Privacy Notice For External Parties

1. WHAT THIS PRIVACY NOTICE COVERS

This Privacy Notice provides information about personal data which is processed by a company or companies within the Prax Group of companies (“Prax Group” or “we”) in relation to:

  • customers and their representatives, employees or agents;
  • suppliers and their representatives, employees or agents;
  • contractors’ representatives, employees or agents;
  • investors and business partners;
  • officers and beneficial owners of the above;
  • visitors to our premises and websites;
  • advisors, consultants and other professional experts;
  • those with whom we work in the context of our Community Initiatives (if applicable);
  • and all other third parties.

We process personal data from and in relation to individuals who are, or who work for or on behalf of, or who are shareholders in, our Business Counterparties, Suppliers, or Business Partners.

If you are under 13 years old, except in those cases where the Prax Group organises educational or charity events specifically designed for children, we will not intentionally collect personal data of individuals under 13 years old. If you are under 13 years old, please do not send us your personal data; for example, your name, address, and e-mail address. If you wish to contact the Prax Group in a way which requires you to submit your personal data (such as for education or innovation events), please ensure your parent or guardian does so on your behalf.

We collect personal data about third parties directly from data subjects or through their appointed representatives, agent, employer, affiliated company, or publicly available information.

2. PERSONAL DATA WE PROCESS ABOUT YOU

This Privacy Notice explains what personal data we process about you, why we are processing your personal data and for which purposes, how long we hold your personal data for, how to access and update your personal data, as well as your rights and the options you have regarding your personal data and where to go for further information.  This is in accordance with the Data Protection Act 2018, the UK adoption of General Data Protection Regulation (GDPR) and other applicable data protection regulation.

It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.

3. DATA PROTECTION PRINCIPLES

We will comply with data protection law and principles, which means that your data will be:

  • Used lawfully, fairly and in a transparent way
  • Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes
  • Relevant to the purposes we have told you about and limited only to those purposes
  • Accurate and kept up-to-date
  • Kept only as long as necessary for the purposes we have told you about
  • Kept securely

Personal data we may process includes private contact information, such as your name, postal or e-mail address, and phone number and business contact number, and other information such as your job title, department, the name of your organisation, and your dealings with the Prax Group on behalf of yourself or the relevant business counterparty, supplier, or business partner.

This may include other information, such as CCTV (video/audio) footage, vehicle registration, video, time-lapse photography, live streaming or capturing of images, electronic identifiers, details of access, communication preference, and other information relevant to customer offers and/or surveys.

4. SENSITIVE PERSONAL DATA

We also may process some special categories of personal data which may include data relating to an individual’s health, race, biometric data and other personal data that needs more protection. We only process such personal data where it is necessary for the purposes of complying with employment and social security laws, for establishment, exercise, or defence claims or where necessary for the purposes of providing occupational medical advice and support, to protect the vital interests of an individual, where necessary for reasons for public health or where the individual provided their explicit consent.

5. WHY WE PROCESS YOUR PERSONAL DATA

We process your personal data a) in order to satisfy our obligations to comply with laws and regulations; b) for legitimate business interest, and c) where we have your explicit consent.

We process your personal data covered by this Privacy Notice for the following purposes:

  • Business execution – including providing, researching, developing and improving products or services; concluding and executing agreements with business customers, suppliers and business partners; recording and settling services, products and materials to and from a Prax company; managing relationships and marketing, such as maintaining and promoting contact with existing and prospective customers, account management, customer service, and development, execution and analysis of market surveys and marketing strategies;
  • Organisation and management of the business – including financial management, asset management, mergers, demergers, acquisitions and divestitures, implementation of controls, management reporting, analysis, internal audits and investigations;
  • Health, safety and security – including protection of an individual’s life or health, occupational health and safety, protection of Prax companies and staff, authentication of individual status and access rights;
  • Legal and/or regulatory compliance – including compliance with legal or regulatory requirements;
  • Secondary purpose – storing, deleting, or anonymising your personal data, fraud preventions, audits, investigations, dispute resolution, insurance purposes, litigation and defence of claims; or research.

6. HOW WE WILL USE INFORMATION ABOUT YOU

We will use the personal data that we collect about you for a number of purposes, including:

  • in order to take steps at the request of an individual prior to entering into a contract or responding to any query that you have submitted to us;
  • to access our premises or administer or customise our websites;
  • where it is necessary to comply with a legal or regulatory obligation;
  • where it is necessary for the purposes of the legitimate interests pursued by the relevant Prax Group company/companies, except where such interests are overridden by the interests or fundamental rights and freedoms of the individual/s; or
  • (only if legally required) with the explicit consent of the individual.

In those cases where processing is based on consent, and subject to applicable local law which provides otherwise, you have the right to withdraw your consent at any time. This will not affect the validity of the processing prior to the withdrawal of consent.

7. MONITORING

We may monitor all activities conducted on Prax Group IT equipment and/or when connected to the Prax Group IT network for legitimate purposes.

The Prax Group may record the date, time, and access points made by individuals within Prax Group premises and assets. The data from the access and security systems are used for: a) health, safety and security purposes, to prevent fraud and theft occurring to Prax Group assets, employees and visitors; b) to comply with legal and regulatory requirements, c)  to monitor the number of individuals entering and working on Prax Group premises for human resources and real estate planning, d) data and time of entry and exit of Prax Group premises for financial management and control.

8. SCREENING

To comply with legal and regulatory obligations; to protect Prax Group assets, employees and contractors; and to ensure that the Prax Group complies with trade control, anti-money laundering, bribery and corruption laws and other regulatory requirements, we may conduct screening on our employees, contractors, and business partners and suppliers. The screening takes place against publicly available information, or government-issued sanctions lists and compared with information we hold about you.

9.      DATA SHARING

We process your data for the purposes referred above and will only be shared on a strict need-to-know basis with:

  • Other companies within the Prax Group of companies;
  • Authorised third party agents, service providers, auditors, financial institutions, insurers, accountants, lawyers, and/or subcontractors of the Prax Group; or
  • A competent public authority, government, regulatory or fiscal agency where it is necessary to comply with a legal or regulatory obligation to which the relevant the Prax Group company/companies is subject to or as permitted by applicable local law.

We will only disclose your personal data to other organisations where it is necessary (i) to enable the  organisation to provide services for or on behalf of us, (ii) to comply with  applicable legal  requirements,  (iii) to protect or defend our rights or property, or (iv) to protect the health, safety and well-being of our employees, contractors, visitors or members of the public.

10. TRANSFER TO OTHER COUNTRIES

Where your personal data has been transferred to companies within the Prax Group and/or authorised third parties located outside of your country, we take organisational, contractual and legal measures to ensure that your personal data is processed for the purposes mentioned above and that adequate levels of protection are in place to safeguard personal data. These measures may include data sharing/data transfer agreements for transfers within the Prax Group, and EU-approved transferred mechanisms for transfers to third parties.

11. SECURITY OF PERSONAL DATA

The Prax Group is committed to safeguarding your personal data.  We have implemented physical security, cybersecurity technology and policies with the objective of protecting your privacy from unauthorised access, improper use, alteration or disclosure.  We update and review these measures on an ongoing basis.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality.

12. HOW LONG WE KEEP PERSONAL DATA FOR

All information, including personal data, is securely deleted once no longer required for the legitimate business purpose or for the legal or the regulatory purpose for which it was collected.  In all cases, information may be held for a longer period where there is legal or regulatory reason to do so.  In some circumstances, we may anonymise your personal information so that it can no longer be associated with you; in which case, we may use such information without further notice to you.

13. SOCIAL MEDIA

If you choose to interact with Prax through social media on a Prax-administered social media page such as X (formerly Twitter), Facebook, LinkedIn or YouTube, your personal data (such as your name, your profile picture and the fact that you are interested in the Prax Group) will be visible to all visitors, depending on your privacy settings on the relevant social media platform, and will also be visible to Prax. You can delete any information that you share on these sites at any time through your relevant social media platform’s account. Prax does not track your activity across the different social media sites that you use. If you send a message to Prax via any messenger service on a social media platform, please note these messages will be held on file and shared internally by Prax via e-mail to ensure swift resolution. These messages will be retained as long as is necessary and in line with the Prax Data Retention Policy.

Additionally, and to the extent the Prax Group is jointly responsible with a social media platform of a Prax social media page, Prax will have access through the social media platform to aggregated data providing statistics and insights that help to understand the types of actions you take on Prax social media pages. For more information on how your personal data is processed on those social media platforms, including any targeted advertising that you may receive, please refer to your privacy settings accessible through your relevant social media platform’s account.

14. YOUR RIGHTS IN RELATION TO PERSONAL DATA

Under certain circumstances, you have the following rights under data protection laws in relation to your personal data:

  • access to your personal data;
  • correction or deletion of the personal data (but only where it is no longer required for a legitimate business purpose);
  • that you no longer receive marketing communications on behalf of the relevant Business Customer, Supplier or Business Partner;
  • object to the processing of your personal data;
  • that the processing of your personal data is restricted;
  • that you receive personal data that you have provided to the Prax Group, in a structured, digital form to be transmitted to another party, if this is technically feasible;
  • withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. To withdraw your consent, please contact us using the contact details below. Once we have received notification that you have withdrawn yourconsent, we will no longer process your information for the purpose or purposes you originally agreed to, unlesswe have another legitimate basis for doing so in law.

15. ENQUIRIES, CONCERNS OR COMPLAINTS             

If you have any queries or complaints regarding your personal data, please contact: privacy@prax.com.

You can also contact the Data Privacy Officer (DPO) at: The Prax Group, York House, 45 Seymour Street, London W1H 7JT, United Kingdom. 

If you are not satisfied with our handling of personal data, you have the right to submit a complaint to your local data protection authority or the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk).

16. CHANGES TO THIS PRIVACY NOTICE

This Privacy Notice is subject to change over time. You are advised to regularly review this Privacy Notice for possible changes. This Privacy Notice was last updated in October 2024.