Privacy Policy

General
NMG Consulting Ltd. (“NMG”, “we”, “our” or “us”) is committed to respecting your privacy and protecting information that identifies or is associated with you (“personal information”), whether you are a client, a research respondent, or an individual visiting our websites (e.g., https://nmg-group.com/, https://connect.nmg-consulting.com/).

This Privacy Policy contains important information about who we are; what personal information we collect and how we use it; the legal bases upon which we rely to process that information; with whom we share it and why; and what rights and responsibilities are associated with the personal information you give us.

From time to time, we may need to make changes to our Privacy Policy for compliance purposes. Important changes made will be notified to you.

This Privacy Policy applies to NMG and all subsidiaries that manage the products and services we offer to our clients. It also applies to all personal information received by NMG, whether electronically, verbally, or in paper format.

Who We Are
NMG offers client focused strategy, management and actuarial consulting services; objective studies into market trends, business allocations, competitive dynamics and client positioning and capability; and detailed market and custom analytics for financial institutions including insurers, reinsurers, wealth and asset managers, and fund managers. Globally, NMG has offices in the United Kingdom, Canada, Malaysia, Singapore, Australia, Sri Lanka, and the United States.

The identity of the controller responsible for your personal information will depend on who you are and how you are engaging or interacting with NMG. If you are an individual using our website, the data controller is NMG. If you are a research respondent, the data controller is the NMG entity with which you have interacted. If you are a client (or representative of a client), the relevant data controller will depend on the NMG office with which you are engaging, as set out below:

Office	Relevant Data Controller
United Kingdom	N.M.G. Financial Services Consulting Ltd.; or BQM UK Ltd.
Canada	NMG FSC Inc.
Malaysia	NMG Financial Services Consulting Sdn. Bhd.
Singapore	NMG Financial Services Consulting Pte. Ltd.; or BQM Holdings (trading as NMG Strategic Insights) Pte. Ltd.
Australia	NMG Financial Services Consulting Pty Ltd.; or Tria Investment Partners Pty Ltd.
Sri Lanka	NMG Management Advisors Pvt Ltd.
United States	NMG Consulting Inc. Flaspöhler Research Group, Inc. Eastbridge Consulting Group, Inc.

How We Collect and Obtain Your Personal Information
We may collect your personal information from a variety of sources.

Where you are a research respondent this may include:

• From publicly available sources (for example, LinkedIn or similar social media), where permitted by law;
• Information we lawfully obtain from third parties such as marketing and other lists;
• Information we lawfully obtain from our clients;
• Referrals from clients and research respondents; and
• Information you have provided having participated in research surveys conducted by NMG or an associate on our behalf.

Where you are a visitor to our website, client (or representative of a client), or a job applicant this may include:

Directly from you when you voluntarily submit information to us; for example, when you access our website, contact any of our personnel, use our services or where you apply for a job via our website, LinkedIn or other external job board;

• Directly from you when through email or phone conversations you have with us;
• Your interaction with NMG’s website including information we automatically collect when you browse the NMG website; and
• From third-party providers such as a recruitment firm, background check provider, or other service provider who supports the employment process.

What Personal Information We Collect and How We Use It
Where you are a research respondent, the table below sets out the categories of personal information we collect about you, how we use that information and the relevant legal basis.

If we obtain your contact information from a research panel or other third party, we will use that information in accordance with your agreement with that third party when you signed up to participate in the relevant survey or research engagement or when you became a customer or client of that third party. Occasionally, we may re-contact you to validate your contact information or confirm your consent to participate in a research study and we will identify ourselves and our purpose when we contact you.

Category of personal information	How we use it	Legal basis for the processing
Contact details and basic personal details. This includes your name, company, company location, business email and business phone.	We use this information to contact you to participate in market research surveys and/or consulting engagements.	The processing is necessary for our legitimate interests, namely our business and commercial interests in performing and providing market research and insights. Alternatively, we will obtain your consent to process your personal information in those jurisdictions which require this, including any requirement for consent for cross-border data transfers. In addition, where we have obtained your contact details from a third party, we will process your information on that third party’s representations they have a proper legal basis to request that we process your information.
	We use this information to manage our relationship with you, including maintenance of our database of research respondents for administration, accounting, and relationship management purposes.	The processing is necessary for our legitimate interests, namely our business interests in efficiently and effectively managing our relationship with you and related purposes.
	We use this information to issue rewards, such as vouchers or gift cards, for your participation in our research studies.	We process this information where you have provided your consent.
Professional information. Such as your role, license number (if any), employee benefits and premium	We use this information as part of analyses incorporated into the study that is being conducted. Studies may include the following: ·    To help our clients plan products or services; ·    To gauge customer / member satisfaction; ·    To measure awareness of products or services; or ·    To test reaction to products, services or communications.	The processing is necessary for our legitimate interests, namely our business and commercial interests in performing and providing market research and insights. Alternatively, we will obtain your consent to process your personal information in those jurisdictions which require this.
Personal details. Such as your income level / range, net worth/ wealth range gender and age.	We use this information to help us in segmenting the sample of the population we are studying.	The processing is necessary for our legitimate interests, namely our business and commercial interests in performing and providing market research and insights.
Bank account information. Such as your account number.	We use this information to provide rewards for participation in our research studies.	We process this information where you have provided your consent.
Medical scheme information. Such as membership, plan, benefits details.	We use such information in connection with our analyses, which may have certain bespoke requirements based on our clients’ requests.	The processing is necessary for our legitimate interests, namely our business and commercial interests in performing and providing actuarial analyses and advice.
Any other such information which we may obtain from you in the course of your completing a questionnaire.	We use such information in connection with our research studies, which may have certain bespoke requirements based on our clients’ requests.	The processing is necessary for our legitimate interests, namely our business and commercial interests in performing and providing market research and insights. Alternatively, we will obtain your consent to process your personal information in those jurisdictions which require this.

Where you are a visitor to our website, client (or representative of a client), or job applicant the table below sets out the categories of personal information we collect about you, how we use that information and the relevant legal basis:

Category of personal information	How we use it	Legal basis for the processing
Contact and basic personal details. Such as your name, contact information or other information that you give to us to inquire about our services.	We will use this information to contact you about our services.	We will process such personal information based on the legitimate interest of providing you information related to our services.
	We will use this information to correspond with you and to perform our services to you.	The processing is necessary for the performance of a contract to which you are a party (and to take steps at your request prior to entering into such contract).
	We may process this personal information to manage our relationship with you. This would include maintenance of our database of clients for administration, accounting, and relationship management purposes.	The processing is necessary for our legitimate interests, namely our business interests in efficiently and effectively managing our relationship with you and related purposes.
Recruitment information. Information you provide when apply for positions at NMG including employment information such as resume, references or LinkedIn profile, background check results	We may process your personal information in connection with any job application you (or your authorized representative) have submitted.	We process this information where you have provided your consent.
Information that is automatically collected when you visit our website. This would include information about how you access and use our website and information about the device you are using to access our website.	We may process your personal information in relation to the functioning of our website. Namely, we may process your information:   ·    To enhance and customize our website according to your interests and preferences through means including troubleshooting, data analysis, testing, research, statistical and survey responses; ·    To allow you to participate in interactive features on our website when you choose to do so; and ·    To aid our efforts to keep our website safe and secure.   You may review our Cookie Policy here.	We process this information for our legitimate interests namely to tailor our website to you, for marketing purposes, to allow you to participate in features on our website and to ensure the safety and security of our website.
Contact and basic personal details; Recruitment Information; Information that is automatically collected when you visit our website.	We may process your personal information in order to comply with any other professional, legal and regulatory obligations which apply to us or policies that we have in place.	We process the information in where it is necessary to comply with a legal obligation.
	We may process your personal information as we feel is necessary to prevent illegal activity or to protect our interests.	We process this information for our legitimate interests namely to prevent illegal activity and to protect our business interests.

Place of Processing
If you are visiting our website or are participating in one of our research studies, your information may be transferred to, stored, and processed where NMG, our employees, associates, agents, directors including those of our affiliate companies have operations. These locations include the United Kingdom, Canada, United States, Malaysia, Singapore, Philippines, Hong Kong, Sri Lanka, Benelux, South Africa and/or Australia.

Furthermore, NMG utilises cloud computing services in its business, and personal information may be stored in the following locations:

• Forsta (Confirmit, Dapresy and Decipher): United Kingdom
• Dropbox (data storage): United Kingdom
• Azure and Microsoft Office 365: Singapore; or United Kingdom, Australia, or South Africa in line with our client agreements
• Egress: United Kingdom
• Egnyte (data storage): United States
• Online survey platforms and CRM tools, including but not limited to Active Campaign and Survey Monkey.

Note that some cloud computing services’ websites use cookies and other identifiers to collect visitor information. To learn more about how these websites collect Personal Data, review their privacy policy and cookie policy.

While the data protection and other laws of these countries might not be as comprehensive as those in your country, we endeavour to take necessary and protective steps to safeguard your privacy, including restricting access, enabling encryption, and putting in place standard contractual clauses between the various NMG entities and/or third parties with whom NMG engage. Additionally, NMG personnel may access our systems remotely when working abroad (including from jurisdictions outside the EEA). Where they do so, they are required to use our data systems and access any personal information in accordance with NMG’s internal policies and procedures.

For data subjects in China, please be advised that in addition to the locations of our cloud-based providers, your personal information would be processed in Canada, United Kingdom, Australia, Singapore, Malaysia, and Hong Kong, being the locations of relevant NMG personnel processing the personal information.

Furthermore, if we need to share your personal information with a third-party service provider, we will ensure we do so in compliance with relevant data protection legislation and will review our contracts regularly to remain compliant.

Your Rights
You have the following rights under applicable data protection legislation in relation to your personal information:

• Right of access. The right to obtain access to your personal information along with certain related information;
• Right to data portability. The right to receive your personal information in a commonly used format and to have your personal information ported to another data controller;
• Right to rectification. The right to obtain rectification of your personal information without undue delay where that personal information is inaccurate or incomplete;
• Right to erasure. The right to obtain the erasure of your personal information without undue delay in certain circumstances, such as where the personal information is no longer necessary in relation to the purposes for which it was collected or processed;
• Right to restriction. The right to obtain the restriction of the processing undertaken by us on your personal information in certain circumstances, such as where the accuracy of the personal information is contested by you, for a period enabling us to verify the accuracy of that personal information; and
• Right to object. The right to object, on grounds relating to your particular situation, to the processing of your personal information, and to object to processing of your personal information for direct marketing purposes, to the extent it is related to such direct marketing.

For data subjects in California, the California Consumer Privacy Act (CCPA) gives residents the right to opt out of the selling or sharing of their personal information.  You may request to stop selling or sharing your personal information (“opt-out”) at any time. Upon receipt of your opt-out request in writing, we will not sell or share your personal information.

If you wish to exercise one of these rights, please contact us using the details set out at below.

Disclosure of Personal Information
We will share your personal information with the following categories of recipients for the purposes set out above.

• Service providers: that enable us to fulfil our contractual obligations to you and/or our clients in the course of business, which may include:
  • contractors who conduct fieldwork, including interviews and translations for our studies;
  • third-party transcription services;
  • third-party recruitment services;
  • banks and other payment processors;
  • retailers (for purposes of issuing vouchers or gift cards);
  • third parties that provide security, email security, data governance, archiving, research support and other IT and business support services;
  • email marketing platform provider and our website platform provider; and
  • selected partner digital agencies and online job application providers; analytics and search engine providers that assist us in the improvement and optimisation of our website.
• NMG’s affiliates and companies: our affiliates and subsidiaries (i.e., any organization or brand we own or share control). These companies may use your personal information in the same way as we can under this Privacy Policy.
• Third parties at your request: any third party you ask us to share your personal information with.
• Purchasers and third parties in connection with a business transaction: personal information may be disclosed to third parties in connection with a transaction, such as a merger, sale of NMG assets or shares, reorganization, financing, change of control or acquisition of all or a portion of our business by an affiliated NMG entity or third party, or in the event of a bankruptcy or related or similar proceedings.
• Law enforcement, regulators and other parties for legal reasons: third parties as required by law or if we reasonably believe that such action is necessary to (a) comply with the law and the reasonable requests of law enforcement; (b) enforce our client contractual terms or to protect the security or integrity of our service; and/or (c) exercise or protect the rights, property, or personal safety of NMG, our visitors, or others.

From time to time, our website may contain links to and from the websites of advertisers and partners which are subject to their own privacy policies. If you follow a link to such websites, we disclaim any responsibility or liability for these websites.

Storing of Personal Information
Security of your information. We maintain appropriate security measures to protect your personal information against accidental or unlawful destruction, loss, change or damage. All personal information you register on our website is transmitted across the Internet in an encrypted state and is stored in a secure data centre.

Retention of your information: We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of our legitimate business interests, observing our contractual obligations as data processor in respect of our engagements with clients, and satisfying any legal or reporting requirements.

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and the applicable legal requirements.

ENFORCEMENT
NMG uses a self-assessment approach to assure compliance with this Privacy Policy and periodically verifies that the policy is accurate, comprehensive for the information intended to be covered, prominently displayed, completely implemented and accessible and in conformity with any applicable standards that govern international transfer of protected data.

AMENDMENTS
Our Privacy Policy may be amended from time to time consistent with the regulations and law surrounding the international movement of data. We will post any revised policy on our website or notify you by sending a notice to the email address you provided to us or by placing a prominent notice on our website or on our surveys.

CONTACT INFORMATION
Questions, comments or complaints regarding our compliance or data collection and processing practices can be addressed below.

TO CONTACT US WITH A COMPLAINT OR INQUIRY
If you have any questions, complaints or problems related to the collection or use of your information, or if you wish to opt out of any contact list, or have a concern with our privacy policy in general, you may contact us though our website or write to us at:

Karin Barry
Chief Operating Officer
NMG Consulting c/o NMG Financial Services Consulting Pte. Ltd.
109 North Bridge Road
#05-21
Singapore 179097
[email protected]
NMG Consulting Compliance
[email protected]