Marketing and events privacy notice

We may collect, use and store the following types of personal information about you for the purpose of carrying out our marketing activities:

• Contact details: Full name, email address, phone number, postal address
• Business information: Job title, organisation/employer, membership of any professional bodies or institutes
• Online tracking information: Internet protocol address ('IP Address'), cookies, pixels, tags
• Health information: Dietary requirements or restrictions, and accessibility requirements (including mobility, sight or hearing) where needed to facilitate your attendance at one of our events

We treat your health information as particularly sensitive and so we will only process it if there is a legal justification for doing so, or if we have sought your prior consent.

• Other information: Your image (photographs or videos), any interests that you provide directly to us (for example, you may indicate that you are interested in receiving news insights from us relating to a particular industry sector), or any information we may derive indirectly from your interactions with us (for example, the information we may gather through the use of online tracking technologies about how you interact with any of our newsletters, which you sign up to recieve).

We obtain your personal information when you engage with us in person, when you visit our website, or through other channels. There are also some occasions where we do not receive your personal information directly from you.

• Website marketing activities: We collect your personal information when you visit our website to register for our online newsletters or register to attend our events. This includes any information that you provide to us by email or within the forms that you use to register for our events or sign up to our newsletters.
• Marketing emails: Any emails which you have signed up for may include some tracking technologies to help us to understand how you interact with those emails (for example, which content you click through to read more detail). This enables us to consistently improve the content of the marketing materials we provide to you.
• In person marketing activites: We may collect your contact details when you interact with someone representing our business at a meeting, event or conference (for example, if you share your business card with us). We may also capture your image if you attend one of our events, as filming or photography may take place.
• Social media: We may use social media platforms that you actively use, such as Linkedin, to send you information about our services, products and events, which we think might interest you. In sending those communications, we respect all of the preferences that you have sent on these platforms.
• Mott MacDonald digital services: We collect your personal information where you have signed up for our digital services, such as Moata, Merlin or STEPS. We may use this information to personalise your experience within these services and (with your agreement) provide you with access to information about our other services, products and events, which we think might be of interest. Please see our see our Digital solutions privacy notice for more information.
• Third parties: Third parties may occassionally provide us with your personal information, such as where we have partnered with other organisations to host an event. We will always confirm with any third parties that you have agreed to have your personal information shared with us, and we will communicate with you to let you know when any such sharing has taken place.

We will only use personal information about you when the law allows us to do so. In certain locations, there may be differences in the legal justifications that can be relied upon when we collect, use, and handle personal information due to local legal requirements or the way that Mott MacDonald operates in that location. If that is the case, we will notify you of the differences in a supplementary privacy notice.

We have outlined the purposes for which we use your personal information in the context of our marketing activities below, along with the categories of personal information used:

To deliver marketing communications to you, including information about our events:

• Contact details
• Business information
• Interests (if provided by you)

To register you for one of our events and facilitate your attendance

• Contact details
• Business information
• Health information

To use in promotional material including on our website, social media feeds or in brochures promoting our services, products and events

• Your image (photographs or videos)
• Endorsements or comments you've provided about our services, products and events

To improve the content of our marketing materials

• Contact details
• Online tracking information

When using your personal information for the purposes above, we will generally rely on your express or implied consent as our legal justification.

In certain jurisdictions, such as the UK and EEA, we may also process this information based on our legitimate interests. If this is the case, then we will balance your rights and freedoms against our own interests, or those of any third parties, to ensure that your rights are not infringed.

Personal information processed during our business activities may be shared, used, handled and otherwise made available to Mott MacDonald entities, service providers, and third parties when it is necessary and proportionate to do so. We may share, provide access to and transfer your personal information:

Within Mott MacDonald as appropriate to provide our services and to effectively maintain our business.

Our third party services providers who assist us with services that relate to our provision of marketing material, including communications about our services, products and events. These include Microsoft (communication delivery), EventBrite (event management) and Campaign Monitor (marketing communication and event analysis).

Other third parties if we are hosting a joint event with another organisation, trade association, professional membership body or similar.

An acquiring company if the structure of our business changes. For example, if we merge, combine or divest a part of our business, then we may need to transfer your personal information to the relevant third party or restructured organisation.

Regulatory authorities or law enforcement agencies if we need to comply with their request for information, such as where an investigation is being carried out.

When we need to share your personal information with these third parties, we use a combination of contractual, physical and technical measures to keep it secure. To protect personal information that is transferred internationally, we ensure that appropriate safeguards are in place and that your privacy and data protection rights are protected. Those safeguards will normally include data encryption, role-based access permissions, and legal agreements that facilitate the lawful cross-border transfer of personal information. Please refer to our Group policies for more information.

Please note that we will never sell your personal information to a third party for any purpose.

We work hard to maintain and improve security measures that prevent personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to personal information to individuals and organisations who have a legal right of access (for example, regulatory authorities or law enforcement agencies), or a legitimate business need to know (for example, communication and marketing specialists, brand specialists and service providers). Our service providers and suppliers will only process personal information in accordance with our instructions, and we ensure that all third parties are subject to a legal duty of confidentiality.

All Mott MacDonald People who may be required to access your personal information when carrying out their duties are required to complete privacy and data protection training on an annual basis.

Please also see our Information security and Privacy and data protection Group policies for more information.

We will only retain personal information for as long as reasonably necessary for the purposes set out in this notice. If we collect any health information relating to you, such as your dietary restrictions or accessibility requirements, then this will be securely deleted at the end of the event for which it was originally collected.

When your personal information is deleted or destroyed, we ensure that it is safely and permanently disposed of in accordance with any local legal requirements.

We respect your rights over your personal information, which are set our below:

• Right of access to your personal information. This enables you to request a copy of your personal information and to check that we are processing it lawfully.
• Right to correct the personal information that we hold about you. This enables you to ask us to amend or update any incomplete or inaccurate personal information.
• Right to request erasure of personal information about you. This enables you to ask us to delete or remove personal information where there is no valid reason for us to continue processing it.
• Right to object to the use of your personal information if you think we do not have a valid reason to process it and want us to stop processing it.
• Right to restrict further use of personal information about you. This enables you to ask us to limit or suspend the use of your personal information (for example, if you want us to confirm its accuracy or the reason why we are processing it).
• Right to transfer personal information about you to another party. You can ask us to send (or 'port') your personal information to another organisation.

You can exercise these rights at any time by initiating a request via privacy@mottmac.com. There may be occasions where we need to collect personal information from you, such as your name and contact details, to verify your identity before responding to your request.

We will handle your request carefully and respond to you within any applicable statutory deadline (for example, in the UK and EEA, we will respond to you within one month from the date we receive your request and in California, we will respond to you within forty-five days from the date we receive your request). If there is a lawful reason to extend this deadline, then we will let you know as soon as possible.

If you choose to exercise any of your rights set out above, then please be assured that we are committed to treating you fairly and ensuring non-discriminatory treatment.

Please also note that the extent to which you can exercise your rights may be limited by the rights and interests of others (for example, where we are unable to delete all your personal information due to our regulatory obligations). If this is the case, we will let you know without undue delay.