Privacy Policy

The short version

We collect the minimum data needed to run this website and respond to your enquiries. We don't sell your data. We don't spam you. If you want us to delete your information, just ask.

Who we are

This website is operated by TG Holding Co Limited, a New Zealand company, on behalf of the Topham Guerin group of companies. We have offices and subsidiaries in New York, London, Sydney, and Auckland.

For data protection enquiries, contact us.

What we collect

When you contact us

If you use our contact form, we collect your name, email, company (if provided), and message. We use this to respond to you. That's it.

When you apply for a job

If you apply for a role through our careers pages, we collect the details you give us: your name and email, your phone and location if you provide them, your CV, and any cover note. We use this only to consider your application and to get back to you. It's stored in our internal recruitment system and seen only by the Topham Guerin people involved in hiring. We don't use it for anything else, and we don't share it with anyone outside that team.

Automatically

Like most websites, we collect basic technical data: your IP address, browser type, and which pages you visit. This helps us keep the site running and secure. We use Cloudflare for hosting, which processes this data on our behalf, and Cloudflare Web Analytics to count visits without cookies.

We also use Google Analytics to see which pages are useful, and Google Ads cookies so we can occasionally show TG ads to people who've visited. Whether they run depends on where you are and what you've chosen; our Cookie Policy explains how, and Cookie settings at the bottom of every page turns either off.

Cookies

We use a small number of cookies. See our Cookie Policy for the full list. It's genuinely short.

Why we process your data

We're required to tell you our "lawful basis" for processing. Here's the plain English:

• To reply to you: If you contact us, we need your details to respond. (Legal basis: legitimate interests)
• To run the website: Security, and cookieless visit counts from Cloudflare. (Legal basis: legitimate interests)
• To see how the site is used: Google Analytics. (Legal basis: your consent in the EU, EEA and Switzerland; elsewhere, legitimate interests, and in the UK the statistical purposes exception for analytics. You can turn it off anytime.)
• To show TG ads to people who've visited: Google Ads cookies. (Legal basis: your consent in the UK, EU, EEA and Switzerland; elsewhere, legitimate interests. You can turn it off anytime.)
• Marketing emails: Only if you explicitly opt in. (Legal basis: consent)

Who has access

Your data is handled by:

• Our team: Staff who need access to respond to enquiries
• Cloudflare: Hosts this website (US-based, EU-US Data Privacy Framework certified)
• Resend: Delivers our contact form emails (US-based)
• Google: Google Analytics, measuring how the site is used, as our processor; and, where ads are on, Google Ads, to show TG ads to people who've visited (US-based, EU-US Data Privacy Framework certified)

We don't sell data. Apart from Google Ads, as above, we don't share it with advertisers. We don't give it to anyone else unless legally required.

How long we keep it

• Contact form submissions: 2 years, then deleted
• Job applications: kept while we consider you and for a reasonable period after; we delete them on request, and otherwise review and remove applications we're no longer acting on
• Server logs: 30 days

Your rights

Under UK/EU data protection law, you can:

• Ask what data we hold about you
• Ask us to correct it
• Ask us to delete it
• Ask us to stop processing it
• Request a copy in a portable format

Get in touch and we'll sort it within 30 days.

If you're unhappy with how we've handled things, you can complain to the UK Information Commissioner's Office (or your local data protection authority if you're in the EU).

International transfers

Some of our service providers are US-based. Where we transfer data outside the UK/EU, we ensure appropriate safeguards are in place, either through the EU-US Data Privacy Framework or Standard Contractual Clauses. If you want the specifics, ask us.

Changes

If we update this policy, we'll change the date at the top. For significant changes, we'll make it obvious.