UK Privacy Policy

EG GROUP

PRIVACY NOTICE - UK

THIS PRIVACY NOTICE

This Privacy Notice explains how we collect, use, share and otherwise process your personal data in connection with our UK activities. We also explain what rights you have in relation to your personal data.

In this Privacy Notice, when we use terms like “we”, “us”, “our” or “EG Group”, we refer to the UK business of EG Group (as further defined below).

We are regulated by the Information Commissioner’s Office, which is UK data protection regulator, or any successor body to it. We refer to this body (or its successor) as the “ICO” in this Privacy Notice.

We may update this Privacy Notice from time to time to reflect changes in applicable laws or the way we use your data. The Privacy Notice displayed on this page is always the most up to date version. We would encourage you to re-visit this Privacy Notice from time to time so that you are aware of any relevant updates we have made.

To contact us, please see the “How To Contact Us” section at the end of this Privacy Notice.

WHO THIS PRIVACY NOTICE APPLIES TO

This Privacy Notice is directed to individuals based in the UK. It applies to customers, potential customers, visitors to our website or any of our physical premises or sites, suppliers, potential suppliers, business intermediaries and partners, advisers and job applicants.

This Privacy Notice does not apply to our employees. If you are an employee of EG Group, please instead refer to the Employee Privacy Notice which is available to you on our internal systems.

ABOUT US

EG Group Limited (an English company with company number 09826582) is the immediate parent company of a group of companies, which operate in a number of countries around the world. We refer to the subsidiaries of EG Group Limited which are incorporated in England and Wales, or which have an establisment in or operate in the UK, as “EG Group”.

In the UK, the main operating companies of EG Group are:

EG Corporate Services Limited (an English company with company number 14941036). This company operates and manages this website, manages and operates EG Group’s UK CCTV systems, provides customer services and responds to customer enquiries and complaints, and manages all central finance, operational and legal matters (including any legal claims or actions). This company is the controller of your personal data which is collected, used or otherwise processed in connection with these activities. This company is registered as a controller with the ICO under number ZB639944.
EG Finco Limited (an English company with company number 09826778). This company employs some UK staff, and is the controller of personal data relating to their employment. This company is registered as a controller with the ICO under number ZC177615.
EGspresso Limited (an English company with company number 15169648). This company operates our Starbucks® franchised business in the UK, and processes transactions for customers who purchase goods from our franchised Starbucks® outlets. This company is the controller of your personal data in connection with these activities. This company does not undertake any direct marketing, whether by email or otherwise, or maintain any customer marketing lists. This company does not operate any mobile apps (which are instead operated centrally by or on behalf of the UK Starbucks® franchisor). In addition, this company employs our staff working within the UK Starbucks® business, and it is the controller of personal data relating to their employment. EGspresso Limited is (with the agreement of the ICO) not registered as a controller with the ICO because its data processiong operations are exempted from registration.
EVPoint Services Limited (an English company with company number 14875983). This company provides EV charging point services at various sites in the UK, and it operates a mobile app relating to those services. This company is the controller of your personal data which is collected, used or otherwise processed in connection with these activities. If you are a customer of our EV charging services, please also refer to the privacy notice at https://www.ev-point.com. This company is registered with the ICO under number ZB639956.

Various of the EG Group operating companies may be the data controller of your personal data, depending on the specific activities undertaken (as described above). This Privacy Notice is therefore made on behalf of, and applies to each of, the UK companies within the EG Group, in respect of the various activities for which they are data controller.

EG Corporate Services Limited, EG Finco Limited and EVPoint Services Limited have formally appointed a data protection officer, who may be contacted at dpo@eg.group. The DPO’s office is also the point of contact for all other enquiries of EG Group relating to data protection matters.

TERMINOLOGY USED IN THIS PRIVACY NOTICE

We use several terms in this Privacy Notice which have a particular legal meaning, as follows.

‘Personal data’. This is a very broad concept. It covers any information relating to a “data subject”. We have defined certain types of personal data in the section immediately below, which we use throughout this Privacy Notice.
‘Data subject’. This means any living individual “who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.
‘Special category’ data. Data protection law provides higher protection to specific types of personal data, known as ‘special categories’. These are as follow: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data (such as fingerprinting) used to identify you, health data, and data relating to sex life and sexual orientation.
‘Lawful basis’. In the section below entitled “How And Why We Process Your Personal Data”, we have described several different concepts of “lawful basis” of our processing, namely: “Contract Performance”, “Legitimate Interest”, Recognised Legitimate Interest”, “Legal Obligation” and “Consent”. We have also described several different legal conditions for processing, namely: “Employment & Social Security Condition”, “Substantial Public Interest Condition” and “Legal Rights Condition”. These reflect definitions contained in applicable data protection law.

TYPES OF personal data PROCESSED BY US

To help explain the different types of data we use, we have categorised them as follows.

Identity data: Data specifically related to your identity which includes, your full name, marital status, title, date of birth, national insurance details and other recognised official identity documents.
Contact data: The contact data of you and others, including, email addresses and telephone numbers, postal address details and social media handles.
Technical data: Technical data such as your internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our websites. We may use cookies or similar technologies to collect Technical dataa. Please see our Cookies Policy (available on our website) for more information.
Marketing data: To help us develop lasting relationships with our customers, we may from time to time provide you timely and relevant information about services and products which we think are relevant to you. You always have the option to decline this or opt out at any point. We may also collect data about your marketing preferences.
Location data: If we provide any location-based features or functions to you, whether via our website or a mobile app, we may access and collect your geolocation data in order to facilitate those features and functions.
Transaction data: We may collect data about the products you buy, billing address, method of payment, and payment details.
Engagement data: We may collect data from you when you submit a review, comment or other content to our websites or on our social networking pages, and when you contact us. In addition, we track when you like us or share our content through Facebook, Twitter, Instagram or other social networking platforms. Please see our Cookie Policy for more information.
CCTV data: We operate CCTV at our sites and premises, and we may collect imagery of you in the normal course of our business. Please see the section entitled “Our Use Of CCTV” for more details.
Communications data: We may collect or generate data from you in connection with any enquiry, complaints or other correspondence we may have with you.

Some of these categories of personal data may contain “Special Category data”. This concept is discussed and defined in the section above entitled “Terminology Used In This Privacy Notice”. These instances are likely to be incidental, however, and are not part of an organised processing activity.

In addition, if you are a job applicant, then (depending on the role applied for) we may obtain details relating to any criminal offences or convictions you may have had, which we refer to as “Criminal offence data”. This processing is undertaken only where strictly necessary, and in compliance with applicable law.

Please note that we do not knowingly collect personal data relating to children. Our websites and our services are not specifically intended for children. If you are under the age of 16, please obtain consent from your parent or guardian before you submit any personal data to us. If you are a parent or guardian of a minor and you have reason to believe your child or ward has provided us with their personal data without your prior consent, please contact us to request the erasure of their personal data or for the minor to be unsubscribed from our mailing lists.

HOW WE COLLECT YOUR PERSONAL DATA

Personal data you voluntarily provide to us

We only collect personal data that is relevant to our relationship with you, for example:

when you visit our websites, or use our mobile applications, we use cookies and similar technologies, and we cover this in more detail in our Cookie Policy;
when you subscribe to our mailing lists;
when you attend events or meetings organised by us, or conducted at our offices or sites, for example, sales events, promotional and marketing events, training sessions and social events;
when your images are captured by us via CCTV cameras while you are within the properties we operate and use, or when photographs or videos of you are taken when you attend events, meetings or training sessions organised by us;
when you use our services or enter into transactions with us, or express an interest in doing so, including services, products and transactions in person at one of our many locations or electronically;
when you communicate with us by telephone, email, via our website or through other communication channels, for example, through social media platforms;
when you submit an employment application to us or when you provide documents or information including your CV in connection with such applications;
when you make a purchase through our websites; and/or
when you submit your personal data to us for any other reason.

Personal data that has been provided by others

Depending on your relationship with us, we may also collect your personal data from third party sources, for example:

from your referees, educational organisations or previous employers (if you have applied to us for a job);
from your family members, friends or colleagues who provide your personal data to us on your behalf; or
from public agencies or other public sources.

HOW AND WHY WE PROCESS YOUR PERSONAL DATA

We are required to process your personal data on the basis of a stated ‘lawful basis’. The most relevant types of lawful basis, which are strictly defined by law, are explained below.

Contract Performance. This basis where we need to process your personal data to perform a contract with you or where you ask us to take steps before we enter into a contract with you. Where we rely on performance of a contract and you do not provide the necessary information, we will be unable to perform your contract.
Legitimate Interests. This basis applies where it is necessary for our legitimate interests (or those of a third party), and your interests and fundamental rights do not override those interests. We will consider and balance any potential impact on you (both positive and negative) and your rights when processing your personal data for our legitimate interests. Our legitimate interests include:
marketing activities (except where we rely on your consent to contact you about our products and services, as explained in the table below);
analysis to inform our marketing strategy, and to enhance and personalise your customer experience (including to improve the recommendations we make to you on our website);
to correspond or communicate with you;
for employment-related purposes, including verifying information in a job application;
to verify the accuracy of data that we hold about you and create a better understanding of you as a customer;
for network and information security in order for us to take steps to protect your data against loss or damage, theft or unauthorised access;
for prevention of fraud and other criminal activities;
to comply with a request from you in connection with the exercise of your rights (for example where you have asked us not to contact you for marketing purposes, we will keep a record of this on our suppression lists in order to be able to comply with your request);
for sharing of your personal data between EG Group companies where necessary for internal administration purposes;
to assess and improve our service to customers through recordings of any calls;
for the management of queries, complaints, or claims; and
for the establishment and defence of our legal rights.
Recognised Legitimate Interest. We may sometimes use your personal data because we (or a third party) have a recognised legitimate interest. Recognised legitimate interests apply where there are public interest reasons for processing (such as preventing or detecting crime, safeguarding individuals, responding to emergencies, supporting national or public security or defence, or sharing information with public bodies when they confirm it is necessary for their official functions). Where we rely on a recognised legitimate interest, we will ensure the use is strictly necessary and only use or share the minimum data required.
Legal Obligation. This basis applies where we need to use your personal data to comply with a legal or regulatory obligation. Where we rely on legal obligation and you do not provide the necessary information, we may be unable to fulfil a right you have or comply with our obligations to you, or we may need to take additional steps, such as informing law enforcement or a public authority or applying for a court order.
In some circumstances, we may seek your consent in order to process your personal data. We are required to ensure that your consent is given as a specific, informed and unambiguous indication of your wishes. You can withdraw your consent at any time by contacting us (see the section below entitled “Your Rights Relating To Your Personal Data”). If you withdraw your consent for us to process any specific personal data, this does not affect the lawfulness of our processing (based on that consent) of that personal data before the date of its withdrawal.

In addition to the above, in respect of our processing of any of your special category data, we must also be able to rely on one of the following conditions:

Employment & Social Security Condition: where our processing is necessary for the purposes of carrying out our legal obligations under employment and social security law.
Substantial Public Interest Condition: where our processing is necessary for reasons of substantial public interest.
Legal Rights Condition: where our processing is necessary to establish, exercise or defend our legal rights or claims.

We have set out details in the table below of what types of personal data we process, why we process it, and the lawful basis relied on by us for that processing.

Type of processing	Data category	Our lawful basis	Specific purpose
Marketing communications	Identity, Contact, Communications & Marketing data	Consent; Legitimate Interests	When you’ve asked us to, or if you are an existing customer, we’ll use your data to contact you with details of our products, events and services and to facilitate our relationship with you, your business or colleagues. You have the right to opt-out of email marketing at any time, and to object to marketing in any form. Our legitimate interest in relation to this processing is to promote our business products and services to you.
Customer and supplier relationship management	Identity, Contact, Communications Marketing, Transaction & Engagement data	Legitimate Interests	We organise our customer and supplier records within relationship management systems. We securely store, access, and analyse the data that we have in our CRM systems. The use of our CRM systems helps us ensure the smooth operation of our businesses, plan effectively and it helps us analyse our business. Our legitimate interest in relation to this processing is to manage our customer and supplier data and accounts efficiently and responsibly, and to enable us to optimise our products and services.
Customer service	Identity, Contact, Technical, Communications & Transaction data	Contract Performance; Legal Obligation; Legitimate Interests	We keep and maintain records of any enquiry or complaint made by you. Our legitimate interest in relation to this processing is to manage our customer service processes efficiently and to improve our future services.
Training and other corporate events	Identity & Contact data (including Special Category data)	Contract Performance; Consent; Legitimate Interests + Substantial Public Interest Condition	The data you provide will be used to communicate with you about your attendance at the event and to follow-up on your experience post-event. We will ask for your consent to process any health data (such as dietary data or data relating to mobility or disability). Our legitimate interests in processing this data is to ensure efficient and safe operation of training and events.
Promotional images and footage	Identity data	Consent	We may take photographs and / or video footage at our offices or an event we host, which could capture personal data of customers, suppliers, visitors and other third parties. We will always notify participants when a photographer or filmmaker is present at our offices or events. Written consent will always be obtained, and we will respect the wishes of anyone who signals their desire not to have their image taken and will always ask for consent where photos are to be published alongside a name or other personal identifier.
Disclosure to regulators and government bodies, and to our professional advisers	All categories (including Special Category data and Criminal offence data)	Legal Obligation; Legitimate Interests; Recognised Legitimate Interest + Substantial Public Interest Condition; Legal Rights Condition	We are subject to reporting, filing and (in some cases) audits and assessments to or by regulators, government entities (such as HMRC or Companies House) and industry standard bodies. In this context, we may be required to share data with disclose your personal data either to comply with the law or in the protection of our business interests. We may also share your data voluntarily with law enforcement and/or advisers in some circumstances; in these cases our legitimate interest for doing so is to assist in any criminal investigation, and to defend or enforce our legal rights.
Administrative and business purposes	All categories (including Special Category data and Criminal offence data)	Legitimate Interest + Legal Rights Condition	We may disclose your personal data to other companies within the EG Group, our investors and third parties who provide services to us, including our service providers and data processors (providing services such as hosting and maintenance services, analysis services, e-mail messaging services, delivery services, handling of payment transactions, marketing, human resources and other professional services) and our consultants and professional advisors (such as accountants, compliance, lawyers and auditors). Our legitimate interest in relation to this processing is to ensure the efficiency and resiliency of our business operations.
Recruitment	Identity, Communications & Contact data (including Special Category data or Criminal offence data)	Legal Obligation; Legitimate Interests + Employment & Social Security Condition	If you apply for a job with us, we shall maintain a record of your application and associated data during the recruitment process and (if you are unsuccessful) for a short period of time thereafter. We also maintain a restricted list of unsuccessful job applicants. We may pass your personal data to other departments within the EG Group, for the purpose of offering alternative or additional employment opportunities. Our legitimate interest in relation to this processing is to ensure efficiency, resiliency and legality of our recruitment processes in the normal course of our business.
Security & Safety	Identity, Contact, Technical & CCTV data (including Special Category data or Criminal offence data)	Legal Obligation; Legitimate Interests; Recognised Legitimate Interest + Substantial Public Interest Condition	We may process personal data for the specific purposes of security and safety. This is in connection with the buildings that we own and/or rent, or events organised by us or conducted at the buildings we own and/or use; and through the systems that we operate throughout the organisation. We use CCTV in and around our sites for your security and safety, and to prevent and detect crime. (Please see section entitled “Our Use of CCTV” for further details.) Our legitimate interest in relation to this processing is to protect the safety and security of our assets and staff, and to prevent and detect criminal acts affecting our business and to prosecute offenders.
Investor relations	Identity, Contact, Technical & Communications data	Legitimate Interests	We like to build lasting relationships with our investors, and in addition to any registering your contact details with any investor or incentives portal we may provide, we’ll also use your data to invite you to press releases, presentations and other investor relations events. Our legitimate interest is to maintain appropriate investor relations in the normal course of our business.
Personalise content and apps	Identity, Contact, Technical & Location data	Consent	To make recommendations, promotions and offers to you about our products and services; to tailor the data that we send or display to you; to offer customisation, based on your location; and to otherwise personalise your experiences based on your digital interaction with us.

OUR USE OF CCTV

We have installed CCTV cameras across many of our sites and premises. Our use and operation of these systems is necessary for the legitimate purposes of our business. Specifically we operate CCTV for the following purposes:

to deter, prevent, detect, record and allow investigation and analysis of any type of incident, primarily including malicious or criminal acts. This description includes theft, vandalism and property damage to our goods, premises, vehicles and equipment. It also covers acts of violence or assaults against our staff, visitors or customers;
to support police forces, and other law enforcement agencies, in investigating crimes or suspected crimes and in prosecuting offenders. In this respect we may be asked to share CCTV footage with police forces in response to their requests, in connection with investigations or enquiries being pursued by them;
to assist in resolving disputes which arise in the course of disciplinary or grievance proceedings with members of staff. This may include action taken by us against a member of staff for actions which, whilst not being criminal in nature, amount to misconduct or gross misconduct; and
to assist in the defence of any civil litigation, including employment tribunal proceedings.

We do not employ CCTV equipment in private areas, such as restrooms, toilets or changing rooms, or otherwise deploy covert CCTV technology. Where CCTV is deployed externally, we will only capture images of public streets and buildings, where permitted. Our CCTV does not record any audio.

Our CCTV footage is subject to a maximum 30 day retention period. This means that the footage on each day is automatically overwritten on or before 30 days after the date of first being recorded, unless it has been specifically downloaded and set aside by us.

Only authorised personnel have permission to operate the CCTV systems and view the images, including security teams and appropriate management, internal and external legal advisors, and police, law and regulatory enforcement authorities.

AUTOMATED DECISION-MAKING

When we refer to “Automated Decision Making”, we mean a decision which is made about you by a computer system, without any meaningful human involvement, and which has a legal or similarly significant effect on you.

We will not undertake any Automated Decision Making about you which is based on any of your Special Category data, unless either (a) we have your explicit consent to do so, or (b) it is necessary to do so in order to enter into or perform a contract with you (or else is required or authorised by law), and in addition it is necessary for us to do so for reasons of substantial public interest.

If we undertake any other Automated Decision Making about you, which is based on your personal data, we shall provide you with information about the automated decisions taken, and we shall enable you to make representations to us, and obtain human intervention, about those decisions, and to contest those decisions.

OUR SHARING OF YOUR PERSONAL DATA

Sharing with our service providers

In the normal course of our business, we may share your personal data with other businesses who provide services to us, and who process that data for us and on our behalf. This includes sharing with vendors and service providers, who are engaged to provide business, support, operational and/ or administrative functions such as IT support, auditing, legal, marketing, website maintenance, payment, fulfilment and delivery of orders. It might also include sharing of data with credit reference agencies, debt collection and tracing agencies.

When disclosing personal data to third parties, we have contracts with these third parties to protect your personal data, which ensures we are compliant with the law and so that they only process your personal data in accordance with our instructions.

Sharing with other businesses

We may also share your personal data with other businesses, who use that data for their own purposes (and as independent ‘data controllers’). Examples of this are as follows:

if our business, or a part of it, is sold or integrated with another business, your details may be disclosed to our advisers and any prospective purchaser’s adviser and will be passed to the new owners of the business;
data may be shared to other companies within the EG Group, where necessary or desirable for centralised management purposes, including operations, marketing, IT, HR or finance functions. This may include sharing with international entities;
data may be shared with regulatory authorities, statutory bodies or public agencies, including to support their investigations or enquiries;
data including CCTV footage may be shared with government or law enforcement authorities, in connection with their discharge of their public duties (such as the prevention and detection of crime);
we may share Contact data, Transaction data, Marketing data, Engagement data or Communications data with our franchisors, or with other businesses with whom we work, who need to have that data in order to provide services to you whilst engaging with us or whilst visiting our sites.

International transfer of your personal data

In the provision of our website and services to you, we may from time to time need to transfer data to other entities which are based outside of the UK. The UK General Data Protection Regulation has strict rules about this kind of data transfer. Where this occurs, we shall ensure we have put in place all safeguards required by the law, including, as necessary, undertaking due diligence against the recipient of the data, undertaking risk assessments and putting in place contracts containing approved data transfer provisions. If you would like any more information, please contact us at dpo@eg.group.

SECURITY OF YOUR PERSONAL DATA

Unauthorised access. We have put in place security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.
Specific access. We limit access to your personal data to those employees, agents, contractors and other third parties who have been authorised to access your personal data.
Vulnerabilities. We have put in place procedures to deal with any suspected personal data breach and will notify you and the appropriate supervisory authority of a breach where we are legally required to do so. However, we cannot guarantee that our systems or applications are invulnerable to security breaches, and we cannot provide any guarantee that your use of our systems or applications is safe and protected from viruses, and other vulnerabilities. We also cannot guarantee the security of data that you choose to send us electronically. Sending data to us electronically is entirely at your own risk.
Third-party links. Our websites contains links to third-party websites. Any access to and use of such linked websites is not governed by this Privacy Notice, but by the privacy notices of those third-party websites. We are not responsible for the information practices of such third-party websites. Please read their respective third-party privacy notices for information about how these third parties handle the processing of your personal data.

HOW LONG WE KEEP YOUR PERSONAL DATA

We will only retain your personal data for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data in question, the potential risk of harm from unauthorised use or disclosure of it, the purposes for which we process it, and the applicable legal requirements.

Details of retention periods for different aspects of your personal data are available on request, by emailing us at dpo@eg.group.

YOUR RIGHTS RELATING TO YOUR PERSONAL DATA

At any point while we are processing your personal data, you may exercise certain rights against us, known as ‘data subject rights’. We have summarised these rights below.

We have a one-month time period in which to respond; however, if your request is complex then we may extend that limit by up to two further months. We reserve the right to ask for further information from you in order to identify more clearly what details you are seeking, and until we have received that further information the statutory time-period is paused.

In normal cases, you may exercise your statutory right free of charge. We may also ask for a reasonable administration fee, or decline your request, if we consider that your request is manifestly unfounded or excessive in nature.

Right of access. You have the right to request a copy of the information that we hold about you. Access to a copy of your personal data is often known as a Data Subject Access Request. There are a number of exemptions which apply to this right, and in addition we have a duty to ensure that we do not disclose personal data relating to others when responding to a Data Subject Access Request, which means that usually documents will be redacted or obscured to remove all details which would identify others. Please note that we are only legally obliged to provide information to you as a result of a reasonable and proportionate search. If your request is so broad or undefined that it would not allow a reasonable or proportionate search to be undertaken, then we shall ask you to narrow your request.

Right of rectification. You have a right to review and correct data that we hold about you that is inaccurate or incomplete.

Right of erasure. You may request that we erase data that we hold about you. This is not an absolute right. It only applies in certain circumstances. In particular, we must erase your data upon request if: (a) we have obtained your personal data on the basis of your consent, and you withdraw that consent; (b) your personal data is no longer needed by us for the purposes for which it was obtained; or (c) our processing is based on the grounds that it is necessary for a Legitimate Interest or for a Recognised Legitimate Interest, and you have objected to that processing and we cannot show compelling legitimate grounds which override your objection.

Right to restriction of processing. Where certain conditions apply, you have a right to restrict our processing. In particular, if we do not need to process your data in order to meet a contractual or other legal requirement, or if we are using your data only for direct marketing, then you may be entitled to restrict our further usage of it.

Right of portability. You have the right to have the data that you have provided to us, for the fulfilment of a contract or where you have provided your consent, transferred in a structured and machine-readable format to another organisation.

Right to object. You have the right to object to certain types of processing. In particular, you have a right to object to our processing of your personal data for direct marketing purposes (including profiling in relation to that direct marketing). You will be able to object to or opt out of any marketing message we send you.

Right to complain to us. You have the right to complain to us directly in connection with any aspect of our processing of your personal data. To do so, please contact us at dpo@eg.group. Alternatively, you can write to us at: DPO, EG Group, Lofthouse, Burnden Way, Middlebrook, Bolton, Lancashire BL6 6JW. We shall acknowledge receipt of your complaint within 30 days, and we shall take appropriate action in response to your complaint (including informing you of the outcome) without undue delay.

Right to complain to the ICO. You also have the right to complain directly to the UK regulator, the Information Commissioner’s Office (also known as “the ICO”). Details of how to contact the ICO may be found at https://ico.org.uk/make-a-complaint/.

HOW TO CONTACT US

If you have a query about our processing of your personal data, or you want to exercise a statutory right in relation to your personal data, there are a number of ways you can contact our team. You can write to us at DPO, EG Group, Lofthouse, Burnden Way, Middlebrook, Bolton, Lancashire BL6 6JW. Alternatively, you may email us at dpo@eg.group.

Last updated: 15 July 2026

PRIVACY POLICY