Privacy policy

About this policy

This Policy applies to the personal data we process as part of our business. Whilst our group of companies process personal data in accordance with this Policy, it doesn’t apply to any other companies or organisations we work with and you are therefore encouraged to check their privacy policies as they may apply to you.

We understand that the privacy and security of your personal information is extremely important. Therefore, this Privacy Policy (“the Policy”) explains how we use any personal data we collect about you, including via our website fundamentalgroup.com (and any other websites operated by our group of companies) (the “Website”), together with what we do to keep it secure. This Privacy Policy also includes an overview of the services we provide to our clients, where we process personal data on their behalf as their data processor. All personal data collected about you will be processed by us in accordance with this Policy and the applicable data protection legislation as is in force from time to time. “Personal data” (or “personal information” as the terms may be used interchangeably in this Policy) means information that identifies you as an individual or is capable of doing so.

Local data protection laws apply to our collection and use of personal data but include the UK Data Protection Act 2018, the General Data Protection Regulation (“GDPR”) and the Californian Consumer Privacy Act (“CCPA”) (in each case the “Applicable Data Laws”). The terms used throughout this Privacy Policy are taken from the UK Data Protection Act and GDPR. However, where local laws apply and use terms with a similar meaning, the terms used in this Policy shall, where the context so dictates, be substituted with those terms. For example, in relation to the CCPA, the terms “personal data” shall be read as “personally identifiable information”, the term “data controller” shall be read as “business” and “data processor” shall be read as “service provider”.

Additional privacy information applies to certain services we provide (e.g. Fundamental Monitor, CPD Hub and Alphix). This information is provided in the form of specific Privacy Notices, which you are invited to read when registering or subscribing for these services. This Privacy Policy does not cover our processing in connection with our recruitment, please see our separate Careers Privacy Notice for further information.

We may need to make changes to this Privacy Policy from time to time as Applicable Data Laws evolve or due to changes in our business and technology. This Policy was last updated on 04th July 2025.

This section provides an overview of what we do as a business and the context in which personal data is processed.

About Us

We are a media buying, marketing and tech solutions agency and we offer these services through our Fundamental Media group of companies. Primarily, our clients work across the asset management, securities services, investment and corporate banking, reinsurance and private banking sectors within the finance industry and separately within high-profile education institutions promoting undergraduate, postgraduate and professional qualifications. The nature of the products and services we provide to our clients drives the nature of the personal data we process.

Overview of the personal data we process

Our services - We collect and use information about you when you enquire about Fundamental Media and/or our services and request information from us, to provide you with the services, to contact clients about other services that may be of interest and, with consent to contact our business contacts about our products and services which may be of interest. We also collect and use the information you provide where you participate in our market research, respond to our surveys or otherwise provide feedback to us. Further details on each are set out below.

The Alphix Tag enables us to (i) carry out website visit fraud verification and analysis of “bot” activity (ii) generate company-level insights about corporate visitors to our website and (iii) retarget and advertise to those corporates visiting our website via their company-owned IP address (firmographic targeting). We do not seek to process any data which is directly or indirectly capable of identifying any individual visitor to our website. The solution does not rely on cookies and individual users are not tracked. With privacy by design at its heart, the overriding objective of the solution is to only use non-personal data. Although that is the case, we recognise that the mere collection of IP addresses raises the question of whether personal data is in fact processed. In that vein, we (as data controller) have a legitimate interest in processing Alphix data where it comprises personal data for these purposes. “Legitimate interest” is explained in our “What we do” section in this policy. We have produced a specific Alphix Privacy Notice, see alphix.com/privacy-policy.

To service our clients - Separately, we process personal data as part of our services to our clients. We provide our clients with media planning and buying services and media intelligence, this includes undertaking market research, event analysis, campaign data analytics and the procurement and placement of advertising on publisher and other websites and via various media platforms. For example, in connection with media placement, on behalf of our clients we use information collected from websites you visit, belonging to our clients and/or particular publishers or media owners, via cookies or other technologies. This enables us, as a media agency, to advise on and undertake effective online advertising and analysis for our clients. Further detail on the services we provide is set out below. The capacity in which we act in processing this data depends, on the solution we provide (Our Products and Services).

We also offer our clients other online proprietary services. In order to provide these, we require personal information to grant access and monitor usage in accordance with fair usage policies. Further detail about the data required to provide these services is set out in each service’s privacy notice. A list of these is set out below.

We also use personal information in the day-to-day operation of our business, in order to maintain contact with our clients and potential clients as well as for administration, recruitment and employment purposes.

The “Lawful Basis” for our processing

We only process your personal data where we or our client (for whom we act as data processor) have a legal ground for doing so. We explain which legal ground we rely on in each case below, but in all cases, we rely on one of the four legal grounds below:

• It being necessary in order to perform or take steps to perform a contract with you or your employer;
• It being processed with your consent;
• It being processed to comply with our legal obligations or
• It being processed where we have a legitimate interest in doing so. Please see below to find out more about legitimate Interests.

What are Legitimate Interests?

“Legitimate Interests” is a term used in the GDPR and is a legal ground upon which a business may process personal data, where that processing is necessary to pursue interests of the business (data controller or by a third party) provided always that the fundamental rights and freedoms of the data subject in question are not overridden as a result. Where we rely on this ground, we make sure to consider and balance any potential impact on you and your rights. If you have any concerns about any processing we carry out based on our “legitimate interests”, you have the right, (save in relation to our “compelling legitimate interests”) to object to that processing. For more information on your rights, please see “Your Rights” section below.

This section sets out in more detail how we process personal data in connection with the provision of our products and services.

In the sections which follow we outline how we process personal data in connection with the services we provide to our clients. We also offer website visitors the ability to sign up to our CE learning Platform. This is a solution to track and record your learning on and across our website; useful for your reference as well as recording CPD activity. Where you sign up for this activity via CPDHub, in order to track and record your learning we drop a (necessary) cookie; you can log out and disable the cookie at any time. Details of that cookie are set out in the cookie consent management tool. We store the following data points to recognise you when you visit our website and to record your learning: the cookie, CPDHub user ID, first and last name. This data is stored in the UK and is not shared with any third party for their use.

Consulting - We conduct specific media consulting projects for our clients from time to time which causes us to act as a data processor of your personal data. Where we do so, we only process your personal information in accordance with our client’s lawful written instructions and where our clients confirm that they have an appropriate legal basis to undertake the project in question.

Business Management and Marketing - In the event that you work for one of our clients, or suppliers, we may, as data controller, process your employee business contact details (name, business email, job title, business telephone number) so that we may provide our services, undertake day to day management and administration of our clients’ and suppliers’ accounts in each case as is necessary to perform our contractual obligations. We process this in the form of emails, client files, invoicing and account records which are securely hosted in the UK. We may invite you to collaborate with us via certain tools and platforms as part of our working relationship. We will notify you of the provider and any additional data processing terms which apply.

In addition, we retain business contact details to maintain our business relationship with you, our clients and suppliers and potential clients and suppliers. This data is securely held in our CRM database in the UK. In each case we have a legitimate interest in processing your personal data for these purposes. From time to time we send business insights to our clients and, where visitors subscribe to receive the same on our website, to our subscribers. We use third party platforms for to record where individuals have expressed an interest in our solutions (Monday.com). Where we do so, such third parties are appointed in writing under contract and required to process only in accordance with our written instructions, and not for their own purposes. Wee only transfer personal data outside of the EEA where appropriate legal safeguards are in place or we have consent to do so. We use functionality to check email opening rates to assess the relevance and interest in our insight materials. Recipients are able to opt out of receiving these emails at any time via the opt out link contained within each email.

As part of our work for our clients we approach, negotiate and instruct media owners, publishers, creative agencies or other suppliers as part of the planning, negotiation and appointment process. During this process it may be necessary for us to share your business contact data (where you work for one of our clients) with such providers for the purposes of concluding contracts of your behalf which, depending on the account in question, may be located outside of the EEA.

Advertising planning and buying - We plan and buy media space using media intelligence so that relevant advertising can be delivered appropriately on behalf of our clients. The advertising we place therefore tends to be across online and offline publications as well as out of home and experiential media. We may use targeted advertising as an advertising tool and track visits to our clients’ websites and particular online campaigns to measure the effectiveness of the advertising placed. The exact nature of the targeting and tracking of advertising will vary depending on the requirements of our clients’ campaigns but an overview is below.

• Identifying and advertising on websites with audiences our clients' wish to reach and dealing directly with publishers to establish a campaign;
• Matching that cookie ID to a pool or segment (profile) which our client is trying to reach and serving advertising in real time to websites with corresponding advertising space for sale;
• identifying a cookie ID that has previously visited a client site to serve relevant advertising based on their earlier activity on the client site (retargeting).

What is targeted advertising? We are able to deliver relevant advertising on behalf of our clients by using cookies (tiny text files that are stored on your browser (where you agree) when you visit our clients’ websites or websites of publishers or media owners relevant to our clients’ activities) or other technology. Where delivered via cookies the cookies used do not collect your name or any similar information, but instead comprise a unique identifier called a cookie ID: a string of characters that websites and servers associate with the browser on which the cookie is stored. By associating the cookie ID with the browsing activity undertaken it is possible to place that information into a “pool” or “segment” within the data management platforms we use, enabling us to show you (or rather the browser associated with the cookie ID) advertisements of interest.

What is “Profiling”? Generally, profiling is an activity which automates some or all of the processing of personal data to evaluate certain features relating to an individual, such as behaviour. Profiling, like other processing, can only be carried out where there is a legal ground to do so. Where a cookie is used, we segment data based on the cookie data we receive (with consent) to place targeted advertising on behalf of our clients as described in this policy.

We undertake targeted advertising for our clients in a variety of ways, depending on our clients’ advertising strategy, but these may include:

• Retargeting - Google DoubleClick and Beeswax cookies and their respective data platforms to deliver targeted advertising on behalf of our clients. Where we assemble cookie IDs as part of one of our solutions we act as a data controller. Where we collect cookie IDs to service a specific client’s instructions we do so as a data processor on behalf of our client, the data controller. To reiterate we do not obtain your name, contact details or any similar information as part of this process and this data is only collected with your consent via the applicable cookie consent platform. This means in practice, if you browse on one of our clients’ websites, you may see an advert from them on another website. We do not profile, pool or segment any “special category information”, special category information being data identifying racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic and or biometric data for the purpose of uniquely identifying an individual and data concerning an individual’s health, sex life or sexual orientation. You can choose not to accept a cookie on your device via client or publisher consent management tools (as applicable). Alternatively, you may adjust your browser settings. You can learn how to do this by viewing the browser’s help menu, or you can go to the Digital Advertising Alliance’s consumer choice page www.youronlinechoices.com. If you do this however, it does not mean that you will stop receiving advertising, just that you will stop receiving advertising which reflects your browsing and/or interests. Additionally, you may also clear your browser cache or reset your cookies, but you should remember that this does not prevent cookies from being placed on your device in the future. In any case, you should review the privacy policy of the website you are visiting.
• To reiterate we do not obtain your name, contact details or any similar information as part of this process and this data is only collected with your consent via the applicable cookie consent platform. This means in practice, if you browse on one of our clients’ websites, you may see an advert from them on another website. We do not profile, pool or segment any “special category information”, special category information being data identifying racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic and or biometric data for the purpose of uniquely identifying an individual and data concerning an individual’s health, sex life or sexual orientation.
• You can choose not to accept a cookie on your device via client or publisher consent management tools (as applicable). Alternatively, you may adjust your browser settings. You can learn how to do this by viewing the browser’s help menu, or you can go to the Digital Advertising Alliance’s consumer choice page www.youronlinechoices.com. If you do this however, it does not mean that you will stop receiving advertising, just that you will stop receiving advertising which reflects your browsing and/or interests. Additionally, you may also clear your browser cache or reset your cookies, but you should remember that this does not prevent cookies from being placed on your device in the future. In any case, you should review the privacy policy of the website you are visiting.
• Social Media - We also advise on and manage social media campaigns (e.g. LinkedIn, Facebook, Twitter) on behalf of our clients. This may involve our using the platforms’ services to identify user types to which our clients wish to target their advertising. Although we are provided with information regarding the success of such a campaign, this is only provided to us in an aggregated format, and no individual can be identified. We may also manage direct campaigns using the platform’s services (e.g. by Inmail via LinkedIn) on behalf of our clients. However, we shall only do so where our client has an appropriate legal ground to do so. Our clients’ privacy policies will provide more information about the processing they undertake.

Why are targeted campaigns used? Our clients are seeking to understand what products and campaigns interest you and to measure the effectiveness of various marketing strategies. By understanding your interests, we with our clients work to promote relevant products and avoid advertising products that may not be suited to you. From your browsing activity our clients may be able to avoid promoting products which, by their regulated nature, may not be available to you and therefore helps our clients serve advertising compliantly. As set out above, please alter your browser settings or do not accept advertising cookies if you would prefer for your data to not be used in this way.

Analytics – Our clients utilise third party analytics on their websites. We process that data so as to advise on the effectiveness of their campaigns. Analytics tools (e.g. Google Analytics) using cookie technology are able to identify the number of users, their location, number of previous visits and so on, but do not identify individuals. We use various tools, including Google Data Studio which pulls together data from social media, analytics tools (e.g. Google Analytics), Doubleclick and other sources such as MOAT (a tool which verifies advert visibility) to reflect and visualise that data. No personal data is used as part of this process. As set our above, please alter your browser settings or do not accept analytics cookies or if you would prefer for your personal data to not be used in this way.

Research - We conduct primary research and proprietary research analysis in the financial and business education sectors amongst, for example, financial services professionals, (investors and advisors) together with educational specialists, prospective students, students and alumni, allowing us to support and advise our clients effectively with their media planning and buying needs. The personal data we use to undertake our research is sourced directly or via third parties from publicly available sources, including business directories and websites and comprises: name, business name, business address, email, business telephone number, job title, age and languages spoken. We also make contact via business-led platforms such as LinkedIn. We have a legitimate interest in undertaking primary research as part of our work as a media agency, providing media insights and intelligence to our clients and in processing this data for these purposes.

We undertake our research through surveys and polls. Once an individual has participated in our research, we hold their responses (including any comments or opinions on relevant market information), together with additional details where relevant (such as the type of assets under management, business size/number of clients and whether any incentive has been received to participate). All responses are held only with the consent of the respondent, and used in an anonymous, aggregated format. From time to time as part of our service offering, we may pass our research findings to our clients, but we only ever do so in a fully anonymised and aggregate way ensuring that no personal data is disclosed.

When we seek to recruit participants, we provide the opportunity to decline participation and/or to be contacted again for these purposes (where we hold minimal details for suppression purposes). You also have the right to object to our processing of your data for these purposes. We do not ask for any special category (sensitive) personal data (e.g. data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic and or biometric data for the purpose of uniquely identifying an individual and data concerning an individual’s health, sex life or sexual orientation) to be submitted as part of any response; nonetheless we ask for explicit consent to enable us to retain responses for our market research purposes.

We work with carefully selected third parties such as Qualtrics LLC and Monday.com who assist us with the administration of our research. Where we do so, such third parties are appointed in writing under contract and required to process only in accordance with our written instructions, and not for their own purposes. We only transfer personal data outside of the EEA where appropriate legal safeguards are in place, or we have consent to do so. We also work with panel providers who distribute our surveys to their panellists based on their data and permissions (which is not shared with us). We ask all panel providers to confirm that the personal data they use for these purposes is compliant with all applicable data protection and privacy legislation. We may pass your contact information on to an incentive provider (as set out in our email to you), but only where you agree to take part in the research in question and only for the purpose of providing the incentive in question.

Where we undertake market research specifically for a client using client data, we act as a data processor and process that data in compliance with the requirements of the client data controller.

Proprietary Solutions - The Fundamental Group offers a range of solutions to its clients. An overview is given below. Specific privacy notices provide more detailed information in relation to each:

• Fundamental Monitor - Fundamental Monitor, our proprietary web-based tool, provides digital and media insights on the fund management industry to our clients. Access to the application requires that clients/users register, providing limited personal information prior to use. Where registration is applicable to you, please read the Fundamental Monitor dedicated privacy compliance statement before use, see www.fundamentalmonitor.com for more information. However, by way of overview, limited personal information is processed by the application including name, company name, job title, telephone number, email address and billing address (it being necessary for us to collect client business and user contact data for registration and administration purposes and to enable us to monitor usage in accordance with Fundamental Monitor’s Terms of Use and Fair Usage Policy). This personal data is securely stored on servers located within the EEA (Germany) and processed as a necessary part of providing the services and performing our contract for Fundamental Monitor with our client and you, where applicable, as a user.
• CPD Hub - CPD HUB, our proprietary web-based tool, provides a source of CPD Materials for you to access and online tools for you to record the CPD you undertake. Access to the application requires that users register, providing their details and contact information prior to use. This information, including, the user’s name, company name, job title, telephone number and email address is used to enable us to administer accounts and monitor usage (where applicable). This personal data is securely stored on servers located within the United Kingdom and processed as a necessary part of providing the CPD HUB Services and performing our contract for CPD HUB Services. Fundamental acts as Data Controller in processing personal data submitted to or obtained via your use of CPD HUB.
• Alphix Solutions - Alphix Solutions, a division of Fundamental Media Limited, provide a suite of services providing reliable analytics insights that conventional tools are unable to provide. Dependent on the services taken, Alphix Solutions enables users to accurately count website visits and page views, analyse potential “bot traffic” and, using company IP address data, provide firmographic insights. The solution does not rely on cookies and individual users are not tracked, see alphix.com/privacy-policy.

Recruitment and Employment - We process the personal data of our employees in connection with their employment with us. A full description of the types of personal data we hold, how it is used and who it is shared with is set out in our Employee Privacy Notice available to all employees as part of our Employee Handbook and as shared with all employees on induction and afterwards on a periodic basis. Details of how we process your personal data as part of our recruitment process is set out in our Recruitment Privacy Notice.

We may share your personal data within the Fundamental Group or with third party suppliers and other third parties where we have reason for doing so as described in this Policy. Where third parties are appointed to process any of your data on our behalf they are appointed in writing under contract and required to process only in accordance with our written instructions, and not for their own purposes. We only transfer personal data outside of the EEA where appropriate legal safeguards are in place or we have consent to do so.

Within Fundamental Group

We may share your personal data within the Fundamental Media Group to provide our services to you, maintain our business relationship with our clients and potential clients and so that our group companies may offer you their products and services (with your consent, where applicable). We work to internal policies which set out the standards to which we as a business work and to which our employees are expected to adhere. It applies to companies and employees across the Fundamental Group to ensure consistency in our approach and it emphasises the legal requirement that, where we process personal data (for our own purposes or on behalf of clients), we do so lawfully, fairly and transparently.

Outside the Fundamental Group

We employ appropriate security measures to protect your personal information from unauthorised access, accidental loss, disclosure and destruction. We require that our suppliers and service providers also use appropriate security measures when processing your personal information on our behalf and that they only do so in ways and for the purposes we’ve agreed; not for their own uses. We reserve the right to check their security measures and processing activities.

We may need to transfer your personal information to other companies within the Fundamental Media Group, suppliers or service providers based outside of the UK and outside of the EEA (see “Sharing your information” for more details).

Unless we explain otherwise to you, we’ll hold your personal information based on the following criteria:

• for as long as we provide our services to you and then for as long as someone could bring a claim against us related to those services; and/or
• for as long as we have reasonable business needs to do so, such as providing our services to our clients, maintaining our relationships with our clients and potential clients, for as long as our research projects remain live and their results relevant, and a period thereafter in which we may need to validate the findings and for managing our business operations; and/or
• in line with legal and regulatory requirements or guidance.

European residents

You have the right to be provided with transparent and clear information about the personal data we hold about you and how we use it. You also have the right to request access to that information, request changes to be made where it is incorrect or incomplete, request for it to be deleted or blocked (if you believe we shouldn’t be processing that information, or are processing it incorrectly) and, in some circumstances, the right to request that we move, copy or transfer your personal information (where we process it based on your consent). You are also legally entitled to withdraw your consent for processing at any time. In each case we will promptly review your request in accordance with applicable law. In addition, you have the right to object to any of our processing where we do so based on our legitimate interests. If our processing relates to any direct marketing or profiling, we will stop processing at your request (providing that in relation to profiling we are able to identify you from the data we hold). If you object to targeted advertising using cookies, we encourage you to revisit your browsing choices and decline cookies or change your browser settings (please refer to section 4 above). In all other cases, where processing is based on our legitimate interests, if you raise an objection we will stop processing your personal data unless compelling circumstances apply (in which case we will inform you of this).

Californian residents

To make enquiries, exercise any of your rights set out in this Privacy Policy and/or make a complaint please contact us, our contact details our set out below. If you're not satisfied with the way any complaint you make in relation to your personal information is handled by us, then you may be able to refer your complaint to the relevant data protection regulator. In the UK, this is the Information Commissioner's Office, see www.ico.org.uk.

By email: [email protected]

By post:

The Privacy Manager Fundamental Media Limited 3rd Floor 100 Cannon St London EC4N 6EU