Privacy.

1. INTRODUCTION

This policy explains how the ddx group (“ddx”, “we”, “us” or “our”) collects, uses, shares and protects personal data through this website, ddxtransformation.com: when you visit it, send us an enquiry or a workshop request, or apply for a job. It also explains your rights and how to use them.

It doesn’t cover personal data we handle for clients under our contracts with them, or our own staff’s data, which are subject to separate client engagement and employee privacy notices.

2. WHO WE ARE

ddx is one consultancy with offices in London, Tokyo, Hong Kong, Bangkok and Dubai. Behind it is a group of companies: DDX Group Limited, in Hong Kong, is the group’s holding company, and the companies below make up the group (“group companies”). ddx has no company in Japan or the United Arab Emirates: our Tokyo and Dubai teams work for the group companies.

2.1. Controller

The data controller responsible for personal data collected through this website is DDX Group Limited (Hong Kong) as the primary holding company, working alongside DDX Holdings Limited (United Kingdom) which holds the group’s intellectual property. Where required under UK GDPR or EU GDPR Article 27, DDX Holdings Limited acts as the representative for processing operations directed at individuals in the UK and EU.

If you apply for a job, the group company that would employ you is also responsible for your application from the moment we pass it to them. We tell you which company that is before we make an offer.

3. THE LAWS THAT APPLY

Which data protection laws apply to your data depends on where you are and which group company handles it. Between them, our offices and the people we work with are covered by:

• United Kingdom: the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018; and, for cookies and similar technologies, the Privacy and Electronic Communications Regulations 2003 (PECR).
• European Union and European Economic Area: the General Data Protection Regulation (EU GDPR), where it applies to visitors there.
• Thailand: the Personal Data Protection Act B.E. 2562 (2019) (PDPA).
• Hong Kong: the Personal Data (Privacy) Ordinance (Cap. 486) (PDPO) and its six data protection principles.
• Japan: the Act on the Protection of Personal Information (APPI).
• United Arab Emirates: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL).

This policy is written to work under all of them. Where a law gives you more, sections 10 and 12 say so.

4. PERSONAL DATA WE COLLECT AND WHY

We collect only what we need for the purposes below. The last column gives the legal basis for each under the UK and EU GDPR.

Thailand’s PDPA has similar legal bases. Hong Kong’s PDPO, Japan’s APPI and the UAE’s PDPL work differently: under them, we use your data only for the purposes in this table, and ask for your consent where they require it.

We don’t sell personal data or use it for advertising, and we don’t make decisions about you by automated means alone.

4.1. Sensitive information

Please don’t include sensitive information in a CV or message: your health, religion, ethnicity, political views, sexual orientation or criminal record, or an identity number such as a national ID or passport number. We don’t need any of it to consider you. If a CV includes it, we won’t use it to assess your application.

5. COOKIES AND ANALYTICS

5.1. What are cookies?

Cookies are small text files placed on your device when you visit a website. They allow the website to remember your preferences and analyse how visitors use the site.

5.2. Cookies we use

Necessary

Necessary cookies and storage keep the website secure and remember your cookie choice. The law lets us use them without asking first.

Analytics

Analytics cookies are set only if you accept them in the cookie banner. They help us understand how visitors use the website: how many there are, which pages they read and where they came from. We have turned off Google signals and ads personalisation.

Manage cookie preferences

Consent Preferences

You can modify your cookie settings anytime by clicking the ‘Consent Preferences’ button above. This will allow you to revisit the cookie consent banner and update your preferences or withdraw your consent immediately.

Additionally, different browsers offer various methods to block and delete cookies used by websites. You can adjust your browser settings to block or delete cookies. Below are links to support documents on how to manage and delete cookies in major web browsers.

Chrome: https://support.google.com/accounts/answer/32050

Safari: https://support.apple.com/en-gb/guide/safari/sfri11471/mac

Firefox: https://support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox?redirectslug=delete-cookies-remove-info-websites-stored&redirectlocale=en-US

Microsoft Edge: https://support.microsoft.com/en-us/windows/manage-cookies-in-microsoft-edge-view-allow-block-delete-and-use-168dab11-0753-043d-7c16-ede5947fc64d

If you are using a different web browser, please refer to its official support documentation.

6. WHO WE SHARE IT WITH

6.1. Within the group

We work as one team across our offices. Enquiries and applications arrive in one private Slack channel, open only to the ddx people who handle them, so the right person can reply from whichever office and group company they work for. Group companies share personal data with each other only for the purposes in section 4, and each handles it as this policy describes.

For Japan’s APPI, this is joint use: the group companies in section 2 jointly use the personal data listed in section 4, for the purposes listed there. The company responsible for managing it is the controller in section 2.1, at the address in the table in section 2; its representatives are Gareth Davies and Pawel Michalski, directors of the controller.

6.2. Service providers

These companies process personal data for us, on our instructions and under contracts that require them to protect it:

When we reply to you or take an application further, your details also go into our email and business systems, such as Google Workspace (Gmail) and LinkedIn.

6.3. Others

• Legal and regulatory: where a law, court order or regulator in a country where we operate requires it, or to establish or defend legal claims.
• Professional advisers: our lawyers, accountants and auditors, who are bound to keep it confidential, where they need it.
• Business changes: if all or part of the group is sold, merged or restructured, to the new owner, who must protect it as this policy does.

7. INTERNATIONAL TRANSFERS

We work across five countries, and the services we use run worldwide. So your data may be handled outside the country you are in:

• by our people in the United Kingdom, Thailand, Hong Kong, Japan and the United Arab Emirates;
• by Cloudflare, which keeps enquiries and applications in its Asia-Pacific region;
• by Slack and Google, in the United States.

Some of these countries are recognised as protecting personal data adequately: the UK and the EU recognise each other, and both recognise Japan. Where a transfer goes somewhere that isn’t, we protect it with an approved safeguard such as standard contractual clauses (including the EU Standard Contractual Clauses and the UK International Data Transfer Addendum), active certifications under the EU–U.S. Data Privacy Framework and UK Extension, or an intra-group data transfer agreement governing international transfers between ddx group entities.

You can ask us for a copy of the safeguards that apply to your data (section 11).

8. HOW LONG WE KEEP IT

If an enquiry leads to work together, or an application to a job, we keep what we need as part of that relationship, and tell you how long at the time.

9. SECURITY

We take practical steps to protect personal data from unauthorised or accidental access, loss or misuse. The website is served only over encrypted connections. Enquiries and applications are kept in a private storage bucket with no public address, which Cloudflare encrypts at rest, and posted to a private Slack channel. Only the people who need them have access.

How we protect information more widely, including our Cyber Essentials certification, is on our security page.

No way of sending or storing data is completely secure. If something goes wrong that puts your data at risk, we will tell you and the regulators when the law requires it.

10. YOUR RIGHTS

Wherever you are, you can:

• Access: ask whether we hold personal data about you, and for a copy.
• Correction: ask us to correct data that is wrong or incomplete.
• Deletion: ask us to delete data we no longer need or have no other basis to keep.
• Restriction and objection: ask us to stop or limit how we use it, including use based on our legitimate interests.
• Portability: ask for the data you gave us in a common electronic format, or for us to send it to someone else.
• Withdraw consent: where we rely on it. For analytics, use the Consent Preferences button in section 5, or Cookie settings at the foot of any page.

Some of these rights come from particular laws and have conditions. If one doesn’t apply to your request, we’ll tell you why. We may ask you to prove who you are before we act. We don’t charge, unless a law allows a reasonable fee.

We reply as soon as we can, and always within the time the law allows. What each law adds:

• United Kingdom and EU: we reply within one month, which we can extend by two months for a complex request; we’ll tell you if we do.
• Thailand: we reply to a request for access within 30 days. You can also ask how we obtained data about you that you didn’t give us.
• Hong Kong: you can make a data access request and a data correction request under the PDPO. We reply within 40 days, and may charge a fee for a data access request that isn’t excessive.
• Japan: you can also ask us to stop providing your data to third parties, and to show you our records of providing it.
• United Arab Emirates: you have the rights the PDPL gives, which are close to the list above.

11. HOW TO CONTACT US

For any question about this policy or your data, or to use any of your rights, email our privacy contact at dpo@ddxtransformation.com.

Or send us a message through our contact form: choose “Something else” and say it’s about your personal data.

We haven’t appointed a data protection officer. The privacy contact above handles every request.

12. COMPLAINTS

If you’re unhappy with how we’ve handled your data, please tell us first (section 11) so we can put it right. You can also complain to the data protection regulator where you live or work, or where you think the problem happened:

13. CHILDREN

Our website is not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you become aware that a child has provided us with personal data without appropriate consent, please contact us and we will take steps to delete that data promptly.

14. OTHER WEBSITES

Our website may contain links to external websites operated by third parties. This Privacy Policy does not apply to those websites, and we are not responsible for their privacy practices or content. We encourage you to review the privacy policies of any third-party sites you visit.

15. CHANGES TO THIS POLICY

We may revise this Privacy Policy from time to time to reflect changes in law, our business practices, or the nature of our website. The most current version will be published on our website, and the date at the top of this page shows when it last changed.

ddx is the brand of the group companies in section 2. DDX Holdings Limited is registered in England and Wales, company number 13774972, registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. DDX Group Limited is registered in Hong Kong, business registration number 79607025, at 6/F Wyndham Place, 40-44 Wyndham Street, Central, Hong Kong.