Dentsu Aegis London Limited

Lifestyle Survey Privacy Notice

Last updated: 14/05/2019

Dentsu Aegis London Limited (“our”, “us”, “we” and “Dentsu Aegis London”) is part of the Dentsu Aegis Network group (“Dentsu Aegis Network”). We are a global digital and media advertising company. Our core business is to help our clients improve how they advertise and market, whether by print, post, email or on websites. Infomation provided by people like you is therefore important to our business.

This privacy notice (“Notice”) tells you more about the information – specifically, the personal data - that we gather through the Lifestyle Survey and any follow-up surveys (together, the “Survey”).

The Survey is a consumer survey, which provides insight into the types of people who might buy Dentsu Aegis Network clients’ products or services. Thanks to the information that you share when completing the Survey, you have the power to influence some of the world’s largest brands.

Who is involved in the Survey?

Dentsu Aegis London is an independent controller of the personal data that you provide when you participate in the Lifestyle Survey. For more information on what that personal data is, please see section 1 of this Notice, below. It may share this data with other members of the Dentsu Aegis Network group, which can use the data for the purposes described in this Notice.

We rely on market research companies to invite you to participate in, and to administer, the Survey. These are market research companies that you have voluntarily registered with and are independent controllers of the personal data that you share with them. This Notice should therefore be read in conjunction with the privacy notices that were presented to you by those market research companies.

One such market research company is Toluna UK Limited. Toluna UK Limited administers the Survey in a number of countries. It is an independent controller of any data you share with it – such as the contact data that you disclosed when registering to become one of its members, and the personal data that you give when completing the Survey. A copy of Toluna UK Limited’s privacy notice can be found here: https://survey18.toluna.com/customsurvey/GDPR/2019/en/privacy.html.

You may also be invited to participate in one or more follow-up surveys, which are conducted on behalf of clients of Dentsu Aegis Network. The client for whom a follow-up survey is conducted will be an independent controller of the personal data collected during the course of the Survey. See section 1, below, for information on what that personal data is.

Contents of this Notice

This Notice explains:

1. the information we may collect,
2. why we process your personal data,
3. the legal grounds that allow us to process your personal data,
4. where the personal data comes from,
5. who gets to see the data,
6. how long we keep the data,
7. how we protect your personal data,
8. participation in the Survey by children aged 15 - 17 years,
9. your rights in relation to your personal data,
10. transferring personal data overseas,
11. how to contact us, and
12. how we make changes to this Notice.

In the Supplementary Information section at the end of this Notice, we explain what is meant by “controller”, “personal data”, “processing” and other terms used in the Notice.

1. Information we may collect

Each time you complete the Survey, we receive the following types of information from the market research company that’s responsible for administering the Survey:

• A unique reference code. Your Survey responses are linked to a unique reference code (a random arrangement of numbers and letters). This reference code is given to you by the market research company.
• Your Survey responses. These will include your demographics, attitudes and interests. The Survey asks for your opinions, interests, hobbies; views on products and services items you own and buy; your age; occupation; income; lifestyle; media usage; views on marketing and advertising; and other information that is useful for describing different types of people.
• Your Survey responses in relation to questions about your race, ethnicity, sexual orientation and religious or philosophical beliefs, your health, political opinions or trade union membership (“special category personal data”). It is up to you whether you provide this special category personal data when completing the Survey and you will be provided with a “prefer not to say” or a “neither agree/nor disagree” style answer to choose from.   As with all personal data about you and gathered during the course of the Survey, we never use this information to target you with marketing and advertising.

Dentsu Aegis London does not receive your contact details (such as your name, full postal address or email address) from the market research companies involved in the Survey. This type of directly identifiable data is removed from the Survey responses before being shared with Dentsu Aegis London.

We may also receive data derived from third party cookies that are set and stored in your browser as part of the Survey.

Data from cookies

When you participate in the Survey online, a cookie may be set and stored in your browser. The market research company administering the Survey will ask your permission to set the cookie and you should accept or decline as you wish. The cookie records your unique reference code and can be synced with other cookies on your device – for instance cookies that record the websites you have visited. This data allows us to gain a better understanding of you, which allows us to find other people that behave in a similar way to you. We only use the information gathered from the cookie dropped as part of the Survey for research purposes; never to target you with marketing and advertising.

2. Why we process your personal data

The personal data collected about you through the Survey is not used to target you with Dentsu Aegis Network clients’ marketing activities.

Personal data provided through the Survey is used by us for research purposes – to allow us to better understand how consumers respond to marketing and advertising. Your personal data can help us decide the right types of people to target when carrying out marketing and advertising activities on behalf of clients. To do this we use the personal data described in section 1 to gain audience insight for multiple clients.

We may also use the personal data you provide through the Survey to find individuals that behave in a similar manner to you and to then send those similar individuals targeted marketing and advertising on behalf of clients. This type of activity may include what’s known as “profiling” (explained in more detail below). As previously mentioned, we do not use the personal data derived from the Survey to target Survey participants.

Profiling

Some of what we do with your personal data involves what's known as profiling – using automated means to process your personal data to analyse or predict your personal preferences, interests, or behaviour. This helps with our research – it enables us to work out how best to target a person with the same preferences, interests or behaviours as you.

Please note that we do not carry out profiling activities in order to target you with our clients’ marketing and advertising activities. You will not receive targeted marketing as a consequence of the profiling activity described in this Notice. Instead, profiling that involves your personal data enables us to derive insight into clients’ target audiences so that we can determine when, where and how to market to those audiences. You can object to our profiling (see section 9 of this Notice, below).

3. What are the legal grounds that allow us to process your personal data?

When we receive the types of personal data described in section 1 from the market research companies that administer the Survey, we process it on the basis of our legitimate interests. We have a legitimate interest in deriving insight into audiences that are relevant to Dentsu Aegis Network clients in order to assist them with their business strategy. We will not process your personal data if your interests, rights and freedoms override our interests.

As described in section 1, we may receive special category personal data. It is up to you whether you provide this special category data when completing the Survey and you will be provided with a “prefer not to say” or a “neither agree/nor disagree” style answer to choose from. By opting to participate in the Survey and disclose special category personal data to us, we are relying on your consent to process it.  

4. Where the personal data comes from

Dentsu Aegis London employs market research companies to run the Survey. You will have voluntarily registered with one or more of these market research companies.

When you participate in the Survey online, a cookie may be set and stored in your browser. This cookie is a third-party cookie. The small amount of data derived from the cookie (as further described in section 1) is directed to the third-party cookie provider’s data management platform. The data is then stored in this platform for Dentsu Aegis Network, which processes the data in line with the purposes outlined in this Notice.

5. Who gets to see your personal data?

Most of the research work described at section 2 of this Notice uses data from aggregated groups of Survey respondents, not individual responses. We share such aggregated data, not individual responses, with Dentsu Aegis Network staff responsible for creating consumer insight reports and media plan recommendations for clients. We also share this type of data with clients of Dentsu Aegis Network.

We share the personal data described in section 1 on an individual, rather than aggregated, basis with: (i) other companies within the Dentsu Aegis Network group so that they can use the data for the same purposes as described in section 2 (or help us to achieve the purposes described in section 2); (ii) companies that can assist us with the type of work described in section 2. For example, the company that provides us with cross tabulation software (software that enables us to carry out faster analysis) and the third-party cookie providers who help us to process your cookie data; and (iii) a client of Dentsu Aegis Network where the client has commissioned a follow-up survey.

6. How long do we keep your personal data?

We will keep your personal data for as long as is necessary for the purposes described in section 2, and in accordance with our legal obligations. After this time, your personal data will either be securely deleted or anonymised so that it can be used for analytical purposes.

7. How We Protect Your Personal data

Our safeguards include robust systems and processes designed to ensure that we collect only the minimum personal data necessary to pursue our legitimate interest, and that only those who need to view your personal data can see it. We adhere to restrictions on our use of the information (such as making sure that no marketing or advertising is directed at individuals who have provided data through the Survey).

Under Dentsu Aegis Network’s Chief Information Security Officer, there is a group-wide security function tasked with understanding security threats. Policies have been implemented to help keep your personal data secure. These policies are aligned to applicable regulations and industry standards including ISO27001 and NIST, and are applicable to all parts of Dentsu Aegis Network. 

8. Participation in the Survey by children aged 15 - 17 years

Where children aged 15 years or over participate in a survey, the market research company administering the Survey will seek consent for their participation from a parent/guardian. If you have any concerns about your child’s privacy in relation to our services, or if you believe that your child may have provided personal data via the Survey without you first giving your consent, please contact us at dpo@dentsuaegis.com.

9. Your rights

You have rights (with some exceptions and restrictions) to:

• object to our processing of your personal data, including profiling. You can object, on grounds relating to your particular situation, at any time. In which case, we shall stop processing the data that your objection relates to, unless we can show compelling legitimate grounds to continue that processing;
• access your personal data. If you make this kind of request and we hold personal data about you, we are required to provide you with information on it, including a description and copy of the personal data and why we are processing it;
• request that we provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format;
• request erasure of your personal data in certain circumstances;
• request correction or updating of the personal data that we hold about you and that is inaccurate;
• request the restriction of our processing of your personal data in some situations. If you request this, we can continue to store your personal data but are restricted from processing it while the restriction is in place;
• complain to your local data protection authority about our collection or use of your personal data. For example, in the UK, the local data protection authority is the UK Information Commissioner's Office.

Please note the limited data that we receive about you, as described in section 1 of this Notice. Therefore, if you choose to exercise the rights described above, we may ask you to provide additional information so that we can satisfy ourselves as to your identity before we take further action.

If you would like to exercise any of these rights in relation to any information that we hold about you, please contact us. Our contact details can be found in section 11 of this Notice. We will consider and respond to your request in accordance with the relevant law.

10. Transferring personal data overseas

Your personal data is kept on servers in multiple countries and may be transferred outside of your country or territory (for example, outside of the UK or the EEA) for the purposes described in this Notice. We may transfer personal data to countries where Dentsu Aegis Network group companies or clients are located so that they may review and use the research and insight.

When we transfer data, we take appropriate steps to ensure UK and European Union data protection law is complied with. These steps might include, for example, transferring the information to someone in a country which the UK Information Commissioner or the European Commission (as appropriate) has decided provides adequate protection for personal data, or to someone who has signed standard contractual clauses approved by the European Commission.

11. How to contact us

If you have any questions about this Notice or would like to exercise any of the rights mentioned in section 9 of this Notice, you can contact our Data Protection Officer in any of the following ways:

Address: Data Protection Officer, Dentsu Aegis London Limited, Regent’s Place, 10 Triton Street, London, NW1 3BF

Telephone: (+44) (0) 207 070 7700

Email: dpo@dentsuaegis.com

12. Changes to the Notice

We may make changes to this Notice on occasion. We will post any revised versions of this Notice at https://www.dentsuaegisnetwork.com/?global=true. Please review this Notice periodically to see if any changes have been made.

SUPPLEMENTARY INFORMATION

In this Supplementary Information section, we explain some of the terminology used in the Notice.

"controller" – the person or company that controls the purposes and means of processing personal data.

"EEA” – the European Economic Area, which comprises the current countries in the European Union plus Iceland, Liechtenstein and Norway.

"personal data" – any information that relates to you (or from which you can be identified).

"processing" – doing anything with personal data. For example, collecting it, storing it, disclosing it and deleting it.

"profiling" – using automated means to process personal data in order to work out certain things about people, like analysing or predicting their performance at work, economic situation, personal preferences, interests, behaviour, location or movements.