HubSpot Privacy Notice

This Privacy Notice sets out how Suntera Group Limited (and its global subsidiaries) (hereinafter to be referred to as "Suntera", “we”, “us” or “our”) uses and protects any information customers, event attendees, employment candidates or website enquiries give to us relating to our products and services.

The Controller is Suntera Group Limited and depending on who and where you gave your information to, please be referred to Appendix A, which highlights jurisdictional specific entities.

• We are committed to ensuring that your privacy is protected. Should we ask you to provide certain information by which you can be identified during your dealings with us you can be assured that it will only be used in accordance with this Privacy Notice.
• We may change this Privacy Notice from time to time. You should check this document regularly to ensure that you are happy with any changes.

• Consent means a freely given, specific, informed and unambiguous indication of the data subjects wishes.
• Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data. For the purposes of this Privacy Notice, the relevant Suntera entity with which you engage will act as the Controller. This may include Suntera Group Limited or one of its subsidiaries, depending on the nature of your interaction and the jurisdiction in which it occurs.
• Data Subject means the individual to whom the personal data relates.
• Personal Data means any information that can identify, directly or indirectly, a living individual.
• Processing means any operation or set of operations which is performed on Personal Data or on sets of Personal Data.
• Processor means a natural or legal person that processes personal data on behalf of the controller.
• Third Party means any person or organisation other than the data subject, controller, or processor.

While this Privacy Notice adopts definitions aligned with the EU General Data Protection Regulation (GDPR), we acknowledge that terminology and legal interpretations may vary across jurisdictions in which Suntera operates. Where applicable, local data protection laws, such as the Cayman Islands Data Protection Act, the Hong Kong Personal Data (Privacy) Ordinance (PDPO), or equivalent legislation may apply. In such cases, the definitions and rights outlined in this notice should be interpreted in accordance with the relevant local legal framework.

Whether you have engaged with Suntera at a professional event, participated in an interview process, or reached out to request further information on our services, your interaction allows us to collect and process relevant personal data in accordance with this Privacy Notice. As a result and dependent on your interaction with us, we may collect and process any of the following information: 

 

If you provide us with Personal Data relating to another individual, you confirm that you have obtained their consent or have another lawful basis to do so, and that you have informed them of our identity and provided them with access to this Privacy Notice. 

If you are applying for a job with us, we might ask you to participate in aptitude tests and/or to attend an interview – or a combination of both. Information will be generated by you and by us. For example, you might complete a written test or we might take interview notes. This information will be held by Suntera Group Limited, or whichever of our subsidiaries to which you directly applied.

We collect your Personal Data using some or all of the methods listed below:

Direct Collection 

• From the individual (e.g. via website forms, phone calls, in-person meetings)
• Through job applications submitted via the website

Third-party collection 

• From other individuals (e.g. referrals, referees)
• From event partners or sponsors who share attendee data

Automated or Passive Collection

• Via cookies, tracking pixels or analytics tools (e.g. HubSpot)
• From social media platforms (LinkedIn, Facebook, Twitter, Instagram)

Public or Institutional Sources

• Government departments or agencies
• Publicly available online sources

Where we are engaged in a media or industry partnership, we may be contracted to receive contact information of leads generated or attendees from an event the partner is hosting or marketing promotion we have featured and/or we are a named sponsor or partner.

Where we collect Personal Data from third parties or public sources, we do so under our legitimate interests in maintaining accurate records and providing relevant services, unless otherwise required to obtain your Consent. 

We require this Personal Data to understand your needs and provide you with a better service, and in particular for the following purposes:

Service Delivery  

• To provide you with access to our online client portal (if available) if you become a client of ours
• To deliver of content, you may have signed up for including a training course, workshop, demo or webinar
• To manage customer relationships and communications

Marketing and Communications 

• To periodically send promotional emails about new products, special offers or other information including seasonal greetings or updates we believe may be of interest to you. 
• To showcase our latest product and service updates through emails such as newsletters and event invitations.
• Marketing community and engagement tools that require the collection of data may be used to engage with you such as HubSpot Chatbot and LinkedIn or Facebook Events.

Event Management

• Registration details are required to confirm your place at an event we are hosting. These details may also be used to invite you to future events which we think that you may be interested in attending.
  
• Managing dietary or accessibility requirements
• Following up on event participation

Recruitment 

• To process and consider any applications for employment with us
• Conducting interviews and aptitude tests
• Retaining candidate data for future roles (with consent)

Analytics and website optimisation 

• We monitor and track customer interactions through data analytics to help inform and customise our Website according to your interests and/ or to improve your user experience. 

 Competitions and Promotions 

• Administering prize draws and delivering rewards

Under applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and equivalent legislation in other jurisdictions, we are required to identify a lawful basis each time we collect, use, or otherwise process your personal data. 

We rely on one or more of the following legal bases depending on the context and purpose of the processing: 

• Consent: Where you have given us clear and informed permission to process your personal data for a specific purpose. This includes, for example, receiving marketing communications, registering for events, or providing dietary or accessibility information. 
• Contractual: Where processing is necessary to enter into or perform a contract with you. This includes delivering services, managing your client account, or processing job applications. 
• Legal Obligation: Where we are required to process your personal data to comply with a legal or regulatory obligation, such as anti-money laundering checks or tax reporting. 
• Legitimate Interests: Where processing is necessary for our legitimate business interests, provided these are not overridden by your rights and interests. This includes improving our services, managing client relationships, and conducting analytics. We conduct a balancing test to ensure that our interests do not unfairly impact your privacy. 
• Vital Interests: In rare cases, we may process your personal data to protect your vital interests or those of another person, such as in a medical emergency at an event. 

Where we process special category data (such as health-related information for event participation), we will only do so with your explicit consent or where another lawful condition under Article 9 of the GDPR or equivalent legislation applies. 

If you would like more information about how we determine the appropriate legal basis for specific processing activities, or to object to processing based on legitimate interests, please contact us using the details provided in the “Contact Us” section of this Privacy Notice. 

We are committed to ensuring that your personal data is protected. To safeguard the information we collect, we implement a range of technical and organisational measures, including: 

• Secure transmission methods (e.g. HTTPS and encrypted email) for sharing personal or company information;
• Role-based access controls and multi-factor authentication to limit access to authorised personnel only;
• Encryption of data both in transit and at rest;
• Regular security audits, vulnerability assessments, and penetration testing;
• Ongoing staff training on data protection and cybersecurity awareness;
• Documented policies and procedures for data handling and incident response.

Where we engage third-party service providers, such as HubSpot, we ensure they are contractually obligated to implement appropriate security measures and comply with applicable data protection laws. HubSpot maintains a comprehensive security and compliance framework, including SOC 2 Type II certification, ISO 27001 certification, and GDPR-aligned data handling practices. Further details on HubSpot’s security posture can be found at https://trust.hubspot.com. 

In the event of a suspected data breach, we follow a structured incident response process and, where required, notify affected individuals and supervisory authorities in accordance with legal obligations. 

You can also help protect your data by using secure networks, enabling browser security features, and keeping your devices and software up to date. 

You have certain rights under applicable data protection laws in relation to your Personal Data. These rights may not apply in all circumstances and may be subject to legal limitations. Subject to those conditions, you may have the right to: 

• Access the Personal Data we hold about you;
• Rectify any inaccurate or incomplete data;
• Erase your Personal Data, where legally permissible;
• Restrict the processing of your Personal Data in certain circumstances;
• Object to processing based on our legitimate interests;
• Port your Personal Data to another service provider (data portability);
• Withdraw your consent at any time, where processing is based on consent.

To exercise any of these rights, please contact our Data Protection Officer at dataprotection@suntera.com or write to us at the address provided in the Appendix A of this Privacy Notice. We aim to respond to all valid requests within one month. 

You also have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been violated. Details of relevant authorities are provided in the “Complaints” section. 

We may share your personal data under the following circumstances: 

Intra-Group Sharing 

We may disclose your Personal Data to other entities within the Suntera Group, including subsidiaries and affiliates, where necessary to fulfil the purposes outlined in this Privacy Notice. All group entities are subject to internal data protection policies and safeguards. 

Third-Party Service Providers 

We may share your Personal Data with trusted third-party service providers who support our operations, such as: 

• The Beach Limited (marketing support)
• Launchpad Creative LLC (design services)

These providers are bound by contractual obligations, including data processing agreements, and are required to implement appropriate security measures and process your Personal Data only in accordance with our instructions. 

Consent-Based Sharing 

We may share your Personal Data with internal or external parties (including clients, intermediaries, or other group companies) for referral or introduction purposes, but only where we have obtained your explicit consent. 

Legal and Regulatory Disclosures 

We may disclose your Personal Data: 

• To comply with legal or regulatory obligations;
• To enforce our terms or protect our rights, property, or safety;
• In response to lawful requests from public authorities.

Corporate Transactions 

If Suntera or substantially all of its assets are acquired by a Third Party, Personal Data held by us may be transferred as part of that transaction. 

We will not share your Personal Data with third parties for marketing purposes unless we have obtained your express consent to do so. 

We may send you marketing and promotional communications, such as newsletters, event invitations, and product updates, where we have your Consent or are otherwise permitted to do so under applicable data protection laws. 

You may opt-in to receive these communications by providing your Consent when prompted (e.g. via a form, event registration, or email subscription). You may withdraw your Consent at any time. This will not affect the lawfulness of any processing carried out before your withdrawal. 

You can opt-out of receiving marketing communications at any time by: 

• Clicking the “unsubscribe” link included in each marketing email; or
• Contacting our Data Protection Officer at dataprotection@suntera.com.

Please note that opting out of marketing communications does not affect service-related communications (such as billing notices or account updates), which are necessary for the performance of our services. 

Where available, you may also manage your communication preferences, such as topics of interest or frequency, through a preference centre linked in our emails. 

As a global organisation, we may transfer your personal data to countries outside of your jurisdiction, including to other Suntera Group entities, service providers, or partners located in jurisdictions that may not offer the same level of data protection as your home country. 

These transfers may occur for the purposes of service delivery, internal administration, client relationship management, or the use of cloud-based platforms such as HubSpot. 

Whenever we transfer your personal data internationally, we ensure that appropriate safeguards are in place to protect your rights and freedoms. These safeguards may include: 

• Transfers to countries that have been deemed to provide an adequate level of protection by the European Commission or UK Government;
• Standard Contractual Clauses (SCCs) approved by the European Commission or UK Information Commissioner;
• Binding Corporate Rules (BCRs) adopted by our group entities;
• Data Protection Impact Assessments (DPIAs) where required.

Where we rely on third-party service providers, such as HubSpot, we ensure they maintain appropriate international transfer mechanisms and security certifications. You can learn more about HubSpot’s data protection practices at their https://trust.hubspot.com. 

Where required by law, we will obtain your explicit consent before transferring your personal data to jurisdictions without an adequacy decision. 

If you would like more information about our international data transfer safeguards, please contact our Data Protection Officer using the details provided in the “Contact Us” section. 

 Our Website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this Privacy Notice. 

We encourage you to exercise caution and review the privacy policies and cookie notices of any external websites before submitting personal data. Some linked websites may use cookies or tracking technologies independently of Suntera. 

The inclusion of a link does not imply endorsement or affiliation unless expressly stated. 

We will retain Personal Data for as long as we reasonably require it for legal or business purposes. In determining data retention periods, we take into consideration local laws, any applicable contractual obligations, and the expectations and requirements of our contacts. When we no longer need Personal Data, we securely delete or destroy it. 

If you have applied for employment with us and were unsuccessful for the position you have applied for, we may ask if you would like your details to be retained in our talent pool for a period of six months. If you say yes, we would proactively contact you should any further suitable vacancies arise. 

You may request the deletion of your personal data at any time, subject to any legal or regulatory obligations that require us to retain certain information. For more information, please refer to the “Your Rights” section of this Privacy Notice.  

If you have any questions, comments, or requests regarding the protection of your Personal Data, or if you wish to exercise any of your rights as outlined in this Privacy Notice, you may contact us using the details below: 

Data Protection Officer 
Suntera Group Limited 
Peveril Buildings, Peveril Square 
Douglas, Isle of Man, IM99 1RZ 
Email: dataprotection@suntera.com 

You may also write to any of our data controllers using the addresses provided in Appendix A of this Privacy Notice. 

We strive to address all valid requests within one month, or within any timeframe required by applicable regulations. 

If you are not satisfied with the above or the way we process your Personal Data you have the right to make a complaint. We hope that you will raise any complaints or concerns with us in the first instance, but if not, or if you are not satisfied with our initial response, you can contact our supervisory authority for data protection related matters using the contact details below. 

The supervisory authorities for the Suntera Global group of companies: 

THE BAHAMAS 

 

CAYMAN ISLANDS

Name	Ombudsman Cayman Islands
Address	5th Floor,  Anderson Square,  64 Shedden Road,  George Town,  Grand Cayman
Mail	PO Box 2252, Grand Cayman  KY1-1107,  CAYMAN ISLANDS
Website	Data Protection | Cayman Islands Ombudsman
Telephone	+1 345 946 6283
Email	info@ombudsman.ky

 

HONG KONG

Name	Office of the Privacy Commissioner for Personal Data
Address	Room 1303, 13/F, Dah Sing Financial Centre, 248 Queen's Road East, Wanchai
Website	https://www.pcpd.org.hk/
Telephone	+852 2827 2827
Email	communications@pcpd.org.hk

 

GUERNSEY

 

ISLE OF MAN 

Name	Information Commissioner
Address	First Floor, Prospect House Prospect Hill, Douglas, Isle of Man IM1 1ET
Website	https://www.inforights.im/
Telephone	+44 (0)1624 693260
Email	ask@inforights.im

 

JERSEY

Name	Office of the Information Commissioner
Address	2nd Floor 5 Castle Street St. Helier Jersey JE2 3BT
Website	https://jerseyoic.org/
Telephone	+44 (0)1534 716530
Email	enquiries@jerseyoic.org

 

LUXEMBOURG

Name	Commission Nationale pour la Protection des Données (CNPD)
Address	15, Boulevard du Jazz, L-4370 Belvaux
Website	https://cnpd.public.lu/en.html
Telephone	+352 26 10 60 1
Email	Not Published. Contact through WebForms on CNPD website.

 

UNITED KINGDOM