Privacy policy

Controller and contact details

Bright Green Partners B.V. (“BGP”, “we”, “us” or “our”) is the controller for the processing of personal data described in this privacy policy, unless expressly stated otherwise.

Bright Green Partners B.V.
Arcenlaan 34
5709 RA Helmond
The Netherlands

Privacy contact: Ewa Granosik, CEO (ewa@brightgreenpartners.com)

This privacy policy explains how we process personal data in connection with our consultancy services, expert network, expert calls, client relationships, business communications, websites and related business activities.

Where BGP operates under a trade name or brand, this privacy policy also applies to the processing of personal data in connection with that trade name or brand, unless a separate privacy policy applies.

Whose personal data we process

We may process personal data relating to the following categories of individuals:

1. independent experts, consultants, advisors and other professionals who are part of, or apply to join, our expert network;
2. clients and prospective clients, including their employees, representatives and contact persons;
3. participants in online expert consultations, interviews, meetings or related communications;
4. business partners, contractors and professional advisers;
5. visitors to our websites and users of our communication channels.

Categories of personal data

Depending on your relationship with us, we may process the following categories of personal data:

1. identification and contact data, such as name, title, address, email address, telephone number and business contact details;
2. professional and profile data, such as job title, employer, professional biography, areas of expertise, industry experience, qualifications, certifications, education, language skills, CV, LinkedIn profile and other professional information;
3. expert network and project data, such as availability, fee expectations, conflict of interest disclosures, project involvement, consultation history, project references and communications with BGP;
4. consultation data, such as audio and/or video recordings of online consultations, transcripts, summaries, notes, analyses, metadata, call date, duration, participants and project reference;
5. expert contributions, such as information, explanations, opinions, know-how, insights and other input provided by experts or consultants during consultations or in connection with our services;
6. client-related data, such as client contact details, questions, project context and other information provided by or on behalf of clients in connection with our services;
7. administrative and financial data, such as invoices, payment details, tax information and accounting records;
8. technical and security data, such as email communications, platform usage logs, IP addresses where relevant, access logs and security-related metadata;
9. marketing and communication data, such as newsletter preferences, business communications and opt-out information.

Special categories of personal data and confidential information

We do not intentionally collect or use special categories of personal data within the meaning of Article 9 GDPR, such as health data, political opinions, religious beliefs or similar sensitive data, unless this is expressly required and legally permitted.

Participants in expert consultations should not provide special categories of personal data, criminal offence data, confidential third-party information, trade secrets or other sensitive information unless this has been expressly agreed in advance and a lawful basis exists.

If such information is provided without legal necessity or without prior agreement, we will delete, restrict, exclude or anonymise it where appropriate.

Purposes and legal bases

We process personal data for the purposes and on the legal bases described below.

Managing our expert network

We process personal data to onboard experts, assess applications, maintain expert profiles, match experts with client requests, manage availability, assess conflicts of interest and administer the expert relationship.

Legal basis:

• performance of a contract or steps prior to entering into a contract, where the processing relates to an expert or consultant with whom we have or may enter into a contractual relationship (article 6(1)(b) GDPR).
• our legitimate interests in operating and managing our expert network (article 6(1)(f) GDPR). Where we rely on this legal basis, we assess the relevant interests and apply appropriate safeguards, such as limiting access to expert profiles, keeping expert information accurate and up to date, processing only information that is relevant for expert matching and project administration, and respecting objections where required under the GDPR.

Facilitating expert consultations and client projects

We process personal data to organise consultations, introduce experts to clients, coordinate meetings, manage project communications, document project scope and provide related consultancy services.

Legal basis:

• performance of a contract with the relevant party, where the processing is necessary for our contractual relationship with the relevant client, expert or consultant (article 6(1)(b) GDPR).
• our legitimate interests in providing, managing and improving our services (article 6(1)(f) GDPR). Where we rely on this legal basis, we assess the relevant interests and apply appropriate safeguards, such as limiting the personal data used to what is necessary for the relevant consultation or project, restricting access to project information, applying confidentiality obligations, and avoiding unnecessary disclosure of personal data between clients and experts.

Recording, transcription and documentation of online consultations

Online consultations, interviews, expert calls or related communications may be recorded in audio and/or video form and may be transcribed, summarised, analysed and otherwise documented where appropriate for the performance, documentation, quality assurance, administration and security of our services.

Legal basis:

• performance of a contract, where the processing is necessary for the relevant contractual relationship with an expert, consultant or client (article 6(1)(b) GDPR).
• our legitimate interests in documenting, managing, securing consultations and maintaining the quality of our services (article 6(1)(f) GDPR). Where we rely on this legal basis, we assess the relevant interests and apply appropriate safeguards, such as informing participants about recording and transcription, restricting access to recordings and transcripts, applying retention limits, excluding or restricting information that is not necessary for the relevant purpose, and taking measures to prevent unnecessary use of personal data or client confidential information.

Internal knowledge management and service improvement

We may use expert contributions, transcripts, summaries and other consultation-derived materials to support internal knowledge management, quality assurance, training, internal review, service improvement and AI-supported internal tools.

The purpose of this processing is to make expert knowledge internally accessible within BGP, improve the quality and consistency of our services, avoid unnecessary duplication of work and support our consultancy activities.

Where we use such information for internal knowledge management or AI-supported internal tools, we take reasonable measures to remove, filter or restrict access to personal data, client-identifying information and client confidential information before such information is used in an internal knowledge layer.

Legal basis:

• our legitimate interests in improving our services, maintaining quality and consistency and making expert knowledge internally accessible in a privacy-conscious manner (article 6(1)(f) GDPR). Where we rely on this legal basis, we assess the relevant interests and apply appropriate safeguards, such as access restrictions, filtering of personal data, removal of client-identifying information, exclusion of client confidential information, logging, retention limits and human review.

Filtering, cleaning and anonymisation

We may process recordings, transcripts, summaries and related materials in order to identify, remove, mask, restrict or anonymise personal data, client-identifying information, client confidential information and other information that should not be used for internal knowledge management or service improvement.

Legal basis:

• our legitimate interests in protecting privacy, confidentiality and information security while enabling the responsible internal use of expert knowledge (article 6(1)(f) GDPR). Where we rely on this legal basis, we apply safeguards such as limiting access to raw recordings and transcripts, removing or masking personal data and client-identifying information, excluding client confidential information where appropriate, and applying retention limits.

Compliance, security and dispute management

We process personal data where necessary for compliance with legal obligations, tax and accounting requirements, audit purposes, fraud prevention, security, incident management, enforcement of our rights and handling disputes.

Legal basis:

• compliance with legal obligations (article 6(1)(c) GDPR).

Business communications and marketing

We may process business contact data to communicate with clients, experts, consultants and business contacts, including newsletters, updates and relevant information about our services, where permitted by law.

Legal basis:

• our legitimate interests in business communications and marketing (article 6(1)(f) GDPR). Where we rely on this legal basis, we consider the interests, rights and freedoms of the individuals concerned and apply appropriate safeguards, such as using limited business contact data, providing clear opt-out options and respecting marketing preferences.
• consent, where we send electronic direct marketing for which consent is required or where we otherwise specifically rely on consent (article 6(1)(a) GDPR).

Use of digital and AI-supported tools

We may use digital tools, including AI-supported tools, to assist with online communication, recording, transcription, summarisation, analysis, drafting, internal documentation, quality assurance, internal knowledge management and service improvement.

These tools are used to support our internal workflows and do not replace human judgment where review is appropriate.

We take measures designed to reduce the risk that personal data, client-identifying information or client confidential information is used inappropriately in internal knowledge management or AI-supported internal tools.

We do not use client confidential information or identifiable client materials for cross-client knowledge management, AI-supported internal tools, external AI services or AI-enabled services for the benefit of other clients, unless this has been expressly agreed with the relevant client and appropriate safeguards have been put in place.

Historical recordings and transcripts

We may review historical recordings, transcripts, summaries or related consultation materials to determine whether they can be used for internal knowledge management, quality assurance or service improvement.

Before such materials are used for those purposes, we may filter, clean, restrict or anonymise the materials to remove or reduce personal data, client-identifying information, client confidential information and other information that should not be used.

Historical materials will not be used for internal knowledge management or AI-supported internal tools unless we consider that we have a lawful basis for the relevant processing and that appropriate safeguards are in place.

Categories of recipients

We may share personal data with the following categories of recipients where necessary for the purposes described in this privacy policy:

1. employees and authorised personnel of BGP;
2. independent experts, consultants and subcontractors involved in the relevant project or service;
3. clients, where necessary for the relevant project and subject to applicable confidentiality obligations;
4. IT, hosting, communication, transcription, CRM, cloud and other technology providers;
5. providers of AI-supported tools used for transcription, summarisation, analysis, internal documentation or internal knowledge management;
6. public authorities, courts or regulators where required by law.

Where service providers process personal data on our behalf, we enter into appropriate data processing arrangements where required under Article 28 GDPR.

International transfers

Where personal data is transferred outside the European Economic Area, we ensure that appropriate safeguards are in place in accordance with the GDPR, such as an adequacy decision, standard contractual clauses or other legally recognised safeguards.

Retention

We retain personal data only for as long as necessary for the purposes described in this privacy policy, unless a longer retention period is required or permitted by law.

Retention periods may differ depending on the category of data and the purpose of processing. In general:

• expert profile and network data are retained for as long as the expert relationship continues and for a reasonable period thereafter;
• project and consultation records are retained for as long as necessary for project documentation, quality assurance, compliance, dispute management and legitimate business purposes;
• recordings and transcripts are retained only for as long as necessary for the purposes for which they were collected or further processed, subject to applicable retention limits and safeguards;
• marketing data is retained until you opt out or we no longer have a legitimate reason to retain it.

Where possible and appropriate, data may be anonymised instead of retained in identifiable form.

Your rights

Subject to the conditions set out in the GDPR, you may have the following rights in relation to your personal data:

1. the right of access;
2. the right to rectification;
3. the right to erasure;
4. the right to restriction of processing;
5. the right to data portability;
6. the right to object to processing based on legitimate interests;
7. the right to withdraw consent where processing is based on consent;

You may submit requests by contacting us at: connect@brightgreenpartners.com

The right to erasure or objection may not apply where processing is necessary for compliance with a legal obligation, the establishment, exercise or defence of legal claims, or where we have compelling legitimate grounds for the processing.

Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

These measures may include access restrictions, confidentiality obligations, secure storage, logging, limitation of access to raw recordings and transcripts, filtering or anonymisation procedures and review processes.

Questions and complaints

If you have any questions about this privacy policy or the way we process personal data, please contact us at: connect@brightgreenpartners.com

You also have the right to lodge a complaint with the Dutch Data Protection Authority.

We may update this privacy policy from time to time. The latest version will be made available on our website or otherwise provided where appropriate.