Scorpio Partnership Privacy Notice
Scorpio Partnership is a business unit within McLagan (Aon) Limited, a leading global professional services firm providing a range of pay, productivity and performance solutions. Scorpio Partnership is committed to protecting your privacy. This commitment reflects the value we place on earning and keeping the trust of our customers, business partners, and others who share their personal information with us.
What does this Privacy Notice do?
This Privacy Notice (“Notice”) explains Scorpio Partnership’s information processing practices. It applies to any personal information you provide to us and any personal information we collect from other sources. This Notice is a statement of our practices and of your rights regarding your personal information. This is not a contractual document, and it does not create any rights or obligations on either party, beyond those which already exist under data protection laws.
Who is responsible for your information?
Throughout this Notice, “Scorpio” refers to Scorpio Partnership, including its affiliated companies and subsidiaries (also referred to as “we”, “us”, or “our”). Scorpio Partnership is responsible for your personal information (and act as the controller for the purposes of data protection laws) when we collect personal information from or about you.
When and how do we collect your information?
We collect personal information in the following ways:
- When you provide us with personal information to enable us to provide services
- When you enquire about the products or services we offer
- When you procure a service from us and/ or become a client.
- When you register with or use any of our websites or applications.
- When you respond to one of our surveys and provide your personal information.
- When you participate in our qualitative interviews or focus groups.
- When you register to attend our events or conference.
- When you contact us with a complaint or query.
- When you correspond, or engage with us over social media.
- When we source personal information from other Aon Group companies and third parties in order to provide services.
What information do we collect?
Information you provide to us
When we provide the services to our clients, we may collect personal information such as:
- basic personal details, such as your name, address contact details, date of birth, age, gender and marital status;
- demographic details, such as your racial and ethnic origin, sexual orientation, financial income and financial standing;
- employment details, such as your employment status, employer name, job title and position, industry and length of service;
- online information, such as location data and your IP (Internet Protocol) address; and
- your marketing preferences.
More information about the personal information collected for each of our services, together with the purpose and legal basis for collecting the information is provided below.
If you provide us with sensitive personal information, you understand and give your explicit consent that we may collect, use and disclose this information to appropriate third parties for the purposes described in this Notice. If you provide personal information about other individuals such as employees or dependents, you must obtain their consent prior to your disclosure to us.
Information we collect over Scorpio Partnership and Aon websites, mobile applications and social media
For purposes of this Notice, “website” includes our mobile applications.
We may ask you for some or all of the following types of information when you register for events, request services, manage accounts, access various content and features or directly visit our websites. This includes, but is not limited to:
- Contact information, such as name, e-mail address, postal address, phone number and mobile number;
- User name, password, password reminder questions and password answers;
- Communication preferences, such as which newsletters you would like to receive;
- Search queries;
- Contact information about others when you refer a friend to a particular site or service (note: this information is used solely to facilitate requested communications); and
- Information posted in community discussions and other interactive online features.
You can engage with us through social media websites or through features such as plug-ins or applications on our websites that integrate with social media sites. You may also choose to link your account with us to third party social media sites. When you link your account or engage with us on or through third party social media sites, plug-ins, or applications, you may allow us to have ongoing access to certain information from your social media account (e.g., name, e-mail address, photo, gender, birthday, the posts or the ‘likes’ you make).
If you access our websites on your mobile telephone or mobile device, we may also collect your unique device identifier and mobile device IP address, as well as information about your device’s operating system, mobile carrier and your location information. We may also ask you to consent to providing your mobile phone number (for example, so that we can send you push notifications).
How do we use your personal information?
The following is a summary of the purposes for which we use personal information. More information about the personal information collected for each of our services, together with the purpose and legal basis for collecting the information will be provided to you below.
Performing services for our clients
We process personal information which our clients provide to us and which we collect directly from you through mechanism of digital survey or interview in order to perform our consultancy services. This may impact you, for example, where you are the employee of our client, or a customer of our client. The precise purposes for which your personal information is processed will be determined by the scope and specification of our client engagement, and by applicable laws, regulatory guidance and professional standards. It is the obligation of our client to ensure that you understand that your personal information will be disclosed to Scorpio Partnership (or to service providers we work with).
Administering our client engagements
We process personal information of our clients, the clients of our clients, the employees of our clients and industry professionals in order to:
- Secure customer or employee feedback on behalf of our clients
- Improve the solutions and services which our clients offer to their customers
- Help our clients to identify key success factors for their employees to improve client relationships and commercial outcomes
- Inform our client’s expertise of a particular subject matter or theme, for the purposes of marketing or proposition development
- Create marketing materials such as whitepapers and social media content
- Carry out client communications, service, billing and administration
Contacting and marketing our clients and prospective clients
We process personal information about our clients and the individual representatives of our corporate clients in order to:
- contact our clients in relation to current, future and proposed engagements;
- send our clients newsletters, know-how, promotional material and other marketing communications;
- invite our clients to events (and arrange and administer those events).
Conducting data analytics
We are an innovative business, which relies on developing sophisticated products and services by drawing on our experience from prior engagements. Unless otherwise specified and communicated to you, we are not concerned with an analysis of identifiable individuals, and we take steps to ensure that your rights and the legitimacy of our activities are ensured through the use of aggregated or otherwise de-identified data.
If we wish to use your personal information for a purpose which is not compatible with the purpose for which it was collected for, we will request your consent. In all cases, we balance our legal use of your personal information with your interests, rights, and freedoms in accordance with applicable laws and regulations to make sure that your personal information is not subject to unnecessary risk.
All processing (i.e. use) of your personal information is justified by a “lawful basis” for processing. In the majority of cases, processing will be justified on the basis that:
- the processing is necessary for the performance of a contract to which you are a party, or to take steps (at your request) to enter into a contract (e.g. where we help an employer to fulfil an obligation to you under an employment contract in relation to the delivery of employee benefits);
- the processing is necessary for us to comply with a relevant legal obligation (e.g. where we are required to collect certain information about our clients for tax or accounting purposes, or where we are required to make disclosures to courts or regulators); or
- the processing is in our legitimate commercial interests, subject to your interests and fundamental rights (e.g. where we use personal information provided to us by our clients to deliver our services or send marketing communications to clients about new products and services).
Do we collect information from children?
We do not directly provide services to children, and we do not knowingly collect personal information from children.
How long do we retain your personal information?
How long we retain your personal information depends on the purpose for which it was obtained and its nature. We will keep your personal information for no more than the time required to fulfil the purposes described in this privacy notice unless a longer retention period is permitted by law. We have implemented appropriate measures to ensure your personal information is securely destroyed in a timely and consistent manner when no longer required.
In specific circumstances we may store your personal information for longer periods of time so that we have an accurate record of your dealings with us in the event of any complaints or challenges, or if we reasonably believe there is a prospect of litigation relating to your personal information or dealings.
Do we disclose your personal information?
We may share your personal information with other Aon entities, brands, divisions, and subsidiaries to serve our clients, including for the activities listed above.
We do not rent, sell or otherwise disclose personal information with unaffiliated third parties for their own marketing use. We do not share your personal information with third parties except in the following circumstances discussed below.
We disclose personal information to business partners who provide certain specialized services to us, or who co-operate with us on projects. These business partners operate as separate controllers, and are responsible for their own compliance with data protection laws. You should refer to their privacy notices for more information about their practices.
- Financial institutions – wealth managers, family offices, private banks, asset managers, banks and other financial product providers of whom you may or may not be a client
- Other corporate institutions who commission our research –of whom you may or may not be a client Authorized Service ProvidersExamples include:
- We may disclose your information to service providers we have retained (as processors) to perform services on our behalf (either in relation to services performed for our clients, or information which we use for its own purposes, such as marketing). These service providers are contractually restricted from using or disclosing the information except as necessary to perform services on our behalf or to comply with legal requirements. These activities could include any of the processing activities that we carry out as described in the above section, ‘How we use your personal information.’
- IT service providers who manage our IT and back office systems and telecommunications networks;
- marketing automation providers;
- contact center providers,
- Translation agencies
- companies who have surveying technology or other market research capabilities and collect insight on our behalf
These third parties appropriately safeguard your data, and their activities are limited to the purposes for which your data was provided.
Legal Requirements and Business Transfers
We may disclose personal information (i) if we are required to do so by law, legal process, statute, rule, regulation, or professional standard, or to respond to a subpoena, search warrant, or other legal request. (ii) in response to law enforcement authority or other government official requests, (iii) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss, (iv) in connection with an investigation of suspected or actual illegal activity or (v) in the event that we are subject to a merger or acquisition to the new owner of the business. Disclosure may also be required for company audits or to investigate a complaint or security threat.
Do we transfer your personal information across geographies?
We are a global organization and may transfer certain personal information across geographical borders to our, authorized service providers or business partners in other countries working on our behalf in accordance with applicable law. Our affiliates and third parties may be based locally or they may be overseas some of which have not been determined by the European Commission to have an adequate level of data protection.
When we do, we use a variety of legal mechanisms to help ensure your rights and protections travel with your data:
- we ensure transfers within are covered by agreements based on the EU Commission’s standard contractual clauses, which contractually oblige each member to ensure that personal information receives an adequate and consistent level of protection wherever it resides within;
- where we transfer your personal information outside of us or to third parties who help provide our products and services, we obtain contractual commitments from them to protect your personal information. Some of these assurances are well recognized certification schemes like the EU – US Privacy Shield for the protection of personal information transferred from within the EU to the United States, or the standard contractual clauses; or
- where we receive requests for information from law enforcement or regulators, we carefully validate these requests before any personal information are disclosed.
Examples of countries we transfer personal information to include, but are not limited to, the United States of America, the United Kingdom, Ireland, Singapore, India and the Philippines.
If you would like further information about whether your information will be disclosed to overseas recipients, please contact us as noted below. You also have a right to contact us for more information about the safeguards we have put in place (including a copy of relevant contractual commitments, which may be redacted for reasons of commercial confidentiality) to ensure the adequate protection of your personal information when this is transferred as mentioned above.
Do we have security measures in place to protect your information?
The security of your personal information is important to us and we have implemented reasonable physical, technical and administrative security standards to protect personal information from loss, misuse, alteration or destruction. We protect your personal information against unauthorized access, use or disclosure, using security technologies and procedures, such as encryption and limited access. Only authorized individuals access your personal information, and they receive training about the importance of protecting personal information.
Our service providers and agents are contractually bound to maintain the confidentiality of personal information and may not use the information for any unauthorized purpose.
What choices do you have about your personal information?
We offer certain choices about how we communicate with our customers and what personal information we obtain about them and share with others. When you provide us with personal details, if we intend to use those details for marketing purposes, we will provide you with the option of whether you wish to receive promotional email, telephone calls and postal mail from us. At any time, you may opt out from receiving interest-based advertising from us by contacting email@example.com.
You may also choose not to receive marketing communications from us by clicking on the unsubscribe link or other instructions in our marketing emails.
How can you update your communication preferences?
We take reasonable steps to provide you with communication about your information. You can update your communication preferences in the following ways.
If you request electronic communications, such as an e-newsletter, you will be able to unsubscribe at any time by following the instructions included in the communication.
Contact us by e-mail or postal address as noted below. Please include your current contact information, the information you are interested in accessing and your requested changes.
If we do not provide you with access, we will provide you with the reason for refusal and inform you of any exceptions relied upon.
Other rights regarding your data
Subject to certain exemptions, and in some cases dependent upon the processing activity we are undertaking, you have certain rights in relation to your personal information.
We may ask you for additional information to confirm your identity and for security purposes, before disclosing the personal information requested to you. We reserve the right to charge a fee where permitted by law, for instance if your request is manifestly unfounded or excessive.
You can exercise your rights by contacting us. Subject to legal and other permissible considerations, we will make every reasonable effort to honour your request promptly within one month, or inform you if we require further information in order to fulfil more complex requests which may take up to three months.
We may not always be able to fully address your request, for example if it would impact the duty of confidentiality we owe to others, or if we are legally entitled to deal with the request in a different way.
Right to Access
You have right to access personal information which we hold about you. If you have created a profile, you can access that information by visiting your account.
Right to Rectification
You have a right to request us to correct your personal information where it is inaccurate or out of date.
Right to be Forgotten (Right to Erasure)
You have the right under certain circumstances to have your personal information erased. Your information can only be erased if your data is no longer necessary for the purpose for which it was collected, and we have no other legal ground for processing the data.
Right to Restrict Processing
You have the right to restrict the processing of your personal information, but only where:
· its accuracy is contested, to allow us to verify its accuracy; or
· the processing is unlawful, but you do not want it erased; or
· it is no longer needed for the purposes for which it was collected, but we still need it to establish, exercise or defend legal claims; or
you have exercised the right to object, and verification of overriding grounds is pending.
Right to Data Portability
You have the right to data portability, which requires us to provide personal information to you or another controller in a commonly used, machine readable format, but only where the processing of that information is based on (i) consent; or (ii) the performance of a contract to which you are a party.
Right to Object to Processing
You have the right to object the processing of your personal information at any time, but only where that processing has our legitimate interests as its legal basis. If you raise an objection, we have an opportunity to demonstrate that we have compelling legitimate interests which override your rights and freedoms.
As noted above, you can ask to obtain a copy of, or reference to, the safeguards under which your personal information is transferred outside of the European Union.
If you have any questions, would like further information about our privacy and information handling practices, would like to discuss opt-outs or withdrawing consent, or would like to make a complaint about a breach of the law or this Privacy Notice, please contact the Privacy Officer: firstname.lastname@example.org. Alternatively, you have the right to contact your local Data Protection Authority. Our Data Protection Authority is The Information Commissioner’s Office: email@example.com
If you have any questions relating to this Notice, please contact us at the Aon Global Privacy Office, Aon plc, 200 E. Randolph, Chicago, Illinois 60601 or firstname.lastname@example.org.
Changes to this Notice
We may update this Notice from time to time. When we do, we will post the current version on this site, and we will revise the version date located at the bottom of this page.
We encourage you to periodically review this Notice so that you will be aware of our privacy practices.
This Notice was last updated on 29 August 2018.