1. About this Privacy Notice

Northbridge Risk Advisory Limited ("Northbridge", "we", "us" or "our") respects your privacy and is committed to protecting your personal data.

This Privacy Notice explains how we collect, use, store and protect personal data when you:

• visit our website;
• contact us about our advisory services;
• become or enquire about becoming a client;
• apply to the Northbridge Compliance Academy;
• participate in our training programmes;
• apply for an internship, placement or employment opportunity through Northbridge;
• become or enquire about becoming an Employer Partner;
• attend our events, webinars or training;
• subscribe to our communications; or
• otherwise interact with Northbridge.

This Notice also explains your rights under applicable UK data protection law.

2. Who We Are

Northbridge Risk Advisory Limited is a UK risk and compliance advisory business providing regulatory advisory, compliance training and talent-development services.

For the purposes of UK data protection law, Northbridge Risk Advisory Limited will normally be the controller of personal data covered by this Notice.

In some advisory engagements, Northbridge may process personal data on behalf of a client. Where we act solely on a client's instructions, the client may be the controller and Northbridge may act as its processor.

3. Personal Data We May Collect

Depending on your relationship with Northbridge, we may collect the following categories of personal data.

Identity and Contact Information

This may include:

• name;
• title;
• organisation;
• job title;
• postal address;
• telephone number;
• email address; and
• professional contact details.

Client and Business Information

This may include:

• organisation details;
• regulatory status;
• information relating to an enquiry;
• engagement records;
• contracts;
• correspondence;
• meeting notes;
• invoices; and
• other information necessary to provide our professional services.

Academy and Candidate Information

If you apply to or participate in the Northbridge Compliance Academy or Talent programme, we may collect:

• educational background;
• university and course information;
• CV;
• employment history;
• professional qualifications;
• application responses;
• assessment results;
• interview notes;
• training attendance;
• programme performance;
• Skills Passport information;
• career interests;
• internship preferences;
• placement records; and
• employer feedback.

Where necessary and lawful, additional information may be collected as part of a recruitment or placement process.

Employer Partner Information

We may collect:

• business contact details;
• role and organisation;
• recruitment requirements;
• internship or placement opportunities;
• correspondence;
• candidate feedback; and
• partnership information.

Website and Technical Information

Depending on the technologies used on our website, we may collect:

• IP address;
• browser type;
• device information;
• operating system;
• pages visited;
• referral information;
• website interaction data; and
• cookie or similar technology information.

Please see our Cookie Notice for further information.

Marketing Information

We may record:

• marketing preferences;
• newsletter subscriptions;
• event registrations;
• communication preferences; and
• engagement with our communications.

4. How We Obtain Personal Data

We may obtain personal data:

• directly from you;
• through our website;
• through application or registration forms;
• during meetings, calls and correspondence;
• from your employer or organisation;
• from universities or educational institutions where appropriate;
• from Employer Partners;
• from recruitment and professional networking platforms;
• from professional referrals;
• from publicly available professional sources; and
• from service providers acting on our behalf.

Where we receive your information from another source, we will handle it in accordance with applicable data protection requirements.

5. How and Why We Use Personal Data

We may process personal data for the following purposes.

Advisory Services

We use personal data to:

• respond to enquiries;
• assess potential engagements;
• provide regulatory and compliance advisory services;
• manage client relationships;
• communicate with clients;
• administer contracts;
• manage billing and payments; and
• maintain appropriate professional records.

Our lawful bases may include performance of a contract, steps taken at your request before entering a contract, legitimate interests, and compliance with legal obligations, as applicable.

Northbridge Compliance Academy

We use candidate and participant information to:

• administer applications;
• assess suitability for programmes;
• deliver training;
• manage assessments;
• monitor programme participation;
• issue certificates and Skills Passports;
• provide mentoring and career support; and
• administer Academy activities.

Our lawful bases may include contract, pre-contractual steps and our legitimate interests in operating and improving our training programmes.

Internships, Placements and Talent Services

Where candidates choose to participate in placement or employment opportunities, we may use their information to:

• identify potentially suitable opportunities;
• assess suitability;
• introduce candidates to participating employers;
• arrange interviews;
• support internship or placement processes;
• provide mentoring;
• obtain placement feedback; and
• maintain appropriate placement records.

Where appropriate, candidate information may be shared with prospective employers as part of this process.

We will not represent that participation in the Northbridge Compliance Academy guarantees an internship, placement or employment.

Employer Partnerships

We use business contact information to:

• establish and manage Employer Partner relationships;
• identify internship and graduate opportunities;
• introduce appropriate candidates;
• arrange mentoring and career activities;
• manage partnership communications; and
• evaluate programme outcomes.

Events and Training

We may use information to:

• register participants;
• deliver webinars and events;
• issue training materials;
• communicate event information;
• maintain attendance records; and
• obtain feedback.

Marketing and Business Development

We may use appropriate professional contact information to communicate information about:

• Northbridge services;
• regulatory insights;
• events;
• training programmes;
• Academy opportunities; and
• relevant Northbridge developments.

We will comply with applicable direct-marketing and data-protection requirements and provide an appropriate way to unsubscribe from marketing communications.

Website Administration and Security

We may process technical information to:

• operate our website;
• maintain security;
• diagnose technical issues;
• prevent misuse;
• understand website performance; and
• improve the user experience.

6. Our Legitimate Interests

Where we rely on legitimate interests, those interests may include:

• operating and developing our business;
• providing and improving our services;
• developing relationships with clients and professional contacts;
• developing the Northbridge Compliance Academy;
• connecting appropriately qualified candidates with employers;
• protecting our systems and business;
• maintaining appropriate professional records; and
• communicating relevant information to business contacts.

Where required, we consider whether our interests are overridden by the rights and interests of the individual concerned.

7. Special Category and Sensitive Information

Northbridge does not generally seek special category personal data through its website.

However, there may be circumstances in which individuals voluntarily provide sensitive information, or where such information is necessary for a particular programme, reasonable adjustment, legal requirement or professional engagement.

Where we process special category or other particularly sensitive information, we will ensure that an appropriate lawful basis and additional condition for processing applies where required.

Please avoid sending sensitive personal information through general website enquiry forms unless specifically requested.

8. Sharing Personal Data

We may share personal data where appropriate with:

• professional advisers;
• technology and IT providers;
• website hosting providers;
• email and communications providers;
• cloud and document-management providers;
• payment and accounting providers;
• training-platform providers;
• Employer Partners;
• prospective employers, where appropriate for candidate placement;
• universities or educational partners, where applicable;
• regulatory, governmental, law-enforcement or judicial authorities where legally required; and
• other suppliers necessary to operate our business.

We require service providers handling personal data on our behalf to protect that information appropriately.

Candidate information will not ordinarily be provided to prospective employers indiscriminately. Information should be shared in connection with genuine opportunities and in accordance with the applicable candidate process.

9. International Transfers

Some of our technology or service providers may process personal data outside the United Kingdom.

Where personal data is transferred internationally, Northbridge will take appropriate steps to ensure that the transfer complies with applicable UK data protection requirements.

This may include reliance on applicable adequacy regulations or appropriate contractual safeguards.

10. Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, regulatory, contractual, accounting and professional requirements.

Retention periods may vary depending on the type of information and relationship concerned. For example:

• client and engagement records may be retained for an appropriate period following completion of an engagement;
• financial and accounting records will be retained in accordance with applicable legal requirements;
• unsuccessful Academy applications may be retained for a limited period after the relevant intake;
• Academy participant records may be retained for an appropriate period to verify participation, assessments and certificates;
• candidate placement information may be retained while the individual remains active within the Northbridge Talent network and for an appropriate period afterwards;
• marketing information may be retained until you unsubscribe or we determine it is no longer appropriate to retain it; and
• website information will be retained according to the applicable cookie or technical retention period.

Northbridge will establish and periodically review detailed internal retention periods.

11. Information Security

Northbridge takes appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, disclosure or destruction.

Access to personal data is restricted to individuals and service providers who require access for legitimate business purposes.

No internet-based service can, however, be guaranteed to be completely secure.

12. Your Data Protection Rights

Depending on the circumstances, UK data protection law may give you rights including the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete information;
• request deletion of your personal data;
• request restriction of processing;
• object to certain processing;
• request transfer of certain information;
• withdraw consent where processing is based on consent; and
• raise concerns about how your personal data is handled.

These rights are subject to applicable legal conditions and exemptions.

To exercise your rights, contact: info@northbridgereg.co.uk

We may need to verify your identity before responding to a request.

13. Automated Decision-Making

Northbridge does not currently intend to make decisions producing legal or similarly significant effects about website users, Academy candidates or clients solely through automated processing.

If this changes, we will update this Privacy Notice and provide any additional information required by law.

14. Complaints

If you have concerns about how Northbridge handles your personal data, please contact us first so that we have an opportunity to address them.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO).

Further information is available from the ICO.

15. Third-Party Websites

Our website may contain links to third-party websites, including professional networking, regulatory or other external websites.

Northbridge is not responsible for the privacy practices of third-party websites. You should review the privacy information provided by the relevant third party.

16. Changes to this Privacy Notice

We may update this Privacy Notice periodically to reflect changes in our business, services, technology or legal requirements.

The latest version will be published on our website with the date of the most recent update.