Analysis Group U.S. Privacy Notice
Last Updated: January 1, 2023
This U.S. Privacy Notice (the “U.S. Notice”) supplements the information contained in our Website Privacy Statement by providing additional information about how Analysis Group, Inc. and our subsidiaries and affiliates (“Analysis Group,” “we,” “our,” or “us”) collect, use, disclose, and otherwise process personal data of individual residents of the United States (“U.S.”) who are our clients or service providers, and anyone else who may contract, contact or otherwise interact with us. Unless expressly stated otherwise, all terms defined in our Website Privacy Statement have the same meaning in this U.S. Notice.
For purposes of this U.S. Notice, the term “personal data” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household. For the purposes of this U.S. Notice, personal data does not include deidentified, aggregated or anonymized information that is maintained in a form that is not capable of being associated with or linked to you.
To the extent that any provision of the Analysis Group Website Privacy Statement conflicts with a provision of this U.S. Notice, the provision in this U.S. Notice controls as to U.S. residents. This U.S. Notice is not a contract and does not create any legal rights or obligations.
This U.S. Notice does not pertain to personal data relating to Analysis Group’s employees, contractors and other staff or job applicants. Please also note that the processing of personal data which a client provides to us for rendering our services (e.g., personal data relating to the client's own clients), or which we collect on a client’s behalf in rendering our services, is not subject to this U.S. Notice to the extent the processing of such personal data is conducted only on behalf of the client and solely for the purpose of providing the services and according to the client's instruction. In such a case, the client is generally the “business” or “controller” of the personal data and is responsible for providing notice about such processing.
Any processing of personal data in the context of your using of the website accessible at www.analysisgroup.com is subject to the Website Privacy Statement set out on the Site (and accessible via: https://www.analysisgroup.com/policy/).
- OUR COLLECTION OF PERSONAL DATA
Personal Data Collected from Individuals
We may collect the following personal data about you and others at your organization in the course of our interactions:
- Contact Information, such as your first and last name, company name, employer, job title, job function, phone number, email address, mailing address, professional background, and nature of your relationship with us.
- Billing and Payment Information, such as your bank routing number, bank account number, and tax identification number.
- Information relating to our Contractual Relationship.
- For Office Visits and Events, we may also collect information regarding the purpose of your visit, any restrictions or preferences relevant to your visit (such as dietary restrictions), a copy of your government ID (such as a driver’s license), a record of your access to our office or event, any use by you of our computer systems, and images or audio- or video-recordings of you while on premises (where permitted by law).
- Other Informationthat you provide to us online, by phone or email, by mail, or in person, including the content of communications with us and, audio- or video-recordings of calls with us (where permitted by law), and any feedback that you provide to us regarding our services and business.
Information Collected Automatically
We may collect the following personal data automatically when you visit our Site: log file data (including IP address), analytics data, and location data. Like many websites, our Site uses “cookie” technology to collect website usage data and to improve the Site and our services. More information about data collected automatically through our Site is available in our Website Privacy Statement.
When communicating with us via email, we may also automatically collect personal data such as information on whether or not you open the email or use a link contained in the email, and how you otherwise interact with the message we sent. When collecting data automatically, we typically cooperate with third party providers and use web beacons in our emails. These are small graphics that are often transparent and can therefore not be seen. They help us understand how you interact with our email. If you access our Site via a link contained within a marketing email received from us, additional information may be collected by us or our third party partners, such as your IP address.
Note that we and our third-party partners may combine information that each of us collects automatically with other information about you, including information you choose to provide.
See the “Your Choices” section below to learn more about how you may opt out of or limit certain automatic data collection tools.
Personal Data Obtained from Third Parties
We may also obtain personal data from third parties, which could be combined with personal data that we have collected directly from you.
We may receive the same categories of personal data as described above from your employer (such as your business contact information), other individuals who have a business relationship with us (for instance, in the provision of a business referral), and third-party information providers or publicly available sources (for instance, to correct or supplemental the personal data we have collected). We may also obtain personal data through our service providers.
We may also receive personal data from social media networks. For instance, when someone follows us or shares our content on LinkedIn, Facebook, Google, or other social networks we may receive some information about individuals that they permit the social network to share with third parties. The data we receive is dependent upon an individual’s privacy settings with the social network.
- HOW WE USE PERSONAL DATA
We may use personal data we collect to:
- Meet the reason the information was provided, such as to fulfill our contractual obligations, to deliver services, and to process financial transactions;
- Manage our organization and its day-to-day operations;
- Communicate with individuals, including via email, direct mail, social media and/or telephone calls;
- Share our knowledge and promote our services, including through email, direct mail, social media and/or telephone calls;
- Register individuals for and provide them access to events;
- Monitor, review, and evaluate the performance and effectiveness of our services and our business, including to measure the success of our marketing measures and identify usage trends;
- Help maintain the safety, security and integrity of our staff, property, services, technology assets, data, and business, or those of third parties;
- Establish, exercise or defend legal claims, including to protect or enforce our rights or property or those of third parties;
- Detect, prevent, investigate or provide notice of fraud or unlawful or criminal activity;
- Carry out audits;
- Address complaints, feedback, and inquiries; and
- Comply with legal obligations, including tax reporting requirements, and assistance with investigations carried out by competent authorities.
Where an individual chooses to contact us, we may need additional information to fulfill the request or respond to inquiries. We may provide additional privacy disclosures where the scope of the inquiry/request and/or personal data we require falls outside the scope of this U.S. Notice. In that case, the additional privacy disclosures will govern how we may process the information provided at that time.
- OUR DISCLOSURE OF PERSONAL DATA
We disclose personal data in the following ways:
- Within Analysis Group: We may share personal data within our family of companies for internal administrative purposes, business purposes, and uses that are consistent with this U.S. Notice. For example, staff employed by another one of our entities may receive your personal data when we collaborate in providing services.
- Your Employer / Company: If you engage in our services through your employer or company, including our clients or former clients, we may disclose information to your employer or the company, such as your name and contact information.
- Marketing Providers: We coordinate and share personal data with our marketing providers in order to communicate with individuals about the services we make available and to market our services to individuals.
- Service Providers: We engage third-party service providers that perform business or operational services for us or on our behalf, such as providers of outsourced IT services, cloud services and storage, analytics services, and other administrative services.
- Other Parties as Needed to Provide Services: We may share personal data with third party consultants and experts providing services to us or directly engaged by you, or law firms and other service providers who are advising you, or otherwise as needed to provide our services or in the course of our business relationship.
- Business Transaction or Reorganization: We may take part in or be involved with a corporate business transaction, such as a merger, dissolution, acquisition, sale of company assets, or similar transaction. We may disclose personal data to a third party during negotiation of, in connection with or as an asset in such a corporate business transaction. Personal data may also be disclosed in the event of insolvency, bankruptcy or receivership.
- Legal Obligations and Rights: We may disclose personal data to third parties, such as legal advisors and law enforcement:
- in connection with the establishment, exercise, or defense of legal claims;
- to comply with laws or to respond to lawful requests and legal process;
- to protect our rights and property and the rights and property of others, including to enforce our agreements and policies;
- to detect, suppress, or prevent fraud;
- to protect the health and safety of us and others; or
- as otherwise required by applicable law.
- Otherwise with Consent or Direction: We may disclose personal data about an individual to certain other third parties or publicly with the individual’s consent or direction. For example, with an individual’s consent or direction we may feature an individual on our Site or in service-related publications.
In connection with any of the above, we may share information with others in an aggregated or otherwise anonymized form that does not reasonably identify an individual.
- Your Choices
An individual may control their information in the following ways:
- Email Communications Preferences: You can stop receiving promotional email communications from us by clicking on the unsubscribe link provided in such communications. You may not opt out of communications related to the services we provide or our business relationship with you.
- Modifying or Deleting Your Information: If you have any questions about reviewing, modifying, or deleting your information, you can contact us directly at AGPrivacy@analysisgroup.com. We may not be able to modify or delete your information in all circumstances.
- Data Collection Technologies: You may have options within your email client to prevent the automatic downloading of images that may contain technologies that would allow us to know whether you have accessed our email and performed certain functions with it. With regard to information collected through our Site, you can manage cookies by modifying your preferences in the cookie banner on our Site. You may also have the ability to change your browser settings to assist in limiting cookies or other tracking technologies. We allow certain third parties, like Google Analytics, to collect information about individuals directly through our Site for purposes of analyzing and optimizing our Site and services. More information about the use of Google Analytics for these purposes can be obtained by visiting Google’s privacy policy here. You may opt out of Google Analytics here. More information about how to control data collected automatically through our Site is available in our Website Privacy Statement.
- CHILDREN’S PERSONAL DATA
Our services are not directed to, and we do not intend to, or knowingly, collect or solicit personal data from children under the age of 13. If we learn that any personal data we collect has been provided by a child under the age of 13, we will promptly delete that personal data.
- UPDATES TO THIS U.S. NOTICE
We will update this U.S. Notice from time to time. When we make changes to this U.S. Notice, we will change the date at the beginning of this U.S. Notice. If we make material changes to this U.S. Notice, we will notify individuals in a manner at our discretion.
Please review our privacy notices regularly, as updated notices will apply to your future interactions with us, as of the date of publication unless otherwise provided in the notification.
- CONTACT US
If you have any questions or requests in connection with this U.S. Notice or other privacy-related matters, please send us an email at: AGPrivacy@analysisgroup.com.
- Additional U.S. State Privacy Disclosures
For residents of the States of California, Colorado, Connecticut, Nevada, Utah and Virginia: These Additional U.S. State Privacy Disclosures (“U.S. State Privacy Disclosures”) supplement the information contained in the above U.S. Notice and our Website Privacy Statement by providing additional information about our personal data processing practices relating to individual residents of these states. For a detailed description of how we collect, use, disclose, and otherwise process personal data in connection with our services, please see the above U.S. Notice and our Website Privacy Statement. Unless otherwise expressly stated, all terms defined in the above U.S. Notice and our Website Privacy Statement retain the same meaning in these U.S. State Privacy Disclosures.
These U.S. State Privacy Disclosures do not pertain to personal data relating to Analysis Group’s employees, contractors and other staff or job applicants, or to personal data which a client provides to us for rendering our services (e.g., personal data relating to the client's own clients), or which we collect on a client’s behalf in rendering our services.
Collection and Use of Personal Data
We collect personal data from and about individuals for a variety of purposes. To learn more about the types of personal data we collect, the sources from which we collect or receive personal data, and the purposes for which we use this data, please refer to the “Our Collection of Personal Data” and the “How We Use Personal Data” sections of our U.S. Notice and the “Information We Collect”, “How Data Is Collected”, and “Use of Personal Data” sections of our Website Privacy Statement.
No Sales or Targeted Advertising
We do not sell personal data, and we do not process or otherwise share personal data for the purpose of displaying advertisements that are selected based on personal data obtained or inferred over time from an individual’s activities across businesses or distinctly-branded websites, applications, or other services (otherwise known as “targeted advertising”).
Sensitive Information
We may collect driver’s license number and/or Social Security number for business purposes, such as tax purposes and verifying the identity of office visitors. These personal data elements may be classified as “sensitive” under certain privacy laws (“sensitive information”).
We do not sell sensitive information, and we do not process or otherwise share sensitive information for the purpose of targeted advertising. Depending on your state of residency and subject to certain legal limitations and exceptions, you may be able to limit, or withdraw your consent for, our processing of sensitive information (as described in the “Your Privacy Rights” section below).
Deidentified Information
We may at times receive, or process personal data to create, deidentified information that can no longer reasonably be used to infer information about, or otherwise be linked to, a particular individual. Where we maintain deidentified information, we will maintain and use the information in deidentified form and not attempt to reidentify the information except as required or permitted by law.
Your Privacy Rights
Depending on your state of residency, you may be able to exercise the following rights in relation to the personal data we have collected about you (subject to certain limitations at law):
|
The Right to Know |
|
|
The Right to Access & Portability |
The right to obtain access to the personal data we have collected about you and, where required by law, the right to obtain a copy of the personal data in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance. |
|
The Right to Correction |
The right to correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of the personal data. |
|
The Right to Control Over Sensitive Information |
The right to exercise control over our collection and processing of certain sensitive information. |
|
The Right to Request Deletion |
The right to have us delete the personal data we maintain about you. |
Depending on your state of residency, you may also have the right to not receive retaliatory or discriminatory treatment in connection with a request to exercise any of the rights described above.
Please note that if the exercise of the rights described above limits our ability to process personal data (such as in the case of a deletion request), we may not be able to provide our services to individuals who exercise these rights, or to otherwise engage with such individuals going forward.
How to Exercise Your Privacy Rights
To submit a request to exercise any of the above rights, please:
- Contact us at 866-425-0020; or
- Email AGPrivacy@analysisgroup.com.
Before processing your request, we will need to verify your identity and confirm you are a resident of a state that offers the requested right(s). In order to verify your identity, we will generally require the matching of sufficient information you provide us to the information we maintain about you in our systems. This process may require us to request additional personal data from you, including, but not limited to, your name, email address, mailing address, date of your last interaction with us, and the general nature of your interactions with us. If we are able to verify your identity, we will respond to your request or provide an explanation as to why we are unable to comply with your request.
In certain circumstances, we may decline a request to exercise the rights described above, particularly where we are unable to verify your identity or locate your information in our systems. If we are unable to comply with all or a portion of your request, we will explain the reasons for declining to comply with the request.
Submitting Authorized Agent Requests
In certain circumstances, you are permitted to use an authorized agent to submit requests on your behalf through the designated methods set forth in these U.S. State Privacy Disclosures, where we can verify the authorized agent’s authority to act on your behalf. In order to verify the authorized agent’s authority, we generally require evidence of either: (i) a valid power of attorney; or (ii) a signed letter containing your name and contact information, the name and contact information of the authorized agent, and a signed statement of authorization for the request. Depending on the evidence provided and your state of residency, we may still need to separately reach out to you to confirm the authorized agent has permission to act on your behalf and to verify your identity in connection with the request.
Appealing Privacy Rights Decisions
Depending on your state of residency, you may be able to appeal a decision we have made in connection with your privacy rights request. All appeal requests should be submitted by emailing us at AGPrivacy@analysisgroup.com with the subject line, “Privacy Request Appeal.”
Minors Under 16
We do not sell the personal data of individuals we know to be less than 16 years of age. Please contact us at AGPrivacy@analysisgroup.com to inform us if you, or your minor child, are under the age of 16.
California-Specific Privacy Disclosures
The following disclosures only apply to residents of the State of California:
Personal Data Collection
In the last 12 months, we may have collected the following categories of personal data:
- Identifiers, such as name, address, email address, phone number, user ID, IP address, driver’s license number, and social security number.
- California Customer Records (Cal. Civ. Code § 1798.80(e)), such as including your bank account information.
- Professional/Employment Information, including your job title or current employer.
- Internet/Network Information, including your browsing history, search history, cookie data, your usage information (such as the actions you take and the content you view on Analysis Group’s website).
- Geolocation Data, including your general geographic location or more precise location when permitted by law.
Disclosure of Personal Data
In the preceding 12 months, we have not sold any California residents’ personal data or shared personal data for purposes of targeted advertising. We do allow certain service providers, like Google Analytics, to collect information about individuals directly through our Site for purposes of analyzing and optimizing our Site and services. You may opt out of Google Analytics here.
In the preceding 12 months, we have disclosed for a business purpose the following categories of personal data about California residents: identifiers, California customer records information, professional/employment information, internet/network information, and geolocation data. We share this information with our service providers who handle information on our behalf or to other third parties at the individual’s direction, as outlined in the “Our Disclosures of Personal Data” section of our U.S Notice.
Data Retention
We retain personal data only for as long as is reasonably necessary to fulfil the purpose for which it was collected. However, if necessary, we may retain personal data for longer periods of time, for instance where we are required to do so in accordance with legal, tax and accounting requirements, or to establish, exercise, or defend legal claims.
Once retention of the personal data is no longer necessary for the purposes outlined above, we will either delete or deidentify the personal data or, if this is not possible (for example, because personal data has been stored in backup archives), then we will securely store the personal data and isolate it from further processing until deletion or deidentification is possible.