Privacy Notice

1. About this notice

This notice explains how CIL collects and uses your personal information.

CIL is a global consultancy that operates through the separate legal entities listed in section 2. This one notice applies to all of them, and to everyone whose personal information we hold, wherever you are. Some of the rights and protections described below apply only in certain countries; where that is the case, we say so.

Where this notice refers to "CIL", "we", "our" or "us", it means the CIL entity responsible for your personal information, as explained in section 2. Our website and our services are aimed at businesses and are not directed at children.

We deal with our use of cookies in our Cookies Policy, and with applications for jobs at CIL in our recruitment privacy notice, which is available on our careers site. Please read those alongside this notice if they apply to you.

2. Who we are

The CIL entity with conduct of your personal information (the "data controller") is normally the entity you have dealt with, the entity you have contracted with or are negotiating with, or which contacted you. Our entities are:

If you are unsure which entity holds your information, or you have dealt with more than one, please contact us.

Our Group Data Protection Lead is Tom Fletcher, a Partner of CIL Strategy Consultants Limited, 30 King Street, London, EC2V 8EH, email: DPO@cil.com.

Depending on your relationship to us, we obtain, process, store and share your information in different ways. The following table explains how we use your personal information in our business depending on our relationship to you. Multiple sections may apply to you.

We only keep your information for so long as is reasonably necessary. How long that is depends on:

• the nature of the information and how sensitive it is;
• why we hold it, and whether we still need it for that purpose;
• whether we may need it in connection with a claim brought by or against us; and
• whether we are required to keep it by law, or by a court or a regulator.

In practice, that means:

• we keep our records of an engagement, and of the people we dealt with on it, for as long as we may need them to answer questions about our work and for as long as a claim could be brought in connection with it;
• we keep records of an inquiry that did not lead to an engagement, or of a potential supplier we did not contract with, for as long as there is a realistic prospect of us working together;
• we keep your contact details for as long as you are a contact for a client or supplier of ours, or you continue to want to hear from us;
• we keep our notes and any recording from a market research interview or survey for as long as we need them for the project they were gathered for, and for our record of that project; and
• if you ask us to stop contacting you, we keep a minimal record of that request so that we can continue to honor it.

We review the information held in our contact database from time to time and remove records we no longer need.

We share your personal information only where we need to do so to comply with the law, to protect our rights, to perform our contractual obligations or to efficiently operate our business. We share your information with the following people or groups of people:

• In order to manage our business, operate a central marketing database and pursue and fulfill contracts, we may from time to time share your information with other companies within our corporate group. Every CIL entity is required to handle your information in accordance with this notice and our group-wide data protection policies and procedures.
• If you are an employee of a client or supplier of ours then we may share your information with your employer. Similarly, if you are a sole trader or partner in a business partnership then we may share your information with your employees (and if applicable, other partners). This is only done to the extent necessary for us to properly provide our services or receive your (or your organization’s) goods/services.
• Our outsourced service providers will sometimes be given access to our databases in order provide certain services to us (e.g. IT support). Our outsourced service providers have strict contractual obligations to handle your information in accordance with data protection law and to keep it confidential at all times.
• The providers of the analytics and marketing technology we use on our website and in our emails (currently Google Analytics, Hotjar and LinkedIn) and the providers who host our website and send those emails. Our Cookies Policy explains what each of them does and how to opt out.
• Where you provide us with dietary or allergy information, or information about your health-related requirements, we may share that information with facility providers such as caterers (for dietary requirements) or venue organizers (e.g. hotels and transportation companies). You will have been notified of this fact at the point you shared that information with us (e.g. when signing our consent form).
• Our professional advisers (including accountants, bookkeepers, and lawyers). All such people are subject to professional duties of confidentiality.
• Public authorities, regulators, courts and law enforcement, where we are required by law to disclose your information or where we need to do so to defend legal claims.
• Potential purchasers of our business would have access to redacted information about our clients, suppliers and their workers/representatives. Before we share such information, the potential purchaser would need to sign a non-disclosure agreement which fully complies with data protection law.

We operate in the United Kingdom, the European Union and the United States, so your information may be transferred between our UK, French, German and US entities, and to our service providers. Transfers between our UK and EU entities do not require additional safeguards, because the UK and the EU each recognize the other as providing an equivalent level of protection.

Where we transfer information from the UK or the European Economic Area to our US entity, we rely on the European Commission’s Standard Contractual Clauses and, for transfers from the UK, the UK International Data Transfer Addendum. Where our service providers process your information outside the UK or the European Economic Area, they do so under safeguards set out in our contracts with them.

You can ask us for a copy of the safeguards we rely on by contacting our Group Data Protection Lead.

We have appropriate technical and organizational measures in place to protect your information against loss, misuse and unauthorized access, and we limit access to those of our people and providers who need it. No transmission over the internet or by email can be guaranteed to be secure, so please take care what you send us by those means. If a security incident affects your personal information we will notify you and the relevant authorities where the law requires it.

We do not make automated decisions about you based on your information. If this changes in the future, then we will let you know.

We use artificial intelligence tools to support our work. Where those tools process personal information they do so only for the purposes set out in this notice and under the supervision of our people, who review the output before it is used, and we do not permit our providers to use your personal information to train their publicly available models.

Depending on where you live, data protection law gives you some or all of the following rights:

• the right to be informed about what we do with your information. This notice provides you with this information;
• if we are processing your data on the basis of your consent then you have the right to withdraw that consent at any time. Consent can be withdrawn by notifying us using the details set out in section 13. Consent to marketing communications can be withdrawn by following the steps outlined in that communication, such as clicking the ‘unsubscribe’ link in the marketing emails we send. The lawfulness of our historic processing based on your consent will not be retrospectively affected by your withdrawal of consent;
• the right to access a copy of your information which we hold. This is called a ‘data subject access request’. Additional details on how to exercise this right are set out in section 9.
• the right to prevent us processing your information for direct marketing purposes. We will usually inform you (before collecting your data) if we intend to use your data for such purposes or if we intend to disclose your information to any third party for such purposes. You can exercise your right to prevent such processing by checking certain boxes on the forms we use to collect your data or by contacting us using the details set out in section 13.
• the right to object to decisions being made about you by automated means. We will inform you if your information is subject to automated processing.
• the right to object to us processing your personal information in certain other situations.
• the right, in certain circumstances, to have your information rectified, blocked, erased or destroyed if it is inaccurate.
• the right, in certain circumstances, to claim compensation for damages caused by us breaching data protection law.
• the right, in certain circumstances, to request that we erase, rectify, cease processing and/or delete your information.

If you live in California or another US state with a privacy law, you also have the right to opt out of the "sale" of your personal information and of its use for targeted advertising, to limit our use of sensitive personal information, and to appeal if we refuse a request. We do not sell your personal information for money. If you consent to marketing cookies, information about your visit is shared with LinkedIn so that we can show you our advertising on its platform, and you can withdraw that consent at any time in our cookie settings. We will not treat you less favorably because you have exercised any of these rights.

To exercise any of these rights, contact us using the details in section 13. We may need to ask you for information to confirm your identity first.

Under data protection law you can exercise your right of access by making a written request to receive copies of some of the information we hold on you. You must send us proof of your identity, or proof of authority if making the request on behalf of someone else, before we can supply the information to you. Requests should be sent to us using the contact details in section 13.

You do not need to pay a fee to exercise this right unless you are requesting copies of documents you already possess, in which case we may charge our reasonable administrative costs. We are also allowed to charge you for our reasonable administrative costs in collating and providing you with details of the requested information which we hold about you if your request is clearly unfounded or excessive. In very limited circumstances, we are entitled to refuse to comply with your request if it is particularly onerous.

In certain circumstances, you are entitled to receive the information in a structured, commonly used and machine-readable form. We will respond within the time the law allows us, being one month in the UK and the EU, and 45 days in most of the United States. If we need longer, we will tell you.

If you have any concerns about how we hold and use your information, please tell us first, using the details in section 13. We will acknowledge your complaint, look into it and respond within one month.

If you are not satisfied with our response, you can complain to the data protection authority where you live. In the UK that is the Information Commissioner’s Office (www.ico.org.uk); in France, the CNIL (www.cnil.fr); in Germany, the Bavarian authority BayLDA (www.lda.bayern.de); and in the United States, your state Attorney General.

Our site may, from time to time, contain links to and from the sites of our partners and affiliates, and social networks. If you follow a link to any of these websites, please note that these sites have their own privacy notices and that we do not accept any responsibility or liability for those notices. Please check their privacy notices before you submit any personal data to those websites as they may not be on the same terms as ours.

This notice was last updated in August 2026. Any material changes we may make to our privacy notice in future will be uploaded to our website and if the change is significant, we will send you the updated notice by email.

Questions, comments and requests regarding this privacy notice are welcomed and should be addressed to our Group Data Protection Lead, Tom Fletcher, using the following details:

• by post to Tom Fletcher, CIL Strategy Consultants Limited, 30 King Street, London, EC2V 8EH; or
• by email to DPO@cil.com.