Privacy notice
Ricardo Plc and its subsidiaries and affiliates (“Ricardo”, “we”, “us” or “our” together or individually as applicable) is committed to comply with its legal obligations under the applicable privacy law in different territories, including but not limited, data protection principles set out in UK GDPR, meaning the retained EU law version of the General Data Protection Regulation (EU) 2016/679 as it forms part of England and Wales, Scotland and North Ireland law by virtue of the European Union (Withdrawal) Act 2018, the UK Data Protection Act 2018, and the General Data Protection Regulation (EU) 2016/679 (GDPR).
This Privacy Notice explains why and how Ricardo processes personal data provided to us by individuals themselves or by others, or collected by us during our business activities, as well as personal data we receive through our websites.
References in this notice to “you” or “your” are references to individuals whose personal data Ricardo processes. For the avoidance of doubt, any reference in this notice to our “clients” or “suppliers” include their employees or other staff whose personal data we process.
If you have any questions about this Privacy Notice, how it applies to you, or would like to exercise your legal rights, contact our Privacy Team at DataProtection@Ricardo.com.
SCOPE OF THIS PRIVACY NOTICE
This Privacy Notice covers the following:
• Visitors to our websites
• Clients and potential clients
• Individuals whose personal data we obtain in connection with providing services to our clients
• Suppliers
• Job applicants
• Visitors to Ricardo offices
• Events organised by Ricardo
• End users of Ricardo’s web Platforms
• End users of Ricardo software applications
We use cookies on our websites. This Privacy notice should be read alongside our Cookie policy.
VISITORS TO OUR WEBSITES
We automatically collect data using cookies when you visit our websites. This includes your IP address, device and browser type, URI, operating system, location, and how you interact with our site (e.g., pages visited, actions taken, time spent). See our Cookie policy for details.
When you visit our websites, you may also share with us some of your personal data. For example, when you contact us, you subscribe to receive news and updates, or you subscribe to marketing communications. This may include your name, surname, email address, phone number, job title, company and country.
We do not intentionally collect special categories of personal data. If you provide it, you consent to our processing.
We process your personal data for the following purposes:
- Managing our website.
- Personalising your browsing experience.
- Developing our business and services.
- Communicating with you to provide requested information or ask for further information.
- Providing you with marketing communications (if you’ve opted in).
- Analysing website usage.
- Fulfilling any other purpose for which you provided information to Ricardo.
Legal grounds for processing your data are your consent (e.g., for marketing) and our legitimate interests to fulfil the purposes above.
CLIENTS AND POTENTIAL CLIENTS
Ricardo processes personal data of clients, and individuals associated with them, to manage the relationship, provide the services and manage the contract.
We also process personal data of potential clients. We collect business contacts details directly from you or the organisation you work for or represent, or from publicly available sources including social media sites.
The personal data we process is generally limited to your name, surname, job title, the company you work for, and contact information such as business email address and telephone number.
In the context of providing some of our services to clients, we also process personal data of individuals who are not directly our clients. See the section “Individuals whose personal data we obtain in connection with providing services to our clients” for additional information.
Legal grounds for processing personal data of our clients are:
- Compliance with a legal or regulatory obligation.
- Performance of the contract
- Ricardo’s legitimate interest in administering and managing our relationship with clients and potential clients.
- Ricardo’s legitimate interest in using business contact details to provide information to clients and potential clients that we think will be of interest, for example, information about Ricardo, industry updates and insights, offers for our services, and invitations to events.
INDIVIDUALS WHOSE PERSONAL DATA WE OBTAIN IN CONNECTION WITH PROVIDING SERVICES TO OUR CLIENTS
When providing some of the services to our clients, Ricardo may process personal data of data subjects that has been shared by our clients or suppliers (including subcontractors and partners). Ricardo may also collect personal data of data subjects on client’s behalf. For example, when Ricardo provides chemical emergency response services, our highly trained emergency responders handle telephone calls, on behalf of our clients, to provide the caller with support during a business related or personal emergency.
Another example would be when we carry out surveys, interviews, email campaigns, exhibition events on behalf of our clients.
Ricardo policy is to collect and process only the personal data that is necessary to fulfil the agreed purposes. When we collect your personal data, we may communicate you who is the data processor and who is the data controller.
The specific responsibilities of Ricardo, who may act as a data processor, and the client will be detailed in the relevant data processing agreement.
Due to the diversity of the services we provide, the personal data we process varies and could include personal and contact details (e.g. name, email address, home address, telephone number, age, location, home address, gender) and job details (e.g. role or experience). For certain services we may process special categories of data for example health information with your explicit consent or where another legal basis applies.
Legal grounds for processing personal data of individuals whose personal data we obtain when providing services to our clients are:
- Ricardo legitimate interest to deliver the services.
- Ricardo vital interest, for example, where the processing is required to protect somebody's life in an emergency situation.
- Compliance with a legal or regulatory obligation.
SUPPLIERS
We process personal data about our suppliers (including subcontractors and partners) to manage the relationship, the contract, to receive services from them, and where relevant to provide services to our clients. We also process their data for audit purposes (i.e. crime checks or conflict of interest).
The personal data we process is generally limited to contact information (name, phone, email and other business contact details) and payment related information, such as bank details, invoice information, and payment history.
Legal grounds for processing personal data of our suppliers are:
- Compliance with a legal or regulatory obligation.
- Performance of the contract.
- Ricardo’s legitimate interest in administering and managing our relationship with our suppliers, subcontractors and partners.
- Ricardo’s legitimate interest in managing payments and collecting and recovering money
- Ricardo’s legitimate interest in carrying out bribery and corruption, adverse media, and other financial crime checks when appointing a supplier, subcontractor, and partner.
- Ricardo legitimate interest in carrying out conflict of interest checks when appointing a supplier, subcontractor and partner.
- Ricardo legitimate interest to use business contact details to provide information to supplier that we think will be of its interest, for example, information about Ricardo, industry updates and insights, offer our services and invitations to events.
JOB APPLICANTS
As part of our recruitment process, we advertise roles online and you can apply for these by completing the application form available online.
Therefore, most of the personal data we collect as part of this process is provided by you, such as:
- Personal details: name, surname, photographs, gender, date of birth, passport or other official identity number, visa information, home address, social media account.
- Contact details: email address and telephone number.
- CV, professional experience, education, academic and professional qualifications.
The data you submit will be shared with relevant hiring managers and persons involved in the recruitment process. If invited to an interview, we will collect additional information such as interview notes, assessment results, feedback and offer details.
If your application is successful, we will collect additional information, for example, bank account details. We will also obtain personal data from third-party sources, such as references from your named referees or pre-employment screening results. For certain roles and if permitted under applicable law, we will obtain criminal background checks results. In addition, as part of the onboarding process and where we have an obligation under employment law, we will collect some special categories of data for example individual’s disabilities.
Legal grounds for processing job applicants’ personal data are:
- Explicit consent of the applicant.
- Ricardo’s legitimate interest in attracting and identifying talent by searching our talent pool.
- Ricardo’s legitimate interest in processing and managing applications for open roles, including evaluating your profile, selecting candidates, and conducting interviews.
- Ricardo’s legitimate interest in hiring and onboarding you.
- Ricardo’s legitimate interest in managing our career website, including conducting statistical analysis and creating reports.
- Compliance with a legal and regulatory obligations.
VISITORS TO RICARDO OFFICES
When you visit our offices, we process your personal data to provide you with certain facilities (e.g. Wi-Fi), to control access to our buildings, and ensure the security of our offices, personnel, goods and confidential information.
We collect your name, contact details and arrival/departure times.
Visitor records: We maintain secure visitor logs, accessible only on a need-to-know basis, for example for emergency purposes.
Wi-Fi: We monitor Wi-Fi traffic. This allows us to see limited information, including source and destination addresses the user is connecting from and to.
CCTV: CCTV is used in some offices where we put signs to show that CCTV is in operation. Recordings are securely stored and accessed only on a need-to-know basis (e.g., incident investigation) and may be shared with law enforcement bodies if legally required. Recordings are deleted after a short period of time unless an issue requires investigation.
Legal grounds for processing personal data of visitors are Ricardo’s legitimate interest in ensuring the security of our offices, personnel, goods and confidential information and crime prevention.
EVENTS ORGANISED BY RICARDO
We will collect personal data about you when you register to attend or speak at an event (including, workshops, webinars, seminars, conferences) organised by Ricardo.
The personal data we will typically collect is name, surname, email address, phone number, job title, company and country. For speakers we may also collect payment related information, such as bank details, invoice information, and payment history if relevant.
We will use your personal data to manage the registration and attendance at our events. We may take photographs of such events and we may use it in our marketing communications.
Legal grounds for processing participant’s personal data is their explicit consent.
END USERS OF RICARDO’S WEB PLATFORMS
If you are a user of Ricardo’s online platforms, such us, Ricardo Analytics – Electricity Market Outlook, , we collect your name, email address, log-in and password details when you register and create an account, for the purposes of giving you access to the services and/or providing you support. We do not intentionally collect other data, but if you enter personal data into the platform when using it you consent we collect and process it.
We automatically collect personal data via cookies, including your IP address, device and browser type, URI, operating system, location, and how you interact with our platform (e.g., pages visited, actions taken, time spent).
Legal grounds for processing personal data of end users are:
- To perform the contract.
- Ricardo legitimate interest to enable us to deliver the services and support.
- Ricardo legitimate interest to understand how end users use the features and functions of our platforms to enhance and improve their experience.
END USERS OF RICARDO SOFTWARE APPLICATIONS
When you register to use a Ricardo software application, such as, Chemdata, you generally provide your name, and email address. You may supply us with other data when contacting us for support.
Software applications will contain their own privacy notices explaining why and how personal data is collected and processed by those applications. Refer to such privacy notices is you are user of such applications.
DATA RETENTION
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes it was collected, including legal, regulatory, tax, or reporting requirements. Contact DataProtection@Ricardo.com for details on our data retention policy.
SHARING YOUR DATA
Ricardo is a global organisation that operates in different countries. Your personal data may be processed by Ricardo personnel in different jurisdictions.
We may share your personal data with third parties:
- Service Providers, or sub-contractors with which we engage to perform functions on our behalf (e.g. IT security providers, recruitment providers). These organisations will have access to personal data needed to perform their functions, but they may not use it for any other purposes.
- Hosting providers, telephony and internet providers and other ancillary service providers that Ricardo uses in the normal course of business.
- Cookie providers.
- Law enforcement or regulatory agencies, if we are required to do so by law or by a Court order.
- Other companies in connection with a reorganisation.
We will not otherwise share any of the personal data you provide to us without your consent. - We will not sell, trade or rent your personal data.
CROSS-B0RDER TRANSFERS
Ricardo takes all steps reasonably necessary to ensure your information is processed in compliance with applicable law and that appropriate safeguards are in place including international transfer mechanisms, for example Standard Contractual Clauses for individuals in the EU or the International Data Transfer Agreement for individuals in the UK.
DATA SECURITY
Ricardo takes security and confidentiality of the data we collect and process very seriously. Appropriate policies and processes are in place. We employ physical, electronic and administrative security measures to protect your information from unauthorised access and against unlawful processing, accidental loss, destruction and damage.
We also require our suppliers and subcontractors to implement an adequate level of security.
In the event we become aware of a breach of your personal data we will notify you without undue delay.
YOUR LEGAL RIGHTS
Under data protection laws you have rights in relation to your personal data that you can exercise. You have the right to:
- Request access to your personal data.
- Request correction of incomplete or inaccurate personal data.
- Request the erasure of your personal data (unless we are required or entitled to preserve such data).
- Object to the processing of your personal data.
- Withdraw your consent if we have obtained your consent to process your personal data.
If you would like to exercise any of these rights, contact DataProtection@Ricardo.com
We try to respond to all legitimate requests within one month, otherwise we will notify you.
Ricardo reserves its right to charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we may refuse to comply with your request. In any case, we will provide reasons for our decision as required by the law.
COMPLAINTS
If you would like to make a complaint about the way we are processing your personal data, you can contact us at DataProtection@Ricardo.com
You also have the right to complain to your local data protection authority.
CHANGES TO THE PRIVACY NOTICE AND YOUR DUTY TO INFORM US OF CHANGES
We regularly review this. This version was last updated in March 2025. Contact DataProtection@Ricardo.com for previous versions.
It is important that the personal data we hold about you is accurate and current. Please inform us of any changes to your personal data during your relationship with us.
CONTACT DETAILS
If you have any questions, comments, or concerns about this Privacy Notice, you can contact us in the following ways:
Ricardo Plc
Shoreham Technical Centre, Old Shoreham Rd,
Shoreham-by-Sea BN43 5FG
United Kingdom
Att: General Counsel