Privacy Policy | United Group

1. UNITED GROUP PRIVACY POLICY

1.1 To which entity does this Notice apply?

This Privacy Policy (“Notice”) applies to the website(s) of United Group B.V. found at https://united.group/about/ with the registered address: Spicalaan 41, 2132 JG Hoofddorp, The Netherland (“United Group”, “we,” “us,” or “our”) as well as any Mobile Apps, online forms and subscriptions, products or services, and social media channels controlled by United Group where a link to this Notice is provided (each, the “Platform” and together, the “Platforms”). Each Platform is controlled by the individual United Group’s entity as defined in its terms of use.

For the purposes of this Notice, the Data Controller of your Personal Data is United Group B.V.. You can find further contact details under the “How to contact us” section below.

1.2 Why is this Notice important?

United Group is committed to protecting your Personal Data in accordance with our internal policies and applicable privacy and data protection legislation.

This Notice informs you of our practices with respect to the collection, processing, use and sharing of Personal Data which you provide to us via our Platforms, in relation to any promotions, competitions, offers or marketing campaigns we carry out, or which you provide for your potential employment with us. It also describes your data protection rights, including for instance a right to object to certain processing activities which United Group carries out. More information about your rights, and how to exercise them, is set out in the “Your Rights” section below.

1.3 How do we collect Personal Data and why?

We may collect your Personal Data in the following circumstances:

A. To perform our contractual obligations:

under our terms when you register for or purchase certain Products or Services;
to verify your identity;
when you register to attend a United Group event or to use free of charge service testing;
to provide customer service related to our Products and Services;
if you tell us, you have a disability or otherwise need support, we will note that you are a vulnerable customer, but only if you give your permission or if we have to for legal or regulatory reasons. For example, if you told us about a disability, we need to be aware of when we deliver our services to you, we have to record that information, so we don’t repeatedly ask you about it;
for billing purposes; and
to complete credit checks.

B. For our legitimate business interests, which include:

sending you visual and audio communications messages about Marketing and Promotions where consent is not required by law.
understanding your previous interests when you last visited our Platforms;
providing you with access to Products and Services or specific materials or information from our Platforms;
processing your feedback and contributions to customer surveys, competitions, offers or questionnaires.
recording telephone calls with you for training and/or monitoring purposes;
reviewing your queries so we can better help you or investigate any complaints received by you.
to help identify you for administrative purposes;
to improve our service to analyze trends to administer our Platforms
fraud prevention
security of our network

If you wish to know more about how we have balanced our legitimate interests against the impact on your rights and freedoms, please don’t hesitate to reach out to use via the contact details provided in the “How to contact us” section below.

C. For compliance, legal or regulatory purposes:

to verify your identity as part of the employment screening process, including where appropriate for money laundering regulation purposes;
to report any activity which we suspect breaches any relevant laws or regulations to the appropriate authority;
for the protection of vital interests;
for information security, fraud prevention and service provision (for example, managing abuse of the service); and to comply with EU law for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.

Where we require personal data to comply with legal or contractual obligations, the provision of such data is mandatory: if such data is not provided, then we will not be able to manage our contractual relationship with you, or to meet obligations placed on us.

D. With your consent:

when you subscribe to our marketing lists, social media pages, (promotions, competitions, offers or marketing campaign communications (together, “Marketing and Promotions”) – and an unsubscribe facility will be provided to you;
if you choose to actively engage in an “experiential” campaign (via, for example, a QR code on an interactive advertisement or competition) and we need to know your identity or request your contact details, we will obtain your consent and tell you at the time of requesting that consent, how we will use that data; and
filter any content you ask us to, through your parental control’s settings (or any content our partners ask us to, such as for a wi-fi hotspot).

1.4 What Personal data do we collect?

We collect your personal information in the following circumstances:

When you purchase or use any of our products and services.
When you use our network or other United Group products and services.
When you register for a specific product or service.
When you subscribe to newsletters, alerts, or other services from us.
When you contact us through various channels or request information about a product or service.
When you participate in a competition, prize draw, event, or survey.
When you visit or browse our website or other United Group websites.
When you have given permission to other companies to share information about you.
When your information is publicly available.
When you are a customer of a business that we acquire.
When we collect information from certain organizations, such as fraud-prevention agencies, business directories, credit check reference/vetting agencies, billing calculating agencies, and connected network providers.
Furthermore, we may collect information about you through CCTV when you visit our premises or other security cameras as part of our security and crime prevention measures.
We use cookies and other techniques like web beacons to collect information about your browsing activities on our website. Please refer to the 'Cookies' Notice for more details.

The types of information we may have include:

Personal details

Your name, address, phone and/or mobile number, date of birth, gender, information about your property or household, and email address

Financial information

Your credit or debit card information, bank account information, and other financial details required for payment processing

Traffic data

Information related to your connectivity, such as numbers called, call duration, and data usage

Location data

Precise or approximate location data based on GPS, mobile phone masts, Wi-Fi hotspots, IP address, or other sources when location-based services or features are enabled.

Contact history

Notes or recordings of your interactions with our contact centers, including calls, live chats, emails, letters, or any other communication records.

Account information

Payment dates, subscriptions, account numbers, and other relevant details associated with your account.

Credential information

Passwords, security hints, and other authentication details used to access your accounts and services.

Preferences

Your preferences for products, services, and lifestyle activities, either explicitly provided by you or inferred based on your usage patterns

Information from other sources

YData obtained from credit agencies, fraud-prevention agencies, data providers, and other sources, including demographic data, interest-based data, and internet browsing behavior.

Level of Service

We collect information about the level of service you receive and details of your specific service or product usage, such as call records, text messages, and approximate location data.

Demographic and contact information from other sources

Data obtained from public databases, joint marketing partners, social media platforms (including from people with whom you are friends or otherwise connected) and from other third parties.

Technical information

Location information, the Internet Protocol (IP) address and MAC address used to connect your computer and/or mobile device to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform.

Online browsing behaviour on our Platforms

This includes the Uniform Resource Locators (URL) clickstream to, through and from our Platforms or Social Media Channels (including date and time), download errors, lengths of visits to certain pages, page interaction information (such as scrolling, clicks and mouse-overs) email marketing interaction (including if and when an email is opened and how many times it is opened); and methods used to browse away from the page as well as any devices you have used to access our Products and Services (including the make, model and operating system, IP address, MAC address browser type and mobile device identifiers

Please see our Cookie Notice for more information.

Job Applicant info

Your CV details and any background information we may receive from your referees, your LinkedIn profile, the recruitment agency that you work with (if any).

In some of our interactions with you (for example, when you submit an entry to one of our competitions, or make a complaint), we may request additional Personal Data where it is necessary to help us to provide you with the most appropriate response. If you do not provide the Personal Data where requested, your access to the service, or our ability to assist you, may be restricted.

1.5 Sensitive or Special Category Personal Data

In certain cases, and as permitted by law, we may collect Special Category Personal Data or data relating to criminal convictions and offenses. Special Category Personal Data encompass sensitive information that discloses racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health data, or data related to a person's sex life or sexual orientation. In specific instances, we may collect your health data to evaluate your circumstances for purposes such as aiding debt recovery processes, offering supplementary support, or delivering communications in accessible formats.

2. YOUR RIGHTS

Under the GDPR and other applicable EU and Privacy and Data Protection legislation, you have rights over your Personal Data. You may for example, be entitled to ask us for a copy of your Personal Data, to correct it, erase or restrict its processing, or to ask us to transfer some of this information to other organisations. These rights may be limited in some situations, for example if fulfilling your request would reveal Personal Data about another person, or where we can demonstrate that we have a legal requirement to process your Personal Data.

To exercise any of these rights, to obtain other information, or if you require further information on your rights or our use of your Personal Data, please contact us at [email protected].

If you have unresolved concerns, you have the right to complain to the data protection authority where you live, work or where you believe a breach may have occurred.

Your rights include (subject to legal and regulatory requirements):

2.1 Right to Access Personal Data

You have the right to request a copy of Personal Data that we hold about you. Before responding to your request, we may ask you to (i) verify your identity and (ii) provide further details so we can better respond to your request.

2.2 Right to Rectification of Personal Data

If you inform us that your Personal Data is no longer accurate, or it is incomplete, we will rectify or update it. If we have shared your Personal Data with others, where possible, we’ll let them know about the rectification or update.

2.3 Right to Erasure of Personal Data

We will delete your Personal Data in certain circumstances such as where:

You withdraw your consent for processing the Personal Data (if we rely on your consent for the processing);
You (exercise your right to) object to the processing of your Personal Data (if we rely on our legitimate interest for the processing);
The Personal Data is no longer required for the purpose(s) for which it was collected;
The Personal Data has to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;

We might refuse to satisfy your request for deleting your Personal Data where the processing is necessary to:

Comply with a legal obligation to which United Group or any of its affiliates are subject, or to perform a task in the public interest or the exercise of official authority vested in United Group or in any of its affiliates as the Controller of the Personal Data;
For exercising the right of freedom of expression and information;
For archiving purposes in the public interest, for scientific, historical research purposes; or
For the establishment, exercise, or defense of legal claims.

United Group will inform you of relevant exemptions we rely upon when responding to any deletion request you make.

2.4 Right to Restriction of Processing of Personal Data

We will restrict the processing of your Personal Data in certain circumstances such as where:

You have requested to check the accuracy of your Personal Data – for the time necessary to confirm the accuracy of your Personal Data.
You (exercise your right to) object to the processing of your Personal Data (if we rely on our legitimate interest for the processing).

Where processing has been restricted, United Group shall, with the exception of storage, only process such Personal Data on the basis of your consent, or for the establishment, exercise or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest.

2.5 Right to Withdraw Consent

You have an absolute right to opt-out of direct marketing at any time. If, at any time, you have provided consent to us for processing your Personal Data under the circumstances or purposes described in this policy, and you no longer wish to have your Personal Data processed in this way, you may withdraw your consent by emailing [email protected].

2.6 Right to Portability

You can ask us to provide you with your Personal Data (that you provided to us, or that we collected through your activities on our Platforms) in a structured, commonly used, and machine-readable format to send it to another controller.

2.7 Right to Object

You can object to the processing of your Personal Data when we use the Data for direct marketing purposes, where Personal Data are processed for scientific or historical research purposes or statistical purposes.

2.8 Rights in relation to Automated Decision-Making & Profiling

You have the right not to be subject to a decision when it’s based solely on automated processing or profiling which produces a legal or similarly significant effect on you. We only carry out this type of decision-making where the decision is necessary for the entry into or performance of a contract; or authorized by any EU law applicable to us; or based on your explicit consent.

3. THIRD PARTY WEBSITES

Where links from our Platforms to non-United Group Platforms are provided, we are not responsible for those websites, nor do we imply endorsement of any linked third-party websites. These third-party websites will be governed by their own terms of use, depending on the owner and Data Controller of those websites (including privacy notices), and you are solely responsible for viewing and using each such website in accordance with their applicable terms of use. We are not responsible for how your Personal Information is handled by such third-party websites, and they are not covered by this Notice.

4. TRANSFER OF PERSONAL DATA

4.1 Third Parties

We transfer your Personal Data where we use third party service providers to help us process Personal Data for the purposes described in this Notice. These purposes will include customer management and intelligence solution providers, aggregated data analytics partners, web hosting facilities, audit, and compliance partners.

4.2 Data Controller Intragroup Transfer

United Group is the holding company of a group of businesses (Group) and is registered at:

Spicalaan 41

2132 JG Hoofddorp

The Netherlands

From time to time, we may need to share Personal Data collected by United Group amongst the Group together with their Data Processors for HR, compliance with laws or technical purposes. Any such transfers of Personal Data will be done in accordance with applicable EU data protection and privacy legislation as well as any other applicable laws.

4.3 Transfer Outside the European Economic Area

Non-EEA countries may have Privacy and Data Protection laws that are less protective regarding the processing of your Personal Data than the legislation applicable to your jurisdiction. Where this is the case, our transfers of Personal Data will be regulated by the EU Commission's Standard Contractual Clauses relating to the transfer of Personal Data outside of the European Economic Area (or outside of jurisdictions deemed to provide “adequate” protection for Personal Data to the standards of the European Union. The jurisdictions to which Personal Data are transferred may be conditional on your nationality or location.

4.4 Sale or Merger

If United Group or its assets are sold to or merge with another entity outside United Group, you should expect that some or all of the Personal Data collected by United Group may be transferred to the buyer/surviving company.

5. RETENTION OF PERSONAL DATA

The Personal Data you have provided us with will be retained for the duration of your relationship with us and, to the extent permitted, after the end of that relationship for as long as necessary to perform the purposes set out in this policy. This includes, for example the length of time required to satisfy any legal, regulatory, accounting and reporting requirements, and to process personal information on you in order to establish, exercise or defend legal claims.

Where we process Personal Data in connection with performing a contract or for a competition, we will store personal information for the periods needed for the purposes for which the information was collected or for which it is to be further processed. And sometimes we will keep it for longer if we are required to do so by law. Otherwise, we delete it.

Personal Data collected from applicants who are unsuccessful will be promptly deleted or, if that individual may be of interest for other roles, and with their consent, kept until one year after the applicant submits their application.

Where we process Personal Data for marketing purposes, or with your consent, we process the Personal Data until you ask us to stop and for a short period after this (to allow us to implement your requests). We also keep a record of the fact that you have asked us not to send you direct marketing, or to process your data so that we can respect your request in future.

We will delete or dispose of your Personal Data at the end of the relevant retention periods mentioned above.

In determining the appropriate retention period, we consider the purpose for which we process your Personal Data, the volume, type, and nature of the Personal Data, local legal requirements, the risk of harm to the data protection rights of the individual, and whether the purpose for processing Personal Data can be established through an alternative method.

6. HOW TO CONTACT US

Should you wish to make any comments, complaints, enquiries or if you have any questions relating to this Notice, your rights, our Platforms, our Marketing and Promotion materials or Products or Services we provide, you may contact United Group’s Privacy Office by emailing or writing to:

Postal address Email

To the attention of the Data Protection Officer Email: [email protected]

Spicalaan 41

2132 JG Hoofddorp

The Netherlands

You may also contact the Data Protection Authority where you live, work, or believe the breach has happened. A list of the European Supervisory Authorities can be found here. If you are in the The Netherlands the Data Protection Authority will likely be the Autoriteit Persoonsgegevens. For a list of their contact details, you can visit https://www.autoriteitpersoonsgegevens.nl/en/contact.

7. CHANGES TO THIS NOTICE

This Notice is subject to periodic review to ensure it is in line with applicable legislation.

We retain all applicable ownership rights to information we collect. We reserve the right to change, modify, add, or remove provisions of this Notice. Any changes to this Notice will be posted here, and we encourage you to check back from time to time. If the changes are substantial, we will notify the changes to you.

8. GLOSSARY

Violation of this Policy by employees or suppliers shall result in appropriate disciplinary action, up to and including termination of employment or contract termination, depending on the severity and frequency of the violation. Consequences may also include legal action and financial penalties, as deemed necessary.

“Biometric Data” means personal data resulting from specific technical processing relating to the physical, physiological or behavioral characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data;

“Consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

“Genetic Data” means personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question;

“Marketing and Promotions” means when you subscribe to our marketing lists, social media pages, (promotions, competitions, offers or marketing campaign communications and an unsubscribe facility will be provided to you.

“Personal Data” means any information relating to an identified or identifiable individual. An individual is identifiable when they can be identified by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, psychological, genetic, mental, economic, cultural, or society identity of that individual.

“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;

“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;

“Restriction of Processing” means the marking of stored personal data with the aim of limiting their processing in the future;

“Sensitive or “Special Category” Personal Data” means Personal Data which may relate to: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union memberships, physical or mental health conditions or, genetic or biometric data that uniquely identifies you, your sex life or sexual orientation, and information related to criminal convictions and/or criminal offences or related proceedings.

“Supervisory Authority” means an independent public authority which is established by a Member State.

“Third Party” means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.