HubSpot Privacy Notice

This Privacy Notice explains how the Suntera Global group of companies (“Suntera”, “we”, “us”) uses HubSpot to collect, store and manage personal data.

HubSpot is used as a customer relationship management and marketing platform to support contact management, client and prospect relationship management, event administration, website enquiries, meeting links, marketing preferences, business development activity and related reporting.

This Notice applies to personal data processed through the Suntera Group HubSpot environment, including personal data collected through HubSpot forms, entered by Suntera users, or migrated into HubSpot as part of approved Group system integration, data quality or business development activity.

Access to personal data in HubSpot is limited to authorised users with a legitimate business need. Personal data held in HubSpot must only be used for the purposes described in this Notice or for other lawful and compatible purposes.

Your personal data is collected, retained and processed in accordance with applicable data protection law, including the GDPR as applied in our operating jurisdictions and, where relevant, the UK GDPR and the Data Protection Act 2018.

For the purposes of data protection laws, the ultimate Data Controller is Suntera Group Limited, a company incorporated in the Isle of Man with a registered office address at:

Peveril Buildings, Peveril Square, Douglas, Isle of Man, IM99 1RZ.

Suntera Group Limited is registered with the Isle of Man Information Commissioner under registration number R001070.

Where your relationship is with a specific Suntera Group entity, that entity may also act as a controller of your personal data. For a complete list of our global registrations, please see Appendix A.

If your query relates to your services or your relationship manager, you can also contact your usual Suntera representative.

For data protection queries, please contact:

Data Protection Officer and Information Governance Team
Email: dataprotection@suntera.com
Address: Peveril Buildings, Peveril Square, Douglas, Isle of Man, IM99 1RZ

Depending on your relationship with us and how you interact with HubSpot, we may collect and process:

• Identity and contact details, such as your name, business address, email address, telephone number and other contact details.
• Professional and organisation information, such as your job title, role, employer, company name, directorships and business relationship with Suntera.
• CRM and relationship information, such as contact owner, company association, lifecycle stage, contact source, relationship history, meeting records, event attendance, communication preferences and other CRM records.
• Deal and opportunity information, such as opportunity status, pipeline stage, deal description, associated contacts and companies, estimated value, annual fee, currency, estimated revenue date and related commercial context.
• Marketing and event information, such as newsletter subscriptions, event registrations, webinar attendance, areas of interest, campaign engagement, opt outs and non-marketing status.
• Website, form and technical information, such as HubSpot form submissions, meeting link data, IP address, browser and device information, cookie identifiers, website activity and, where lawful, limited email engagement information collected through tracking pixels, including whether an email has been delivered, opened or interacted with.
• Recruitment information, where HubSpot is used to collect and route application form data.

We do not intend to collect special category data through HubSpot unless this is necessary for a specific purpose, such as dietary or accessibility arrangements for an event, or where you choose to provide it. Where special category data is processed, we will only do so where permitted by applicable law.

We may collect personal data:

• Directly from you, when you complete a HubSpot form, subscribe to updates, register for an event, book a meeting, contact us, provide your business card, or apply for a role through a HubSpot enabled form.
• From Suntera systems or users, where information is entered into HubSpot by authorised employees or migrated from another approved system as part of Group CRM, data quality or business development activity.
• From your organisation or representatives, where your employer, colleagues, managers, introducers, advisers or other representatives provide information about you in connection with a client, prospect or business relationship.
• From third party and public sources, such as introducers, intermediaries, event partners, public registers, company websites, professional directories or LinkedIn, where lawful and relevant.

We also collect information automatically through HubSpot forms, meeting links, cookies, tracking pixels, email engagement and website interactions. Tracking pixels are small invisible images embedded in emails that help indicate whether a message has been delivered, opened or interacted with. We use limited email engagement information to measure communication performance, monitor deliverability, maintain accurate contact records, manage suppression lists, support data cleanse activity and manage the relevance and frequency of our communications. Where appropriate, this information may also be used to support future communications tailored to your preferences and interests. Where this involves using your engagement information to tailor communications, this may constitute profiling under applicable data protection laws. We do not use this information to make decisions about you that produce legal or similarly significant effects.

Some personal data is required to manage our business relationships, respond to enquiries, deliver services, maintain CRM records, manage marketing preferences, administer events, comply with legal or regulatory requirements, and maintain accurate business records. If you do not provide the required information, we may be unable to respond to your enquiry, provide services, manage your preferences, register you for an event or continue the relevant relationship.

We process your personal data in HubSpot for the following purposes and on the following lawful bases:

Explanation of legal bases and what they mean for you:

• Contract: We may need certain personal data to enter into or perform an agreement with you or your organisation, or to take steps before entering into an agreement.
• Legal obligation: We may need to process personal data to comply with legal or regulatory requirements, including data protection rights, record keeping, compliance and risk management obligations.
• Legitimate interests: We may process personal data where it is necessary for our legitimate business interests, such as maintaining accurate CRM records, managing client and prospect relationships, supporting business development, improving data quality, administering events and ensuring the security of our systems, provided your rights do not override those interests. Where we rely on legitimate interests, we balance our interests against your rights and expectations.
• Consent: Where we rely on consent, this is typically for marketing communications or where applicable law requires consent. You can withdraw consent at any time. This will not affect the lawfulness of processing carried out before you withdraw consent.

We may share personal data processed through HubSpot with:

• Other Suntera Group companies, where required for client relationship management, business development, Group support functions, risk, compliance, reporting, event administration or operation of shared systems;
• Authorised Suntera teams, including Marketing, Business Development, IT, Information Governance, Risk, Compliance and relevant client relationship teams;
• Third party processors and service providers, including HubSpot, IT and hosting providers, marketing support providers, email validation providers, website support providers and event administration providers;
• Professional advisers, including legal, audit, tax, compliance and data protection advisers;
• Prospective purchasers, sellers, successors, investors, funders and advisers, where necessary in connection with a corporate transaction; and
• Regulators, law enforcement, courts and other authorities, where required by law, regulation or enforceable request.

HubSpot is our CRM and marketing platform provider. HubSpot may process personal data on our behalf where we use its services for CRM, marketing, forms, meeting links, reporting and related business activities. Optional HubSpot features, such as enrichment, tracking, AI enabled functionality or intent data sharing, are subject to internal review and approval before use.

Where third parties process personal data on our behalf, they do so under contractual obligations covering confidentiality, security and permitted use.

Personal data processed through HubSpot may be transferred to, hosted in, or accessed from jurisdictions outside your location by Suntera Group companies, HubSpot, its affiliates or approved sub-processors.

Where personal data is transferred outside the United Kingdom, the European Economic Area, the Isle of Man or another jurisdiction recognised as providing adequate protection, we apply appropriate safeguards. These may include adequacy decisions, standard contractual clauses, the UK International Data Transfer Agreement, the UK Addendum to the European Commission Standard Contractual Clauses, transfer risk assessments or other safeguards recognised by applicable law.

We keep personal data in HubSpot only for as long as necessary for the purposes described in this Notice, unless a longer period is required by law, regulation, contractual obligation or legitimate business need.

CRM and marketing records may be retained until you opt out, object to processing, become inactive under our retention review process, or the record is no longer required.

Marketing preferences, including opt outs and non-marketing status, may be retained so that we continue to respect your choices.

When personal data is no longer required, it will be deleted, anonymised or securely destroyed.

We implement a range of technical and organisational measures to safeguard personal data processed through HubSpot against misuse, loss, unauthorised access, alteration or disclosure.

These measures include role-based access controls, restricted administrator permissions, access reviews, secure transfer methods, password protection for temporary migration files where used, logging and audit activity where available, supplier due diligence, contractual safeguards, staff training and incident response procedures.

Organisationally, we ensure that only those individuals who require access to personal data for legitimate business purposes are granted such access, and all staff are required to comply with confidentiality and data protection obligations.

Where we use third party systems or service providers, we require that they maintain appropriate safeguards and controls to ensure the security and confidentiality of personal data.

You have rights in relation to your personal data, including the right to be informed, access, rectification, erasure where applicable, restriction, objection including to direct marketing, and data portability where applicable.

To exercise your rights, please contact your usual Suntera representative or the Data Protection Officer using the details below. Any request to exercise your rights may be subject to you providing acceptable proof of identification, if required for us to ensure that the request has come from you.

You have the following rights under data protection law:

• Right to access: You have a right to request access to the personal data we hold about you and to receive information about how we use it, subject to statutory exceptions.
• Right to be informed: You have a right to clear information about how your personal data will be used.
• Right to rectification: You have a right to request corrections if your personal data is inaccurate or incomplete.
• Right to erasure: You have a right to ask for your personal data to be deleted where permitted by law.
• Right to restrict or object to processing: You have a right to limit how your data is used or to object to processing in certain circumstances.
• Right to object to direct marketing: You have the right to object to direct marketing at any time.
• Right to data portability: You may have a right to receive your personal data in a portable format to share with another provider where this right applies.
• Right to withdraw consent: Where we rely on consent, you can withdraw that consent at any time.
• Right to lodge a complaint with a supervisory authority: If you think your data protection rights have been breached, you can complain to the relevant data protection authority.

Contact for all rights requests: dataprotection@suntera.com.

HubSpot may include AI assisted, automation or analytics features. These features should only be enabled where reviewed and approved under Suntera’s internal governance requirements.

We do not use HubSpot to make decisions that produce legal or similarly significant effects based solely on automated processing.

Where you have provided consent, or where we are otherwise permitted by applicable law, we may send you promotional communications about Suntera services, events, insights or updates that may be of interest to you.

You can opt out at any time by using the unsubscribe link in our emails or by contacting dataprotection@suntera.com.

We may retain opt out and non-marketing status information so that we continue to respect your choices.

Opting out of marketing communications does not affect service related or administrative communications that may be necessary for an existing relationship, legal obligation or business purpose.

You have the right to make a complaint about how your personal data is processed. We encourage you to contact us first so that we can try to resolve the issue.

If you are not satisfied with our response, you can complain to the supervisory authority in the jurisdiction where you are based or the jurisdiction from which we provide services.

Supervisory authority contact details may change, and you should refer to the relevant authority website for the latest information.

• Isle of Man: Isle of Man Information Commissioner
• Jersey: Jersey Office of the Information Commissioner
• United Kingdom: Information Commissioner’s Office
• Guernsey: Office of the Data Protection Authority
• Cayman Islands: Cayman Islands Ombudsman
• Hong Kong: Office of the Privacy Commissioner for Personal Data
• Bahamas: Government of The Bahamas
• Luxembourg: National Commission for Data Protection
• Singapore: Personal Data Protection Commission

We may change this Notice from time to time by updating this page. You should check this page regularly to ensure that you are happy with any changes.

Where changes are material, we may take additional steps to bring those changes to your attention.

Personal Data: information relating to an identified or identifiable individual.

Special Category Data: personal data revealing health, ethnicity, political opinions, religious beliefs or similar information that requires additional protection under data protection law.

Controller: the organisation that decides why and how personal data is processed.

Processor: the organisation that processes personal data on a controller’s instructions.

HubSpot: the CRM and marketing platform used by Suntera to manage contact records, companies, deals, communications, forms, meeting links, reporting and related activity.

CRM: customer relationship management system.

Deal information: CRM information linked to a client, prospect, opportunity or business relationship, including opportunity status, pipeline stage, estimated value, annual fee, currency, estimated revenue date and related commercial context.

Legitimate interests: processing that is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms.