Privacy Notice
How Expede Group Limited collects, uses and protects personal information
Last updated: 24 August 2026
Expede Group Limited respects your privacy and is committed to protecting personal information entrusted to us.
This Privacy Notice explains how we collect and use personal information when you visit our website, contact us, enquire about our services, submit information through one of our forms, apply to work with us or otherwise interact with Expede.
It also explains the rights you have in relation to your personal information.
Who we are
Expede Group Limited is a company registered in England and Wales under company number 10187402.
Our registered office is:
Expede Group Limited
71–75 Shelton Street
Covent Garden
London
WC2H 9JQ
United Kingdom
For the purposes described in this notice, Expede Group Limited is generally the data controller, meaning that we decide why and how personal information is used.
You can contact us about privacy or data-protection matters at:
Please use “Data Protection” in the subject line where possible.
Where Expede processes personal information solely on behalf of a client as part of a consultancy engagement, the client may be the data controller and its own privacy notice and contractual arrangements will apply.
Personal information we collect
The information we collect depends on how you interact with us.
Enquiries and contact forms
When you contact us, request a UDRF briefing or submit a website enquiry, we may collect:
your name;
organisation or institution;
role or job title;
business email address;
telephone number, if provided;
the service or subject you are interested in;
information contained in your message; and
subsequent correspondence with us.
Talent and associate applications
If you apply to work with Expede or submit a CV to our associate network, we may collect:
your name and contact details;
CV and employment history;
education, qualifications and professional certifications;
areas of expertise;
availability and engagement preferences;
information supplied during conversations or selection activity; and
other information you choose to provide in support of your application.
Please avoid including unnecessary sensitive or special-category personal information in a CV or application.
Business relationships
Where you are a client, prospective client, supplier, partner, associate or other professional contact, we may also hold:
professional contact details;
your organisation and role;
communications and meeting records;
proposals, contracts and commercial correspondence;
information relating to services we provide or receive; and
information necessary for invoicing, administration, assurance and regulatory purposes.
Website and technical information
When you visit our website, certain technical information may be collected automatically, including:
IP address;
browser and device information;
pages viewed;
referring website or source;
dates and times of visits;
interactions with the website; and
cookie and analytics information.
Further information about this is provided in the Cookies and analytics section below.
How we obtain personal information
Most personal information is provided directly by you - for example when you complete a form, send us an email, submit a CV, meet with us or engage Expede to provide services.
We may also receive professional information from:
your employer or organisation;
professional referrals;
clients, suppliers or partners;
publicly available professional sources; and
business and professional networking platforms.
Where we obtain information from another source, we will use it only where we have an appropriate reason to do so.
Why we use personal information
We use personal information only where we have a lawful basis to do so.
Responding to enquiries
We use contact information to respond to enquiries, arrange conversations, provide information about our services and explore potential engagements.
Our lawful basis will normally be our legitimate interests in responding to and developing business enquiries, or taking steps at your request before entering into a contract.
Providing and managing services
We process information necessary to establish, manage and deliver client, supplier and associate relationships.
Depending on the circumstances, this may be necessary for the performance of a contract, to take steps before entering a contract, to meet a legal obligation, or for our legitimate interests in managing our business and delivering professional services.
Recruitment and our associate network
We use information submitted by prospective employees and associates to assess suitability, communicate about opportunities and manage our talent network.
Our lawful basis will normally be taking steps at your request before entering into a contract and/or our legitimate interests in recruiting and maintaining access to appropriate professional capability.
Operating and protecting our website and business
We may process technical and security information to operate our website, maintain security, detect misuse, troubleshoot problems and protect Expede, our clients and website visitors.
We rely on our legitimate interests in operating and protecting our business and technology securely.
Website analytics
Where required, we use analytics and performance technologies only after appropriate consent has been obtained through our cookie controls.
We use analytics to understand how visitors use the site and to improve its content and performance.
Business communications
We may occasionally communicate with professional contacts about relevant Expede services, insights or developments where this is permitted by law.
Where consent is required, we will obtain it. Where we rely on legitimate interests for appropriate business-to-business communications, you may object or opt out at any time.
Legal and regulatory requirements
We may use personal information where necessary to comply with legal, regulatory, tax, accounting or professional obligations, or to establish, exercise or defend legal claims.
Who we share information with
We do not sell personal information.
Where necessary, information may be shared with carefully selected organisations that support our business, including:
website hosting and technology providers;
email, communications and cloud-service providers;
professional advisers such as accountants, lawyers or insurers;
consultants, associates or subcontractors involved in delivering relevant services;
clients where appropriate to an engagement;
regulators, law-enforcement bodies or public authorities where legally required; and
a purchaser or successor organisation in the event of a legitimate business sale, restructuring or transfer.
Third-party service providers processing personal information on our behalf are expected to protect it and use it only for the purposes for which it has been provided.
Our website is hosted by Squarespace, which processes certain website, form and analytics information in providing its services to us.
International transfers
Some of the technology and service providers we use may process or store personal information outside the United Kingdom.
Where personal information is transferred internationally, we take appropriate steps to ensure that an appropriate level of protection is maintained.
Depending on the destination and circumstances, this may include reliance on:
UK adequacy regulations;
recognised contractual safeguards, including the UK International Data Transfer Agreement or UK Addendum; or
another lawful transfer mechanism available under UK data-protection law.
You can contact us if you would like further information about safeguards relating to a particular transfer.
How long we keep personal information
We retain personal information only for as long as it is reasonably required for the purpose for which it was collected, taking account of legal, contractual, regulatory and business requirements.
As a general guide:
Website and service enquiries are normally retained for up to 24 months after the last meaningful contact, unless they develop into an ongoing business relationship.
CVs and talent/associate information are normally retained for up to 24 months after the last meaningful contact, unless you become engaged by Expede or there is another appropriate reason to retain the information.
Client, supplier and commercial records may normally be retained for up to six years after the end of the relevant relationship, where required for contractual, accounting, tax or legal purposes.
Marketing preferences are retained for as long as necessary to respect your preferences and any request not to receive communications.
Website and cookie information is retained according to the relevant cookie, analytics and technology settings.
We may retain information for longer where required by law or where reasonably necessary in connection with a legal claim, investigation or regulatory requirement.
When information is no longer required, we will delete, anonymise or securely dispose of it.
Cookies and analytics
Our website uses cookies and similar technologies.
Some cookies are strictly necessary for the website to operate securely and correctly.
We may also use analytics and performance cookies to understand how visitors use the website and improve its performance. Where consent is required, these cookies are used only in accordance with the choices you make through our cookie controls.
Our website platform, Squarespace, may process information such as browser and device details, IP address, pages viewed, interactions and traffic-source information in providing website and analytics services.
You can use the cookie controls available on our website to manage or change your preferences.
If we introduce additional analytics, advertising or third-party website technologies, we will update our privacy and cookie information as appropriate.
Keeping information secure
We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.
These measures include access controls, appropriate technology safeguards, secure service providers and proportionate business and information-security processes.
Access to personal information is limited to people who have an appropriate business need.
No internet-based service can be guaranteed to be completely secure, but we regularly consider the safeguards appropriate to the nature and sensitivity of the information we hold.
Your data-protection rights
Depending on the circumstances and the lawful basis on which we process your information, you may have the right to:
ask whether we process your personal information and obtain a copy;
ask us to correct inaccurate or incomplete information;
ask us to erase personal information in certain circumstances;
ask us to restrict how we use your information;
object to certain processing;
receive certain information in a portable format;
withdraw consent where processing is based on consent; and
raise a complaint about how your personal information has been handled.
These rights are not absolute and may depend on the circumstances.
We may need to verify your identity before responding to a request.
To exercise a data-protection right, contact info@expede.group and use “Data Protection Request” in the subject line where possible.
Your right to object
You have the right to object to processing based on our legitimate interests in certain circumstances.
You also have the right to object at any time to the use of your personal information for direct marketing.
If you ask us to stop using your information for direct marketing, we will do so. We may retain limited information on a suppression list so that we can continue to respect your preference.
Data-protection complaints
If you are concerned about the way we have collected, used, secured or otherwise handled your personal information, you can raise a data-protection complaint directly with us.
Please contact:
and use “Data Protection Complaint” in the subject line where possible.
We will acknowledge a data-protection complaint within 30 days, take appropriate steps to investigate it, keep you informed of progress where necessary and communicate the outcome without undue delay.
We would welcome the opportunity to resolve any concern directly.
You also have the right to raise a complaint with the Information Commissioner's Office (ICO), the UK's independent data-protection regulator. Information about making a complaint is available from the ICO.
Automated decision-making
Expede does not currently use information collected through this website to make solely automated decisions that produce legal or similarly significant effects about individuals.
If this changes, we will update this notice and provide the information required by law.
Children
This website and our services are intended for organisations and professional users.
We do not knowingly use the website to collect personal information directly from children.
If you believe a child has provided personal information to us inappropriately, please contact us so that we can review and, where appropriate, remove it.
Changes to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in our services, technology, business practices or applicable law.
The current version will always be published on this website and the Last updated date at the top of the notice will show when it was most recently revised.
Contact us
For questions about this Privacy Notice or the way Expede uses personal information, please contact:
Expede Group Limited
71–75 Shelton Street
Covent Garden
London
WC2H 9JQ
United Kingdom
Email: info@expede.group
Registered in England and Wales: 10187402