Privacy Notice

View notice

INTRODUCTION
1. This privacy notice (Privacy Notice) sets out the ways in which we, The Imagination Group Limited and Imagination Europe Limited (we, us, our), collect and use your personal data (your personal information) in connection with our businesses. It also explains what rights you have to access or change your personal data. IF YOU ARE DEALING WITH OUR AUSTRALIAN SUBSIDIARY, IMAGINATION (AUSTRALIA) PTY LTD, PLEASE CLICK HERE FOR THE APPROPRIATE PRIVACY NOTICE. IF YOU ARE DEALING WITH OUR SUBSIDIARY IN THE U.S.A., IMAGINATION THE AMERICAS INC., PLEASE VIEW THE U.S.A. PRIVACY NOTICE HERE.
2. We are the data controller in relation to the personal data processed in accordance with this Privacy Notice (except where this Privacy Notice explains otherwise). This Privacy Notice and our procedures have been developed in line with the requirements of the EU General Data Protection Regulation, the UK General Data Protection Regulation and the Data Protection Act 2018 (each as amended by the Data (Use and Access) Act 2025), and other applicable law (Data Protection Law).
3. Where we refer to ‘websites’ in this Privacy Notice, we are referring to the main Imagination website available at www.imagination.com (the Imagination website) and the website dedicated to our experience platform “XPKit” available at www.xpkit.com (the XPKit website).
4. Please note that if you are applying for a job via the Careers section of this website or otherwise, your application and any personal data you provide will be processed in accordance with Imagination’s Candidate Privacy Notice.
5. Note, if you have come to this Privacy Notice because you would like to stop receiving marketing emails from us, you can unsubscribe at any time by following the “unsubscribe” link at the bottom of those emails.
ABOUT US
1. We are companies registered in England under company number 01385613 (The Imagination Group Limited) and company number 01442096 (Imagination Europe Limited), with our registered address as set out below.
2. You can contact us as follows:
  Address: 25 Store Street, South Crescent, London, WC1E 7BL UK
  Email: privacy@imagination.com
INFORMATION WE MAY COLLECT ABOUT YOU
1. Information that you provide to us
  1. We will collect any information that you provide to us when you:
    1. make an enquiry about our services via email, telephone, post or via our websites or social media channels;
    2. subscribe to our mailing lists and newsletters via the websites;
    3. as a client, ask us to provide services to you (or you work for someone who we provide services to);
    4. as a supplier, provide goods or services to us (or you work for someone who supplies goods or services to us); and
    5. visit our premises, including when you sign in at reception or are issued with a building access pass.
  2. The information you provide to us might include your name, address, email address, country of residence, phone number and/or job title. If you visit our premises, it may also include the organisation you represent, the person you are visiting and the date and time of your visit.
2. Information we collect about you
  1. We will collect any information contained in any correspondence between us. For example, if you contact us by email or telephone, or send us an enquiry via our websites or social media channels, we will keep a record of that correspondence.
  2. We operate CCTV cameras at our premises, including at the entrances to and exits from our building, which record images of individuals entering, leaving and moving around our premises. We use CCTV to maintain the security of our premises, prevent and investigate crime, and in the interests of health and safety. The images captured are securely stored and only accessed where necessary (e.g., to look into an incident). CCTV recordings are typically automatically overwritten after a short period of time (no more than 30 days) unless an issue is identified that requires investigation (such as a theft), in which case the relevant footage will be retained for as long as reasonably necessary for that investigation and any related proceedings.
  3. We also operate an electronic access control system at our premises. If you are issued with a building access pass (for example, as a visitor or contractor), we will collect information relating to that pass, including your name, the pass number, and a record of each time you tag your pass to enter or leave our building or to access particular areas within it (including the date, time and location). We use this information to control access to our building, to maintain the security of our premises, property and people, to prevent and investigate crime and other incidents, and in the interests of health and safety (for example, so that we know who is on site in the event of an emergency or evacuation). Access records are retained in accordance with our data retention policies and/or applicable laws, unless an issue is identified that requires investigation, in which case they will be retained for as long as reasonably necessary for that purpose. You will need a building access pass to enter certain areas of our premises; if you do not wish to provide the information needed for a pass, we may not be able to give you access to those areas.
  4. In the unlikely event that you have an accident on our premises we will also collect details of the accident in order to comply with relevant health and safety legislation.
  5. When you sign up to our e-mail newsletters, we use technology to collect information about how you interact with our emails, including whether our emails are delivered to you and whether you open them, unsubscribe from them or click on any of the links which they contain.
  6. We also use analytics tools on our websites to collect information about website visitors. This includes information about how our visitors navigate the site (including mouse movements and key presses) details of our visitors’ browsers, operating systems, device screen resolutions and screen sizes, internet protocol (IP) addresses, geographic locations, time zone settings and other technology on the devices they use to access our websites. We use this information for analysis purposes and do not use it to identify individual visitors. However, some of this information (such as IP addresses) may constitute personal data. Where required by law, we will only use these analytics tools with your consent; please see our cookies policies referred to in paragraph 6 below.
3. Information we receive from third parties
  1. We may be provided with your contact details if you or your services are referred or recommended to us by a third party;
  2. We use lead generation agencies who use publicly available sources and dedicated databases to obtain contact details for business purposes; and
  3. In certain circumstances we may use a third-party provider to conduct due diligence on our suppliers. This may lead to us being provided with personal data relating to criminal convictions and offences (such as fraud, bribery) and other information relevant to our decision as to whether to conduct business with you or your company. This information is obtained from publicly available sources.
HOW WE USE INFORMATION ABOUT YOU AND RECIPIENTS OF YOUR INFORMATION
1. We will use your information for the purposes listed below either on the basis of:
  1. performance of your contract with us and the provision of our services to you;
  2. your consent (where we request it);
  3. compliance with a legal obligation to which we are subject (for example, under health and safety legislation); or
  4. our legitimate interests (see paragraph 4.3 below).
2. We may use your information for the following purposes:
  1. to provide you with access to our websites in a manner convenient and optimal including sharing your information with our website hosts and developers (on the basis of our legitimate interest to ensure our websites are presented in an effective and optimal manner);
  2. as a client, to provide you with our services as agreed pursuant to the performance of our contract with you;
  3. to keep in contact with you about our news, events, or new services that we believe may interest you, provided that we have the requisite permission to do so, and sharing your information with our e-mail marketing services provider (either on the basis of your consent where we have requested it, or our legitimate interests to provide you with marketing communications where we may lawfully do so);
  4. if you are a supplier, to receive services from you or your organisation, for example where a supplier is providing us with IT or other outsourced services we will handle personal data about the individuals who are involved in providing the service to us;
  5. to carry out aggregated and anonymised research about general engagement with our websites (on the basis of our legitimate interest in providing the right kinds of information and content to our website users);
  6. to operate CCTV and our electronic access control system at our premises in order to control access to our building, maintain the security of our premises, property and people, prevent, detect and investigate crime and other incidents, and protect health and safety, including knowing who is on site in an emergency (on the basis of our legitimate interests in operating safe and secure premises and, where applicable, to comply with our legal obligations under health and safety legislation);
  7. to record and investigate accidents that occur at our premises (to comply with our legal obligations under health and safety legislation);
  8. to protect, investigate, and deter against fraudulent, unauthorised, or illegal activity, including without limitation fraud (on the basis of our legitimate interests to operate a safe and lawful business or where we have a legal obligation to do so); and
  9. to enable us to comply with our policies and procedures and enforce our legal rights, or to protect the rights, property or safety of our employees and share your information with our technical and legal advisors (on the basis of our legitimate interests to operate a safe and lawful business or where we have a legal obligation to do so).
3. Where we refer to using your information on the basis of our “legitimate interests”, we mean our legitimate business interests in conducting and managing our business and our relationship with you, including the legitimate interest we have in:
  1. Personalising, enhancing, modifying or otherwise improving the services and/or communications that we provide to you;
  2. To provide you with direct marketing about our products and services unless you have asked to be taken off our mailing lists;
  3. Protecting against fraud and other risks to our business, for example when we collect personal data in the course of carrying out due diligence on our suppliers; and
  4. Ensuring network and information security and the security of our premises, for example, when we use CCTV and our electronic access control system at our premises.
4. Relying, where relevant, on the “recognised legitimate interests” (for example, safeguarding vulnerable individuals or responding to an emergency), which do not require us to carry out the balancing exercise described in paragraph 4.5 below.
5. Where we use your information for our legitimate interests, we make sure that we take into account any potential impact that such use may have on you. Our legitimate interests don’t automatically override yours and we won’t use your information if we believe your interests should override ours unless we have other grounds to do so (such as your consent or a legal obligation). If you have any concerns about our processing please refer to details of “Your Rights” in paragraph 9 below.
WHO WE MIGHT SHARE YOUR INFORMATION WITH
1. In connection with the purposes and on the lawful grounds described above and in addition to the recipients of your information as described above, we may share your personal data with third parties that we work with such as:
  1. third parties who provide data processing and IT services to us including website hosting providers, data back-up, security and storage providers and cloud-based software providers;
  2. providers of building management, security, reception and facilities services, including the providers of our CCTV and access control systems;
  3. other third party service providers who help us run and improve our business. For example providers of email services, marketing services, survey and market research providers, providers of fulfilment and postal services and travel service providers;
  4. any selected third party that you consent to our sharing your information with for marketing purposes;
  5. any member of our group, which means our subsidiaries as defined in section 1159 of the UK Companies Act 2006;
  6. third parties with whom we may choose to sell, transfer or merge parts of our business or our assets; and
  7. any other third parties (including legal or other advisors, regulatory authorities, law enforcement agencies such as the police, courts and government agencies) where necessary to prevent, detect or investigate crime, to enable us to enforce our legal rights, or to protect the rights, property or safety of our employees or where such disclosure may be permitted or required by law.
2. We require third parties to maintain appropriate security to protect your information from unauthorised access or processing.
COOKIES
1. We use cookies to ensure that you get the most out of our websites. Please find further details in our cookies policies available on each of our websites. The cookies policy for the Imagination website is available here, and the cookies policy for the XPKit website is available here.
2. We may use certain cookies for statistical purposes to understand and improve our websites without seeking your consent, provided we give you clear information about them and an easy way to opt out. If applicable, we will provide further details in our cookies policies referred to above.
HOW WE LOOK AFTER YOUR INFORMATION AND HOW LONG WE KEEP IT FOR
1. We use appropriate technological and operational security measures to protect your information against any unauthorised access or unlawful use, such as:
  1. ensuring the physical security of our offices and other sites;
  2. ensuring the physical and digital security of our equipment and devices by using appropriate password protection and encryption;
  3. limiting access to your personal data to those in our company who need to use it in the course of their work.
2. In addition to the above, we are certificated to the ISO 27001 Information Security Management Standard. Read our key policies here.
3. We will retain your information for as long as is necessary to provide you with the services that you have requested from us or for as long as we reasonably require to retain the information for our lawful business purposes, such as for the purposes of exercising our legal rights. We operate a data retention policy and look to find ways to reduce the amount of information we hold about you and the length of time that we need to keep it. The retention periods for CCTV recordings and access control records are set out in paragraph 3.2 above. Please contact us if you would like to be provided with the details of the retention periods for specific aspects of your personal data.
4. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.
INTERNATIONAL TRANSFERS OF YOUR INFORMATION
1. We are a global business based in the UK and we use third party service providers located in other countries to help us run our business. As a result of this we may transfer personal data of individuals located in the UK outside of the UK, and personal data of individuals located in the European Economic Area (the European Economic Area being the European Union and Iceland, Liechtenstein and Norway, which is also referred to as the “EEA”) outside of the EEA.
2. Countries outside of the UK and the EEA may not have data protection laws that provide the same level of protection as those within the UK or the EEA and so whenever we transfer your personal data outside the UK or the EEA, we take steps to ensure all personal data is protected with adequate safeguards, such as by entering into approved standard contractual clauses or transferring personal data to countries, territories, sectors or organisations that are covered by an EU Commission “adequacy decision” and/or a UK “adequacy regulation” (assessed by reference to the “data protection test”).
3. Please contact us if you would like further information on the specific mechanism we use when transferring your personal data out of the UK or the EEA.
YOUR RIGHTS TO THE INFORMATION WE HOLD ABOUT YOU
1. You have certain rights under Data Protection Law in respect of the information that we hold about you:
  1. Access: You have the right to request confirmation that we are holding your personal data and to access a copy of the personal data that we hold about you. This is known as a “data subject access request” and enables you to check that we are handling your personal data lawfully. When responding to such requests, we will carry out reasonable and proportionate searches for the requested information;
  2. Correction: You can ask us to change or complete any inaccurate or incomplete personal data we hold about you;
  3. Erasure: You can ask us to delete or remove your personal data where it is no longer necessary for us to use it, you have withdrawn consent, or where we have no lawful reason for keeping it;
  4. Objection: You can object to our processing of your personal data where we are relying on a legitimate interest if there is something about your particular situation which makes you believe it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes;
  5. Withdraw consent: If you have given us your consent to use personal data you can withdraw your consent at any time;
  6. Transfer: You can ask us to provide the personal data which you have provided to us back to you or to a third party in a structured, commonly used, electronic form, so it can be easily transferred; and
  7. Restriction: You can ask us to suspend the processing of your personal data, for example if you want to establish its accuracy or where you have objected to our use of it.
2. In addition, in accordance with Data Protection Law, you have the right to lodge a complaint about us to the UK Information Commissioner’s Office (https://ico.org.uk/), or any of its successor bodies, or the relevant authority in your country of work or residence. Before doing so, we would welcome the opportunity to address your concerns directly – please contact us at privacy@imagination.com.
3. Please note that some of these rights only apply in certain circumstances and we may not be able to fulfil every request. If this is the case you will be notified of this at the time of your request. If you make a request we may require specific information from you to help us confirm your identity. This is to ensure that personal data is not disclosed to anyone who does not have the right to receive it.
4. You may exercise your rights in 9.1 above by contacting us directly using the details set out in 2 above.
CHANGES TO THIS PRIVACY NOTICE
1. We may make changes to this Privacy Notice from time to time. We will post any changes to our site or notify you of any material changes by e-mail.

This Privacy Notice was updated in September 2026.