Close
As is true of most companies, ISG needs to collect and use your personal information for various purposes.
ISG is a company registered in England and Wales under the registration number 10081578. Our registered address is Aldgate House, 33 Aldgate High Street, London EC3N 1AG. All references to ‘ISG’, ‘we’, ‘us’, ‘our’ are references to ISG Plc and its subsidiaries.
We understand that you care about your privacy, and we take that seriously.
This Privacy Notice describes ISG’s policies and practices regarding its collection and use of your personal data.
ISG has appointed an internal data protection officer for you to contact if you have any questions or concerns about ISG’s personal data policies or practices. ISG’s data protection officer’s name and contact information are as follows:
Rich Yates
Data Protection Officer
ISG
Aldgate House
33 Aldgate High Street
London EC3N 1AG
data.protection@isgplc.com
We collect your personal information through various channels including, but not limited to, the following:
Personal Data for Marketing: Mostly, the personal data we collect is limited to the kinds of information that can be found on a business card or can be retrieved from your email enquiries or face to face meetings, namely your first name, last name, job title, employer name, work address, work email, work phone number and content of communications. If you subscribe to our newsletter via a Preference Centre on our website or a Consent Page, we will collect your email, first name, last name, as well as information about your communication preferences and interests. If you choose to opt out of our mailing list, we will move your name and email address to our suppression list. We can also collect your name or nickname, a photo on social media and content of communications, when you send us a message or interact on our social media pages.
Personal Data for Events: When you register to attend an event organised by us, we may collect your first name, last name, job title, employer name, work address, work email, work phone number and content of communications. In some instances, only when appropriate, we may ask you for other personal data, although this will always be optional, for example, your dietary requirements.
Site Visitor’s Personal Data: When you register to visit any of our sites, we may collect your first name, last name, employer or school name, employer or school address, email, phone number, trade and CSCS Card Number. If you are provided with an induction, we will retain the information about it. We may also collect your photo, biometric data or CCTV footage necessary for health and safety and/or security purposes. If you are under age 13, we require your parents’ or guardians’ consent to process your personal data; this consent is to be collected by the school or educational authority prior to the visit commencing.
Tenants’ Personal Data: When a manger of your property requests us to repair it, we will obtain information with your first name, last name, phone number, address, email, time for availability, property defects, work orders, work completion information and content of communications.
For more information, please see the Appendix below.
We offer website visitors the opportunity to submit job applications to us (via our Applicant Tracking System “eArcu”, via e-mail or via postal services). Below, we will brief you on the scope, purpose and use of the personal data collected from you in conjunction with the application process. We assure you that the collection, processing and use of your data will occur in compliance with the applicable data privacy rights and all other statutory provisions and that your data will always be treated as strictly confidential.
Scope and purpose of the collection of data
If you submit a job application to us, we will process any affiliated personal data (e.g. contact and communications data, application documents, notes taken during job interviews, etc.), if they are required to make a decision concerning the establishment or an employment relationship. The legal grounds for the aforementioned are § 26 New GDPR according to German Law (Negotiation of an Employment Relationship), Art. 6 Sect. 1 lit. b GDPR (General Contract Negotiations) and – provided you have given us your consent – Art. 6 Sect. 1 lit. a GDPR. You may revoke any consent given at any time. Within our company, your personal data will only be shared with individuals who are involved in the processing of your job application. If your job application should result in your recruitment, the data you have submitted will be archived on the grounds of § 26 New GDPR and Art. 6 Sect. 1 lit. b GDPR for the purposes of implementing the employment relationship in our data processing system.
Retention period of data
Our applicant management system "eArcu" is a service of an external provider based in Great Britain. the system is controlled- and content-managed by ourselves. The operator eArcu Ltd. has been contractually obligated by us to handle your data properly. You can find further information about "eArcu" here.
Should we not be able to offer you a job, should you decline a job offer, or should you withdraw your application, the data you have submitted, including any remaining physical application documents, will be stored or retained in "eArcu" for a maximum of 15 months after completion of the application process (retention period). this will enable us to consider your application documents for other positions in the future, for which you give us your consent by submitting your data. However, if you use "eArcu" in the meantime (e.g. to update your profile), the 15 months retention period will automatically start again. You will be informed again in our confirmation email following transmission of your application documents that you do not have to agree to this. Of course, the refusal to agree has no influence on the application. If you revoke your consent to data processing or request us to delete your data, or if you have already indicated when you first submitted your data that you do not consent to a storage period of 15 months (as stated above), or if your application data has been sent to us in a way where you were not able to take note of our data protection declaration beforehand, the data you submitted will be stored for a maximum of six months from the date of the decision regarding the position for which you have applied. This will enable us to trace the details of the application process in case of discrepancies (Art. 6 Sect. 1 lit. f GDPR).
You may object to the above-mentioned data storage in general if you have legitimate interests that outweigh our interests.
Once the retention period has expired, the data will be deleted, unless we are subject to any other statutory retention obligations or if any other legal grounds exist to continue to store the data. If it should be foreseeable that the retention of your data will be necessary after the retention period has expired (e.g. due to imminent or pending litigation), the data shall not be deleted until the data have become irrelevant. This shall be without prejudice to any other statutory retention periods.
The applicant data will be processed by the HR-department of ISG Deutschland GmbH, Am Hauptbahnhof 18, 60329 Frankfurt am Main/Germany. This also applies to applications addressed to affiliated companies (currently ISG Schweiz AG, ISG Luxembourg S.á.r.l. and Tecton engineering GmbH).
As is true of most companies, ISG plc needs to collect and use your personal information for various purposes, namely the following:
The legal basis for collecting and using your personal information for the above purposes are legitimate interests, consent and legal obligation.
For more information on ISG’s legal bases and legitimate interests please refer to the Appendix below or contact us at data.protection@isgplc.com
We do not make any automated decision-making or profiling using your personal information.
The information we collect will be stored for the duration of your interest in ISG’s services, for the duration of events and visits on sites, provision of repairs, and in some instances longer, if required by regulatory authorities. Please see the Appendix for more information.
We will always exercise restraint and send you only materials that we feel are relevant to your interests.
If you consent via our Preference Centre on the website, we will send you free of charge marketing content which relates to the preferences you have set, until you tell us not to. If you consent via our Consent Page, we will send you marketing content which we select on your behalf, until you tell us not to. You can set/change your preferences or remove your consent at any time via the same Preference Centre.
We host events throughout the year. These include in-person conferences or meetings or sessions we arrange during industry events. We also publish news, insights and information on our services. If you have used our Preference Centre to confirm you want to receive information about events, news, insights or our services, we will send you information in line with your preferences, free of charge, until you tell us not to.
We may also include forms on our website which enable you to sign up for specific events if you wish to, or download content such as insights or information about our services. Any data we collect from these specific forms will only be processed and used for purposes relating to the event or topic that the form relates to. It will not be used as consent to send you any other unrelated marketing content, although we will also offer you an optional opportunity to consent for us to send you carefully selected marketing content that we think you might be interested in, free of charge, until you tell us not to. Alternatively, you can access our Preference Centre and specify which topics you would like us to send you information about, on an ongoing basis, until you tell us not to.
If you make an enquiry to ISG via our website, by email, or face-to-face (e.g. at an event), we may offer you an opportunity to consent to us storing your personal data, and also the option to use our Preference Centre to consent for us to send you information which reflects the preferences you select, on an ongoing basis, until you tell us not to.
The personal information ISG collects from you is stored in one or more databases hosted by third parties located in the European Economic Area (EEA). These third parties do not use or have access to your personal information for any purpose other than cloud storage and retrieval.
We may share your information with other organisations or divisions within the ISG group located in the EEA. We may also have to share your personal information with law enforcement authorities where we are required to do so by law.
The list of parties is shown below:
| Company | Data shared | Reason for sharing |
| CRM system provider | Name, job title, email, telephone numbers, postal address, dietary requirements, marketing preferences and interests, marketing consent status (if consented), suppression list | This cloud-based database is used to store your personal information in relation to marketing |
| Web, email, social media platforms | Name, job title, email, telephone numbers, postal address, work, name or nickname on social media, photo on social media, content of communications | These service providers help us to respond to any of your enquiries |
| Email, mail and surveys distribution providers | First name, last name, job title, company name, work email, postal address | These service providers help us to deliver email and mail communications to you, e.g. news and insights, information about events, CX surveys |
| Biometric systems providers | Biometric data: fingerprints, retina scans | This only applies to sites where biometric scanners are installed. This technology helps us to carefully identify persons accessing our sites |
| CCTV systems providers | CCTV footage | This only applies to sites where CCTV is installed for security reasons |
| Customer care database | First name, last name, phone number, address, email, time for availability, property defects, work orders and work completion information | This database is used to report information on property repairs |
| Sub-contractors | First name, last name, phone number, address, email, time for availability, property defects, work orders and work completion information | This only applies where we need to use sub-contractors to engage for property repairs |
Under the GDPR data subjects have the following rights:
If you wish to exercise your rights as a data subject, please fill in the form here or contact us at data.protection@isgplc.com
If you wish to unsubscribe from our marketing communications, you can visit our Preference Centre, which is available via the footer on any page on our website (https://www.isgplc.com).
Additionally, if you are aged under 13, we may require your parents’ or guardian’s consent for you to exercise any of your rights.
To help protect the privacy and confidentiality of your personal information, we maintain physical, technical and administrative safeguards. We update and test our security technology on an on-going basis. We restrict access to your personal data to those employees who need to know that information to provide benefits or services to you. In addition, we train our employees about the importance of confidentiality and maintaining the privacy and security of your information. We commit to taking appropriate disciplinary measures to enforce our employees' privacy responsibilities.
The following details the information we may collect (depending on a processing activity), the appropriate legal basis and justification and the retention period for such data.
| Information collected | Legal basis | Justification | Retention period |
| Name |
Legitimate interest Consent |
This data may need be retained in order to identify you. ISG has a legitimate interest to identify data subjects for various reasons including marketing, business development and provision of services to partners. |
Subscribers – for the duration of the subscription Enquirers - for the duration of the engagement Social media users – for the duration of the engagement Events attendees – for the duration of the event Site visitors – for up to one year Partners’ tenants – for up to one year |
| Company (School) Name |
Legitimate interest |
ISG has a legitimate interest to identify data subjects for various reasons including marketing and business development. |
Subscribers – for the duration of the subscription Enquirers - for the duration of the engagement Events attendees – for the duration of the event Site visitors – for up to one year |
| Email Address |
Legitimate interest Consent |
This data may need to be retained in order to identify you and communicate with you. ISG has a legitimate interest to identify and communicate with data subjects for various reasons including marketing, business development and provision of services to partners. |
Subscribers – for the duration of the subscription Enquirers - for the duration of the engagement Events attendees – for the duration of the event Site visitors – for up to one year Partners’ tenants – for up to one year |
| Phone Number |
Legitimate interest |
This data may need to be retained in order to identify you and communicate with you. ISG has a legitimate interest to identify and communicate with data subjects for various reasons including marketing, business development and provision of services to partners. |
Enquirers - for the duration of the engagement Events attendees – for the duration of the event Site visitors – for up to one year Partners’ tenants – for up to one year |
| Address |
Legitimate interest Consent |
This data may need to be retained in order to identify you and communicate with you. ISG has a legitimate interest to identify and communicate with data subjects for various reasons including marketing, business development and provision of services to partners. |
Enquirers - for the duration of the engagement Events attendees – for the duration of the event Site visitors – for up to one year Partners’ tenants – for up to one year |
| Job Title |
Legitimate interest |
This data may need to be retained in order to identify you. ISG has a legitimate interest to identify data subjects for various reasons including marketing, and business development. |
Enquirers - for the duration of the engagement Events attendees – for the duration of the event |
|
Communication Preferences Interests |
Legitimate interest Consent |
ISG has a legitimate interest to identify content relevant to you for various reasons including marketing, and business development. |
Subscribers – for the duration of the subscription Enquirers - for the duration of the engagement Events attendees – for the duration of the event |
|
Suppression list (including name and email address) |
Legitimate interest |
ISG has a legitimate interest to identify you in order cease sending to you marketing communications that you have chosen to opt out of. |
Subscribers – for up to twenty years Enquirers - for up to twenty years Events attendees – for up to twenty years |
|
Content of Communications |
Legitimate interest |
ISG has a legitimate interest to communicate with data subjects for various reasons including marketing, business development and provision of services to partners. |
Enquirers - for the duration of the engagement Events attendees – for the duration of the event Site visitors – for up to one year Partners’ tenants – for up to one year |
|
Photograph (as part of security badge) |
Legitimate interest |
ISG has a legitimate interest to identify visitors on sites for security reasons. |
Site visitors – for up to one year |
|
CSCS Card Number/NI Number |
Legal Obligation/ Legitimate Interest |
In some cases, ISG is required by law or a duty of care to ensure the individual is aware of site risks and record whether they have a CSCS Card. This data is also retained to defend against legal claims. |
Site Visitors – for the duration of project and up to 3 years to defend a legal claim |
|
Trade |
Legal Obligation/ Legitimate Interest |
In some cases, ISG is required by law or a duty of care to ensure the individual is aware of site risks and record which trade they are involved in. This data is also retained to defend against legal claims. |
Site Visitors – for the duration of project and up to 3 years to defend a legal claim |
|
Induction Date and Course |
Legal Obligation/ Legitimate Interest |
In some cases, ISG is required by law or duty of care to ensure the individual is aware of site risks and demonstrate an induction was completed by a visitor. This data is also retained to defend against legal claims. |
Site Visitors – for the duration of project and up to 3 years to defend a legal claim |
|
Biometric Data *This only applies to sites where biometric scanners are installed |
Consent |
ISG may collect biometric data, including fingerprints and retina scans for site security purposes. |
Site visitors – for up to one year |
|
CCTV Images *This only applies to sites where CCTV is installed |
Legitimate interest |
ISG has a legitimate interest in collecting CCTV footage/CCTV images for purposes of security and the prevention of crime. |
Site Visitors – up to 30 days, although may be longer if required by police or other authorities for criminal investigations |
|
Time for Availability |
Legitimate interest |
ISG has a legitimate interest to arrange appointments in order to provide property repair services to partners. |
Partners’ tenants – for up to one year |
|
Property Defects Work Orders Work Completion Information |
Legitimate interest |
ISG has a legitimate interest to use this information to be able to provide property repair services to partners. |
Partners’ tenants – for up to one year |
