1. Introduction

We are Cambridge Consultants Limited (“Company”) and are the controllers of your personal data. Our registered office is Unit 29, Science Park, Milton Road, Cambridge Cambridgeshire CB4 0DW, and our registered company number is 1036298.

In addition to our headquarters in Cambridge UK, we also have subsidiaries in the following locations:

• Cambridge Consultants Inc. of 2 Drydock Avenue, Suite 1210, Boston, MA 02210, USA
• Cambridge Consultants (Singapore) Pte Ltd of 300 Beach Road, The Concourse, #40-02, Singapore 199555
• Cambridge Consultants Japan Inc, of 6F Spline Aoyama Tokyu Building, 3-1-3 Minamiaoyama, Minato-ku, Tokyo, 107-0062, Japan

In the UK we are registered with the Information Commissioner’s Office under registration number Z9851030.

This statement sets out how we will deal with (“Personal Data”) which is defined as any information about an individual from which that person can be identified. This definition provides for a wide range of personal identifiers to constitute Personal Data, including name, identification number, location data or online identifier, reflecting changes in technology and the way organisations collect information about people.

2. Why we process your personal data

The below paragraphs set out why we process your Personal Data, as well as the data processing conditions we rely on when processing this data.

In some circumstances we may also need to share your Personal Data if we are under a duty to disclose or share Personal Data in order to comply with a legal or contractual obligation.

2.1 To enter into contracts

Where you enter into a contract with us for our services, we need to process your Personal Data to provide these services to you. Our use of your Personal Data in this way includes sharing your Personal Data with the third-party agents, consultants, suppliers and contractors we need to in order to provide the services, as well as for the purposes of assessing fraud, credit and/or security risks.

We need to process your Personal Data in this way to enter into and perform the contract for the services you have asked us to provide. If you do not wish to provide us with your Personal Data in this way, you will be unable to use our services.

2.2 To provide customer services

We may also process Personal Data in order to provide various supporting customer services to you (such as where you contact us with a question in connection with our other services which we might be able to provide to you). The data processing condition we rely on when we process your Personal Data in these circumstances is our legitimate interest to provide effective customer support services. If you do not provide us with the Personal Data we request from you for customer services purposes, we may not be able to fully answer your queries.

2.3 To employ services of others

We also process Personal Data where we contract for the provision of third-party goods and services as part of the effective delivery of services to our clients and for the management of our facility.

We will also process your Personal Data for the purposes of making our site more secure, and to administer our site and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes.

The data processing condition we use in these circumstances is our legitimate interest to provide you with the best customer experience we can, and to ensure that our site is kept secure.

2.4 To make our website better

We will also process Personal Data in order to provide a more effective user experience (such as by displaying our website in a way which is tailored for your device and browsing habits). This processing means that your experience of our site will be more tailored to you, and that the services you see on our site may differ from someone accessing the same site with different browsing habits. We also use various cookies to help us improve our site (more details are set out here) and share your Personal Data with third party analytics and search engine providers that assist us in the improvement and optimisation of our site.

2.5 For marketing purposes

We retain Personal Data of those whom we conduct business and may use that data for providing information regarding our capabilities and the services we may provide to our business associates. We rely on our legitimate interest in running our business as a basis for these processing activities.

2.6 In response to requests by public authorities

In addition, we will disclose Personal Data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

3. We will collect the following Personal Data:

3.1 Information you give us

This is information about you that you give us by filling in forms on our site, purchasing our services or by corresponding with us by phone, e-mail or otherwise. It includes information you provide when you register to use our services, register to subscribe to our newsletter, participate in social media functions on our site, enter a survey, and when you report a problem with our site. The information you give us may include names, addresses, email addresses and phone numbers.

3.2 Information we collect about you

When you visit our site, we will automatically collect the following information:

• technical information, including the Internet protocol (IP) address used to connect your computer to the internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, screen resolution, operating system and platform; and
• information about your visit, including the full Uniform Resource Locators, clickstream to, through and from our site (including date and time), page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs) and methods used to browse away from the page.
• We use Google Analytic Advertising and Reporting features to allow us to understand the demographics of our website visitors. You can choose to opt out of these advertising settings. Google provides a tool for this at https://tools.google.com/dlpage/gaoptout/

3.3 Information we receive from other sources

We may receive personal data about you from third parties such as aggregators suggesting potential clients or suppliers to Cambridge Consultants and research bodies providing candidates for human factor studies.

4. Transfers

4.1 Capgemini Binding Corporate Rules

We are a part of Capgemini. Capgemini is a global organization and, as such, several entities of the group may access and further process your personal data. However, such access will always be strictly limited to the relevant stakeholder(s).

Please note that all processing activities carried out by Capgemini, including any cross-border transfers of personal data shall be covered and framed by Capgemini’s Binding Corporate Rules (BCR). Capgemini BCR include both its EU and UK BCR.

Capgemini’s EU BCR were first approved the European Data Protection Authorities back in March 2016 and subsequently updated in January 2019 to comply with the General Data Protection Regulation (GDPR). Capgemini EU BCR where most recently updated in April 2023, to align with additional obligations regarding data transfers. As Capgemini’s Group Data Protection Policy, Capgemini’s BCR are legally binding on all Capgemini entities and their employees and provide a strong standard of protection to all personal data processed by Capgemini on its own behalf and on behalf of its clients.

4.2 Suppliers

We may share your personal data with service providers that carry out certain functions on our behalf. This may involve transferring personal data outside the UK to countries which have laws that do not provide the same level of data protection as the UK law.

Whenever we transfer your personal data out of the UK to service providers, we ensure a similar degree of protection is afforded to it by ensuring that the following safeguards are in place:

• We will only transfer your personal data to countries that have been deemed by the UK to provide an adequate level of protection for personal data; or
• We may use specific standard contractual terms approved for use in the UK which give the transferred personal data the same protection as it has in the UK, namely the International Data Transfer Addendum to the European Commission’s standard contractual clauses for international data transfers.

5. Retaining your Personal Data

We will retain your data for no longer than is necessary for the purposes(s) for which they were first collected and in alignment with Cambridge Consultants’ document retention policy and relevant legal requirements.

We use reasonable precautions to maintain the accuracy and integrity of Personal Data and to update it as appropriate. We have implemented physical and technical safeguards to protect Personal Data, including, for example, network access controls, passwords and access logging. We also protect Personal Data through the use of firewalls, role-based restrictions, and encryption technology. We also employ access restrictions to our physical offices.

6. Your rights under data protection laws

You may request access to, rectification or deletion of your personal data. You may also object to the processing of your personal data, or request that such processing be restricted. You may also withdraw your consent at any time, which will not affect the lawfulness of the processing. In addition, you may ask for the communication of your personal data in a structured, commonly used and machine-readable format.

If you wish to exercise any of these rights and/or if you have any question or request related to the processing of your personal data, please reach out to our DPO at data.controller@cambridgeconsultants.com. Please include all relevant information allowing us to best address your question/request.

7. Contact and changes

Questions, comments, requests about this privacy policy or exercising your rights to access or objection should be addressed to data.controller@cambridgeconsultants.com.

This privacy statement was last updated on 2nd September 2026.