Purpose statement for Ipsos iris Panellists

Ipsos MORI will deliver a single source of high quality and accurate data on a daily basis through the Ipsos iris project to become the trusted and credible partner for the delivery of Online Audience Measurement for UKOM (UK Online Measurement Ltd), the media and advertising industry, websites and apps. Ipsos MORI will ensure the Privacy compliance of Panellists by…

Clarifying the Data Controllers and Processors to allow the panellist clear visibility of who owns their personal data across all the channels used within the Ipsos iris project.

The panellist’s rights will be clearly stated in the relevant Controller’s Privacy Notice, to include clarity on the legal reason for collection of all personal data, the secure control of sensitive data and website cookies/ tagging. Ipsos MORI will give contractual clarity, clearly define the Privacy controls required of its Processors and will work with any joint controller to establish a clear demarcation between the parties allowing full visibility to the Panellist. Ipsos MORI have proactively completed a Data Privacy Impact Assessment, which will be made available to any parties of interest ensuring full transparency of the Ipsos iris solution.

Ipsos iris Panel overview

The Ipsos iris Research Panel has been set up by Ipsos MORI in order to provide a total view of how people in the United Kingdom use the internet.

Ipsos iris is a Research Panel of 10,000 individuals from all over the United Kingdom who agree to take part in the research. By joining the Ipsos iris panel, individuals allow Ipsos MORI, in a safe and secure way, to measure what websites they visit and what apps they use every day.

Ipsos iris collects data from Smartphones, Tablets and Computers from all 10,000 panel members to build a full and comprehensive view of how people use these devices and which websites and apps they use. The aggregate research data collected is used by website owners, publishers, media producers, advertising agencies and broadcasters to ensure they continue to deliver relevant and appropriate content for their visitors.

How we use your information

Ipsos MORI UK Limited, (“Ipsos MORI”,” we” or “us”), commonly known as Ipsos MORI, is a company registered in the United Kingdom at 3 Thomas More Square, London, E1W 1YW under company number 01640855. Ipsos MORI is part of the Ipsos worldwide group of companies.
This privacy policy explains how we use any personal information we collect about you (“Panellist”, ”you” or “your”) when you:

• install the Ipsos iris app/ VPN/browser extension on your primary and any additional devices,
• join our Ipsos iris panel,
• take part in Ipsos iris surveys or
• use the panel members’ website.

What personal data do we collect about you under what legal basis for processing?

Ipsos MORI, as the data controller of the Ipsos iris panel, requires a legal basis to process your personal data.  Ipsos MORI’s legal basis for processing your panel data is your consent to join the panel and participate in its research activities.  If you wish to withdraw your consent at any time, please see the section below covering ‘Your Rights’.

Ipsos MORI will collect the information you provide when you agree to participate in this research project, including your mobile phone number, email address and other contact details. Ipsos MORI will also automatically collect information via the:

• Ipsos iris blue App
• Ipsos iris orange App
• Ipsos iris orange browser extension

For panel members, the information is collected by telephone or via an online questionnaire (your phone number and email address), by completing our recruitment questionnaire when you decide to join our panel and through the Ipsos iris blue App, Ipsos iris orange Apps and Ipsos iris orange browser extension. We may also collect information when you voluntarily complete any other panel related surveys, give your consent to cookies and tagging from certain websites, participate in any other panel activities, when you contact us, when we contact you or when you provide feedback, comments or other information to us.

In the case of the registration process (screening questionnaire, follow-up questionnaire and installation of all required devices) not being successfully completed, your information will be retained by us to prevent any fraud or misuse.

In some instances, concerning our research, we may ask you to provide certain sensitive personal data, for example revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs. You do not have to answer these questions and such questions will always include a “prefer not to answer” option.

When you give your consent for us to use your data, you allow us to use and retain any data you provide. This data will be pseudonymised, and later anonymised, to protect your privacy during the length of the Ipsos iris project.

When working with partners, such as PAMCo, we will always pseudonymise the data to protect your rights, However, both Ipsos MORI and our partners may merge your data with other data sources, for research purposes only. Please note, we pseudonymise this information before it is passed to any 3^rd parties to maintain your privacy and they will not be able to link information to individuals. The exception to this is BI Worldwide, where we will ask you to register your details directly and Ipsos will provide the level of monthly incentives to BI Worldwide.

The Ipsos iris App/ VPN/Browser extension is installed for the purpose of market research. The App/VPN/Browser extension runs in the background whilst you’re using your device(s) normally. They allow Ipsos MORI to collect information about the device and how you use it.

The information collected by our App/VPN/Browser extension is described below in more detail.

With the exception of any terms entered into a web search, our App/VPN/Browser extension does NOT collect keystrokes or information that is entered into a web form, such as website user IDs, passwords, credit card numbers, other financial account numbers or any other data presented on or entered into a secure (HTTPS) webpage. As a result, the App/VPN/Browser extension will normally not have access to any information regarding items in a website shopping basket or your interactions with financial or health-related websites that you may log into, as these are normally secure sites.

However, in the event that any such sensitive data is collected by mistake, such as the collection of personal data by a badly designed website (e.g. user ID/password in the URL); we can assure you any such data will be securely deleted from our systems as soon as it is found to have been collected in line with Ipsos MORI’s data protection and information security policies and procedures.

The App/VPN/Browser extension will collect the URL (e.g. www.google.co.uk) of any secure (i.e. HTTPS) websites, together with any search terms you enter into a secure site that the site adds to the URL (full web address). The App/VPN/Browser extension does NOT collect information displayed in the website pages, nor any information entered into online forms (e.g. online payment form).

Information collected by our Apps/VPNs

Panel members will be invited to download and install one or more of Ipsos’s research Apps/VPNs/Browser extensions. We can reassure you that these apps DO NOT record any phone calls, nor do they collect the content of any emails or text messages. The Apps/VPNs/Browser extensions used with this panel are as follows:

Ipsos iris blue App – installed on Android and iOS smartphones

The Ipsos iris blue App runs in the background whilst you’re using your smartphone. It allows Ipsos MORI to collect the following information about websites/apps accessed, details on the device and how you use it:

• The GPS location of the device and if the device is moving.
• The MediaCell app uses the device microphone to listen out for coded audio or to generate digital audio fingerprints to measure the TV or radio stations you are tuned to; it will never record any audio. (This function is switched off by default, however the mic will switch on occasionally to keep the app running. No conversations or personal information will ever be recorded or stored).
• Data about the date and time the device is switched on, when it uploads data, when the screen is active the battery charge level, how much battery power is left and whether it is on/off charge.
• When it connects to a network and what type of connection is used (e.g. a Wi-Fi connection or mobile service provider)
• Information about your device: Android Advertiser ID or Apple IDFA, together with other Information about your mobile device, in sleep mode and when the screen is locked or the device is active. The information about the device includes make and model
• Information about your usage of other apps and features (such as the camera, though we do not collect any photos) on your mobile device, including the identity of the apps and features, when you downloaded them, how often you use them and for how long.
• Operating system capabilities to view the contents of your applications such as Accessibility services.
• Network information: Information about which mobile network(s) you connect to, the locations of the mobile network sign tower used to connect, signal strength and at what times you connect and use them.
• Presence of Wi-Fi connectivity: we check if you are connected to wi-fi, but we do not collect any information about which wi-fi signal you are connected to
• Time spent using the internet, including:

• Websites/Apps visited/used
• How websites are accessed (e.g. Navigated to it, redirected to it or clicked on a hyperlink)
• Reporting on the in-app content consumption of Netflix, YouTube, Amazon Prime Video, BBC iPlayer and BBC Sounds, plus potentially Spotify in the future
• Information on Subscription Video on Demand (SVOD) capture
• Total amount of online data usage

• Information we can deduce from combining the above information – e.g., what apps you were using just before you searched for particular information using your mobile device’s internet browser, or how often you call, email or text, or the geographic location in which you are most likely to charge your device, make a telephone call, or download an app.

We may ask you to participate in additional research projects from time to time that would require the continuous use of the microphone. Your consent will be required to do this, and additional incentives would be paid for your participation.

Ipsos iris orange App – Installed on Android Tablets and Secondary Android Smartphones and iOS Smartphones

The Ipsos iris orange App runs in the background whilst you’re using your Android tablet or iOS iPad. It allows Ipsos MORI to collect the following information about websites/apps accessed, details on the device and how you use it:

• Information about your device: such as when and for how long you charge it, how much battery power is left, whether it is switched on or off, in sleep mode and when the screen is locked, or the device is active. The information about the device includes make, model, its IMEI or UID, operating system (e.g. iOS, Android) and the Device Advertiser ID (Android ADID/Apple IDFA)
• Information about your usage of other apps and features (such as the camera, though we do not collect any photos) on your mobile device, including the identity of the apps and features, when you downloaded them, how often you use them and for how long.
• Operating system capabilities to view the contents of your applications such as Accessibility services.
• Time spent using the internet, including:

• Websites/Apps visited/used
• How websites are accessed (e.g. Navigated to it, redirected to it or clicked on a hyperlink)
• Reporting on the in-app content consumption of Netflix, YouTube, Amazon Prime Video, BBC iPlayer and BBC Sounds, plus potentially Spotify in the future
• Information on Subscription Video on Demand (SVOD) capture
• Total amount of online data usage

Ipsos iris orange browser extension – installed on Computers (Mac & PC)

The Ipsos iris orange browser extension runs in the background whilst you’re using your computer. It allows Ipsos MORI to collect the following information about websites/apps accessed, details on the device and how you use it.

• Time spent using the internet, including:

• Websites/Apps visited/used
• How websites are accessed (e.g. Navigated to it, redirected to it or clicked on a hyperlink)
• Reporting on the in-app content consumption of Netflix, YouTube, Amazon Prime Video, BBC iPlayer and BBC Sounds, plus potentially Spotify in the future
• Information on Subscription Video on Demand (SVOD) capture
• Total amount of online data usage

VPN Background

The VPN will collect everything that is sent via the internet, so in effect all network traffic from the app and web usage. However, we’ll only collect secure HTTPS traffic for the data points we are interested in e.g. browser activity, content level data from Netflix, iPlayer etc. We don’t collect data from apps or services that don’t require an internet connection i.e. calendar, calculator, phone or other default phone services.

It allows Ipsos MORI to collect the following information about websites/apps accessed, details on the device and how you use it:

• Time spent using the internet, including:

• Websites/Apps visited/used
• How websites are accessed (e.g. Navigated to it, redirected to it or clicked on a hyperlink)
• Reporting on the in-app content consumption of Netflix, YouTube, Amazon Prime Video, BBC iPlayer and BBC Sounds, plus potentially Spotify in the future
• Information on Subscription Video on Demand (SVOD) capture
• Total amount of online data usage

NOTE: you may see a message that pops up when you install the browser extension, it is a default message generated by the operating system to explain what some extensions of this nature are technically capable of capturing, such as passwords etc. However, we do not configure our extension to do this and DO NOT collect sensitive data such as bank accounts or account logins. Our Privacy Policy document explains what we actually capture

Applications that are screened out, fraudulent, duplicated or not completed properly (aka speeders)

During the onboarding process, we may lose some candidates, due to:

• candidates being screened out, as per the “Membership” section in the T&Cs
• completion of duplicate applications
• attempts to complete the application in a fraudulent manner
• incomplete, or too hastily addressed, applications, also known as “Speeders”
• being employed by Ipsos

When these occur, the individual will not be allowed to participate as a panellist and their details will be removed, but kept for reference in case of future attempts to join the panel. NOTE: No incentives will be provided for the above scenarios.

Use of project by children

We understand the importance of protecting the privacy of minors, especially in the online environment. This Ipsos iris project is not designed for or intentionally targeted at minors under the age of 15. We will always gain the consent of anyone aged younger than 16 from their Parent or Guardian. If we become aware that we have collected personal information relating to a minor, we will take reasonable steps to delete it.

Why we collect information from you

The primary purpose of collecting information from you is for Ipsos MORI to conduct market research. When you join our Panel or install any of our Apps/VPNs, we enter into a contract with you, which is subject to this Privacy Policy as well as our Terms and Conditions.

In order to fulfil this contract, we need to collect, process and collate the information requested during the recruitment or that we subsequently collect in accordance with this Privacy Policy and process it. This information will be used to contact you concerning the Ipsos iris project, which is also explained in more detail in our Terms and Conditions.

Where you install any of our Apps/VPNs, respond to any survey invitations we might be sending you or that you may otherwise voluntarily provide. Your participation is at your choice. There might also be situations where we are seeking further information from you or even explicit consent where this might be appropriate or required.

The overall operation and how the Panel works is described in more detail in our Terms and Conditions Here.

When you request deletion, leave or are removed from the panel, we will remove the link between your profile information and the responses you provided before deleting your record. We will only keep a minimised version of your data to uniquely identifying you as a “removed panellist” to prevent duplication or fraudulent activity.

The anonymous research data will be retained within our records for the duration of the project.

Use of Cookies and Page Tagging

A cookie is a small text file that is stored on a user’s computer for record-keeping purposes. We use cookies on our site www.irispanel.ipsos.com. We do not link the information we store in cookies to any personally identifiable information, including the email address, you submit while on our site. We use session cookies to make it easier for you to navigate our site, some websites within the Ipsos iris project may also contain web tags or website tags which are a tool used to gather data on a website.

See below for more information on our use of Cookies contained in our Research Network, which is run by our trusted partner, DotMetrics:

• DeviceKey internet cookie (ends with session)

This internet cookie collects information about the data subject’s device. The purpose for which we use it is to provide a high-quality view of the survey or some content on the data subject’s device.

• Session Temp internet cookie (ends with session)

With this internet cookie, we obtain information about a visit to the Research Network.

• Session Temp Timed internet cookie (ends with session)

Contains information about the current site from which you access the Research Network.

• Unique User Identity internet cookie (30 days)

Contains information about the current user e.g. your unique ID, creation time, current tracking mode and version

• Site Id internet cookie (ends with session)

Indicates which site or what site category is measured.

NOTE: This privacy statement covers the use of cookies by Ipsos Panels only and does not cover the use of cookies by any third parties.

We also use digital fingerprint technology, also known as “Machine Identification”, to gather certain information about your computer, hardware and software, such as:

IP address / display settings of your monitor / type of browser used / type of operating system

This information is sent to our trusted provider, Dotmetrics, who converts it into a unique serial number (the digital “fingerprint”) and determines if it matches previous fingerprints. The data collected in this process and the digital fingerprint created are not tied to any of your personal information and are stored on secured servers.

We will use your information for our ongoing research into how people use various devices to access the internet and interact with websites and Apps.

The results of this research will be fully anonymous statistical research data only. You will NOT be identifiable in any published results.

We will use the information you provide to:

• Fulfil our contract with you
• Keep a record of all Panellists
• Respond to any messages, questions or issues you may raise
• Allow you to sign up with our rewards partner to provide any incentives offered to you for assisting with this research
• Send you invitations to participate in surveys that are relevant to you based on the information you provided in response to our recruitment questionnaire(s) or as may be updated by you at a later stage
• Contact you via SMS message to your mobile phone number (if applicable) containing a verification code, to verify your application and activate your Panellist account;
• Contact you via SMS, email or telephone regarding the completion of the software installation and signup process.
• Contact you via SMS, email or telephone regarding any issues we are having receiving data from you or if you stop sending data or send less than the minimum amount of data
• Append existing personal information about you to your responses to any market research you participate in, such as geographical location, ethnicity, occupation categories etc. for survey analysis of the responses and producing anonymous, statistical research results
• Enter you into any prize draws that you are eligible to take part in or, where invited to do so, have asked to be entered.
• Pass your individual data together with your personal information to the client who commissioned the research. The client will use this information only for research purposes as explained in the relevant survey.
• Ipsos MORI may contact you to participate in further research projects they conduct separately and prior to your information being provided to the client for this, the client may also use this information to contact you to invite your participation in further research they conduct;
• To create anonymous, statistical profiles of the Panel membership based on the information provided by Panellists;
• Pass your information to other Ipsos Group companies, or their partners, so that they may invite you to participate in research studies they are carrying out and that may be relevant to you; and
• Send you by email newsletters, announcements and other communications as set out in the Terms and Conditions.
• Where you agree to take part in a product test to arrange for such a product to be sent to you.
• If you have become a member of the panel through one of our third-party recruitment suppliers, they will be informed that participants have completed the screening questionnaire.

NOTE: Ipsos MORI enforces procedures in order to select suppliers processing personal data based on their capacity to comply with Ipsos MORI’s data protection requirements. This means that all suppliers must sign an agreement with Ipsos MORI including data protection clauses at least as strict as the ones Ipsos MORI signs with its customers, and that no supplier can transfer any personal data outside the EEA unless they agree to appropriate safeguards and obtain customer consent. Additionally, our suppliers cannot subcontract part of the personal data processing services to sub-processors without Ipsos MORI’s prior approval.

As part of our online advertising research and internet usage research studies, we may also:

• Send you invitations by text message (if applicable) to take part in additional research.
• If required, we may also ask you to participate in additional research about what TV channels you watch and what Radio stations you listen to. This will require your consent to access the mic on your device to detect the Audio signal from TV and Radio. No conversations will ever be recorded or stored

We may also send your information to our sub-contractors or affiliated companies, listed in the table below, who carry out some work on our behalf, around, control and responsibility for data hosting or as described above.

Some of these sub-contractors may be based outside the European Economic Area; however, they are required to abide by the same data privacy legal requirements and security arrangements as ourselves and will be subject to appropriate safeguards, a description of which can be obtained by contacting us from the details at the bottom of this document.

We will take all reasonable steps to ensure that any personal data we process is accurate, adequate, relevant and not excessive, given the purpose for which they were obtained. We will not process personal data obtained for one purpose for any unconnected purpose unless you have consented to this.

We will NEVER use your information for any purpose other than research or as described in this policy. Other than in relation to this Panel (like participating in further surveys), we will NOT try to sell you anything, nor use your information for marketing purposes, nor will we pass your information to third parties for marketing or advertising purposes. We will not add information to the data record we collect to try to profile you as an individual,

For more information about our Panel, Panel membership or information related to your membership of our panels, please contact our Panel Support Team. They can be contacted as set out in the details at the bottom of this document.

Who will have access to your information?

Your information may be processed by:

Those Ipsos MORI staff involved in this research project, or who need access in order to directly support the systems used. This may include staff in:

• Other Ipsos Group companies involved in this research, some of which may be located in other countries. The data will be moved safely and will always be pseudonymised.
• Our sub-contractors who may carry out some of the processing on Ipsos MORI’s behalf, and under Ipsos MORI’s control; for example: the service providers who host or provide technical support for our systems.
• As of 6^th August 2020, our sub-contractor, BI Worldwide, will provide the monthly incentives for the panellists, albeit with the data being pseudonymised, and the panellists being asked to register directly with BI Worldwide.
• Where required by law or regulation, we may be required to disclose some of your information to relevant authorities; for example, if you are being investigated by the police for criminal activity.
• It may be that Ipsos MORI is a joint controller with the data collector in which case you should be aware of their Privacy Notice and give explicit consent, or agree to lawful processing under legitimate interest, for them to use your personal data for the stated purpose(s).

This may also involve transferring your personal information to other countries, including the USA and India. However, we can reassure you we take great care to ensure any transfers are carried out securely and in compliance with all applicable data protection and data privacy legal requirements through a set of Binding Corporate Rules for all companies under the Ipsos Company Group. We can also assure you that any sub-contractors involved are also required to abide by the same contracted data privacy legal requirements and security arrangements as Ipsos MORI.

What we do to keep your information secure

We take very seriously our responsibilities to keep your personal, and sensitive, information secure. As such we take every reasonable precaution to ensure your information is protected from loss, theft or misuse. These precautions include appropriate physical security of our offices, controlled access to computer systems, and use of secure, encrypted internet connections when collecting personal information. Ipsos MORI have the ISO27001 and Cyber Essential accreditation standards to ensure a safe and secure infrastructure. Ipsos MORI will continually review and improve its information security measures to ensure they continue to effectively support the business and remain compliant with our legal, regulatory and contractual obligations.

How long will Ipsos MORI keep your information?

We will keep the profile information you provided for as long as you remain a Panellist.

NOTE: You can leave the Panel at any time you wish.

When you leave the panel or are removed, we will retain your measurement data and only the minimum required personal data to uniquely identify you as an individual, for the sole purpose of preventing any duplicate or fraudulent participation for the duration of the panel, unless you specifically request that we delete all your personal data in accordance with GDPR Article 17

Apart from your profile information, Ipsos MORI will also gather the answers you give in any survey. The answers provided by you will be pseudonymised by Ipsos MORI for security reasons and will only be shared with our clients in this form unless you have given your explicit consent to you being identified. We will also remove the link between your profile information and the answers you provided within 12 months of the end of the research project, to ensure that these answers cannot be traced back to you. The anonymous research data will be retained in our research within our records indefinitely.

Your consent and rights as a Panellist

As a Panellist, participation in this research is voluntary, and you can change your mind at any time. As specified above, when you leave the panel or are removed, we reserve the right to hold your personal data for the sole purpose of preventing any duplicate or fraudulent participation for the duration of the panel, unless you specifically request that we delete all your personal data in accordance with GDPR Article 17 If you:

• Change your mind and no longer wish to participate in this research
• Have any questions or concerns regarding our use of your personal information, our privacy policy or privacy practices.
• Want to request a copy of the personal information we may hold about you, or to request that we correct any inaccurate personal information.
• Want to correct anything inaccurate in your personal data, which will be corrected immediately
• Want to raise an objection, where relevant, about how your personal data is processed
• Request that your personal data is erased if there is no longer a justification for it
• Ask that the processing of your personal data is restricted in certain circumstances

Use of your work devices as part of the project

If you wish to use your work device for this project, you must first check with your employer that you are not in breach of company policies by installing the App/VPN on any work device(s).

Please remember to only include your work device(s) if you have permission from your employer to include them in this research.

How to contact us

Please contact the panel support team who will assist you. You can contact them via:

Email
panel@ipsosiris.com

Phone
08000 149464

SMS
07507303032

To contact us in writing
Ipsos iris Panel, Ipsos MORI, Kings House, Kymberley Road, Harrow HA1 1PT

If you have any complaints, we will appreciate if you give us an opportunity to resolve any issue first, by contacting us as set out above. You are, however, always entitled to contact our regulatory body, the UK Information Commissioner at: https://ico.org.uk/global/contact-us/

Changes to our Privacy Policy

Useful Links

Transmission of Personal Data to recipients outside or inside the Ipsos Group is subject to the authorisation requirements for processing Personal Data in countries that do not offer an adequate level of protection. The data recipient (be this another Ipsos company or any sub-contractor) must be required to use the data only for the defined purposes. For external transfers the requirements of this paragraph and those of Attachment B – Outsourced/Third Party Data Processing apply cumulative.

If Personal Data are transmitted to a recipient outside the Ipsos Group to a third country, this recipient must agree in writing to maintain a data protection level equivalent to this Data Protection Policy or as required under applicable law. For example, the GDPR stipulates various requirements that must be complied with, before any transfer may occur. This does not apply if transmission is based on a legal obligation. A legal obligation of this kind can be based on the laws of the domiciliary country of the Ipsos Group company transmitting the data. In the alternative, the laws of the domiciliary country of the Ipsos Group company may acknowledge the purpose of data transmission based on the legal obligations of a third country.
Where Personal Data are transmitted by third party (like a sample supplier) to an Ipsos Group company, it must be ensured that the Personal Data can be used for the intended purpose.

If Personal Data are transferred from an Ipsos Group company with its registered office in one country to an Ipsos Group company with its registered office in another country, the company importing the data is obligated to cooperate with the enquiries made by the relevant supervisory authority in the country in which the party exporting the data has its registered office and to comply with any observations made by the supervisory authority with regard to the processing of the transmitted data.

If a Data Subject claims that this Data Protection Policy has been breached by an Ipsos Group company located in another country that is importing the data, the Ipsos Group company that is exporting the Personal Data undertakes to support the Data Subject concerned, in establishing the facts of the matter and also asserting his/her rights in accordance with this Data Protection Policy against the Ipsos Group company importing the data. In addition, the Data Subjects is also entitled to assert his or her rights against the Ipsos Group company exporting the data. In the event of claims of a violation, the exporting company must document to the Data Subjects that the company importing the Personal Data did not violate this Data Protection Policy.

Each Ipsos Group company transmitting Personal Data to an Ipsos Group company located in another country, shall remain liable for any violations of this Data Protection Policy committed by the Ipsos Group company that received the Personal Data, as if the violation had been committed by the Ipsos Group company transmitting the Personal Data.

Any transfer of Personal Data within the Ipsos Group shall only be made after a relevant entry into JobBook for the project under which the transfer occurs has been made. Such entry will create a contract under the Ipsos Intragroup Master Services Agreement and automatically makes the respective EU Model Clauses applicable to such transfer.

In many cases Ipsos MORI is using external providers to process Personal Data. In these cases, an agreement on data processing on behalf of Ipsos MORI must be concluded with such provider. This can be done either by way of including appropriate provisions in the agreement governing the overall relationship with the provider or in a separate and specific document. In respect of processing on behalf of Ipsos MORI, the provider may only process the Personal Data as per the 12 instructions from Ipsos MORI. When instructing a provider, the following requirements must be complied with:

• Where the Personal Data in question fall under client data, any relevant client requirements need to be passed down to the provider.
• The provider must be chosen based on its ability to cover the required technical and organisational protective measures and in line with Ipsos MORI supplier approval process.
• The provider must not subcontract the processing further without Ipsos MORI’s prior written consent.
• The instructions must be placed in writing by way of an appropriate contract. The instructions on data processing and the responsibilities of Ipsos MORI and provider must be documented.
• Before the data processing begins, Ipsos MORI must be confident that the provider will comply with its duties. A provider can document its compliance with data security requirements in particular by presenting suitable certification. Depending on the risk of data processing, the reviews must be repeated on a regular basis during the term of the contract. Ipsos MORI should retain the right to audit the provider’s compliance.
• In the event of cross-border contract data processing, the relevant national requirements for disclosing Personal Data abroad must be met. In particular, the Personal Data from the European Economic Area can be processed in a third country only, if the provider can prove that it has a data protection standard equivalent to the GDPR and this Data Protection Policy. Suitable tools can be:

• an agreement based on EU standard contract clauses for contract data processing in third countries with the provider. Similar agreements will be required for any subcontractor of the provider.
• Participation of the provider in a certification system accredited by the EU for the provision of a sufficient data protection level.

• building new IT systems for storing or accessing personal data;
• developing new applications or research approaches;
• embarking on a data sharing initiative; or
• using data for new purposes.