Legal

Privacy Policy

GDPR

Last updated: 1 October 2026

This Privacy Policy explains how Egger & Co (“Egger & Co”, “we”, “us”, or “our”) collects, uses, shares, and protects personal data when you visit our website, contact us, apply for roles, or otherwise interact with us. It is designed to meet the transparency requirements of Articles 12–14 of the EU General Data Protection Regulation (EU) 2016/679 (“GDPR”) and, where applicable, the UK GDPR and Data Protection Act 2018.

This notice is provided for transparency. It is not legal advice. If you have questions about how we process your data, please contact us using the details below.

1. Who is the data controller?

The data controller responsible for the processing described in this policy is:

Egger & Co
London office: 20 Wenlock Road, London N1 7GU, United Kingdom
US office: 2810 N Church St, Suite 89471, Wilmington, DE 19802, United States
Email: legal@eggerco.com

We have not appointed a Data Protection Officer where not required. Privacy requests can be sent to the email address above.

2. Scope

This policy applies to personal data processed in connection with:

  • our public website and any related online forms;

  • email, phone, or other correspondence with us;

  • newsletter or updates subscriptions (if offered);

  • recruitment and general applications;

  • business development, partnership, and investor or operator enquiries.

It does not cover third-party websites linked from our site. Those sites have their own privacy notices.

3. Categories of personal data we process

Depending on how you interact with us, we may process:

  • Identity and contact data — name, company, job title, email address, phone number, and message contents you submit via forms or email.

  • Correspondence data — records of enquiries, meetings, and follow-up communications.

  • Recruitment data — CV/résumé, cover letter, professional history, and interview notes if you apply for a role.

  • Technical and usage data — IP address, browser type, device/approximate location derived from IP, referring URL, pages viewed, and timestamps. Some of this may be processed by our website host and analytics providers as described below.

  • Cookie and preference data — cookie consent choices and related preference storage (see our Cookie Policy).

We do not intentionally collect special-category data (for example health or political opinions) through the website. Please do not submit such information unless we expressly ask for it for a lawful recruitment or compliance purpose.

4. Purposes and legal bases (GDPR Art. 6)

We process personal data only where a legal basis applies. Below we describe the main purposes, typical examples, and the legal basis we rely on for each.

Responding to enquiries. Examples include contact forms and partnership or media requests. Legal basis: legitimate interests (Art. 6(1)(f)) — to operate and communicate about our business; or steps prior to a contract (Art. 6(1)(b)) where relevant.

Operating the website. Examples include hosting, security, availability, and load balancing. Legal basis: legitimate interests (Art. 6(1)(f)) — to provide a secure, functioning website.

Analytics (privacy-oriented / consented). Examples include understanding aggregate traffic and improving content. Legal basis: legitimate interests where analytics are configured without non-essential cookies and with low privacy impact; otherwise consent (Art. 6(1)(a)) where required.

Cookies and similar technologies. Examples include non-essential cookies and preference or marketing tags. Legal basis: consent (Art. 6(1)(a)) together with the ePrivacy rules; strictly necessary cookies do not require consent.

Newsletters / marketing emails. Examples include group updates where you opt in. Legal basis: consent (Art. 6(1)(a)); you may withdraw at any time.

Recruitment. Examples include assessing applications and communicating with candidates. Legal basis: legitimate interests and/or steps prior to a contract (Art. 6(1)(b)/(f)); legal obligation where applicable.

Compliance and legal claims. Examples include accounting, regulatory requests, and establishing or defending claims. Legal basis: legal obligation (Art. 6(1)(c)) and/or legitimate interests (Art. 6(1)(f)).

Where we rely on legitimate interests, we balance our interests against your rights and freedoms. You may object to processing based on legitimate interests as described in section 9.

5. Where we obtain data

Most data comes directly from you. We may also receive limited data from:

  • your device and browser when you visit the site;

  • service providers that support hosting, security, forms, email, or analytics;

  • publicly available professional sources (for example company websites or business registries) when relevant to a business enquiry;

  • recruitment platforms or referrers, if you apply through them.

6. Recipients and processors

We may share personal data with:

  • Website and infrastructure providers — including Framer (site hosting/publishing) and related content delivery networks used to deliver the site;

  • IT, email, and productivity providers used to receive and manage correspondence;

  • Professional advisers (legal, accounting, compliance) where necessary;

  • Authorities where required by law or to protect rights and safety.

Where providers process personal data on our behalf, we use appropriate contracts (including GDPR Art. 28 processor terms where applicable). We do not sell your personal data.

7. International transfers

Our website and some service providers may process data in the United Kingdom, the European Economic Area, the United States, or other countries. Where personal data is transferred outside the EEA/UK to a country without an adequacy decision, we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and UK addenda where required), together with supplementary measures as needed.

8. Retention

We keep personal data only as long as needed for the purposes above, including:

  • Contact / business enquiries: typically up to 24 months after the last meaningful interaction, unless a longer period is needed for an ongoing relationship or legal claims;

  • Recruitment records: typically up to 12 months after the conclusion of a process (or longer with your consent or where required by law);

  • Newsletter subscriptions: until you unsubscribe or we delete inactive lists;

  • Technical logs: for short periods needed for security and operations, unless a longer period is required to investigate incidents;

  • Legal / accounting records: for periods required by applicable law.

9. Your rights

Subject to conditions and exceptions under the GDPR/UK GDPR, you may have the right to:

  • access your personal data;

  • rectify inaccurate data;

  • erase data (“right to be forgotten”);

  • restrict processing;

  • data portability;

  • object to processing based on legitimate interests (including profiling based on those interests);

  • object to direct marketing at any time;

  • withdraw consent at any time where processing is consent-based (without affecting prior lawful processing);

  • not be subject to solely automated decisions producing legal or similarly significant effects — we do not carry out such decision-making on this website.

To exercise these rights, email legal@eggerco.com. We may need to verify your identity. We will respond within the timeframes required by law (generally one month).

10. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. In the UK, this is typically the Information Commissioner’s Office (ICO): https://ico.org.uk. If you are in the EU/EEA, you may also contact your local data protection authority. A list of EU authorities is available via the European Data Protection Board.

11. Children

Our website and services are directed to businesses and professionals. We do not knowingly collect personal data from children under 16. If you believe a child has provided us personal data, please contact us and we will take appropriate steps.

12. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or alteration, taking into account the state of the art, costs, and the nature of the processing. No method of transmission or storage is completely secure.

13. Cookies and similar technologies

We use cookies and similar technologies as described in our Cookie Policy. Non-essential cookies are used only with your consent where required by the ePrivacy Directive and GDPR.

14. Changes

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Material changes will be indicated by updating this page; where appropriate we may provide additional notice.

15. Contact

For privacy questions or requests:
Email: legal@eggerco.com
Postal: Egger & Co, 20 Wenlock Road, London N1 7GU, United Kingdom