Analysis Group EU & UK Privacy Notice

(Effective 1 July 2025)

About This Document

This privacy notice explains how Analysis Group’s European Union and United Kingdom-based entities collect, use, share and otherwise process the personal data of past, present, or prospective clients, service providers and anyone else who may contract, contact or otherwise interact with us and the rights those individuals (“you”, “your”) have in relation to the personal data we hold.

We should be grateful if you would send a copy of this privacy notice to each of your colleagues and your clients whose personal data we may process in connection with the provision of our services as soon as possible.

Please note that the processing of personal data which a client provides to us for rendering our services (e.g., personal data relating to the client’s own clients), or which we collect on a client’s behalf in rendering our services, is not subject to this privacy notice to the extent the processing of such personal data is conducted only on behalf of the client and solely for the purpose of providing the services and according to the client's instruction. In such a case, the client is the controller of the personal data and is responsible for providing notice about such processing.

Any processing of personal data in the context of your use of the website accessible at www.analysisgroup.com is subject to the Privacy Statement set out on the website (and accessible via: https://www.analysisgroup.com/policy/).

Controller

For the purposes of European Union (“EU”),  EU member state, and United Kingdom (“UK”) data protection laws, in particular the General Data Protection Regulation (“GDPR”), the UK General Data Protection Regulation (“UK GDPR”), and the UK Data Protection Act 2018 (“DPA”), as applicable, the EU or UK-based Analysis Group entity with whom you interact is the controller of your personal data.  The terms “Analysis Group”, “we” or “us” in this privacy notice reference that entity.

The Analysis Group entities located in the EU and the UK are:

  • Analysis Group Ltd., a UK registered company, registered in England with company number 10629120 and located in 1 Angel Court, London EC2R 7HJR, United Kingdom.
  • Analysis Group SAS, a French registered company, registered in France with company number 838997252 and located in 9 rue d’Argenson 75008 Paris, France.
  • Analysis Group srl, a Belgian registered company, registered in Belgium with company number 0679567251 and located in Rue Montoyer 47, 1000 Brussels, Belgium.

Analysis Group, Inc. as Joint Controller

The EU and UK-based Analysis Group entities above are part of a larger family of companies, including Analysis Group, Inc., which is located in the United States.  Analysis Group, Inc. maintains centralized human resource, legal, compliance, IT, and other administrative functions for the Analysis Group companies.  As a result, Analysis Group, Inc. may process your personal data as a joint controller with the EU or UK-based entity with whom you interact, for purposes consistent with this privacy notice.  Analysis Group, Inc. is located at 111 Huntington Avenue, Boston, MA 02199, USA.

How We Collect Your Personal Data

We may collect your personal data in a number of ways. This includes data we receive directly from you, for example:

  • when you interact with us before becoming a client or service provider, for example when you express your interest in our services or offer your services to us;
  • in connection with the performance of a contract we have concluded with you;
  • when you communicate with us (e.g., by telephone, email), for example in order to make enquiries or raise concerns;
  • when you provide personal data in the context of events;
  • when you sign up to receive marketing communications.

We may also receive personal data from third parties, for example in order to carry out required due diligence checks on you or your organisation.

Please note that where you do not provide personal data to us, we may not be able to provide all or some aspects of our services to you and/or it may affect the provision of those services.

If you communicate with us via email, we may also collect personal data automatically as explained below.

The Types of Personal Data We Collect

We may collect the following types of personal data about you (and anyone at your organisation on whom we need to carry out due diligence checks, for example):

  • your name, and contact information such as address, email address and telephone number;
  • information on your job role, such as your position, title and function;
  • billing and financial information (including bank routing number, bank account numbers and tax ID – used for receipt or payment of funds);
  • information relating to our contractual relationship.

When communicating with us via email, we may also automatically collect personal data such as information on whether or not you open the email or use a link contained in the email, and how you otherwise interact with the message we sent. When collecting data automatically, we typically cooperate with third party providers and use web beacons in our emails. These are small graphics that are often transparent and can therefore not be seen. They help us understand how you interact with our email. You may set your email options to prevent the automatic downloading of images that may contain technologies that allow us to learn whether you have accessed our email and performed certain functions with it. If you access our website via a link contained within a marketing email received from us, additional information may be collected by us or our third party partners, such as your IP address.

The Legal Basis for Processing Your Personal Data and How We Use It

We may process your personal data because it is necessary for the performance of a contract with you or in order to take steps at your request prior to entering into a contract.

We may process your personal data because it is necessary for our or a third party’s legitimate interests. Our “legitimate interests” include our commercial interests in operating our business (and the business of Analysis Group more generally) in a client focused, efficient and sustainable manner, in accordance with applicable legal and regulatory requirements.

In this respect, we may use your personal data for the following:

  • to monitor, review and evaluate the performance and effectiveness of our services and our business, including to measure the success of our marketing measures and identify usage trends;
  • to seek advice on our rights and obligations, such as where we require our own legal advice;
  • sharing our knowledge and promoting our services and those of other Analysis Group member companies (for example, providing you with briefings and other publications, details of events, or information about our other services which may be of interest to you - by letter, telephone, email and other electronic means) and to personalize any such communication. If you do not wish to receive such information, please let us know now or at any time in the future by contacting us as set forth below, and your details will be removed from our mailing list(s). If you receive such information via email you may use the unsubscribe link contained in each such email to unsubscribe from receiving further marketing emails;
  • it is necessary for the establishment, exercise or defense of legal claims (for example, to protect and defend our rights or property, and/or the rights, personal safety or property of our clients, or of third parties);
  • administrative purposes, including administering finance systems and creating financial statements;
  • for fraud detection and prevention;
  • carrying out audits;
  • addressing complaints, feedback and enquiries.

We may process your personal data for our compliance with our legal obligations. In this respect, we may use your personal data in particular for the following:

  • to meet our compliance and regulatory obligations, such as tax reporting requirements;
  • in order to assist with investigations (including criminal investigations) carried out by the police and other competent authorities.

We may process your personal data to the extent you consent.

Sharing Your Personal Data with Others

For the purposes referred to in this privacy notice and relying on the bases for processing as set out above, we may share your personal data with certain third parties, including:

  • other Analysis Group member companies, including Analysis Group, Inc., located in the United States, in connection with their provision of administrative support, to support our sales and marketing efforts, and when servicing our clients or interacting with service providers.
  • our agents and contractors where there is a legitimate reason for their receiving the information, including:
    • third party consultants and experts providing services to us or directly engaged by you;
    • law firms and other service providers who are advising you;
    • providers of outsourced services to us (for example, IT vendors and cloud storage providers);
    • auditors.

Any such agents or contractors will by appropriate data processing agreements be bound to only process personal data on our behalf and under our instructions, unless such agents or contractors act as independent controllers (e.g., in the case we seek advice from lawyers and tax consultants and request the services of auditors).

  • with a third party in a business transaction, in the event that all or part of Analysis Group is sold, merged, dissolved, acquired, or involved in a similar transaction which involves the transfer of client files.
  • third parties as required by law or subpoena or if we reasonably believe that such action is necessary to (a) comply with the law and the reasonable requests of authorities; (b) to enforce our legal claims or to protect the security and/or integrity of our services; and/or (c) to exercise or protect our rights and property or the rights, property and personal safety of our employees, visitors or others.
  • To any other third party to the extent you consent thereto.

International Data Transfers

Some of the personal data we process about you may be transferred to, and stored at, a destination outside of the European Economic Area (“EEA”) or UK, including in the United States.  These transfers could occur, for example, where your personal data is processed by staff operating outside the EEA or UK who work for us or another Analysis Group entity, or where personal data is processed by one of our suppliers or vendors who is based outside the EEA or UK or who uses storage facilities outside the EEA or UK.

In the cases where a transfer of data to a location outside the EEA or UK takes place, this could mean that the data is transferred to a country with a lower level of protection of your personal data. Thus, we will only transfer your personal data on one of the following bases to ensure that your personal data is sufficiently protected:

  • where the transfer is subject to “appropriate safeguards” for international transfers prescribed by applicable law (for example, standard contractual clauses adopted by the European Commission). In particular, we have standard contractual clauses in place between Analysis Group entities in France, Belgium, and the UK and Analysis Group, Inc. located in the United States;
  • a European Commission decision and/or UK Secretary of State decision provides that the country or territory to which the transfer is made ensures an adequate level of protection. In particular, the following data transfers are covered by European Commission and UK adequacy decisions:
    • Data transfers to Groupe d’analyse SRI in Canada (per the European Commission’s and UK’s adequacy findings on the Canadian Personal Information Protection and Electronic Documents Act);
    • Data transfers from Analysis Group srl (Belgium) or Analysis Group SAS (France) to Analysis Group Ltd. (UK) (per the European Commission’s adequacy findings on the UK GDPR and DPA);
    • Data transfers from Analysis Group Ltd. (UK) to Analysis Group srl (Belgium) or Analysis Group SAS (France) (per the UK Secretary of State’s adequacy findings for the EEA countries); or
  • there exists another situation where the transfer is permitted under applicable law (for example, where we have your explicit consent or where the transfer is necessary for the performance of a contract concluded with you or concluded in your interest).

Retention of Personal Data

Subject to our legal and regulatory obligations as well as any other notices that we may provide to you, we may retain your personal data for a reasonable period after your association with us has come to an end and/or if the purpose is fulfilled for which the data has been collected. However, some personal data may be retained for longer, for example where we need to retain it due to legal and regulatory obligations (e.g., to comply with tax and commercial law).  In that case we will delete your personal data upon expiry of the applicable retention obligation.

If you receive promotional emails and unsubscribe from receiving those emails, we will delete the personal data associated with those emails. However, we will store your email address in a black list to ensure that you will not receive any further promotional emails.

Your Rights

You have the following rights regarding your personal data:

  • to obtain access to, and copies of, the personal data that we hold about you (right to access);
  • to require us to correct and complete the personal data we hold about you if the data are incorrect or incomplete (right to rectification);
  • to require us to erase your personal data under certain circumstances, such as where the personal data are no longer necessary in relation to the purposes for which they were collected or processed (right to erasure);
  • to require us to restrict our data processing activities, such as where the accuracy of the personal data is contested by you (right to restrict the processing);
  • to receive from us the personal data we hold about you which you have provided to us in a structured, commonly used and machine-readable format that supports re-use and enables you to transmit that personal data to another controller or to request the transfer of such personal data to a third party (right to data portability);
  • TO OBJECT to any processing based on our legitimate interests where there are grounds relating to your particular situation (right to object). You can object to marketing activities for any reason. If you want to object to receiving marketing emails, you can use the unsubscribe link contained in each such email to unsubscribe from receiving further marketing emails; where our processing is based on your consent, you may withdraw that consent at any time with effect from the point your consent is withdrawn. If you wish to withdraw it, please contact us using the contact details set out below. Please also note that where our processing of your personal data relies on your consent and you withdraw that consent, we may not be able to provide all or some aspects of our services to you and/or it may affect the provision of those services.

Please note that the above rights are not absolute, and we may be entitled or required to refuse requests where exceptions apply or where the requirements to exercise these rights have not been met. 

If you wish to exercise one of these rights, please contact us using the contact details set out below.

If you are not satisfied with how we are processing your personal data, you can make a complaint to the Data Protection Authority (DPA) (right to lodge a complaint). You can find out more information about how to contact your local data protection authority at: https://ec.europa.eu/newsroom/article29/items/612080. However, we encourage you to first reach out to us by using the contact details set out below so that we understand your concerns and can find a solution together.

Privacy Notice Updates

We may make changes to our privacy notice from time to time. Please review our policies regularly, as updated policies will apply to your future interactions with us.  The current privacy notice in effect will be available at https://www.analysisgroup.com/policy/.

Contact Us

If you have any queries about this privacy notice or how we process your personal data, or if you wish to exercise any of your rights under applicable law, you may contact:

  • by email: AGPrivacy@analysisgroup.com;
  • by telephone:
    • (001) 617 425 8000;
  • or by post:
      • Analysis Group Ltd., ATTN: Privacy Compliance Team, 1 Angel Court, London EC2R 7HJ, United Kingdom.
      • Analysis Group SAS, ATTN: Privacy Compliance Team, 9 rue d’Argenson 75008 Paris, France.
      • Analysis Group srl, ATTN: Privacy Compliance Team, Rue Montoyer 47, 1000 Brussels, Belgium.
Read our Website Privacy Statement
Read our Terms of Use
Read the Analysis Group EU & UK Privacy Notice – Français
Read the Analysis Group Privacy Notice for EU and UK Job Applicants - English / Français / Nederlands
Read the Analysis Group Privacy Notice for California Job Applicants
Read the Groupe d’analyse / Analysis Group Privacy Notice for Québec Job Applicants - Français / English