Privacy Statement

Last updated on January 10, 2019

Birches Group has always considered the protection of our clients’ confidential data a top business priority. We are committed to helping our clients thrive by providing simple and effective management consulting advice, tools, and services. We only succeed when our clients succeed, and protecting our client’s data is an important part of earning and maintaining the trust necessary for our shared success. Our commitment to protecting privacy is not limited to clients but extends to our business partners, employees, and others who share their personal information with us.

This Privacy Statement (“Statement”) explains Birches Group’s information processing practices. It applies to any personal information you provide to Birches Group and any personal information we collect from other sources. This Statement is a statement of our practices and of your rights regarding your personal information. This is not a contractual document, and it does not create any rights or obligations on either party beyond those that already exist under data protection laws.

Summary

Birches Group collects personal information from its clients (about their employees) to provide management consulting services. Birches Group also collects some personal information directly, for example, through its websites, applications, and registration forms.

Birches Group uses personal information to deliver services to clients. For its own purposes, it also uses personal information to analyze and improve how it delivers those services, to contact representatives of its clients or prospective clients and to market to them.

If Birches Group uses your personal information, you will have certain important rights that you can exercise. The rights you will be able to exercise will depend on how and why Birches Group uses your information.

You may contact Birches Group for questions regarding your personal information at privacy@birchesgroup.com.

Responsibility for your information

Some of the services that Birches Group provides to its clients are provided as a processor, which means that the client remains primarily responsible for your information. In these circumstances, we may re-direct a query about our use of your information to our client.

When and how we collect your information

Birches Group collects personal information in the following ways:

  • When we perform services for our clients. Our services and products include job evaluation and organizational design, compensation management, performance management, and skills assessment. In these cases, your personal information will normally be provided to us by our clients, or sometimes our clients may ask us to contact you directly or ask you to submit your information to us.
  • When you request a service from us. For example, if you register to participate in one of our training courses, or if you contact us as a representative of your employer to enquire about a professional service you would like us to offer to your company.
  • When you register with or use any of our websites or applications.
  • When you attend a Birches Group site or event. You may provide this information directly, or it may be provided by your employer or colleagues.
  • When you apply for a position at Birches Group. You may provide this information directly (through an online recruitment portal, careers site or via correspondence), or it may be provided via an agency.
  • If you contact us with a complaint or query.
  • When you engage with us on social media.

Information collected by Birches Group

Information you provide to us

When you request services, we ask that you provide accurate and necessary information that enables us to respond to your request. When a visitor provides personal information to us, we use it for the purposes for which it was provided to us as stated at the point of collection or as obvious from the context of collection, for example, registering for a training course, applying for a position at Birches Group, or creating a profile on a website or application.

Information we collect from clients

When we conduct salary surveys or provide labor market studies, we may collect personal information relating to the salary and benefits you receive from your employer. As part of our data minimization strategy to protect your privacy and minimize the risk of a data breach for data subjects, we always request that this information be provided in a pseudonymized manner. We may report this data back in a pseudonymized manner to your employer, indicating salary and benefit data collected by job title or grade. The purpose of reporting this data is twofold: (1) it enables your employer to verify that we have collected and analyzed the data it provided accurately; and (2) it facilitates your employer’s comparison of its internal data with the anonymized market data we provide.

When we provide Community™ job evaluation, performance management, or skills assessment services, we may collect personal information such as your name, contact details, date of birth, gender, marital status, employment details, and salary and benefit coverage. Most of the personal information we receive relates to your participation in the human resources management programs offered by your employer.

Birches Group does not collect any sensitive information’ as defined in the EU GDPR Regulation[1] except that it may collect personal data provided by clients revealing nationality to assist in carrying out the obligations and/or exercising specific rights of the client in so far as it is authorized by applicable law. Sensitive information includes data relating to race or ethnic origin; political opinions; religious, philosophical, or other similar beliefs; trade union membership; physical or mental health; sexual life or orientation; criminal record; or genetic or biometric data.

If you provide us with any personal information, you understand and give your explicit consent that we may collect, use, and disclose this information to appropriate third parties for the purposes described in this Statement. If you provide personal information about other individuals, such as employees or dependents, you must obtain their consent prior to your disclosure to us.

Information we collect over websites, mobile applications and social media

For purposes of this Statement, “website” includes our mobile applications.

We may ask you for some or all of the following types of information when you register for events, request services, manage accounts, access various content and features, or directly visit our websites. This includes, but is not limited to:

  • Contact information, such as name, e-mail address, postal address, phone number and mobile number;
  • User name, password, password reminder questions and password answers;
  • Communication preferences, such as which newsletters you would like to recieve;
  • Search queries;
  • Contact information about others when you refer a friend to a particular site or service (note: this information is used solely to facilitate requested communications); and
  • Information posted in community discussions and other interactive online features.

In some instances, we automatically collect certain types of information when you visit our websites and through e-mails that we may exchange. Automated technologies may include the use of web server logs to collect IP addresses, “cookies” and web beacons. Further information about our use of cookies can be found in our Cookie Notice.

Social Media:

You can engage with us through social media websites or through features such as plug-ins or applications on Birches Group websites that integrate with social media sites. You may also choose to link your account with us to third party social media sites. When you link your account or engage with us on or through third party social media sites, plug-ins, or applications, you may allow us to have ongoing access to certain information from your social media account (e.g., name, e-mail address, photo, gender, birthday, the posts or the ‘likes’ you make).

If you post information when you interact with our websites through social media sites, plug-ins, or other applications, depending on your privacy settings, this information may become public on the Internet. You can control what information you share through the privacy settings available on some social media sites. For more information about how you can customize your privacy settings and how third party social media sites handle your personally identifiable information, please refer to their privacy help guides, privacy notices, and terms of use.

Mobile Devices:

If you access our websites on your mobile telephone or mobile device, we may also collect your unique device identifier and mobile device IP address, as well as information about your device’s operating system, mobile carrier, and location information. We may also ask you to consent to providing your mobile phone number (for example, so that we can send you push notifications).

How we use your personal information

Performing services for our clients

We process personal information that our clients provide to us to perform our professional consulting and advisory services. This may impact you, for example, if you are the employee of our client. The precise purposes for which your personal information is processed will be determined by the scope and specification of our client engagement and by applicable laws, regulatory guidance, and professional standards. It is the obligation of our client to ensure that you understand that your personal information will be disclosed to Birches Group (or to service providers such as Birches Group).

Administering our client engagements

We process personal information about our clients and the individual representatives of our organizational clients in order to:

  • conduct checks and screenings prior to starting a new engagement;
  • communicate with clients, provide servies, or for billing and administration;
  • address client complaints.

Contacting and marketing our clients and prospective clients

We process personal information about our clients and the individual representatives of our organizational clients in order to:

  • contact our clients in relation to current, future and proposed projects;
  • share with clients our newsletters, knowledge, promotional material and other marketing communications;
  • invite our clients to events (and arrange and administer those events).

Conducting data analytics

Birches Group is an innovative company that aims to develop better products and services by drawing on our past experience. Birches Group is not concerned with an analysis of identifiable individuals, and we take steps to ensure that your privacy rights and the legitimacy of Birches Group’s activities are ensured through the use of aggregated or otherwise de-identified data.

Other uses

We may also process personal information in order to:

  • Provide information and services as requested by you;
  • Determine eligibility and process applications for products and services;
  • Provide information and services as requested by clients;
  • Understand and assess clients’ ongoing needs and offer products and services to meet those needs;
  • Conduct data analysis;
  • Execute monitoring and training;
  • Develop new services;
  • Market products and services (subject to appropriate consent); and
  • Conduct processing necessary to fulfill other contractual obligations for the individual.

If we wish to use your personal information for a purpose that is not compatible with the purpose for which it was collected, we will request your consent. In all cases, we balance our legal use of your personal information with your interests, rights, and freedoms in accordance with applicable laws and regulations to make sure that your personal information is not subject to unnecessary risk.

Legal basis

All processing (i.e., use) of your personal information is justified by a “lawful basis” for processing. In the majority of cases, processing will be justified on the basis that:

  • the processing is necessary for us to comply with a relevant legal obligation (e.g. where we are required to collect certain information about our clients for tax or accounting purposes, or where we are required to make disclosures to courts or regulators); or
  • the processing is in our legitimate commercial interests, subject to your interests and fundamental rights (e.g., where we use personal information provided to us by our clients to deliver our services, and that processing is not necessary in relation to a contract to which you are a party).

In limited circumstances, we will use your consent as the basis for processing your personal information, for example, where we are required to obtain your prior consent in order to send you marketing communications.

Information from Children

Our websites are not directed at children, and we do not knowingly collect personal information from children on our websites. Birches Group does not authorize children to use any of our websites or services.

Retention period for personal information

How long we retain your personal information depends on the purpose for which it was obtained and its nature. We will keep your personal information for the period necessary to fulfil the purposes described in this Statement unless a longer retention period is permitted by law. We may also keep your information for longer periods to conduct historical trends analyses.

In specific circumstances, we may store your personal information for longer periods of time so that we have an accurate record of your dealings with us in the event of any complaints or challenges, or if we reasonably believe there is a prospect of litigation relating to your personal information or dealings.

Disclosure of Personal Information

Within Birches Group

We may share your personal information within our company with other Birches Group affiliates to serve you, including for the activities listed above.

We do not rent, sell, or otherwise disclose personal information about our online visitors to unaffiliated third parties for their own marketing use. We do not share your personal information with third parties except in the following circumstances discussed below.

Business Partners

We disclose personal information to business partners who provide certain specialized services to us, or who co-operate with us on projects. These business partners operate as separate controllers and are responsible for their own compliance with data protection laws. You should refer to their privacy notices for more information about their practices.

Authorized Service Providers

We may disclose your information to service providers we have retained (as processors) to perform services on our behalf (either in relation to services performed for our clients or information that Birches Group uses for its own purposes, such as marketing). These service providers are contractually restricted from using or disclosing the information except as necessary to perform services on our behalf or to comply with legal requirements. These activities could include any of the processing activities that we carry out as described in the above section, ‘How we use your personal information.’

Examples may include:

  • IT service providers who manage our IT and back office systems and telecommunications networks;
  • marketing automation providers;
  • contact center providers.

These third parties appropriately safeguard your data, and their activities are limited to the purposes for which your data was provided.

Legal Requirements and Business Transfers

We may disclose personal information: (i) if we are required to do so by law, legal process, statute, rule, regulation, or professional standard, or to respond to a subpoena, search warrant, or other legal request; (ii) in response to law enforcement authority or other government official requests; (iii) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss; (iv) in connection with an investigation of suspected or actual illegal activity; or (v) in the event that Birches Group is subject to a merger or acquisition to the new owner of the business. Disclosure may also be required for company audits or to investigate a complaint or security threat.

Transfer of personal information across geographies

We are a global organization and may transfer certain personal information across geographical borders to Birches Group entities, authorized service providers, or business partners in other countries working on our behalf in accordance with applicable law. Our affiliates and third parties may be based locally or in other countries, some of which have not been determined by the European Commission to have an adequate level of data protection.

When we do, we use a variety of legal mechanisms to help ensure your rights and protections travel with your data:

  • we ensure transfers within Birches Group are covered by agreements based on the EU Commission’s standard contractual clauses, which contractually oblige each member to ensure that personal information receives an adequate and consistent level of protection wherever it resides within Birches Group;
  • where we transfer your personal information outside Birches Group or to third parties who help provide our products and services, we obtain contractual commitments from them to protect your personal information. Some of these assurances are well recognized certification schemes like the EU – US Privacy Shield for the protection of personal information transferred from within the EU to the United States, or the standard contractual clauses; or
  • where we receive requests for information from law enforcement or regulators, we carefully validate these requests before any personal information is disclosed.

Examples of countries we transfer personal information to include, but are not limited to, the United States of America, the United Kingdom, Latvia, Sweden and the Philippines.

If you would like further information about whether your information will be disclosed to overseas recipients, please contact us as noted below. You also have a right to contact us for more information about the safeguards we have put in place (including a copy of relevant contractual commitments, which may be redacted for reasons of commercial confidentiality) to ensure the adequate protection of your personal information when this is transferred as mentioned above.

Security measures in place to protect your information

The security of your personal information is important to us and Birches Group has implemented reasonable physical, technical and administrative security measures to protect personal information from loss, misuse, alteration or destruction. We protect your personal information against unauthorized access, use or disclosure, using security technologies and procedures, such as encryption and limited access. Only authorized individuals access your personal information, and they receive training about the importance of protecting personal information.

Our service providers and agents are contractually bound to maintain the confidentiality of personal information and may not use the information for any unauthorized purpose.

Choices relating to your personal information

We offer certain choices about how we communicate with our customers and what personal information we obtain about them and share with others. When you provide us with personal details, if we intend to use those details for marketing purposes, we will provide you with the option of whether you wish to receive promotional e-mail, SMS messages, telephone calls, and postal mail from us. At any time, you may opt out of receiving interest-based advertising from us by contacting us.

You may also choose not to receive marketing communications from us by clicking on the unsubscribe link or other instructions in our marketing e-mails, or by contacting us as noted below.

Updating your communication preferences

We take reasonable steps to provide you with communication about your information. You can update your communication preferences in the following ways.

Profile

If you have created a profile or account on one of our websites, you can update your contact information by contacting us as noted below.

Newsletters

If you request electronic communications, such as an e-newsletter, you will be able to unsubscribe at any time by following the instructions included in the communication.

Mobile Devices

If you previously chose to receive push notifications on your mobile device from us but no longer wish to receive them, you can manage your preferences either through your device or the application settings. If you no longer wish to have any information collected by the mobile application, you may uninstall the application by using the uninstall process available on your mobile device.

E-mail

Contact us by e-mail as noted below. Please include your current contact information, the information you are interested in accessing and your requested changes.

If we do not provide you with access, we will provide you with the reason for refusal and inform you of any exceptions relied upon.

Other rights regarding your data

Subject to certain exemptions, and in some cases dependent upon the processing activity we are undertaking, you have certain rights in relation to your personal information.

We may ask you for additional information to confirm your identity and for security purposes, before disclosing the personal information requested of you. We reserve the right to charge a fee where permitted by law, for instance, if your request is manifestly unfounded or excessive.

You can exercise your rights by contacting us. Subject to legal and other permissible considerations, we will make every reasonable effort to honor your request promptly or inform you if we require further information in order to fulfil your request.

We may not always be able to fully address your request, for example, if it would impact the duty of confidentiality we owe to others or if we are legally entitled to deal with the request in a different way.

Right to Access

You have a right to access personal information that Birches Group holds about you. If you have created a profile, you can access that information by visiting your account.

Right to Rectification

You have a right to request us to correct your personal information if it is inaccurate or out of date.

Right to be Forgotten (Right to Erasure)

You have the right, under certain circumstances, to have your personal information erased. Your information can only be erased if your data is no longer necessary for the purpose for which it was collected, and we have no other legal grounds for processing the data.

Right to Restrict Processing

You have the right to restrict the processing of your personal information, but only where:

  • its accuracy is contested, to allow us to verify its accuracy; or
  • the processing is unlawful, but you do not want it erased; or
  • it is no longer needed for the purposes for which it was collected, but we still need it to establish, exercise or defend legal claims; or
  • you have exercised the right to object, and verification of overriding grounds is pending.

Right to Data Portability

You have the right to data portability, which requires us to provide personal information to you or another controller in a commonly used, machine readable format, but only where the processing of that information is based on (i) consent; or (ii) the performance of a contract to which you are a party.

Right to Object Processing

You have the right to object the processing of your personal information at any time, but only where that processing has our legitimate interests as its legal basis. If you raise an objection, we have an opportunity to demonstrate that we have compelling legitimate interests that override your rights and freedoms.

Right to Decline Automated Decision Making

You have the right to not be subject to decisions based solely on automated decision making, which produce legal or significant effects for you, except where these are (i) necessary for a contract to which you are a party; (ii) authorized by law; (iii) based on your explicit consent.

Even where such decisions are permitted, you can contest the decision and require Birches Group to exercise human intervention.

We currently do not use automated decision making (including automated decision making using profiling) when processing your personal information. If we ever use an automated decision making solution, you have a right to request that a decision based off your personal information cannot be solely decided via an automated process.

International Transfers

As noted above, you can ask to obtain a copy of, or reference to, the safeguards under which your personal information is transferred outside of the European Union.

Contact us

If you have any questions, would like further information about our privacy and information handling practices, would like to discuss opt-outs or withdrawing consent, or would like to make a complaint about a breach of any applicable law or this Statement, please contact the Privacy Officer: privacy@birchesgroup.com. Alternatively, you have the right to contact your local Data Protection Authority.

If you have any questions relating to this Statement, please contact us at Birches Group LLC, 228 E. 45th Street, New York, New York 10017, or privacy@birchesgroup.com.

Changes to this Statement

We may update this Statement from time to time. When we do, we will post the current version on our website, and we will revise the version date located at the beginning of this Statement.

We encourage you to periodically review this Statement so that you will be aware of our privacy practices.

[1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), article 9, para. 1.