incidents.

Everyone at nudge who handles personal data is trained in data protection and bound by confidentiality obligations. We review our controls regularly through internal and independent external audits. If a breach ever puts your rights at risk we will tell you and the ICO without undue delay, as the law requires.

Further information about our security programme is on our information security page.

9. Your rights

You have the following rights over your personal data. None of them cost anything to exercise, and we will respond within one month, or tell you if we need longer for a complex request.

• Access a copy of the personal data we hold about you
• Rectification of data that is inaccurate or incomplete
• Erasure of your data where we no longer have a reason to keep it
• Restriction of how we use your data in certain circumstances
• Objection to processing based on legitimate interests, including an absolute right to object to direct marketing
• Portability of data you gave us, in a machine-readable format, where we rely on consent or a contract
• Withdrawal of consent at any time, where consent is our lawful basis

We do not make decisions about you based solely on automated processing that would have a legal or similarly significant effect on you.

To exercise any of these rights, email privacy@nudge-global.com or write to the Data Protection Officer at the address in section 1. We may need to confirm your identity first.

If you are unhappy with how we have handled your data or your request, please tell us so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. If you are in the EEA you can complain to your local data protection authority instead.

10. Marketing communications

We send business-to-business marketing, such as research, event invitations and product news, to contacts at organisations we believe may benefit from nudge. We do this under legitimate interests and, where PECR requires it, with your consent. Every email includes an unsubscribe link, and you can also opt out at any time by emailing privacy@nudge-global.com. We will action an opt-out within 30 days and will not share your details with third parties for their own marketing.