Where our Clients or Prospects have chosen to engage with WPP, (“we”, “us”, or “our”), either before or after entering into a business agreement, we are the controller of any personal data about your business or employees that you choose to give us and are therefore responsible for processing it in accordance with the law. This excludes any personal data that you specifically ask us to process as part of the “Services” we will provide.
We respect the privacy of our clients and those individuals working for our clients and recognise that when you choose to provide us with personal data, you trust us to act in a responsible manner with that information. This privacy policy contains important information about how we use personal data for the following data subjects:
We will refer to the above together as the “clients”. If you are considered a client of WPP we invite you to read and understand the contents set out in this privacy policy.
Note, if you are a California resident, please read our California Privacy Notice for further information on how we process personal data of clients here.
At times we may request that information is voluntarily supplied to us by our client themselves or by the legal entity appointed by the client.
We may gather the following information about you during our engagement:
Clients should ensure their employees are aware that their data is being shared with us, as described in this policy.
The primary reason we process your personal data is to approve, manage, administer or effect an agreement between WPP and the client you represent or work for. In this respect, we use your personal data, to, issue invoices, perform accounting, manage our contract or review the services or products we supply to you. In addition, we process personal data to meet our legal obligations (such as record keeping obligations, sanction list screening or anti-corruption obligations), as well as to manage our risks and operations (e.g. prevent and detect security threats, exercise or defend legal claims).
We are also required by law to state a “legal basis for processing”, i.e., to tell you on what grounds we are allowed to use your information, and this is also set out below:
How we will use your personal data | Our legal basis for processing |
Managing our relationship with our clients. | Legitimate interest – in cases where we process data of representatives or contacts of our customers who are legal entities, the processing of your data is necessary for our legitimate interest to communicate with our customers’ representatives in a customary, personal manner.Necessary for the performance of a contract – we use your personal data to liaise with you on matters relating to our relationship, if you, as our client, are a natural person. |
Making decisions about supplying goods and services (e.g., determining invoices or the terms of our contractual agreement(s) etc). | Legitimate interest – in cases where our client is a legal person, we use your personal data to keep our client updated throughout our relationship.Necessary for the performance of a contract – we use your personal data to supply goods and services to you, and to keep you updated throughout our relationship. |
Upholding our company’s economic interests and ensuring compliance and reporting (such as adhering to our policies, local legislation and managing allegations of fraud or misconduct). | To comply with our legal obligations – in cases where our client is a natural person, we use your personal data to investigate and prevent fraud or misconduct and to protect our economic interests, as well as to comply with trade sanctions and anti-corruption laws. |
To manage your visit to our offices. | Our legitimate interests for any other purposes required by law such as for example, compliance with fire protection regulations. |
To keep you informed of news, updates and other information related to our business and that of other companies in our group. | Our legitimate interests – ensuring you receive information relevant to you related to the services we provide.Where required by local law, we will ask you for your consent before we process your data for information purposes. |
Any other purposes required by law and authorities. | Processing is necessary for compliance with a legal obligation to which we are subject. |
We may send your personal data to other WPP group companies, affiliates and third parties to help us process your personal data for the purposes set out in this policy. Further details of our group companies can be found here.
We may disclose your personal data if we or any of our assets are the subject of a sale or similar corporate transaction. We will ensure that the third parties who receive your personal data are required to keep it confidential.
We may disclose personal data to third parties when we reasonably believe we are required by law, and in order to investigate, prevent, or take action regarding suspected or actual unlawful or otherwise prohibited activities, including, but not limited to, fraud.
Our third-party business partners, including RELX (UK) Limited, trading as LexisNexis (“LexisNexis”), may provide us with your Personal Data in order to enable us to conduct background checks and screening activities, comply with our legal obligations and for other purposes as described in this Policy. LexisNexis is responsible for any Personal Data which they may collect and hold about you until it is received by us. To learn more about how LexisNexis collects and uses your Personal Data please see their privacy policy at: https://www.lexisnexis.com/global/privacy/en/article-14-bis.page.
We are a global company and therefore we may transfer your personal data to countries around the world including the US and other countries outside Europe. We will, where the country to which your data is transferred has not been found to provide an adequate level of protection, put in place appropriate safeguards (we use standard contractual clauses) to ensure your information is protected.
We will keep your information for as long as is necessary to fulfil the purpose for which it was collected. The retention time is the term of the clients’ contract until any legal claims under the contract expire, unless an overriding legal or regulatory obligation arises.
We take appropriate measures to ensure that your personal data disclosed to us is kept secure, accurate and up to date and kept only for so long as is necessary for the purposes for which it is used.
Depending on the purposes of processing you may be entitled to ask:
Please contact us using the details set out below if you would like to exercise any of these rights.
You may also have the right to make a complaint to the supervisory authority in your country or jurisdiction if you’re not happy with how we’ve handled your personal data.
If you wish to exercise any of your rights in relation to your personal information or if you have any queries about how we use your personal information, please let us know by contacting us at the following address: WPP. Sea Containers, 18 Upper Ground, London, SE1 9GL, United Kingdom, or by email at enquiries@wpp.com.
We review this privacy policy on a regular basis to ensure that it is up-to-date with our use of your personal data, and compliant with applicable data protection laws.
We reserve the right, at our discretion, to revise this privacy policy at any time. The updated privacy policy will be posted on our website. You are encouraged to review this privacy policy from time to time.