Information Risk Management Limited (IRM) is committed to protecting and respecting your privacy. This Privacy Notice sets out to define the basis on which any personal information we collect from you, or that you provide to us, will be handled and treated by us and to explain your rights regarding the use(s) of this information.
Your personal information is processed by IRM, who for the purposes of UK data protection legislation is the data controller. This is because we determine how and why your personal information is processed in the context of our legitimate business needs.
- IRM is registered in England and Wales (company number 03612719) at the following address: 95 Queen Victoria Street, London, United Kingdom, EC4V 4HN.
- Our Data Privacy Lead can be contacted via dpocapgemini.uk@capgemini.com
IRM as a data processor
This Privacy Notice does not apply to the extent we process personal information as a processor or service provider on behalf of our customers, including where we offer to our customers various services through which our clients (or their affiliates) collect, use, share or process personal information via our services.
For detailed privacy information related to how an IRM customer or a customer affiliate that uses IRM services as the controller processes personal information, please contact our customer directly. We are not responsible for the privacy or data security practices of our customers, which may differ from those explained in this Privacy Notice. If you wish to exercise any rights you may have under UK data protection legislation, please inquire with them directly.
Why we collect personal information
Visiting our website will not necessarily result in the collection and/or further processing of your personal information, however, accessing parts of the website and/or requesting specific information may lead to such processing. Depending on the purpose for which IRM collects or further processes your personal information, it shall either rely on your consent or on its legitimate interest. Please find below the main purposes for which IRM shall collect and/or further process your personal information:
| Purpose | Lawful basis |
| To answer any request, query, or enquiry you may submit | Legitimate interest: to allow us to respond |
| To enable the use of cookies and/or other trackers – provided you agreed to it – and subject to the terms and conditions detailed under the Cookies Notice | Consent |
| To conduct customer satisfaction surveys | Legitimate interest: to allow us to improve our service where required and ultimately provide a good service to our customers |
Types of personal information collected
- Information you may provide us when you contact us either by completing the form on our website or when corresponding with us by phone, email or post.
- Information you may provide to us when you interact with us on social media platforms (such as LinkedIn or Twitter); or
- Information you may provide to us when you report a problem with our Website
- If you download publications, white papers and other documentation made available through our website we may ask for some information to identify you and in some instances your organisation and role within it.
- When you visit our website we may also collect personal information, whether you have actively provided it or are merely browsing. You can read more about our use of cookies via on our Cookies Notice.
How long we retain personal information
IRM shall keep your personal information for no longer than is necessary for the purpose(s) for which they were first collected. IRM shall determine the appropriate retention period considering the purpose(s) of the processing and the relevant applicable legal requirements.
This means that the retention period may be defined differently depending on the purpose(s) pursued by the processing and the local requirements, considering specific legal obligations. In any case, and as described below, you can exercise your rights.
Information you provide in response to questionnaires and surveys are held on our behalf for the duration of a campaign plus one year when we delete it.
We will review and delete or destroy personal information on a regular basis. If we are unable, using reasonable endeavours, to delete or destroy personal information we will ensure that it is anonymised or appropriate measures are taken to put the personal information beyond use.
Who your personal information is shared with
IRM is part of the Capgemini Group and as such, several entities within the group may access and further process your personal information. However, such access will always be strictly limited to the relevant stakeholder(s) both from a functional and geographical scope.
Please note that all processing activities carried out by IRM, including any cross-border transfers of personal information shall be covered and framed by Capgemini’s Binding Corporate Rules (BCR) which include both its EU and UK BCR.
We may disclose your personal information to third parties. Where IRM shares your personal information with any third party, it shall do so in compliance with applicable data protection legislation. Where any cross-border transfers of personal information are involved, such transfers shall be framed by the appropriate data transfer mechanism(s). In particular, where the UK GDPR applies, IRM shall enter into the International Data Transfer Agreement (IDTA) or the European Commission Standard Contractual Clauses (SCC) and the International Data Transfer Addendum (“UK Addendum”) to the SCC. The categories of recipients are:
- Our professional advisors such as our auditors, external legal and financial advisors;
- With government authorities and/or law enforcement officials as mandated for the protection of our legal or legitimate interests and in compliance with applicable legislation;
- Third-party suppliers acting as data processors, which may have limited access to your personal information. Where relying on such processors, be assured that IRM enters into contractual agreements in accordance with data protection legislation;
- If we sell any business or assets, we may disclose your personal information to the prospective buyer of such business or assets;
- If we are under a duty to disclose or share your personal information in order to comply with any legal obligation; or to protect the rights, property, or safety of IRM, our customers, or others.
Your rights
Your personal information is protected by various data protection legislation and there are a number of rights (briefly explained below) which you can seek to exercise.
We will respond to legitimate and requests as quickly as possible and in any event within one month. If we require more information or need to seek clarification, we will contact you directly and without undue delay.
You can request IRM to do the following actions with your personal information:
| Access | You can ask IRM whether personal information concerning you is being processed, and where that is the case, you can request access to such personal information. |
| Erasure | In some cases, you can request that IRM delete your personal information. |
| Rectification | In some cases, you can ask IRM to rectify, update or complete your personal information. |
| Objection | In some cases, you can object to IRM processing your personal information. |
| Restriction | In some cases, you can ask IRM to limit the processing of your personal information subject to certain conditions. |
| Portability | In some cases, you can ask IRM to provide you with the personal information you shared with IRM in a structured, commonly used and machine-readable format; and/or to transmit the information to another controller. |
| Withdraw Consent | You can withdraw your consent to the processing of your personal information even if you had initially granted such consent for IRM to process it. |
If you wish to exercise any of these rights, please contact us by sending an email to the following address: dpocapgemini.uk@capgemini.com
What to do if you have concerns or wish to make a complaint
If you have questions, comments or concerns, or wish to make a complaint regarding how we collect or use your personal information please raise them directly with us in order that we can address them promptly. In the first instance notify your account manager (if you have one), or alternatively via our Data Protection Lead through the contact information given above.
If we are unable to resolve your concerns or compliant to your satisfaction you are entitled to raise a complaint with the supervisory authority, the Information Commissioner’s Office on 0303 123 1113 or via other means as set out on their website – https://ico.org.uk/concerns/.
Links
Our website may contain links to third party websites. IRM is not liable or responsible for your use of such other websites and you are advised to check their policies and privacy notices before you submit any personal information through them.
Changes to our privacy notice
We will review and where necessary update this privacy notice and we will clearly indicate the date it was last updated for your reference and convenience.
This Privacy Notice was last revised June 2026.