Privacy Policy

We are an international consulting firm and operate our business through numerous individual companies (each an “OC&C Company”). For a full list of these companies please see the end of this policy. Whenever providing personal data or interacting with one of our offices, the relevant OC&C Company that corresponds to that office, as set out at the end of this policy, is the ‘controller’ in relation to the processing activities described below. A ‘controller’ is an organisation that decides why and how your personal data is processed and is responsible for such processing.

Where this policy refers to “we”, “our” or “us” below, unless it mentions otherwise, it is referring to the particular OC&C Company that is the controller of your personal data.

The version of our site located at www.occstrategy.com that we present to you will depend on the location of the server from which you access it from, as we aim to present the site in the local language of that location. The controller of the personal data you provide to that site or that is collected when you interact with it, is the OC&C Company listed at the end of this policy that corresponds with the relevant version of the site presented to you.

We collect personal data about you in the following ways:

Personal data you give to us

This is information about you that you give to us when:

• submitting information via www.occstrategy.com, including local versions and microsites (our “website”);
• following and posting on our social media pages;
• corresponding with us by phone, email or in another way,
• interacting with us at events;
• completing surveys for research purposes;
• we provide services to our client for whom you work;
• we receive services from our supplier for whom you work; and
• registering for and participating in our alumni network.

This information is provided by you entirely voluntarily and includes personal data you submit on any web forms on our website, that you share by posting to our message boards or to the alumni network using our website’s community features or that you provide to us in person (e.g. business cards). We may also ask you for information when you report a problem with our website.

If you do not give this information to us, you may be unable to use or interact with certain parts of our website, communicate with us effectively, comply with the contractual obligations that the organisation for whom you work is under, or allow us to comply with our own obligations if you work for an organisation that is our client.

Personal data we collect about you

We may automatically collect the following information during your visits to our website: traffic data, location data, device data, weblogs and other communication data, and details of the resources you access. We also automatically collect technical information, including anonymous data collected by the hosting server for statistical purposes, the Internet protocol (IP) address used to connect your computer or device to the Internet, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform. Please see our Cookies Policy for further information. We may also collect any personal data which you allow to be shared that is part of your public profile as an alumni or on third party social networks.

Personal data we may receive from other sources

We obtain certain personal data about you from other sources which may include other OC&C Companies, our suppliers and our clients. The sources from which we may receive personal data about you are as follows:

We process different types of personal data about you. To make it easier to understand the information that we use about you, we have categorised this information in the table below and provided a short explanation of the type of information each category covers.

The purposes for which we use your personal data and the lawful basis on which we rely to do this are explained below.

1.      Consent. We may use and process your personal data where you have given your consent, for example where you sign up for future updates through our website. You may withdraw your consent for us to use your information in this way at any time. Please see Withdrawing your consent (section ‘Your Rights’) for further details.

2.      Where required to comply with our legal obligations. We will use your personal data to comply with our legal obligations:

• to assist any public authority or criminal investigatory body, where we are under a legal obligation to do so;
• to identify you when you contact us;
• to verify the accuracy of data we hold about you; and
• to respond to and resolve your complaints in relation to our services.

3.      Legitimate interests. We may use and process your personal data where it is necessary for us to pursue our legitimate interests as a business, for the following purposes:

Processing necessary for us to promote our services and our business

• to create a profile of you to obtain insight about market or industry trends, client behaviours which inform our marketing strategy, and to enhance and personalise your experience as a visitor;
• if you work for a corporate business, to contact you by email or by telephone with marketing information about our products and services. We will use your personal data and profile to tailor or personalise the
• marketing communications you receive to make them relevant to you;

Processing necessary for us to support our clients and prospects with sales and other enquiries

• to correspond and communicate with you when supporting you in connection with our services or your queries in relation to our services;

Processing necessary for us to respond to changing market conditions and our clients’ needs

• for market research in order to improve the services that we deliver;
• to notify you about changes to our services and our business;

Processing necessary to manage and administer our alumni network and prospective recruits

• to keep in touch with our alumni, and prospective recruitment candidates through non-promotional mailings, events and surveys;
• to maintain and share marketing and career development contacts within the alumni network and with prospective recruitment candidates;

Processing necessary for us to operate the administrative and technical aspects of our business efficiently and effectively

• to administer our website and our social media pages and for our internal operations, including troubleshooting, testing and statistical reporting purposes;
• to enable us to make payments to contractors and freelancers who provide services to us;
• for the prevention of fraud and other criminal activities;
• to verify the accuracy of information we hold about you and create a better understanding of you as a visitor to our website;
• for network and information security purposes in order for us to take steps to protect your information against loss or damage, theft or unauthorised access;
• to comply with a request from you in connection with the exercise of your rights (for example where you have asked us not to contact you for marketing purposes, we will keep a record of this on our suppression lists in order to be able to comply with your request);
• for the purposes of a corporate restructure or reorganisation or sale of our business or assets;
• for efficiency, accuracy or other improvements of our databases and systems e.g. by combining systems or consolidating records we or other OC&C Companies hold about you;
• to enforce or protect our contractual or other legal rights or to bring or defend legal proceedings; and
• for general administration including managing your queries, complaints, or claims, to send service messages and to provide you with important information about our business.

Other OC&C Companies

We may share your information with other OC&C Companies. They may use your personal data in the ways set out in How we use your personal data, in connection with the services they provide.

Please see the end of this policy for the details of the OC&C Companies with whom we may share your personal data, including their locations.

Our suppliers, service providers and other recipients

We may share your information with our third party service providers, agents, subcontractors and other organisations as listed below:

These recipients mentioned above are in the UK, Europe, USA, Australia and China.

We require all third parties to respect the security of your personal data and to treat it in accordance with applicable law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

Other ways we may share your personal data

We may transfer your personal data to a third party as part of a sale of some or all of our business and assets to any third party or as part of any business restructuring or reorganisation. We may also transfer your personal data if we are under a duty to disclose or share it in order to comply with any legal obligation, to detect or report a crime, to enforce or apply the terms of our contracts or to protect the rights, property or safety of our visitors and customers. We will always take steps with the aim of ensuring that your privacy rights continue to be protected.

We may disclose your personal data to certain overseas recipients. By way of example, this may happen where we share your personal data with other OC&C Companies, or if any of our servers or those of our third party service providers are from time to time located overseas.

We will ensure that any such international transfers are made subject to appropriate or suitable safeguards as required by applicable data protection laws.

If you reside in the European Economic Area (EEA) or the UK and we transfer your personal data to another jurisdiction, we rely on applicable adequacy decisions of relevant bodies on certain countries and, for other jurisdictions, we rely on the Standard Contractual Clauses as approved by the European Commission and any applicable country addenda, including the UK’s International Data Transfer Addendum.

Please contact us using the details at the end of this policy for more information about the protections that we put in place and to obtain a copy of the relevant documents.

We do not retain personal data in an identifiable format for longer than is necessary.

If we collect your personal data, the length of time we retain it is determined by the following criteria:

• Nature of the information. The sensitivity and quantity of personal data and the potential risk of harm from unauthorised use or disclosure;
• Retention in case of queries. We will retain your personal data in case of queries from you, including on behalf of an organisation for whom you work;
• Retention in case of claims. We will retain certain of your personal data for the period in which you or a third party might bring claims against us;
• Retention in accordance with legal and regulatory requirements. We will carefully consider whether we need to retain your personal data after the period described above in case of a legal or regulatory requirement.

The exceptions to the above are where:

• you exercise your right to require us to retain your personal data for a period longer than our stated retention period (see further Erasing your personal data or restricting its processing);
• you exercise your right to have the information erased (where it applies) and we do not need to hold it in connection with any of the reasons permitted or required under the law (see further Erasing your personal data or restricting its processing);
• we bring or defend a legal claim or other proceedings during the period we retain your personal data, in which case we will retain your personal data until those proceedings have concluded and no further appeals are possible; or
• in limited cases, existing or future law or a court or regulator requires us to keep your personal data for a longer or shorter period.

We implement appropriate technical and organisational measures to keep your personal data safe and secure. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and when they are subject to a duty of confidentiality.

Our website may include links to third-party websites. Clicking on those links may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements or security controls. When you leave our website, we encourage you to read the privacy policy of every website you visit.

Like many other websites, our website uses cookies (including Google Analytics cookies) to obtain an overall view of visitor habits and visitor volumes. ‘Cookies’ are small pieces of information sent to your computer or device and stored on its hard drive to allow our website to recognise you when you visit. It is possible to switch off cookies by setting your browser preferences.

For more information on how we use cookies and how to switch them off on your device, please visit our Cookies Policy.

Under data protection law, you have rights including:

• Accessing your personal data. You may ask for a copy of the information that we hold about you. We may not provide you with a copy of your personal data to the extent it concerns other individuals, or we have another lawful reason to withhold that information.
• Correcting and updating your personal data. You may request correction of the personal data that we hold about you.
  Withdrawing your consent. Where we rely on your consent as the lawful basis for processing your personal data, you may withdraw your consent at any time. If you would like to withdraw your consent to receiving any direct marketing to which you previously opted-in, you can do so using our unsubscribe tool.
• Objecting to our use of your personal data. Where we rely on legitimate interests as the lawful basis for processing your personal data, you may object to us using your personal data for these purposes. We will temporarily stop processing your personal data in line with your objection until we have investigated the matter. If we agree that your objection is justified in accordance with your rights under applicable data protection law, we will permanently stop using your data for those purposes. Otherwise, we will provide you with our justification as to why we need to continue using your data. You may object to us using your personal data for direct marketing purposes and we will automatically comply with your request. If you would like to do so, please use our unsubscribe tool included in all our marketing communications.
• Erasing your personal data or restricting its processing. In certain circumstances, you may ask for your personal data to be removed from our systems. Unless there is a reason that the law allows us to use your personal data for longer, we will make reasonable efforts to comply with your request. You may also ask us to restrict processing your personal data where you believe it is unlawful for us to continue processing, you have objected to its use and our investigation is pending, or you require us to keep it in connection with legal proceedings. In these situations, we may only process your personal data whilst its processing is restricted if we have your consent or are legally permitted to do so, for example for storage purposes, to protect the rights of another person, or in connection with legal proceedings.
• Transferring your personal data (‘data portability’). Where we rely on your consent as the legal basis for processing your personal data or need to process it in connection with your contract, you may ask us to provide you with a copy of that information in a structured data file. We will provide this to you electronically in a commonly used form, such as a CSV file. You can ask us to send your personal data directly to another service provider, and we will do so if technically possible.

To make a data protection rights request, please see the Contact us section below.

Except in rare cases, we will respond to you within one month from either the date that we have confirmed your identity or, where we do not need to do this because we already have this information, from the date we received your request.

We keep this policy under regular review. This version was last updated on the date set out above.

Please contact us if you are interested in an historic version of this policy.

• By post –
  OC&C Data Protection
  OC&C Strategy Consultants
  6 New Street Square
  London, EC4A 3AT

(or the applicable office address for the relevant OC&C Company listed at the end of this policy)

• Online –
  Through the “Contact Us” form on our website. Please start your message with “Attention: OC&C Data Protection”.