Post: EF Corporate Education Ltd, 22 Chelsea Manor Street, London, SW3 5RL, GB. We are registered as a company in England and Wales under company number 07434504.

Email: concierge@ashridge.hult.edu

We are the data controller of the personal data which we collect from you, and so we are responsible for the ways your personal data are collected and the purposes for which your personal data are used. Where we only use personal information as allowed by our corporate customers (where we are acting as a ‘processor'), our customers are similarly responsible for the obligations of a ‘controller’ under applicable laws for the data that they share with us about you and we will act as a ‘processor’ on their behalf. This applies, for example, if you are a participant in any of our executive education programs hosted at Ashridge House. If you are using our services through your employer, you should contact them if you have questions or concerns about the processing of your personal information or compliance with applicable laws.

We collect or use the following information to provide services to you. The specific information we collect depends on which service you engage with, and may include:

• Names and contact details

• Addresses

• Date of birth

• Payment details (including card or bank information for transfers and direct debits)

• Health information (including dietary requirements, allergies and health conditions)

• Health and safety information

• Account information

• Photographs or video recordings

• Identification documents

• Information relating to compliments or complaints

We also collect or use the following special category information to provide services and goods, including delivery. This information is subject to additional protection due to its sensitive nature:

• Health information

We collect or use the following information to prevent, detect, investigate or prosecute crimes and to maintain a safe and secure environment for all individuals accessing our premises:

• Names and contact information

• Video and CCTV recordings of public areas (including indoor and outdoor spaces)

• Financial transaction information

• We collect or use the following information for marketing purposes:

• Names and contact details

• Addresses

• Marketing preferences

• Location data

• Recorded images, such as photos or videos

• Purchase or viewing history

• IP addresses

• Website and app user journey information

• Records of consent, where appropriate

• Date of birth

• Occupation

We use the data we collect about you from different sources to try to understand more about you and your preferences, so that we can personalise your experience. We use data that you have directly given to us (such as through reservations or enquiries) as well as data we have obtained from your online activities, such as interactions with our marketing emails or activities on our website (including the use of Cookies). You can find out more about Cookies in our Cookie Policy.

We use these data to personalise your experience in the following ways:

1. To identify your likes and dislikes, so that in future we send you news and offers that are more interesting to you

2. To understand more about your preferences and purchasing habits, so that we can match you with similar customers and use this to offer you and other customers more relevant products and services. Sometimes we use third party systems or tools to help with this.

3. To help you complete a booking, if you leave the booking path before your booking is finalised.

4. To show you more relevant advertising online

You have the right to opt out of receiving future marketing communications at any time and can do so by clicking the unsubscribe link in any email that we have sent you. Alternatively, you can email marketing@ashridge.org.uk to ask to be removed from our mailing list.

Please note that if you tell us that you do not wish to receive marketing communications, you will still receive service emails which are directly related to your reservations or subscriptions, for example a booking confirmation.

We collect or use the following information to comply with legal requirements:

• Name

• Identification documents

• Financial transaction information

• Any other personal information required to comply with legal obligations

• Health and safety information

We collect or use the following personal information for dealing with queries, complaints or claims:

• Names and contact details

• Address

• Payment details

• Purchase or service history

• Video recordings of public areas

• Correspondence

We also collect the following special category information for dealing with queries, complaints or claims. This information is subject to additional protection due to its sensitive nature:

• Health information

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

• Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for.

• Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.

• Your right to erasure - You have the right to ask us to delete your personal information.

• Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information.

• Your right to object to processing - You have the right to object to the processing of your personal data.

• Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.

• Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for collecting or using personal information to provide services and goods are:

• Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

Our lawful bases for collecting or using personal information to prevent, detect, investigate or prosecute crimes are:

• Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

• Legitimate interest in bringing and defending legal claims or for debt collection to protect the business and in detecting, investigating or preventing information security incidents, misrepresentation and crime to protect (a) users of the Ashridge House Products, and (b) our directors, employees and consultants.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for collecting or using personal information for marketing purposes are:

• Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

• Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

• Legitimate interest, for direct marketing of products or services similar to the one(s) you have already purchased from that same legal entity within a limited period of time.

• Legitimate interest in running a commercial enterprise which employs the services of appropriate third party service providers.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for collecting or using personal information for legal requirements are:

• Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

• Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

• Legitimate interest in ensuring compliance with applicable laws and regulations.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

• Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

• Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

• Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

• Legitimate interest in bringing and defending legal claims or for debt collection to protect the business.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Where we get personal information from

• Directly from you

• CCTV footage or other recordings

• Schools, colleges, universities or other education organisations

• Publicly available sources

• Suppliers and service providers

• Third parties: Clients booking conferences, event space or accommodation, including but not limited to Hult International Business School, Ltd.

We will only keep your Personal Data for as long as it is necessary for the purposes for which it has been collected or in accordance with time limits stipulated by law and market practice, unless further retention is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims or unless a specific time period has been communicated.

We will keep limited parts of your Personal Data which are necessary for marketing purposes until you withdraw your consent, but in no event for longer than 10 years after your last completed service.

Data processors, such as third party marketing agencies to create customer profiles and lookalike audiences to deliver more relevant marketing content, and third party marketing tools, to deliver more relevant marketing content.

Others we share personal information with:

• Professional consultants, or legal advisors, corporate affiliates

• Our corporate affiliates include for example companies that provide internal service functions such as IT, legal or other shared services.

• Financial or fraud investigation authorities or regulatory authorities

• External auditors or inspectors

• Organisations we’re legally obliged to share personal information with

• Emergency services

• Publicly on our website, social media or other marketing and information media

• Suppliers and service providers:

• We share Personal Data with third parties in connection with the delivery of services to you and the operation of our business. For example, we may share Personal Data to providers of IT systems in order to manage customer relations, process credit cards or other payment solutions, schedule events or store booking information; or to providers of software and services for digital marketing automation and analytics; to advertising platforms in order to serve you with advertising tailored to your interests; to other third parties to provide customer service, business analytics, fraud prevention and compliance services and to visa processing agencies. If you have not paid your bills to us in time, we may transfer some of your data to a debt collection provider.

Business partners:

• We may share your Personal Data with business partners. This may happen, for example, when we promote an event or offer a service or product in conjunction with a third-party business partner or when we use local sales agents to promote our services. In most cases, the event or offer will include the name of the third-party business partner, either alone or with ours, or you will be redirected to the website of that business with notice.

Corporate transactions:

• In the event that our business is directly or indirectly sold or combined with another business, your Personal Data may be disclosed to our advisers, a prospective purchaser and any prospective purchaser’s advisers and may be transferred to the new owners of the business.

We use technical measures such as encryption and password protection to protect your data and the systems they are held in. We also use operational measures to protect the data, for example by limiting the number of people who have access to your personal data.

We keep these security measures under review and refer to industry security standards to keep up to date with current best practice.

The vast majority of our data processing is undertaken in the United Kingdom and European Economic Area (EEA). We will ensure that any data that is processed outside of the United Kingdom or EEA adheres to the same security standards as that processed inside the United Kingdom and EEA. Unless the UK Government and/or the EU Commission has decided that a country ensures an adequate level of protection for personal data, we will use contracts based on the European Commission’s standard contractual clauses for international data transfers, the UK international data transfer agreement (IDTA) and/or UK the international data transfer addendum to ensure compliance with applicable law.

If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint