Digital solutions privacy notice – Moata

Below is a list of the categories of personal information that we normally process for our own purposes.

• Personal identification: Name, job title, company
• Contact information: Email
• Moata and related digital solutions usage (collected using cookies and similar technologies): Identification numbers, location, IP address, cookies and similar technologies, device ID, pages visited and solutions used, language used. See our Online tracking technologies privacy notice for further information about cookies and other similar technologies that we use
• Account login information: Login ID, other information used to access and/or secure our digital solutions
• Any other information that you volunteer: Feedback, opinions, information provided in comments, support requests or other conversations (eg Moata Community and Moata Support)

Below is a non-exhaustive overview of the categories of personal information that we may process on behalf of one or more of our clients. This information will depend upon each client’s need and the purpose of their specific project. You should direct your privacy enquiries, including any requests to exercise your privacy and data protection rights, to our client directly.

• Personal identification: Name, title, gender, nationality

• Contact information: Email, phone number, address

• Moata and related digital solutions usage (collected using cookies and similar technologies): Identification numbers, location, IP address, cookies and similar technologies, device ID, websites visited, language used

• Account login information: Login ID, other information used to access and/or secure our digital solutions

• Property or asset information: Land or property ownership information, photographs and/or footage of your property as part of surveys or other client project related activities, details of other property owners

• Project related information: Surveyor qualifications, registrations and experience, work tasks, project labour costs, project progress and assessment

• Any other information that you volunteer: Feedback, opinions, information provided in survey and questionnaire responses, emails and letters or other conversations

Most of the personal and non-personal information that is processed in our digital solutions is provided to us by our clients and/or third parties. For example, in the Moata Land Management digital solution, clients usually instruct us to collect information about landowners and their land from sources such as the relevant authorities (eg HM Land Registry in the UK), third party surveyors, third party information verification services (eg LexisNexis TraceIQ in the UK), and responses to landowner questionnaires or surveys. Find out more about Moata Land Management.

In general, we process personal information in our digital solutions to provide our services to our clients under their instruction and in accordance with the lawful basis that they have deemed applicable.

Where we process your personal information for our own purposes, we will process personal information as part of providing our digital solutions in our legitimate interest to manage our relationship with our clients, promote our services to our clients, and to develop and improve our services and digital solutions. We may also need to process personal information to fulfil legal or regulatory requirements associated with these purposes. Some of the grounds for processing may overlap and there may be several grounds which justify our use of personal information.

Manage our relationship with our clients:

• Business relationship / account management

• Project management and support

• Project invoicing

• Responding to queries and other communications

Promote our services to our clients and prospective clients:

• Send promotional communication via email, post, and social media

• Analyse usage of our digital solutions to identify enhancements or other digital solutions that may be of interest

Compliance with legal obligations arising out of the appointment process: Disclosing personal information to government institutions or supervisory authorities as applicable in all countries in which Mott MacDonald operates, such as record-keeping and reporting obligations, compliance with government inspections and other requests from government or other public authorities, responding to legal processes such as subpoenas, pursuing legal rights and remedies, and managing any complaints or claims

Responding to any legal claims: Establishing, exercising, or defending our legal position

Where we process your personal information on behalf our client(s), we are instructed to collate and analyse personal information to meet their purpose(s). For example, our Moata Land Management digital solution is used by clients to:

• collate and store publicly available information about the land and the legal landowners;
• access information about the surveyors on the project and organise/manage planned surveys;
• create and send landowners communications, surveys, questionnaires, letters, etc; and
• analyse the information collected and produce reports for various purposes.

Where we process your personal information on behalf our client(s), we will only share your personal information with our client and any third parties that the client authorises.

Where we process your personal information for our own purposes, we will share your personal information with our trusted business partners (including suppliers and service providers) or other third parties only when it is necessary and proportionate to do so. We may share personal information with:

• External service providers who help us communicate with you and deliver our programmes, products, information and services, support our technology systems and infrastructure, or manage access to our work premises and facilities
• Regulatory authorities as required by law
• Law enforcement agencies investigating alleged criminal offences by you, another individual or an organisation

Please note that we will never sell your personal information to another organisation for any purpose.

We are a global business and our clients and trusted business partners (including service providers and suppliers) are located all over the world. This means your personal information may need to be accessed, stored, used, handled, or otherwise processed in countries outside of the one where you are normally located, for the purposes described in this notice.

However, where we process your personal information on behalf our client(s) we will host your personal information in the country, jurisdiction or location specified by our client. For example, some of our United States clients require the personal information that we process on their behalf to stay within the United States. If no location has been specified by our client(s) your personal information will be hosted on our servers in the UK and EU.

Whenever your personal information is being used for our own purposes, or is required to provide you with access to our digital solutions, it will be hosted on our servers in the UK and EU.

Before sharing any personal information across international borders, we ensure that appropriate safeguards are in place and that your privacy and data protection rights are protected. Those safeguards will normally include data encryption, role-based access permissions, and legal agreements that facilitate the lawful cross-border transfer of personal information. Where we process your personal information on behalf our client(s), we will follow their instructions and requirements.

We are not responsible for the privacy or information security practices of our clients, which may differ from our information security practices stated below.

We work hard to maintain and improve security measures that prevent personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Where we process your personal information for our own purposes, we limit access to personal information to individuals or organisations who have a legal right of access (for example, regulatory authorities or law enforcement agencies) or a legitimate business need to know (for example our project teams), suppliers and service providers or other third parties. Where we process your personal information on behalf our client(s), we limit access to personal information to the individuals who need it to perform their roles and the third parties approved by our client(s).

Our service providers and suppliers will only process personal information under our instructions, and we ensure that all third parties are subject to a legal duty of confidentiality. We have put in place procedures to deal with any suspected personal data breaches and will notify you and any relevant regulator or supervisory authority of a breach when required. Where we process your personal information on behalf our client(s), we will notify our client(s) and action as required by our client(s) and local law.

All Mott MacDonald People, including employees and temporary workers, are required to complete mandatory privacy and data protection training on an annual basis. This includes Moata and related digital solutions developers, account management, project teams and any other colleagues who may be required to access your personal information when carrying out their duties.

Please also see our Information security and Privacy and data protection Group policies for more information.

Where we process your personal information on behalf our client(s), we will delete your personal information in line with their instruction.

Where we process your personal information for our own purposes, we will only keep your personal information for as long as necessary. In certain cases, if required to do so by law, we may need to keep personal information for an extended period of time. Specific retention periods are defined, recorded, and applied by the business unit responsible for the personal information to which they apply. If you have an account with one of our digital solutions, the retention period for your account information can be found in the solutions documentation.

When your personal information is deleted or destroyed, we ensure that it is safely and permanently disposed of in accordance with any local legal requirements.

Where we process your personal information on behalf our client(s), who has directed you to one of our digital solutions or services, please direct your privacy enquiries, including any requests to exercise your privacy and data protection rights, to them directly. If you have an account with one of our digital solutions, our client will be identified in each project area. If you are responding to a survey or questionnaire invite, our client will be identified in the communications you receive from us. If you need any help identifying the client please contact Moata Support for support.

Where we process your personal information for our own purposes, Mott MacDonald gives you control over your personal information including:

• Informing you about our processing of your personal information in relevant privacy notices;
• Enabling you to withdraw your consent to our processing, where applicable; and
• Providing you will a copy of the personal information that we hold about you on request.

In most circumstances we will also be able to action your requests to:

• Rectify or complete your personal information if you inform us that it is inaccurate or incomplete;
• Erase (delete) the personal information that we hold about you;
• Restrict our processing of your personal information;
• Port your personal information to another company; and
• Manually review any automated decisions about you that may have a significant or legal impact.

Please complete this online form to submit any of the requests listed above.

We endeavour to respond to all valid requests within one month of receipt, or any alternative time period specified by law. It may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated. To help us provide a response in a timely manner, please be as specific as possible when describing both the information you believe may exist and its possible sources.

You will not normally have to pay a fee to exercise any of these rights, and your application will not be affected in anyway. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

In addition to the above, you may also have the right to contact a privacy and data protection regulator in the country, state, or province where you are located if you are not happy with how we are processing your personal data. If you need any help identifying the relevant regulator please contact the Privacy and Data Protection Team at privacy@mottmac.com.

If you are unsure about anything in this notice please contact Moata Support for further information.

Alternatively, if you have any concerns about this privacy notice, or how we have used your personal information, please contact our Privacy and Data Protection Team at privacy@mottmac.com. If you are located in Singapore, you can also contact us by calling 6293 1900. If you are a resident of California, please contact privacyamericas@mottmac.com or dial 800.832.3272.

If you are unhappy with how we have used your personal information, you can register a complaint with the data protection regulator in the country, state, or province where you are located.

If you would like to exercise any of your privacy and data protection rights please contact us using this online form.

We continually review the accuracy of our privacy notices and may update them at any time to include changes to our processes - this notice was last reviewed and updated in May 2022. If we process your personal information for our own purposes, we will notify you of any significant changes.