1. Purpose and Scope

This privacy policy sets out how and why North Highland collects and uses your personal data when you visit this website, including any data you may provide through this website. Our privacy policy as it relates to affiliates and employees is separately available.

2. Document Review Plan

Critical review and updates to this document are defined below:

• Required annually.
• As required to correct or enhance the information content.

3. Who We Are and Our Data Protection Officer

North Highland is a global consulting firm and the leader in change management. We bring big ideas and challenge the norm. We deliver value in a way that others cannot, through our seamlessly integrated offerings.

North Highland is made up of different legal entities, details of which can be found on this website. This privacy policy is issued on behalf of the North Highland Group so when we mention "North Highland", "we", "us" or "our" in this privacy policy, we are referring to the relevant company in the North Highland Group responsible for processing your data.

We have appointed a Data Protection Officer for managing our data protection matters and fielding questions about this privacy policy. The contact details of our Data Protection Officer are set out below in the Contact Details.

4. The Types of Data We Collect and How We Collect It

Types of Data

We collect, use, store and transfer different types of both personal and non-personal information through our website or otherwise.

Personal data, or personal information means any information about an individual from which that person can be identified. It does not include data from which a person cannot be identified.

We may collect the following categories of personal data about you:

• Identity Data includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth and gender.
• Contact Data includes physical address, email address and telephone numbers.
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website.
• Profile Data includes your username and password.
• Usage Data includes information about how you use our website and services.
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.
• Identifiers and Demographic Data. This includes data such as title, full name, gender, contact details, such as home and work address, phone number(s), email address(es), your geographic preferences for the location of employment, proof of eligibility to work and details of any work permit application, including biometric data.
• Sensitive Data. This includes data like SSNs or performance reviews, etc. collected for business purposes. However, we will not collect, store, or use any sensitive information for purposes of inferring characteristics about you.
• Professional or employment-related information. This includes information such as work history and prior employer information.
• Non-public education information. This is information related to your academic credentials such as what school you went to, what your GPA was, what activities or sports you did in school, or other data on your school transcripts.
• Register an account.
• Request marketing to be sent to you.
• Contact us.
• Respond to a questionnaire or survey; or
• Apply for employment.
• If you are not logged into your Google account, the information collected is not linked to personal data and instead uses an anonymized unique identifier tied to your browser, application or device. If you are logged into your Google account, some additional information is collected—however, this is treated by Google as personal information and is not available in the Google Analytics platform.
• You can stop Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on.
• Google also allows users to personalize their advertising settings.
• Google Tag Manager is used to manage and deploy website analytics, marketing, and tracking tags.

We may also collect the following categories of personal data from job applicants:

• Identifiers and Demographic Data. This includes data such as title, full name, gender, contact details, such as home and work address, phone number(s), email address(es), your geographic preferences for the location of employment, proof of eligibility to work and details of any work permit application, including biometric data.
• Sensitive Data. This includes data like SSNs or performance reviews, etc. collected for business purposes. However, we will not collect, store, or use any sensitive information for purposes of inferring characteristics about you.
• Professional or employment-related information. This includes information such as work history and prior employer information.
• Non-public education information. This is information related to your academic credentials such as what school you went to, what your GPA was, what activities or sports you did in school, or other data on your school transcripts.

We may also collect, use and share non-personal information such as statistical data for any purpose. This non-personal information may be derived from your personal data but is not considered personal data as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature.

If we combine any non-personal information with your personal data so that you can be identified from it, we will treat the combined data as personal data which will be used and protected in accordance with this privacy policy.

How We Collect Data

We collect data in different ways through our website. You may provide us the data directly when you:

• Register an account.
• Request marketing to be sent to you.
• Contact us.
• Respond to a questionnaire or survey; or
• Apply for employment.

Additionally, using cookies and similar technologies, we may automatically collect Technical Data about your equipment, browsing activity and patterns, and location. Please see the Cookies Policy for details.

We may also receive personal data about you from certain third parties and use it as follows:

Google Analytics and Google Tag Manager

All affiliated first-party cookies are provided on our behalf by Google. These cookies assist with reporting user behavior, enable market research, and aid in improving site functionality. We use the data collected to improve the user experience on our website and enhance its functionality. We may also use this data for ad targeting. You may opt out of these cookies at any time.

• If you are not logged into your Google account, the information collected is not linked to personal data and instead uses an anonymized unique identifier tied to your browser, application or device. If you are logged into your Google account, some additional information is collected—however, this is treated by Google as personal information and is not available in the Google Analytics platform.
• You can stop Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on.
• Google also allows users to personalize their advertising settings.
• Google Tag Manager is used to manage and deploy website analytics, marketing, and tracking tags.

LinkedIn, Twitter, Facebook, Terminus, Vidyard

We use data from social media platforms like LinkedIn, Twitter, and Facebook for audience targeting and ad targeting. For more details on the user information gathered by these third parties, please review their individual privacy policies: LinkedIn, Twitter, Facebook, Vidyard.

HubSpot

Some forms on our website are linked to HubSpot. HubSpot is a data collection and evaluation tool that allows us to gather pertinent information on potential and current clients. We use this data for lead generation and receive form completion data and some page view data, which is housed in Salesforce. We also use Hubspot for email communication with opted-in clients and prospects. For more information on the data collected by HubSpot and Salesforce, please view their privacy policy.

Bullhorn and related Marketplace Partners (Kyloe Partners, TextUs & SourceFlow)

Recruiting & Application Tracking Systems

• Bullhorn provides ATS functionality that allows us to track candidate assessment workflows such as interviews and generate offers against open jobs.
• SourceFlow facilitates the advertisement of open jobs and the process by which candidates apply online, landing in Bullhorn as an applicant on an open job record.
• Both systems capture certain details related to candidates, such as name, location, email address, and phone number. These systems may also capture other information NH needs to comply with certain diversity or anti-discrimination regulations, depending on the candidate's location. Neither capture SSN, DOB, or government ID information.
• Kyloe Partners provides data management and document templating services that operate within the Bullhorn database. Kyloe does not consume or retain data outside of Bullhorn.
• TextUs provides SMS communication capability inside Bullhorn, and consumes candidate names and phone numbers.
• Both systems maintain compliant GDPR/CCPA data privacy/ownership policies. Bullhorn is Soc 2 Type 2 certified and SourceFlow is in process for ISO2001 certification.

5. What Happens If You Fail to Provide Personal Data to Us?

If you fail to provide personal data that we need to perform a contract with you or by law, then we may not be able to provide you with the service the contract relates to. We will notify you when this is the case.

6. Cookies

We may use cookies on our website. For more information on how we may use cookies and how you can use the My Cookie Preferences panel to disable or refuse cookies, please see our Cookie Policy.

7. How We Use Your Data — The Purposes and Lawful Grounds for Processing

Purposes and Lawful Bases

We will use your personal data only where we have a lawful basis for doing so. We process your personal data for several purposes. The lawful basis for processing your personal data will depend on the purpose for which it was obtained. The table below sets out the purposes for which we may process your personal data and the relevant lawful basis/bases that allow for that processing:

Changes to the Purposes of Processing

We will only process your personal data for the purpose(s) for which we collected it. If we do need to use your personal data for a new purpose, we will notify you of this and explain the lawful basis we will be relying on.

Please be aware that we may process your personal data without your knowledge or consent where this is required or permitted by law.

8. Marketing

By using the 'My Preferences' tool you can control how we send you marketing communications. We will send you marketing communications if you have requested information from us or purchased services from us, or if you have provided us with your details when registering for a promotion, and in each case, where you have not opted out of receiving that marketing.

As well as using the My Marketing Preferences tool, you can opt out of receiving marketing communications by following the opt-out or unsubscribe links on any marketing message sent to you or by contacting us at any time.

9. How We Share Your Personal Data and With Whom

We may need to share your information with certain third parties — these third parties are as follows:

• Other companies in the North Highland Group acting also as controllers or processors and who are based in the UK and US, provide IT and system administration services and undertake leadership reporting.
• Our suppliers acting as processors identified in section 4 above.
• Our professional advisers acting as processors or joint controllers including lawyers, bankers, auditors, and insurers who provide us with professional services
• For job applicants, we may also share personal information with independent third parties related to your eligibility for employment, or our ongoing management of our business.

We do not sell personal data we collect to third parties.

10. Artificial Intelligence

We may use Artificial Intelligence (“AI”) as part of processing your personal information. However, if we do use AI to process your personal information it will not be done for a purpose or in a manner different than has previously been described as part of this privacy policy. Additionally, no profiling or decisions will be made without the involvement of a human will be done based on your personal information. Your personal information will not be retained by or used to train any AI model.

11. Third-Party Links

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy policies. When you leave our website, we strongly recommend you read the privacy policy of every website you visit.

12. Requesting Access to Your Personal Data

Under certain data protection laws, some individuals have the right to request access to correction of, or deletion of information about them that we hold. To make a request regarding your personal data please contact privacy@northhighland.com.

13. International Transfers

We share your personal data in certain ways that may involve transferring your personal data to countries whose laws do not afford the same level of protection to personal data as the country in which it was collected. We do this in the following ways:

• To other entities within the North Highland Group.
• To the third-party suppliers as referenced above.
• Whenever we transfer your personal data out of the country in which it was collected, we ensure a similar degree of protection is afforded to it by putting in place the following safeguards:
• Standard Contractual Clauses: Where we use certain service providers, we use specific contracts approved by the European Commission which give personal data the same protection it has in Europe and the UK.
• Data Privacy Framework: North Highland has certified its compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF as an approved transfer mechanism for personal data received from the EU and UK (and Gibraltar). See §14 Data Privacy Framework below.

14. Data Privacy Framework

Certification

North Highland (The North Highland Company and its U.S. affiliates) complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF (collectively, the “Data Privacy Framework” or “DPF”) as set forth by the U.S. Department of Commerce.

North Highland has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF.

The following U.S. entities and/or subsidiaries of North Highland also adhere to the EU-U.S. DPF Principles, including as applicable under the UK Extension to the EU-U.S. DPF Principles, and are covered by North Highland’s DPF submission: The Bridge Strategy and Technology Consulting LLC and UMT360 LLC.

If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles, the Principles shall govern.

To learn more about the Data Privacy Framework program and to view North Highland’s certification, please visit https://www.dataprivacyframework.gov/.

FTC Jurisdiction

North Highland is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC) with respect to its compliance with the DPF Principles.

Scope

This section applies to all personal data received from the EU and UK (and Gibraltar) that North Highland processes in reliance on the DPF. It supplements the rest of this privacy policy, which continues to apply in full.

Notice

North Highland notifies individuals about its data practices at the time of collection, or as soon as practicable thereafter, including:

• The types of personal data collected and the purposes for which it is collected and used;
• The types of third parties to which personal data may be disclosed and the purposes for such disclosures;
• The right of individuals to access their personal data;
• The choices and means North Highland offers for limiting the use and disclosure of personal data;
• The independent recourse mechanisms available to individuals;
• North Highland’s liability in cases of onward transfer to third parties; and
• The requirement to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
• Disclosed to a third party acting as an independent controller (i.e., for a purpose not solely on North Highland’s behalf); or
• Used for a purpose that is materially different from the purposes for which it was originally collected or subsequently authorized by the individual.
• Enter into a contract with the agent requiring it to process personal data only for the limited and specified purposes consistent with the consent provided by the individual;
• Require the agent to provide at least the same level of privacy protection as required by the DPF Principles;
• Require the agent to notify North Highland if it determines it can no longer meet this obligation; and
• Upon notice, take reasonable and appropriate steps to stop and remediate any unauthorized processing.
• Obtain confirmation of whether North Highland holds personal data about them;
• Access, correct, amend, or delete their personal data where it is inaccurate or has been processed in violation of the DPF Principles; and
• Object to specific uses or disclosures of their personal data.
• In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, North Highland commits to cooperate and comply with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF in the context of the employment relationship. For human resources data only, if North Highland’s internal complaint resolution process does not resolve your complaint to your satisfaction, you may contact the following independent recourse mechanisms:
• EU individuals (HR data only): EU Data Protection Authorities (DPAs) — https://edpb.europa.eu/
• UK individuals (HR data only): UK Information Commissioner’s Office (ICO) — https://ico.org.uk/
• Gibraltar (HR data only): Gibraltar Regulatory Authority (GRA) — https://www.gra.gi/

Choice

North Highland provides individuals with notice and an opportunity to opt out when personal data is to be:

• Disclosed to a third party acting as an independent controller (i.e., for a purpose not solely on North Highland’s behalf); or
• Used for a purpose that is materially different from the purposes for which it was originally collected or subsequently authorized by the individual.

Where sensitive personal data (as defined by the DPF Principles) is involved, North Highland will obtain affirmative express consent (opt-in) before disclosing such data to third parties acting as controllers or using it for materially different purposes.

To exercise your opt-out choice, please contact us at privacy@northhighland.com.

Accountability for Onward Transfer

Before transferring personal data to a third party acting as an agent (processor) on North Highland’s behalf, North Highland will:

• Enter into a contract with the agent requiring it to process personal data only for the limited and specified purposes consistent with the consent provided by the individual;
• Require the agent to provide at least the same level of privacy protection as required by the DPF Principles;
• Require the agent to notify North Highland if it determines it can no longer meet this obligation; and
• Upon notice, take reasonable and appropriate steps to stop and remediate any unauthorized processing.

North Highland remains liable under the DPF Principles for onward transfers to agents acting on its behalf, unless North Highland proves that it was not responsible for the event giving rise to the damage.

Where North Highland transfers personal data to a third party acting as an independent controller, it will do so only consistent with the notice provided to individuals and any consent they have given. North Highland will enter into a contract with such controller requiring it to process the personal data for limited and specified purposes consistent with the consent provided, and to provide at least the same level of protection as required by the DPF Principles.

North Highland may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Access

Individuals whose personal data North Highland processes under the DPF have the right to:

• Obtain confirmation of whether North Highland holds personal data about them;
• Access, correct, amend, or delete their personal data where it is inaccurate or has been processed in violation of the DPF Principles; and
• Object to specific uses or disclosures of their personal data.

These rights may be limited where the burden or expense of providing access is disproportionate to the risks to the individual’s privacy, or where the rights of other individuals would be violated.

To exercise these rights, please contact: GDPR@northhighland.com or privacy@northhighland.com.

Data Integrity and Purpose Limitation

North Highland collects and processes personal data under the DPF only in ways that are relevant to, and limited to, the purposes for which it was collected. North Highland takes reasonable steps to ensure that personal data is reliable, accurate, complete, and current for its intended uses.

Security

North Highland takes reasonable and appropriate technical and organizational measures to protect personal data covered by the DPF from loss, misuse, unauthorized access, disclosure, alteration, and destruction, consistent with the requirements of §14 (Data Security) of this policy.

Recourse, Enforcement, and Dispute Resolution

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, North Highland commits to resolve DPF Principles-related complaints about its collection and use of personal information. EU and UK individuals with inquiries or complaints should first contact North Highland at:

Email: privacy@northhighland.com
Phone: 1-855-644-3578
Post: 3333 Piedmont Road | Suite 1000 | Atlanta, GA 30305

• In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, North Highland commits to cooperate and comply with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF in the context of the employment relationship. For human resources data only, if North Highland’s internal complaint resolution process does not resolve your complaint to your satisfaction, you may contact the following independent recourse mechanisms:
• EU individuals (HR data only): EU Data Protection Authorities (DPAs) — https://edpb.europa.eu/
• UK individuals (HR data only): UK Information Commissioner’s Office (ICO) — https://ico.org.uk/
• Gibraltar (HR data only): Gibraltar Regulatory Authority (GRA) — https://www.gra.gi/

These services are provided at no cost to the individual. North Highland will consider any advice given by the relevant supervisory authority regarding specific action required to comply with the DPF Principles, including remedial or compensatory measures.

These services are provided at no cost to the individual. North Highland will consider any advice given by the relevant supervisory authority regarding specific action required to comply with the DPF Principles, including remedial or compensatory measures.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, North Highland commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF to JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you. If your DPF Principles-related complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. North Highland is obligated to arbitrate claims and follow the terms as set forth in Annex I of the DPF Principles, provided that you have invoked binding arbitration by delivering notice to North Highland and following the procedures and subject to the conditions set forth in Annex I of the Principles. See https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction for more information.

15. Data Security

While we store and use your personal data, we will ensure the appropriate security of your personal data including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach as is required by the law.

16. Retention of Your Data

We will not keep your personal data longer than is necessary for the purpose for which we use it. In order to continue to provide you requested information and consider applicants for additional employment opportunities, we will retain your personal data until you request that we delete it.

In some circumstances we may anonymize your personal data (so that it can no longer identify you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

17. Your Other Privacy Rights

Persons living or working in some jurisdictions have certain additional privacy rights.

Data subjects in the European Union and the United Kingdom have a right to:

• Be informed of how we are processing your personal data — this privacy policy explains this to you, but please contact us if you have any questions.
• Have your personal data corrected if it is inaccurate or incomplete.
• Have your data erased (the right to be forgotten) in certain circumstances — e.g. where it is no longer needed by us for the purpose for which it was collected, or you have withdrawn your consent. Please note however, that in certain circumstances, we may not be able to comply with your request of erasure for legal reasons. If this is the case, we will notify you at the time you request deletion.
• Restrict the use of your data in certain circumstances, e.g. where you have told us the data is inaccurate, and we are in the process of checking this. In such circumstances we will continue to store your data but will not process it further until we have checked and confirmed whether the data is inaccurate.
• Object to the processing of your data in certain circumstances, e.g. you may object to processing of your data for direct marketing purposes.
• Object to decisions being taken by automated means.
• Request the transfer of your personal data to a third party. Please note this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you; and
• Withdraw your consent at any time to processing where we are relying on consent as the lawful basis, e.g. to receiving marketing communications. Please note if you withdraw your consent, we may not be able to provide certain services to you. We will let you know if this is the case at the time you withdraw your consent.
• California residents using our website may request and obtain a list of personal information we disclosed to third parties for the preceding calendar year as well as the names and addresses of those third parties. To make such a request, please contact us at privacy@northhighland.com.
• Request to Know. You have the right to request access to personal information that we collected for the previous 12 months. Please note that if your access request requires the disclosure of personal information of another individual, we won’t be able to comply with all of your access request. Similarly, if responding to your access request would cause us to violate any law, rule, regulation, or law enforcement request, we would not be able to fulfill your request.
• Request to Delete. You have the right to request that we delete personal data that we collected from you. However, we are not required to comply with your request if it is necessary for us or our service provider to maintain your personal data in order to complete the transaction with you; detect security incidences; identify and repair errors; exercise free speech; comply with the California Electronic Communications Privacy Act; engage in certain public interest research; use internally in a manner reasonably aligned with your expectations; comply with a legal obligation or otherwise use your personal data internally in a way that compatible with the context in which you provided it.
• Right to Opt-out. You have the right to opt-out of the sale of your personal data to Third Parties at any time. This means that once you exercise your right to opt-out of the sale of your personal information, we are required to honor your request. North Highland does not sell personal information collected through our website to Third Parties.
• Exercise of California-Specific Rights. You have the right to be free of discrimination for exercising your consumer privacy rights. We will not deny you goods or services, charge different amounts or provide a different quality level of goods or services for exercising your rights unless the difference is reasonably related to the value of your data.

If you have any concerns about the way we are collecting or using your personal data, please contact us. You also have the right to lodge a complaint with the relevant supervisory authority for data protection matters.

California Consumer Rights

California affords certain privacy rights to its residents (“Consumers”) regarding their personal information:

California residents may also:

• Request to Know. You have the right to request access to personal information that we collected for the previous 12 months. Please note that if your access request requires the disclosure of personal information of another individual, we won’t be able to comply with all of your access request. Similarly, if responding to your access request would cause us to violate any law, rule, regulation, or law enforcement request, we would not be able to fulfill your request.
• Request to Delete. You have the right to request that we delete personal data that we collected from you. However, we are not required to comply with your request if it is necessary for us or our service provider to maintain your personal data in order to complete the transaction with you; detect security incidences; identify and repair errors; exercise free speech; comply with the California Electronic Communications Privacy Act; engage in certain public interest research; use internally in a manner reasonably aligned with your expectations; comply with a legal obligation or otherwise use your personal data internally in a way that compatible with the context in which you provided it.
• Right to Opt-out. You have the right to opt-out of the sale of your personal data to Third Parties at any time. This means that once you exercise your right to opt-out of the sale of your personal information, we are required to honor your request. North Highland does not sell personal information collected through our website to Third Parties.
• Exercise of California-Specific Rights. You have the right to be free of discrimination for exercising your consumer privacy rights. We will not deny you goods or services, charge different amounts or provide a different quality level of goods or services for exercising your rights unless the difference is reasonably related to the value of your data.

18. Changes to Your Personal Data

It is important that the personal data we hold about you is accurate and current. Please let us know if your personal data changes and we need to update our records.

19. Contact Details

If you have any questions about this privacy policy or about your legal rights, please contact the Security Architecture Director using the details set out below:

North Highland (UK) Limited

Shaun Boucher
Sr. Director, Security Architecture
GDPR@northhighland.com
3333 Piedmont Road | Suite 1000 | Atlanta, GA 30305
404.439.1640

California Consumer Privacy Act:

Shaun Boucher
Sr. Director, Security Architecture
Privacy@northhighland.com
3333 Piedmont Road | Suite 1000 | Atlanta, GA 30305
855.644.3578

19. How to Exercise Your Rights

To exercise your rights, you may submit a request for information by contacting us at 1-855-644-3578 or privacy@northhighland.com.

20. Changes to this Privacy Policy

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.