2CV Privacy Policy

Contact Details

2CV Limited is the data controller responsible for your personal data. If you have any queries concerning this policy, or would like to make a subject access request, please contact our Data Protection Officer:

Email: DataProtection@2cv.com
Phone: +44 20 7655 9900

Address: 12 Flitcroft Street, London, WC2H 8DL, UK

EU Representative

Where applicable under EU GDPR, we have appointed IT Governance Europe Limited to act as our EU Representative.

If you are located in the European Economic Area (“EEA”) and wish to exercise your rights under EU GDPR, or have questions regarding the processing of your personal data, you may contact our EU Representative at:

• IT Governance Europe Limited
• Email: eurep@itgovernance.eu

Please include “2CV” in any correspondence.

How we use your personal data and our lawful bases

Clients and business contacts

Personal Data	Purpose of Processing	Article 6 UK GDPR Lawful Basis	Legitimate Interest	Article 9 UK GDPR Condition
Name, company name, job title, email address, telephone number and correspondence records	Responding to enquiries and managing business relationships	Article 6(1)(b) – Steps prior to entering into a contract; Article 6(1)(f) – Legitimate interests	Operating and developing our business and responding to enquiries	N/A
Business contact details	Sending information regarding relevant services, events or research opportunities	Article 6(1)(f) – Legitimate interests; Article 6(1)(a) – Consent where required	Promoting relevant services and maintaining professional relationships	N/A

Research participants

Personal Data	Purpose of Processing	Article 6 UK GDPR Lawful Basis	Legitimate Interest	Article 9 UK GDPR Condition
Research participant information and survey responses	Conducting market research and consultancy projects	Article 6(1)(f) – Legitimate interests; Article 6(1)(a) – Consent where required	Conducting market research, consultancy and audience insight activities	Article 9(2)(a) – Explicit consent where special category data is processed
Audio recordings, video recordings, photographs and interview materials	Conducting market research and analysis	Article 6(1)(a) – Consent	N/A	Article 9(2)(a) – Explicit consent where special category data is captured
Payment and financial information	Processing participant incentives or payments	Article 6(1)(b) – Contractual necessity	N/A	N/A

Job applicants and candidates

Personal Data	Purpose of Processing	Article 6 UK GDPR Lawful Basis	Legitimate Interest	Article 9 UK GDPR Condition
CVs, employment history, qualifications and recruitment information	Assessing suitability for employment opportunities and managing recruitment processes	Article 6(1)(b) – Steps prior to entering into a contract; Article 6(1)(f) – Legitimate interests	Recruitment administration and assessing candidate suitability	N/A
CVs, applications and recruitment information	Supporting AI-assisted recruitment administration and CV review processes	Article 6(1)(f) – Legitimate interests	Improving recruitment administration, efficiency and consistency	N/A
Interview notes and correspondence	Recruitment administration and communication	Article 6(1)(f) – Legitimate interests	Recruitment administration and assessing candidate suitability	N/A
References	Recruitment assessment and verification	Article 6(1)(f) – Legitimate interests	Recruitment administration and assessing candidate suitability	N/A
Criminal records checks (where applicable)	Assessing suitability for regulated or sensitive roles	Article 6(1)(c) – Legal obligation; Article 6(1)(f) – Legitimate interests	Recruitment administration and assessing candidate suitability	Where criminal offence data is processed, this will only be carried out where permitted by law and subject to appropriate safeguards.

Website visitors

Personal Data	Purpose of Processing	Article 6 UK GDPR Lawful Basis	Legitimate Interest	Article 9 UK GDPR Condition
Technical information, IP addresses, browser information and website usage data	Maintaining website security, functionality and analytics	Article 6(1)(f) – Legitimate interests; Article 6(1)(a) – Consent for non-essential cookies where required	Maintaining website security, preventing misuse and improving website functionality	N/A

Individuals identified through public sources

Personal Data	Purpose of Processing	Article 6 UK GDPR Lawful Basis	Legitimate Interest	Article 9 UK GDPR Condition
Publicly available online content, social media content and engagement metrics	Conducting cultural analysis, audience insight and research activities	Article 6(1)(f) – Legitimate interests	Conducting research and cultural analysis based on publicly available information	Article 9 condition only where applicable and lawful

 

Where we process special category personal data, we will provide additional transparency information where required and ensure an appropriate Article 9 UK GDPR condition applies.

As part of our recruitment processes, we may use artificial intelligence (“AI”) assisted tools to support recruitment administration activities, including reviewing and organising CVs and applications.

AI-assisted technologies are used solely to support recruitment and operational processes and are not used to make solely automated decisions about individuals. All significant decisions involve meaningful human review and oversight.

Automated decision making

We do not use your personal data for solely automated decision-making or profiling that produces legal or similarly significant effects.

Sharing your personal data

We do not sell your personal data and we do not permit third parties to use your personal data for their own direct marketing purposes. Where necessary for the purposes described in this Privacy Policy, we may share personal data with the following categories of recipients:

• companies within the DTAG group of companies for internal administrative, operational, compliance, IT, reporting and business support purposes;
• clients commissioning research, consultancy or audience insight services, where appropriate and typically in anonymised, aggregated or pseudonymised form unless you have otherwise consented;
• research partners, recruitment partners and event partners;
• IT service providers, cloud hosting providers and software providers;
• survey and research platform providers;
• providers of AI-assisted technologies used to support administrative, operational or recruitment-related activities;
• payment service providers and finance administration providers;
• professional advisers, including legal, audit, insurance and compliance advisers;
• transcription, translation and research support providers;
• background screening providers, where appropriate;
• regulators, law enforcement agencies, courts or public authorities where disclosure is required by law or necessary to establish, exercise or defend legal claims.

Where third-party organisations process personal data on our behalf, they do so under written contractual arrangements and are required to:

• process personal data only in accordance with our documented instructions;
• implement appropriate technical and organisational security measures;
• maintain confidentiality and protect personal data;
• comply with applicable data protection laws, including UK GDPR and EU GDPR where applicable.

Third-party providers are only permitted access to the personal data necessary for the relevant services they provide to us and may not use personal data for their own purposes.

International transfers

As part of our business operations, some of our service providers, systems, suppliers and group companies may be located outside the United Kingdom (“UK”) or European Economic Area (“EEA”). As a result, your personal data may be transferred to, stored in, or accessed from countries outside the UK or EEA. This may occur, for example, where we use:

• cloud-based systems and software providers;
• survey and research platforms;
• recruitment platforms;
• AI-assisted technologies;
• IT support and operational service providers;
• research, consultancy or analytics support providers;
• or companies within the DTAGROUP group of companies.

Where we transfer personal data internationally, we ensure that appropriate safeguards are implemented in accordance with applicable UK data protection laws. These safeguards may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement (“IDTA”);
• the UK Addendum to the EU Standard Contractual Clauses (“SCCs”);
• the European Commission Standard Contractual Clauses;
• or other lawful transfer mechanisms permitted under applicable data protection laws.

We take appropriate technical, organisational and contractual measures to ensure that personal data transferred internationally remains protected to standards substantially equivalent to those required under UK data protection laws.

You may request further information regarding the safeguards used for international transfers by contacting us using the details set out in this Privacy Policy.

How long we will keep your personal data

We retain personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, regulatory, contractual, accounting or reporting requirements.

Retention periods may vary depending on the type of personal data and the purpose for which it is processed. As a general guide:

• client and business contact information is retained for the duration of the business relationship and for a reasonable period afterwards;
• recruitment and candidate information is generally retained for up to 12 months following completion of the recruitment process unless a longer retention period is required by law or consent has been provided for future opportunities;
• research participant information is generally retained for the duration of the relevant research project and for a limited period afterwards where necessary for validation, audit, quality assurance or legal purposes;
• payment and financial records may be retained for up to 7 years in accordance with legal and tax obligations;
• website and technical information is retained in accordance with our technical and security retention schedules.

Where we process publicly available personal data for research, consultancy or cultural analysis purposes, we retain identifiable personal data only for as long as necessary for the relevant project or analytical activity.

Where appropriate, personal data may be anonymised, aggregated or pseudonymised for research, statistical or reporting purposes. Once data is anonymised so that individuals can no longer be identified, it may be retained for longer periods for research and analytical purposes.

Where retention periods cannot be specified precisely, we determine retention by considering:

• the nature and sensitivity of the personal data;
• the purpose for which it was collected;
• legal and regulatory obligations;
• contractual requirements;
• limitation periods;
• operational and research requirements;
• and the potential risk of harm from unauthorised use or disclosure.

You may request further information regarding our retention practices by contacting us using the details set out in this Privacy Policy.

Your rights

Under UK GDPR, you have the following rights in relation to your personal data. These rights may not apply in all circumstances and may be subject to exemptions under applicable data protection law.

• Right of access: You have the right to request confirmation of whether we process your personal data and to receive a copy of the personal data we hold about you, together with other supplementary information.
• Right to rectification: You have the right to request correction of inaccurate personal data or completion of incomplete personal data.
• Right to erasure: You have the right to request deletion of your personal data in certain circumstances, for example where the data is no longer needed for the purpose for which it was collected.
• Right to restrict processing: You have the right to request that we restrict how we use your personal data in certain circumstances.
• Right to data portability: Where applicable, you have the right to receive personal data you have provided to us in a structured, commonly used and machine-readable format, and to request that we transfer it to another organisation. This right only applies where processing is based on consent or contract and is carried out by automated means.
• Right to object: You have the right to object to processing based on legitimate interests, including profiling based on legitimate interests. You also have an absolute right to object to direct marketing at any time.
• Right to withdraw consent: Where we rely on consent or explicit consent to process your personal data, you have the right to withdraw that consent at any time.
• Withdrawing consent will not affect the lawfulness of processing carried out before consent was withdrawn.
• Rights Relating to automated decision making: You have rights in relation to solely automated decision-making that has a legal or similarly significant effect on you. We do not use your personal data for solely automated decision-making that produces legal or similarly significant effects.

Data protection complaints

If you are unhappy with how we have handled your personal data, or how we have responded to a data protection rights request, you can make a data protection complaint to us. You can submit a complaint by contacting:

2CV DPO Team

Email: DataProtection@2cv.com
Phone: +44 20 7655 9900

Address: 12 Flitcroft Street, London, WC2H 8DL

When submitting a complaint, please provide:

• your name and contact details;
• a description of your concern;
• details of what you would like us to look into;
• copies of any relevant correspondence or supporting information.

We will acknowledge receipt of your complaint within 30 days. We will take appropriate steps to investigate your complaint without undue delay. This may include reviewing relevant records, speaking with relevant teams or processors, and requesting further information from you where needed.

We will keep you updated on the progress of your complaint and provide an outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office (“ICO”), the UK supervisory authority for data protection matters.

Information Commissioner’s Office

Website: https://ico.org.uk/make-a-complaint/

Telephone: 0303 123 1113

We would encourage you to contact us first so that we have the opportunity to investigate and respond to your concerns.

Cookies

Our website uses cookies and similar technologies to improve user experience, analyse website traffic and support website functionality. Where required by law, we will request your consent before placing non-essential cookies on your device.

For more information, please see our Cookie Policy.

Changes to this privacy policy

We may update this Privacy Policy from time to time to reflect changes in legal, technical or business developments. Any updates will be published on this page and the “Last Updated” date will be amended accordingly.

We encourage you to review this Privacy Policy periodically.