Privacy policy

2.3.    HOW WE USE IT

We use your personal data as set out in the table below.  Where we use your personal data for a legitimate interest, we mean our legitimate business interests in the normal running of our business which do not materially impact your rights, freedom or interests.

Type of Use	Type of Data	Legal Basis
1.    Perform the services requested by you in respect of our Event, Membership and Service Delivery;	Contact Identity Financial Sensitive	(a) To perform a contract with you; (b) For our legitimate interest in monitoring your engagement and improving our Events, Membership and Services.
2.    Manage your access to and use of our website and digital platforms;	Contact Identity Financial	(a)    To perform a contract with you; (b)    For our legitimate interest in monitoring your use of and improving our services; (c)    To comply with our legal obligations;
3.    Deliver customer care, technical support and security;	Contact Identity Financial Transaction	(a)    To perform a contract with you; (b)    To comply with our legal obligations ; (c)    For our legitimate interest in improving, customising and enhancing our services;
4.    Provide you with updates, operational announcements and other news in relation to our business;	Contact Identity	(a)    To perform a contract with you; (b)    For our legitimate interest in developing our relationship with you and proving enhanced services to you;
5.    Deliver targeted advertisements, promotional communications, notices and other information related to services provided by us, other Nineteen group companies and relevant third parties, such as exhibitors, sponsors and media partners (subject to Section 2.4 (Direct Marketing);	Contact Identity Usage Marketing  Technical	(a)    For our and certain third parties’ legitimate interests in providing additional or new services to you;
6.    Call monitoring for training and quality monitoring purposes, including the recording of sales and/ or marketing calls made to you.	Contact Identity Marketing	(a)    To perform a contract with you; (b)    For our legitimate interest in monitoring and improving our relationship with you;
7.   Invite you to take part in user testing and surveys, competitions and promotions;	Identity Marketing	(a)    For our legitimate interest in in improving, customising and enhancing our Services; (b)    For our legitimate interest in developing our relationship with you and providing enhanced services to you;
8.   Identify usage trends and develop data analysis, including for research, audit, reporting and other business purposes;	Technical Usage	(a)    For our legitimate interest in improving, customising and enhancing our Services;
9.    Disclose data to selected third parties in accordance with this Policy;	Contact Identity Financial Sensitive	(a)    To perform a contract with you; (b)    For our legitimate interest in offering or delivering ancillary or complimentary services to you; (c)    To comply with our legal obligations; (d)    In certain circumstances, where you have provided consent;
10.    Send you notices and requests in relation to our services, for example legal, financial and regulatory administration	Contact Identity Financial	(a)    To perform a contract with you; (b)    For our legitimate interest in resolving disputes and enforcing our agreements.

11. Provide you with updates about business acquisitions and integrations

To assess, complete and integrate business acquisitions, transfer customer and membership relationships, maintain business continuity and manage associated data records.

Type of Data: Contact, Identity, Professional, Membership, Transaction and Engagement Data, where relevant.

Legal basis: Legitimate interests, contractual necessity or legal obligation, as applicable.

Where acquired personal data is intended to be used for a new purpose, we will assess whether that use is compatible with the original purpose and whether additional transparency, consent or other safeguards are required.

Variations based on jurisdiction and context:

Purpose	Legal Basis (UK/EU GDPR)	Legal Basis (AU Privacy Act)	Legal Basis (US – e.g. CCPA/CPRA)	Legal Basis (SG PDPA)
To provide Services	Contractual necessity	Reasonably necessary for core function	Performance of contract or as reasonably expected	Reasonableness & purpose
Customer support, security, access control	Legitimate interest	Reasonably necessary	Legitimate business interest (subject to notice rights)	Reasonableness & purpose
Marketing communications	Legitimate interest or consent	Consent required in some cases	Consent or opt-out required (depending on state law)	Consent required in some cases
Event management (incl. sponsors/exhibitors)	Legitimate interest	Reasonably necessary or with consent	Legitimate interest or consent (depending on data type)	Reasonableness & purpose
Analytics, research, development	Legitimate interest	Permitted with anonymisation or consent	Permitted with notice; opt-out required for sale/sharing	Reasonableness
Legal and regulatory compliance	Legal obligation	Legal obligation	Legal obligation	Legal obligation

2.4. DIRECT MARKETING

We may contact you with information about events, exhibitions, conferences, memberships, publications, professional communities and related Services that we believe may be relevant to your professional or business interests.

We will only send direct marketing communications where permitted by applicable data protection and electronic communications legislation.

Depending on your location, the type of communication and our relationship with you, we may rely on:

• Your consent to receive marketing communications;

• Our legitimate interests in promoting relevant business services, where this is permitted under applicable law and your rights and interests do not override those interests; or

• An applicable existing customer or similar services exemption, where the relevant legal requirements are satisfied.

Marketing to Individuals in the European Economic Area (EEA)

Where we send marketing communications to individuals in the EEA, we will comply with the EU GDPR, the ePrivacy Directive and applicable national electronic marketing legislation.

Where prior consent is required, including for certain business-to-business communications, we will obtain appropriate consent before sending marketing.

Where local law permits marketing on another lawful basis, we will ensure that the relevant requirements are met, including providing clear information about the processing and an effective opportunity to object.

Marketing Using Third-Party or Acquired Data

Where we obtain business contact information from third-party providers, publicly available professional sources or acquired businesses, we will assess the lawful basis for processing and any applicable marketing permissions before using that information for direct marketing.

We will respect existing objections, unsubscribes and marketing preferences and, where necessary, obtain new consent before sending marketing communications.

We will not treat the acquisition of a business or transfer of a database as automatically providing permission to send marketing communications.

Marketing Across Nineteen Group

Where permitted by applicable law, we may send you information about relevant products, events, memberships, publications or Services offered by other Nineteen Group companies.

We will take account of your existing relationship with us, the relevance of the communication, applicable marketing permissions and your expressed preferences.

We will not assume that consent to receive communications from one Group brand automatically authorises unrelated marketing from every other Group brand.

Your Marketing Choices

You may opt out of receiving marketing communications at any time by:

• Selecting the unsubscribe link included in our marketing emails;

• Using the manage preferences link, where available;

• Informing us during a marketing telephone call; or

• Contacting data@nineteengroup.com.

Where we rely on consent, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before it was withdrawn.

Where you object to processing for direct marketing purposes, we will stop processing your personal data for that purpose.

We may retain limited information on a suppression list to ensure that your preferences continue to be respected and that you are not contacted again for marketing purposes against your wishes.

Opting out of marketing will not prevent us from sending essential service, contractual, transactional or legally required communications where these are necessary and lawful.

3. THIRD PARTIES

3.1. SERVICE PROVIDERS

We use third-party service providers to enable us to operate our business and deliver our Services.

These providers may process personal data on our behalf where necessary in connection with:

(a) The facilitation of Services you have requested from us;

(b) Data storage, hosting and cloud infrastructure;

(c) IT security, system monitoring and technical support;

(d) Workplace productivity, email and communications;

(e) Customer relationship management and membership administration;

(f) Direct marketing communications and email delivery;

(g) Marketing automation, analytics and reporting;

(h) Communications services and customer support;

(i) Project management and event planning;

(j) Event sponsorship administration and delegate experience;

(k) Event registration, badge scanning, networking and matchmaking;

(l) Website and application development, hosting and maintenance;

(m) Accounts receivable, accounts payable, payment processing and credit control;

(n) Professional advice, including legal, financial, accounting and audit services;

(o) Research and survey platforms, including services supporting industry research, member surveys, sectoral studies, benchmarking and statistical reporting; and

(p) Data quality, validation, enrichment and database management services.

We only share personal data with service providers to the extent reasonably necessary for them to deliver the relevant Services or fulfil their agreed responsibilities.

Where a service provider acts as a data processor on our behalf, we will put appropriate contractual arrangements in place, including data processing agreements where required by applicable law.

We require our processors to implement appropriate technical and organisational security measures, maintain confidentiality and process personal data only in accordance with documented instructions, subject to applicable legal requirements.

Where service providers engage authorised subprocessors or process personal data internationally, appropriate contractual, security and international transfer safeguards will be implemented where required.

When a service provider relationship ends, personal data will be returned, securely deleted or otherwise handled in accordance with the relevant contractual and legal requirements, including any applicable lawful retention obligations.

Information about our principal service providers or categories of providers may be obtained by contacting data@nineteengroup.com.

3.2. OTHER THIRD PARTIES

We may share personal data with third parties where necessary, proportionate and permitted by applicable law, including the following categories:

(a) Other Nineteen Group Companies

We may share personal data within Nineteen Group for legitimate business purposes, including service delivery, customer relationship management, business administration, reporting, data quality and relevant marketing activities, subject to applicable legal requirements and marketing preferences.

(b) Business Purchasers, Sellers and Acquired Organisations

We may disclose or receive personal data in connection with an actual or proposed acquisition, merger, sale, restructuring or transfer of a business or its assets.

Where ownership or responsibility for personal data changes, we will take appropriate steps to inform affected individuals, preserve applicable rights and marketing preferences, and ensure that subsequent processing complies with applicable data protection legislation.

(c) Business and Commercial Partners

We work with selected commercial partners to provide services that complement our own.

We may share personal data with such partners where necessary to deliver a Service you have requested, where another appropriate lawful basis applies, or where you have provided consent when required.

(d) Analytics and Technology Providers

We may use analytics, advertising and technology providers to understand the performance of our websites and Services and improve user experiences.

Where these activities involve cookies, tracking technologies or the sharing of personal data, we will comply with applicable consent and transparency requirements.

Further information is provided in our Cookies Policy.

(e) Event Networking and Meeting Services

Where you choose to participate in event networking, meeting programmes, matchmaking services or attendee directories, relevant professional information may be made available to other participants in accordance with the information and choices provided at registration or when using the Service.

(f) Event Sponsors

We may share relevant personal data with event sponsors where you have requested contact, actively engaged with a sponsored Service or activity, or provided appropriate consent where required.

Attendance at a sponsored event or session will not automatically be treated as consent to receive independent marketing communications from a sponsor.

Where a sponsor intends to use your personal data for its own purposes, it may act as an independent data controller and will be responsible for complying with applicable data protection legislation.

(g) Event Exhibitors

Where you voluntarily permit an exhibitor to scan your event badge, exchange contact details or request information from an exhibitor, relevant registration or professional contact information may be shared with that exhibitor.

We will explain the relevant data-sharing arrangements and purposes at registration, through event materials or at the point of interaction.

Exhibitors receiving personal data for their own purposes are responsible for complying with applicable data protection and marketing laws.

(h) Event Service Suppliers

We may share necessary personal data with suppliers providing event registration, badge production, accommodation, venue services, accessibility arrangements, event technology, networking platforms and other operational Services. See a list here.

Such sharing will be limited to what is necessary for the relevant Service and subject to appropriate contractual and security safeguards. 

(i) Regulators, Authorities and Professional Advisers

We may disclose personal data to regulators, law enforcement authorities, courts, legal advisers, auditors and other professional advisers where required by law or where necessary for the establishment, exercise or defence of legal claims.

We do not permit third parties to use personal data received from us for unrelated independent marketing purposes unless there is an appropriate lawful basis and any consent required by applicable law has been obtained.

3.3. THIRD-PARTY WEBSITES AND EMBEDDED CONTENT

Our websites may include links to third-party websites or functionality provided by third parties, including embedded videos, social media content, analytics services and external applications.

Examples may include content from video-sharing platforms and professional networking services.

These providers may collect technical information or use cookies and similar technologies when you interact with their content, subject to applicable consent requirements.

Where required by law, non-essential tracking technologies will not be activated until appropriate consent has been obtained.

Third-party websites and services may operate under their own privacy notices and data protection practices. We encourage you to review those notices before providing personal data.

Further information about cookies, embedded content, analytics technologies and your choices is available in our Cookies Policy.

4. DATA RETENTION

We retain personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected, including providing our Services, maintaining business relationships and complying with applicable legal, regulatory, contractual, accounting and reporting obligations.

Retention periods are determined by the nature of the personal data, the purpose of processing, our relationship with you, applicable legal requirements and the need to establish, exercise or defend legal claims.

Our general retention approach is as follows:

Contractual and Financial Records

We generally retain contractual, financial and transaction records for six years following the end of the relevant contractual relationship or transaction, unless a longer or shorter period is required under applicable local law.

Business Development and Professional Contact Data

We retain business contact and relationship information for as long as there is a legitimate and lawful business purpose, subject to periodic review of accuracy, relevance, engagement and necessity.

Direct Marketing Data

We retain marketing information while we have a lawful basis to process it and the information remains relevant and necessary.

We periodically review inactive or unengaged contacts and may remove, anonymise or suppress records where continued retention is no longer justified.

Where you withdraw consent or object to direct marketing, we will cease processing your personal data for that purpose and may retain limited suppression information to ensure your wishes are respected.

Membership and Event Participation Data

We retain membership, registration and event participation information for as long as necessary to administer the relevant Services, maintain appropriate business records and fulfil applicable legal obligations.

Research and Survey Data

We retain identifiable research and survey responses only for as long as necessary for the relevant research purpose, taking account of the information provided to participants and applicable legal requirements.

Where appropriate, research findings will be anonymised or aggregated to minimise the need to retain identifiable responses.

Recruitment Data

Information relating to unsuccessful applicants is generally retained for up to one year following the recruitment process, unless a different period is required by local law or you have agreed to a longer retention period.

Legal and Regulatory Requirements

We may retain information for longer where necessary to comply with legal obligations, resolve disputes or establish, exercise or defend legal claims.

Where personal data is no longer required, we will securely delete or anonymise it, unless continued retention is required or otherwise permitted by applicable law.

Where information has been irreversibly anonymised so that individuals are no longer identifiable, it may be retained for statistical, analytical or historical reporting purposes.

You may request the deletion of your personal data in accordance with your applicable rights, as described in Section 7.

5. INTERNATIONAL TRANSFERS OF PERSONAL DATA

Nineteen Group operates internationally and may transfer, store or permit access to personal data in countries outside the United Kingdom or European Economic Area (EEA).

Such transfers may occur between Nineteen Group companies or through authorised service providers, technology platforms and commercial partners located in other jurisdictions.

Where personal data is transferred outside the UK or EEA, we will comply with applicable international data transfer requirements under the UK GDPR, EU GDPR and other relevant data protection legislation.

Where required, we will rely on appropriate transfer mechanisms, which may include:

• An adequacy decision issued by the European Commission or applicable UK authorities;

• Standard Contractual Clauses approved by the European Commission;

• The UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses;

• Other lawful transfer mechanisms recognised under applicable data protection legislation.

Where necessary, we will assess the risks associated with international transfers and implement supplementary technical, contractual or organisational safeguards.

These measures may include encryption, access controls, data minimisation, contractual confidentiality requirements and appropriate supplier due diligence.

We will also take appropriate steps to ensure that international transfers between Group Companies are governed by suitable contractual arrangements and safeguards.

Where personal data is processed in or transferred from Singapore, Australia, the United States or other jurisdictions, we will comply with applicable local requirements relating to overseas disclosure and cross-border data transfers.

You may request further information about the safeguards applicable to transfers of your personal data, including how to obtain a copy of relevant contractual protections, by contacting data@nineteengroup.com.

6. DATA SECURITY

We employ appropriate technical and organisational security measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures include:

(a) Limiting access to personal data to authorised individuals who have a legitimate business need to access it and are subject to appropriate confidentiality obligations;

(b) Maintaining appropriate security controls to protect the confidentiality, integrity and availability of our technology systems;

(c) Implementing appropriate data backup, disaster recovery and business continuity arrangements;

(d) Monitoring and reviewing the effectiveness of our security measures;

(e) Applying appropriate access management, authentication and security procedures;

(f) Requiring relevant employees and service providers to comply with applicable data protection and information security obligations; and

(g) Reviewing and improving our security practices in response to changing risks, technologies and regulatory requirements.

We have procedures in place to identify, investigate, manage and respond to suspected personal data breaches.

Where a personal data breach occurs, we will notify the relevant supervisory authority and affected individuals where required by applicable law.

Although we take reasonable steps to protect personal data, no method of electronic storage or transmission can be guaranteed to be completely secure.

7. YOUR RIGHTS

Depending on your location and the applicable data protection legislation, you may have certain rights concerning the personal data we hold about you.

For individuals whose personal data is processed under the UK GDPR or EU GDPR, these rights may include:

Right of Access

You have the right to request confirmation of whether we process your personal data and to obtain access to that information, together with relevant information about how it is used.

Right to Rectification

You have the right to request correction of inaccurate personal data or completion of incomplete information.

Right to Erasure

You may request deletion of your personal data in certain circumstances, including where it is no longer necessary for the purposes for which it was collected, where consent has been withdrawn and no other lawful basis applies, or where processing is unlawful.

This right is subject to applicable legal exceptions and retention obligations.

Right to Restrict Processing

You may request that we restrict the processing of your personal data in certain circumstances, including while we verify its accuracy or consider an objection.

Right to Data Portability

Where applicable, you may request to receive personal data you have provided to us in a structured, commonly used and machine-readable format, or request its transfer to another controller where technically feasible.

Right to Object

You have the right to object to processing based on legitimate interests in certain circumstances.

Where you object to the processing of your personal data for direct marketing purposes, we will stop processing your personal data for those purposes.

Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time.

Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.

Rights Relating to Automated Decision-Making

Where applicable, you have rights concerning decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.

We do not currently use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects.

Right to Lodge a Complaint

You have the right to lodge a complaint with the relevant data protection supervisory authority if you believe your personal data has been processed unlawfully.

Individuals in the UK may contact the Information Commissioner’s Office (ICO).

Individuals in the European Economic Area may contact the supervisory authority in the country where they live, work or where an alleged infringement has occurred.

Exercising Your Rights

You may exercise your applicable data protection rights by contacting our Data Protection Officer at:

data@nineteengroup.com

Nineteen Group Limited
Unit Dept First, Wimbledon Quarter
4 Queen’s Road
Wimbledon
SW19 8ND
United Kingdom

Individuals in the European Union may also contact our designated EU representative, as detailed in Section 10.

We will respond to requests within the timeframes required by applicable law, generally within one month under the UK GDPR or EU GDPR, subject to any permitted extensions.

We may request additional information to verify your identity where reasonably necessary.

We will not ordinarily charge a fee for exercising your rights. However, where permitted by law, we may charge a reasonable fee or refuse to act on requests that are manifestly unfounded or excessive.

Certain rights are subject to legal conditions, limitations and exemptions.

For information about cookies and similar technologies, please refer to our Cookies Policy.

8. SENSITIVE INFORMATION AND SPECIAL CATEGORY PERSONAL DATA

We do not routinely collect or process sensitive or special category personal data.

However, where necessary to provide our Services or support participation in events, we may collect information relating to accessibility requirements, disabilities, health conditions or dietary requirements that you choose to provide.

Where this information constitutes special category personal data under the UK GDPR or EU GDPR, we will process it only where an appropriate lawful basis and additional legal condition apply, including explicit consent where required.

We will use such information only for the specific purpose for which it was collected, limit access to authorised personnel and service providers, and retain it only for as long as necessary.

Special category personal data may include information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data used for identification, health information, or information concerning an individual’s sex life or sexual orientation.

We ask that you do not provide sensitive information unless it is necessary for a specific Service or we have expressly requested it for a lawful purpose.

Where sensitive information is provided unnecessarily, we will take appropriate steps to securely delete it or otherwise handle it in accordance with applicable law.

9. MINORS

Our Services are primarily intended for business professionals and adults.

We do not knowingly collect personal data from children for marketing purposes.

Where an event, educational programme or other Service is open to individuals under the age of 18, we will take appropriate steps to ensure that personal data is collected and processed lawfully, including obtaining parental or guardian consent where required by applicable law.

We will apply appropriate safeguards to the personal data of children and young people, taking account of their age, the nature of the activity and relevant national legal requirements.

If we become aware that personal data relating to a child has been collected or processed unlawfully, we will take appropriate action, including deletion where required.

10. CONTACT US

If you have any questions, concerns or complaints about this Privacy Notice or how we process your personal data, please contact:

Data Protection Officer
Nineteen Group Limited
Unit Dept First, Wimbledon Quarter
4 Queen’s Road
Wimbledon
SW19 8ND
United Kingdom

Email: data@nineteengroup.com

We will investigate privacy-related concerns and respond in accordance with applicable data protection legislation.

EUROPEAN UNION REPRESENTATIVE

For individuals located in the European Union, our designated representative under Article 27 of the EU GDPR is:

Thibault de Barsy
EU Data Protection Representative
9 Rue du Laboratoire
Luxembourg

The EU representative may be contacted regarding Nineteen Group’s processing of personal data under the EU GDPR, including enquiries from individuals and relevant supervisory authorities.

You may alternatively contact Nineteen Group’s Data Protection Officer directly at data@nineteengroup.com.

DATA PROTECTION SUPERVISORY AUTHORITIES

If you are dissatisfied with our response, you may have the right to lodge a complaint with the relevant supervisory authority.

United Kingdom: Information Commissioner’s Office (ICO) – www.ico.org.uk

European Economic Area: The competent supervisory authority in the EU or EEA Member State where you live, work or where an alleged infringement has occurred.

Singapore: Personal Data Protection Commission (PDPC).

Australia: Office of the Australian Information Commissioner (OAIC).

UNITED STATES RESIDENTS

If you are a resident of the United States and have questions about how we handle your personal information, or wish to exercise privacy rights under applicable US state legislation, including the California Consumer Privacy Act (CCPA), as amended, you may contact:

President of Nineteen Group Americas – Mary Larkin

Email: mlarkin@nineteengroup.com

You may also contact our Data Protection Officer at data@nineteengroup.com.

Residents of certain US states may have additional rights under applicable state privacy laws. Where these apply, we will provide the relevant information and mechanisms necessary to exercise those rights.

11. UPDATES TO THIS POLICY

We may update this Privacy Notice from time to time to reflect changes in our business operations, Group structure, Services, legal requirements or data protection practices.

Where changes materially affect how we process personal data, we will take appropriate steps to notify affected individuals where required by applicable law.

The latest version of this Privacy Notice will be available on our website.

This Policy was last updated on 28 October 2026.