Privacy Policy

1. Introduction and company information

This Privacy Policy explains how Northbridge Retention Partners collects, uses, stores, shares, and protects personal data in connection with its customer-retention services. We are committed to handling personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and other applicable UK data protection laws.

Data controller: Northbridge Retention Partners

Registered / business address: Northbridge Retention Partners, 18 Victoria Street, Westminster, London SW1H 0NN, UK

Email: [email protected]

Phone: +44 20 7946 8273

This Privacy Policy applies where we act as a data controller in relation to personal data collected through our website, communications, service delivery, business operations, and any other interactions with individuals, clients, prospects, suppliers, and other contacts.

2. Data collection and processing

We may collect and process the following categories of personal data, depending on your relationship with us and the services involved:

• Identity data: name, title, job title, employer, and similar identifiers.
• Contact data: email address, telephone number, postal address, and other communication details.
• Business and account data: organisation details, account records, service preferences, and correspondence.
• Technical data: IP address, browser type, device identifiers, operating system, and website usage data.
• Marketing and communications data: preferences regarding marketing, opt-ins/opt-outs, and responses to communications.
• Transaction and service data: records relating to services provided, instructions, feedback, and support interactions.
• Compliance data: records needed to meet legal, regulatory, tax, accounting, or audit obligations.

We generally collect personal data directly from you, from your employer or organisation, from publicly available sources, from our website and analytics tools, and from third parties such as service providers or business partners where lawful to do so.

We do not intentionally collect special category data unless it is necessary, lawful, and appropriate for a specific purpose. Where special category data is processed, we will only do so in accordance with applicable law and with an appropriate lawful basis.

3. Purpose of data processing

We process personal data for the following purposes:

• to provide and manage our customer-retention services;
• to communicate with clients, prospects, suppliers, and other contacts;
• to respond to enquiries and provide support;
• to manage contracts, billing, payments, and business administration;
• to improve our services, website, and customer experience;
• to send service-related communications and, where permitted, marketing communications;
• to monitor and analyse website usage and performance;
• to maintain security, prevent fraud, and protect our systems and users;
• to comply with legal, regulatory, tax, accounting, and reporting obligations;
• to establish, exercise, or defend legal claims.

Where we use personal data for direct marketing, we will do so in line with applicable law and your communication preferences.

4. Legal basis for processing

We will only process personal data where we have a lawful basis under UK GDPR. Depending on the context, our legal bases may include:

• Performance of a contract: where processing is necessary to enter into or perform a contract with you or your organisation.
• Legitimate interests: where processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. This may include service delivery, business development, fraud prevention, IT security, and internal administration.
• Consent: where you have given clear consent, for example for certain marketing communications or optional cookies, where applicable.
• Legal obligation: where processing is necessary to comply with a legal or regulatory obligation.
• Vital interests: where processing is necessary to protect someone’s life in an emergency.
• Public task: where applicable, if processing is necessary for a task carried out in the public interest or under official authority.

Where we rely on legitimate interests, we assess the impact on your rights and freedoms and take appropriate safeguards.

5. Data sharing and third parties

We may share personal data with the following categories of recipients where necessary and lawful:

• service providers and processors who support our operations, such as IT hosting, cloud services, analytics, communications, CRM, and security providers;
• professional advisers, including lawyers, accountants, auditors, and insurers;
• clients, business partners, and counterparties where required to deliver our services;
• payment providers and banking partners;
• regulators, law enforcement agencies, courts, and other authorities where required by law or to protect our rights;
• third parties involved in a business transaction, such as a merger, acquisition, restructuring, or asset transfer.

We require third parties who process personal data on our behalf to implement appropriate technical and organisational measures and to process personal data only in accordance with our instructions and applicable law.

6. Data transfer to third countries

Some of our service providers or recipients may be located outside the UK. Where personal data is transferred outside the UK, we will ensure that appropriate safeguards are in place to protect your data, such as:

• the UK International Data Transfer Agreement (IDTA);
• the UK Addendum to the EU Standard Contractual Clauses;
• an adequacy regulation or decision recognised under UK law;
• other lawful transfer mechanisms permitted by applicable data protection law.

Where required, we will also carry out transfer risk assessments and implement supplementary measures to protect personal data.

7. Storage duration

We retain personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, reporting, and operational requirements.

Retention periods vary depending on the type of data and the purpose of processing. In general, we consider the following factors when determining retention periods:

• the nature and sensitivity of the data;
• the risk of harm from unauthorised use or disclosure;
• the purposes for which we process the data;
• whether we can achieve those purposes by other means;
• legal, regulatory, tax, and contractual obligations;
• the need to establish, exercise, or defend legal claims.

When personal data is no longer required, we will securely delete, anonymise, or archive it in accordance with our retention procedures.

8. User rights

Subject to conditions and exemptions under applicable law, you have the following rights in relation to your personal data:

• Right of access: to request confirmation of whether we process your personal data and to obtain a copy of that data.
• Right to rectification: to request correction of inaccurate or incomplete personal data.
• Right to erasure: to request deletion of your personal data in certain circumstances.
• Right to restriction: to request that we limit the processing of your personal data in certain circumstances.
• Right to data portability: to receive certain personal data in a structured, commonly used, machine-readable format and to request transfer to another controller where technically feasible.
• Right to object: to object to processing based on legitimate interests and to object at any time to direct marketing.

You may also have rights relating to automated decision-making where applicable. We do not currently make decisions based solely on automated processing that produce legal or similarly significant effects, unless we notify you otherwise and such processing is lawful.

To exercise any of your rights, please contact us using the details in the Contact Information section below. We may need to verify your identity before responding. We aim to respond within one month, although this may be extended where permitted by law.

9. Withdrawal of consent

Where we rely on your consent to process personal data, you may withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.

You can withdraw consent by using any unsubscribe mechanism provided in our communications or by contacting us directly at [email protected].

If you withdraw consent, we may still be able to process your personal data where another lawful basis applies.

10. Right to complain

If you have concerns about how we handle your personal data, please contact us first so that we can try to resolve the issue.

You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner’s Office (ICO):

• Website: https://ico.org.uk/
• Telephone: 0303 123 1113
• Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom

We would appreciate the opportunity to address your concerns before you contact the ICO, but you are not required to do so.

11. Data security

We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures may include:

• access controls and role-based permissions;
• encryption where appropriate;
• secure storage and transmission methods;
• staff confidentiality obligations and training;
• regular review of systems, processes, and security practices;
• incident detection, response, and business continuity procedures.

While we take reasonable steps to protect personal data, no system can be guaranteed to be completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will act in accordance with applicable legal requirements.

12. Contact information

If you have any questions about this Privacy Policy or our data protection practices, or if you wish to exercise your rights, please contact:

Northbridge Retention Partners
18 Victoria Street, Westminster, London SW1H 0NN, UK
Email: [email protected]
Phone: +44 20 7946 8273

13. Changes to privacy policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Any updated version will be posted on our website with a revised effective date where appropriate.

We encourage you to review this Privacy Policy periodically to stay informed about how Northbridge Retention Partners protects your personal data.