Privacy notice.

Last updated 2 August 2026

Who is responsible for your information

SGA World Limited (company number 12001597) operates the SGA World website and is the data controller for personal information submitted to SGA World through it. SGA World is an international network of independent member firms; each member firm is a separate legal entity and is responsible for its own processing.

For data protection questions, rights requests or complaints, email support@sgaworld.org or write to SGA World Limited, 3 Legion Row, Navigation Street, Trethomas, Caerphilly, Wales, CF83 8JA.

Information we collect

When you submit an enquiry, we collect the details you provide: enquiry type, name, business email, organisation and telephone number where supplied, country or market, subject, message, the page used to contact us and your privacy and referral choices. If you contact us by email or post, we process the information contained in that correspondence.

We also process limited request and device information needed to deliver and secure the website. The enquiry form uses a short-lived IP-address rate limit to deter misuse; that address is not added to the stored enquiry record. Hosting and security systems may keep limited technical logs for reliability, fraud prevention and incident investigation.

Once our Cloudflare services are activated, Cloudflare will process limited website traffic information such as IP addresses, requested URLs, routing data, system configuration and security events to provide authoritative DNS, content delivery, availability and protection against malicious traffic. We use Cloudflare's server-side aggregate traffic, performance and security information. We do not enable its client-side Web Analytics beacon or use it to set analytics cookies.

Why we use your information and our lawful bases

• To answer enquiries, discuss membership and help identify a relevant member firm. We rely on steps taken at your request before a possible contract where applicable, and on our legitimate interests in communicating with people who contact us and administering the network.
• To maintain enquiry records, manage follow-up and protect our legal rights. We rely on our legitimate interests in accountable and effective administration and, where applicable, compliance with legal obligations.
• To secure, troubleshoot and improve the reliability of the website. We rely on our legitimate interests in protecting SGA World, website users and our systems.
• To refer an enquiry to an independent member firm only when you select the separate optional referral permission. Where we rely on that permission as consent, you may withdraw it before the referral by contacting us.

We do not use the enquiry form to subscribe you to marketing.

What you need to provide

The form marks the details needed to receive and assess an enquiry. You are not under a legal or contractual obligation to provide them, but we may be unable to respond without your name, contact details and a meaningful message. Other fields and referral permission are optional. Please do not submit special-category or criminal-offence information through the general enquiry form unless we have specifically asked for it and explained the applicable safeguards.

Who receives your information

Access is limited to authorised SGA World administrators who need it to handle the enquiry. Relevant service providers may process limited information on our behalf, including OVHcloud for UK-hosted website infrastructure, Cloudflare for DNS, traffic routing, content delivery, website security and server-side aggregate analytics, and Zoho for email services. We may also disclose information to professional advisers or public authorities when necessary and lawful.

If you give optional referral permission, we may send the enquiry to an appropriate independent member firm. Once a member firm receives it, that firm acts under its own privacy responsibilities and should provide any further privacy information relevant to the professional relationship.

International transfers

The website application and its primary database are hosted in the United Kingdom. Because SGA World is an international network, an authorised recipient or service provider may be outside the UK. This includes Cloudflare and its service providers where global network operation requires processing outside the UK. Before making a restricted transfer, we use a mechanism permitted by UK data protection law as applicable, such as UK adequacy regulations, appropriate contractual safeguards supported by the required assessment, or a permitted exception. Contact us if you would like information about the mechanism relevant to a particular transfer.

How long we keep information

We review ordinary general, member-finder and media enquiries no later than 12 months after receipt or closure. We review membership enquiries no later than 24 months after receipt or closure because the assessment and relationship-development process may take longer. Records marked as spam are reviewed for deletion after 30 days.

At each review, we delete or anonymise information that is no longer needed. We may keep a record longer where an active relationship, complaint, rights request, legal or regulatory duty, dispute, investigation or security incident requires it; any such hold must be documented and reviewed. Where an enquiry results in membership or another agreement, necessary information moves to the relevant business record and follows the retention period for that relationship rather than remaining indefinitely as an enquiry.

Our daily application-level backups expire after 14 days. Provider-managed disaster-recovery copies are access-restricted and expire under the applicable service cycle; they are not used to extend normal live-record retention. Bounded technical logs are retained only for security, reliability and incident investigation.

Your data protection rights

Depending on the circumstances, you may request access to your personal information, correction, deletion, restriction or portability. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing.

Your right to object: You may object to processing based on legitimate interests. We will stop unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims.

Data protection complaints

Send a complaint to support@sgaworld.org with “Data protection complaint” in the subject line, or write to the registered office above. We will acknowledge a data protection complaint within 30 days, take appropriate steps to investigate it without undue delay, keep you informed where appropriate and tell you the outcome.

You may also complain to the UK Information Commissioner’s Office. The ICO explains how to raise a concern at ico.org.uk/make-a-complaint.

Automated decisions and sale of information

We do not use enquiry information for solely automated decisions or profiling that produces legal or similarly significant effects. We do not sell personal information.

Changes to this notice

We review this notice when the website or our information-handling practices change. The current version and update date will remain available on this page.