Data Protection Notice

Last Modified: 15 July 2026

1. Introduction

This Data Protection Notice (“Notice”) applies in relation to our processing of your personal data in connection with: (i) your access to and interaction with our websites, social media accounts and digital properties (collectively, “website” and such data, “Website Data”); (ii) our customer and prospective customer relationships relating to our product and service offerings in Europe (as defined below) (“Customer Data”); (iii) supplier and prospective supplier relationships (collectively, “suppliers” and such data, “Supplier Data”); and (iv) our business partnerships and prospective business partners (including actual and prospective corporate, commercial and investment transactions and financing arrangements) (collectively, “business partners” and such data, “Business Partnership Data”, cumulatively with the Website Data, Customer Data and Supplier Data, the “Cumulative Data”).

This Notice is provided by Zayo Group UK Limited and/or any of its European Economic Area (“EEA”), Switzerland and United Kingdom (“UK”) based affiliates (collectively, “Zayo”, “we”, “our” or “us”, and the EEA, Switzerland the UK, collectively, “Europe”). Such affiliates consist of those entities found here and to the extent not listed at such webpage, such other entities forming part of our group of companies which may be notified to you from time to time, including via their engagement with you or your organisation. The listing of, or reference to, all such Zayo entities does not, expressly or otherwise, mean that all or any of such Zayo entities accept responsibility for the acts or omissions of each other.

For the purposes of this Notice, “personal data” means any information that relates to a living human being, or which is otherwise considered “personal data” under the GDPR (as defined below). We are a “controller” of Website Data, Customer Data (except as set out in the section below titled “Does this Notice apply with respect to all our interactions with Customer Data”), Supplier Data, and Business Partnership Data under laws relating to privacy, e-privacy, processing and protection of personal data that apply in Europe, including as applicable Regulation (EU) 2016/679 of 27 April 2016 (collectively, with the UK General Data Protection Regulation, “GDPR”, and collectively all such laws, “European Data Protection Laws”). The specific Zayo entity/ies acting as controller(s) will be the entity that determines the purposes and means as to why your personal data will be processed (i.e. the entity that engages with you or your organisation, noting Zayo Group UK Limited is the controller of Website Data).

This Notice only applies to when Zayo deals with your personal data as a controller in the circumstances set out in this Notice. It does not apply to any other company or to any other company’s websites, products or services (including those of Zayo Group LLC). If you disclose your personal data to other companies (including those that act as “controllers” of your personal data), your information will be dealt with according to their privacy practices and it is your responsibility to familiarise yourself with these before doing so. The word “including” in this Notice is not limiting.

2. Does this Notice apply with respect to all our interactions with Customer Data?

No. This Notice only applies with respect to our interactions with Customer Data to the extent that we act as a “controller” of such personal data under European Data Protection Laws. By way of (non-exhaustive) illustration, this Notice is not applicable in the circumstances set out below since we are not a controller of the relevant Customer Data involved. In turn, in these circumstances, you will need to review the relevant controller’s data protection notice to understand how your personal data will be processed.

EU1/ 506659347.15

Fibre & Transport and Network Connectivity.

Zayo provides infrastructure and bandwidth services that permit our customers to transport data in accordance with our customers’ contractual requirements. Our customer is responsible for ensuring the data transmitted through these services is appropriately protected and compliant with the European Data Protection Laws. Although the information moving through Zayo infrastructure may include Customer Data, Zayo is not acting in the role of controller or processor of Customer Data; Zayo does not possess any direct or administrative access to any customer content that is transmitted through our communication infrastructure. This separation is maintained through both technological and security controls implemented on our service architecture.

3. What personal data does Zayo process which is subject to this Notice?

Website Data

In connection with your access and use of our websites, we may collect personal data by automated means (i.e., without you actively submitting such information), using technologies such as cookies, web server logs, web beacons, and similar technologies as described below and in our Cookie Policy, including the following Website Data:

  • the date and time of visit, referring address (location from which a visitor comes to our website(s));
  • type of Internet browser, OS and device details;
  • visitor’s IP address (a unique number that is assigned to any computer that connects to the Internet for identification purposes); and
  • website analytics

When you access or use our websites (including if you were to sign up for our newsletters and other promotional materials, enquire about our products and services, or participate in a promotion, event, survey or other marketing campaign we organise), you may also directly provide us with the following Website Data which is personal data:

  • your name,
  • address,
  • telephone/mobile number,
  • email and other contact details, and
  • any other information relating to you which you may provide

Customer Data

In connection with the use or prospective use of our products and services, we may obtain your personal data as Customer Data, either directly from you or your organisation, including:

  • Basic personal details and identifiers such as name, address, job function/title and contact details (such as telephone and mobile numbers, email address, etc.).
  • Online account details including username, password and other credentials used to access Zayo’s products and services (e.g., Tranzact, Workday recruitment, Zayo service portals, etc.).
  • Financial and payment data such as banking details, invoices and payment terms, as well as any personal data for fulfilling and legitimate processing billing information.
  • Personal data provided when you communicate with us including any complaints, enquiries and responses provided to surveys.
  • Imagery, videos and/or audio from events (including virtual events) you attend and as otherwise agreed or notified to you.
  • Marketing and communication
  • Any other information that you provide to us or direct us to (e.g., company website or LinkedIn profiles).

In connection with the use or prospective use of our products and services, we may obtain the following personal data as Customer Data, by automated means:

  • network traffic

Supplier Data

In connection with you or your organisation potentially or actually entering into and/or managing a contract or other arrangement with us in relation to the provisions of products and/or services to us, we may obtain the following Supplier Data which is personal data directly from you:

  • Basic personal details and identifiers such as name, address, job function/title and contact details (such as telephone and mobile numbers, email address, etc.).
  • AML/KYC data including personal data contained in government issued identification documents, tax, national identification and social security numbers, financial and banking information, and potentially information relating to political exposure and criminal convictions and offences data (to the extent required and permitted by applicable laws) if revealed during AML, KYC, fraud checks, or transaction-related due diligence.
  • Financial and payment data such as banking details, invoices and payment terms, as well as any personal data for fulfilling and legitimate processing billing information (which could include tax details such as when a supplier is a sole trader).
  • Any other information that you provide to us or direct us to (e.g., company website or LinkedIn profiles).

Business Partnership Data

In connection with you or your organisation potentially or actually entering into and/or managing a contract or other arrangement with us (including actual and prospective corporate, commercial and investment transactions), we may obtain the following Business Partnership Data which is personal data directly from you:

  • Basic personal details and identifiers such as name, address, job function/title and contact details (such as telephone and mobile numbers, email address, etc.).
  • AML/KYC data including personal data contained in government issued identification documents, tax, national identification and social security numbers, financial and banking information, and potentially information relating to political exposure and criminal convictions and offences data (to the extent required and permitted by applicable laws) if revealed during AML, KYC, fraud checks, or transaction-related due diligence.
  • Financial and payment data such as banking details and payment terms, as well as any personal data for fulfilling and legitimate processing billing information (which could include tax details such as when a Business Partner is an individual).
  • Imagery, videos and/or audio from events (including virtual events) you attend and as otherwise agreed or notified to you.
  • Any other information that you provide to us or direct us to (e.g., company website or LinkedIn profiles).

Personal data collected by third parties

Zayo may also receive information about you from other sources, including third parties from whom we have purchased data and third party hosted publicly available sources, and combine this information with data we already have about you. This helps us to update, expand and analyse our records, identify new customers, and create more tailored advertising to provide products and/or services that may be of interest to you. We ensure that such data processing activities, including marketing campaigns, comply with European Data Protection Laws.

Special categories of personal data

We do not generally request any special categories of personal data from you with respect to the data processing activities covered by this Notice (this includes details about race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information concerning health, and genetic and biometric data). However, you may provide these types of personal data to us. In these cases, we will rely on applicable conditions (including explicit consent) provided for in the European Data Protection Laws to process such special categories of personal data.

Criminal convictions and offences personal data

We do not request any personal data relating to criminal convictions and offences with respect to the data processing activities covered by this Notice. However, such personal data may be provided to us. In these cases, we will rely on applicable conditions provided for in the European Data Protection Laws to process such criminal convictions and offences data.

4. How do we use your personal data?

Zayo shall only process your personal data for the purposes described in this Notice or as otherwise permitted under applicable laws. The processing of your personal data by Zayo for the purposes described below is subject to the relevant legal bases (and condition if applicable) noted below in respect of the European Data Protection Laws.

The following categories of personal data may be processed for the purposes indicated below:

  • Cumulative Data to administer and manage our relationships, including responding to your enquiries or complaints and to administrate our contracts, which may include providing customer notices, service announcements, assisting with incident resolution, on-premises installation and maintenance services, payment and billing, implementing physical security controls, including to customer equipment and at co-location facilities, marketing, conducting surveys and managing events (legal bases: contractual necessity (GDPR Article 6(1)(b)) and/or our legitimate interests in operating our business (GDPR Article 6(1)(f)));
  • Business Partnership Data and Customer Data to provide any products and/or services or information related to our products and/or services you have requested (legal bases: contractual necessity (GDPR Article 6(1)(b)) and/or our legitimate interests in operating our business (GDPR Article 6(1)(f)));
  • Customer Data and/or Website Data to administer, operate, maintain, and improve our website(s) and our products and/or services (legal bases: contractual necessity (GDPR Article 6(1)(b)) and/or our legitimate interests in operating our business (GDPR Article 6(1)(f)));
  • Customer Data and/or Website Data to simplify access to some interactive features on our website(s) or products and/or services (legal basis: our legitimate interests in operating our business and improving our offering(s) (GDPR Article 6(1)(f)));
  • Customer Data and/or Supplier Data to manage your or your organisation’s accounts, orders, invoices and payments (legal bases: contractual necessity (GDPR Article 6(1)(b)) and/or our legitimate interests in ensuring we receive payment, managing client relationships and protecting our business (GDPR Article 6(1)(f)));
  • Customer Data to manage and provide after-sale services (legal bases: contractual necessity (GDPR Article 6(1)(b)) and/or our legitimate interests in managing client relationships and operating our business (GDPR Article 6(1)(f)));
  • Business Partnership Data, Customer Data and/or Supplier Data to administer accounting and taxes (legal bases: compliance with legal obligation(s) (GDPR Article 6(1)(c)) and/or our legitimate interests in operating and protecting our business (GDPR Article 6(1)(f)));
  • Cumulative Data to respond to requests from regulatory, administrative, judicial or police authorities (legal bases: compliance with legal obligation(s), contractual necessity (GDPR Article 6(1)(b)) and/or our legitimate interests in operating and protecting our business (GDPR Article 6(1)(f)));
  • Cumulative Data to instigate, defend and otherwise participate in actual, potential or threatened legal proceedings (legal bases: compliance with legal obligation(s) (GDPR Article 6(1)(c)) and/or our legitimate interests in operating and protecting our business (GDPR Article 6(1)(f)) and in relation to special categories of personal data (if applicable) the exemption shall be processing is necessary for the establishment, exercise or defence of legal claims or judicial proceedings (GDPR Article 9(2)(f));
  • Cumulative Data in connection with business dealings (including actual and prospective corporate, commercial and investment transactions and financing arrangements) with our customers, suppliers, and other business partners and third parties, who we may share your personal data with, (legal bases: contractual necessity including in relation to the foregoing (GDPR Article 6(1)(b) and/or our legitimate interests to operate our business or for business continuity, including financing, reasons (GDPR Article 6(1)(f)));
  • Cumulative Data to protect the integrity and functioning of our network and IT systems, manage and respond to threats, security incidents and other events, including by monitoring network traffic metadata (legal bases: contractual necessity (GDPR Article 6(1)(b)), compliance with legal obligation(s) (GDPR Article 6(1)(c)) and/or our legitimate interests in operating and protecting our business, including for business continuity reasons (GDPR Article 6(1)(f))); and
  • Cumulative Data to comply with applicable laws and regulations, which may include complying with AML/KYC obligations (legal basis: compliance with legal obligation(s) (GDPR Article 6(1)(c))) and in relation to special categories of personal data (if applicable) the exemption shall be processing is necessary further to obligations and rights in the field of employment, social security and social protection law (GDPR Article 9(2)(b)).

Providing personal data for marketing purposes is optional and refusal will have no consequence on the performance of any contract between Zayo and you or your organisation.

5. With whom do we share your personal data?

Your personal data may be disclosed both internally and externally to third parties (as set out below) to the extent necessary for us to successfully complete the purposes of the processing as set out above. Specifically, your personal data may be disclosed to our personnel who have a business need to use such personal data.

We disclose or otherwise make available personal data with the following categories of third parties:

  • Affiliates, including
  • Suppliers including those acting on our behalf, in connection with managing services, data analytics, finance, accounting or other administrative services and information technology support (e.g., Zayo US LLC, Salesforce and Microsoft).
  • Business partners, which may include potential or existing counterparties, joint venture partners, investors and/or acquirers (in connection with a merger, acquisition, or sale involving Zayo or as part of a corporate reorganisation, stock or asset sale, or other change in corporate control).
  • Advisors, banks and financial institutions and
  • Government authorities and bodies including regulatory and supervisory, administrative, judicial, law enforcement, or police authorities.
  • Other third parties which we agree with, or notify to,

See “How is your personal data protected?” section, or contact us at the contact details included, below for further details on the measures we put in place to safeguard our disclosure of such personal data. Zayo does not share, sell, rent or trade personal data with non-affiliated third parties for their marketing and promotional purposes.

6. Will your personal data be transferred abroad?

In the performance of any contract for the purchase of our products and/or services or in your use of our website(s) or the other purposes noted herein, we may need to transfer your personal data to third parties identified in the “Why and with whom do we share your personal data?” section that are located inside and outside Europe, including in countries that do not provide the same level of protection for personal data as in Europe.

In any case, we will only transfer personal data to recipients in locations that provide an adequate level of data protection and have an applicable adequacy decision, or as otherwise permitted by applicable laws such as by implementing appropriate safeguards, including entering into relevant data transfer agreements which are or incorporate the European Commission’s Standard Contractual Clauses and/or other jurisdiction specific equivalents (“SCCs”). If relied on in relation to any such transfers of your personal data, you may request a copy of the appropriate safeguards (e.g., SCCs) or in the case of reliance on a derogation the suitable safeguards we have relied on. For further information, please contact us at the details included below.

7. How is your personal data protected?

Zayo has appropriate policies and technical and organisational measures in place to safeguard and protect your personal data against unlawful or unauthorised access, accidental loss or destruction, damage, and unlawful or unauthorised use and disclosure (e.g., access controls, security technologies, related data handling and security policies and procedures, auditing and monitoring practices, contractual, including confidentiality, arrangements etc.). We also take all reasonable precautions to ensure that our staff and employees who have access to personal data about you have received adequate training.

8. How long do we keep your personal data for?

We have a retention policy for personal data that we adhere to, in line with legal and statutory requirements. We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, audit, accounting, or reporting obligations and requirements, where required by law and, where required for Zayo to assert or defend against legal claims or resolve disputes, or until the claims in question have been settled and to enforce our contracts and pursue our legitimate business interests in protecting the operation our business. For further details, please contact us at the details included below.

9. What happens when you provide us with personal data about third parties?

If you provide us with personal data about third parties, you warrant, represent, and undertake that you have complied with applicable laws including providing data protection notices to data subjects, and obtaining all necessary consents and approvals for the provision of such personal data to Zayo and informing (or ensuring the informing of) the relevant individuals of the processing by Zayo of this personal data as described in this Notice prior to such processing.

10. How can you update or delete your personal data?

In accordance with applicable laws, you have the right to access personal data we hold about you and request the rectification of any inaccurate data or that we erase your personal data that we hold about you. You can find out more details on such rights and may exercise such rights by contacting us as described, under the “What are your data protection rights?” section below.

When you register online for a Zayo account, you can also view and update your personal data by logging onto our website(s) and following the relevant instructions. To ensure any details we hold about you remain accurate, please update your personal data if it changes or send a request to us as described under the “What are your data protection rights?” section below. If you close your account we may, for limited periods and in accordance with applicable law, retain some personal data to comply with our legal obligations or for other proper purposes, such as for example legal retention obligations, collecting outstanding debts or resolving legal disputes.

When you request to be removed from certain of our marketing activities or offers, you will, in accordance with applicable laws, be added to the relevant internal suppression list(s) to ensure your request is complied with.

11. How do we use your personal data for marketing purposes?

We may use your personal data to conduct marketing, promotional and informational activities and to perform business analytics, satisfaction surveys or market research and direct marketing purposes in general, including sending notifications about updates to our website(s), information on our products and/or services we think may be of interest to you, initiatives or events by mail, e-mail, telephone, mobile, or other electronic means. However, we will only do so in accordance with relevant legal requirements. If you no longer wish to receive marketing information and communications, please inform us by email or use the UNSUBSCRIBE option available on the relevant communication.

12. How do we treat children’s personal data?

We do not knowingly collect personal data from anyone under the age of 18 or knowingly allow such persons to register on our website(s) or purchase our products and/or services.

13. What are your data protection rights?

In accordance with the European Data Protection Laws, you have a right to:

  • Access: obtain confirmation of the existence of, and to request access and a written copy of the personal data Zayo holds about you;
  • Rectification: have any inaccurate or incomplete information we hold about you corrected;
  • Erasure: have personal data we hold about you deleted;
  • Withdraw consent: withdraw your consent where it is the legal basis relied upon for processing, without affecting the lawfulness of processing based on your consent before its withdrawal;
  • Restrict processing: restrict the processing we undertake in relation with your personal data;
  • Data Portability: receive, or have us transfer to another controller, your personal data, which you have provided to us, in a structured, commonly used and machine-readable format, noting this right only applies where the processing is based on consent or pursuant to a contract as a legal basis or is carried out by automated means;
  • To object: object to the use of your details for direct marketing activities, as described under the “How do we use your personal data for marketing purposes?” section previous or when processing is based on legitimate interest as a legal basis;
  • Not to be subject to automated decision making (including profiling): not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning or similarly significantly affects you (e.g., making decisions without human oversight being applied which produces such effects). We do not conduct any automated decision making in relation to the processing covered in the Notice; and
  • Complain: lodge a complaint with a supervisory authority, in particular in the country of your residence, place of work or place of the alleged infringement if you consider that the processing of your personal data infringes applicable European Data Protection Laws.

In case you wish to exercise any such rights, please send a written and signed request to Zayo as described under the “How can you contact us?” section below.

Please note these rights are not always absolute and in certain circumstance their exercise may not be possible including when personal data must be maintained to comply with applicable laws.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any other rights). This is a security measure to ensure that personal data is not disclosed to any person who does not have the right to receive it. We may also contact you to ask you to provide further information in relation to your request to speed up and improve our response.

14. What happens if you visit a linked website?

The information obtained by third party websites accessed via our website(s) is not covered by this Notice and is governed by the terms applicable to your relationship with that third party, and Zayo accepts no responsibility or liability in respect of third-party websites.

15. How can we update this Notice?

We may review this Notice at any time. Where appropriate or required by law, we will notify you about the new Notice by posting it on our products and/or services or on our website(s) or otherwise communicating it to you, which may be by e-mail (to the extent that we have your e-mail address). We encourage you to periodically review this Notice to stay informed about our privacy and data protection practices.

16. How can you contact us?

If you have any questions about this Notice, or if you wish to exercise your rights under applicable laws, please feel free to contact our Data Protection Officer (DPO) at privacy.europe@zayo.com or:

Zayo Europe Attention: Data Protection Officer
Zayo Group UK Limited
4 th Floor, The Relay Building | 114 Whitechapel High Street | London | E1 7PT | UK