Lifestyle Survey Privacy Notice 

Last updated: 13/12/2023

Dentsu UK Limited (“our”, “us”, “we” and “Dentsu UK”) is part of the Dentsu group (“Dentsu”). We are a global digital and media advertising company. Our core business is to help our clients improve how they advertise and market, whether by print, post, email or on websites. Information provided by people like you is therefore important to our business.

This privacy notice (“Notice”) tells you more about the information – specifically, the personal data - that we gather through the Lifestyle Survey and any follow-up surveys (together, the “Survey”).

The Survey is a consumer survey, which provides insight into the types of people who might buy Dentsu clients’ products or services. Thanks to the information that you share when completing the Survey, you have the power to influence some of the world’s largest brands.

Who is involved in the Survey?

1.) Dentsu UK: Dentsu UK commissions the Survey.

2.) Dentsu: The dentsu entity who commissions the Survey will generally act as Data Controller of your personal data.  As part of the Survey, Dentsu UK and its subsidiaries and affiliates may collect and use some of your personal data. The data controller may share personal data collected from you with its group companies within Dentsu.

3.) Market research companies. We rely on market research companies to create and run the Survey – they invite you to complete the Survey. These are market research companies that you have voluntarily registered with, and they also act as independent data controllers for the data you share with them. This Notice should be read in conjunction with the privacy notices of these market research companies.

One such market research company is Toluna UK Limited. Toluna UK Limited administers the Survey in a number of countries. It is an independent controller of any data you share with it – such as the contact data that you disclosed when registering to become one of its members, and any personal data that you might give when completing the Survey. A copy of Toluna UK Limited’s privacy notice can be found here:

https://s3media-itwp-eu.surveycenter.com/CCS/GDPR/2022/en/privacy.html

4.) Partners – we may share your personal data with some of our third-party suppliers.

5.) Dentsu’s clients.

• You may also be invited to participate in follow-up surveys, which are conducted on behalf of clients of Dentsu.  These clients act as independent controllers for the personal data collected from you during the course of those follow-up Surveys.
• Dentsu’s clients may instruct Dentsu to use what are known as our “Identity Products”. These products are described in more detail in the “Identity Products” section below, with details of the processing being undertaken found in our Identity Product Privacy Notice, here.

This Notice explains what data each of these companies may have access to, and why they have access to it.

Contents of this Notice

This Notice explains:

1. the personal data we may collect,
2. why we process your personal data,
3. the legal grounds that allow us to process your personal data,
4. where the personal data comes from,
5. who gets to see the data,
6. how long we keep the data,
7. how we protect your personal data,
8. participation in the Survey by children aged 15 - 17 years,
9. your rights in relation to your personal data,
10. transferring personal data overseas,
11. how to contact us, and
12. how we make changes to this Notice.

In the Supplementary Information section at the end of this Notice, we explain what is meant by “controller”, “personal data”, “processing” and other terms used in the Notice.

1.) Personal data we may process

(a) personal data we collect

Each time you complete the Survey, we receive the following types of personal data from the market research company that’s responsible for administering the Survey:

• A unique reference code. Your Survey responses are linked to a unique reference code (a random arrangement of numbers and letters). This reference code is given to you by the market research company.
• Your Survey responses. These will include your demographics, attitudes and interests. The Survey asks for your opinions, interests, hobbies; views on products and services items you own and buy; your age; occupation; income; lifestyle; media usage; views on marketing and advertising; and other information that is useful for describing different types of people. Your responses in relation to questions about your race, ethnicity, sexual orientation and religious or philosophical beliefs, your health, political opinions or trade union membership (“special category personal data”). It is up to you whether you provide this special category personal data when completing the Survey and you will be provided with a “prefer not to say” or a “neither agree/nor disagree” style answer to choose from.   We do not use this information to knowingly target you with marketing and advertising.
• Cookie data. We may also receive data derived from third party cookies that are set and stored in your browser as part of the Survey.
• Your identity and contact details. A Dentsu entity will be an independent controller of your identity and contact information – including your name, address and email address. However, that Dentsu entity does not actually have access to these details. Instead, they instruct the market research company to send these details directly to our Partners, or Merkle (another Dentsu group company) for the purposes explained below. At no stage will the controlling entity or its clients see or have access to this data. The Dentsu entity who is controller will be stated in the consent wording. Note we only receive this data if you have consented to it being shared.

(b) personal data we receive or utilise from other data sources.

We may receive or utilise personal data about you from other data sources, both public and private sources. We may use this data to enrich or verify the Survey results. We may also combine the data from the Survey with data from these other sources to create new sets of data.  Where we receive or utilise data from these other sources as a data controller, we will always provide a separate notice to individuals at the time that the data is collected. An example of this is found in the “Identity Products” section below.  Partners that provide us with additional personal data may include the following companies, as well as their affiliates or other partners that Dentsu selects to provide this service for them: Zeotap, Meta, Amazon, Google, Infosum, Experian, CACI, Liveramp, Dunnhumby, The Trade Desk, Quantcast, MiQ and we may appoint other similar suppliers for the purposes set out in this Notice. Such Partners are not allowed to use your personal data for any reason, other than is set out here and we have entered or will enter into contracts with those Partners to ensure your data is kept secure, confidential and erased in accordance with our data retention and destruction policies. If you are a UK or EEA Citizen, those Partners shall not process your personal data outside the UK or the EEA, unless either:

• the countries that they transfer your personal data to have internationally recognised data protection structures in place to adequately protect your personal data; and/or
• they have entered into appropriate agreements with us, using European or UK approved standard contractual clauses designed to protect your personal data.

Data from cookies

When you participate in the Survey online, a cookie may be set and stored in your browser. The market research company administering the Survey will ask your permission to set the cookie and you should accept or decline as you wish. The cookie records your unique reference code and can be synced with other cookies on your device – for instance cookies that record the websites you have visited. This data allows us to gain a better understanding of you, which allows us to find other people that behave in a similar way to you. 

2.) Why we process your personal data

Market and marketing insights research purposes

We use your data provided through the Survey for research purposes, which includes creating marketing insights – to allow us to better understand how consumers respond to marketing and advertising.

On occasion, our consumer research will be based on the Survey results in combination with data from other sources (see Other Data Sources above). In these situations, we match your Survey data with other data to create a new set of data and this helps make our research more accurate.

Assisting our clients’ marketing strategy

Your personal data can help us decide the right types of people to target when carrying out marketing and advertising activities on behalf of clients. To do this we use the personal data described in section 1 to gain an understanding about what different types of people are likely to be interested in.

Where we carry out this targeting following a client’s instruction, that client will be considered the data controller as we are acting as their service provider for that specific targeting activity.

We may carry out this targeting in a number of ways.  Ones of the ways we assist our clients’ marketing strategy, is through offering Identity Products. This type of processing is explained in brief below, and in our Identity Product Privacy Notice in more details, here.

• Deterministic Matching

We use the contact details that you have consented to being shared with us us in combination with data from other sources (see Other Data Sources above), so that we are able to find consumers that are similar to you and may also be interested in our clients’ products or services. We then build target audiences of those people and market to those people on our clients’ instruction. This is often called a “lookalike audience”.  

• Attribute Matching (utilising personal data)

Dentsu and its clients are not able to deliberately identify you and specifically target you with advertising based on your completion of the Survey, and takes steps (but cannot guarantee) to remove you from any audience identified for targeted advertising.

In both (a) and (b) above, all this means is that people who we think are similar to you (in your preferences or behaviours that we learn from the Survey) will receive specific, targeted marketing from our clients for the products and services that we think you would have been interested in.  The personal data collected about you through the Survey is not used to directly target you with Dentsu’s clients marketing activities. However, where parts of the data from the Survey are used to identify types of people (“Segments”), and those identified Segments are then matched against similar groups from other, independent databases, there is a chance that you will form a part of the Segments chosen by Dentsu’s clients to display their adverts. We do all we can to avoid targeting you, but because we are matching against Segments based on their characteristics, rather than the people who make up the Segment, we are not able to control whether or not you will form a part of the targeted Segment.

This type of activity may include what’s known as “profiling”. This means that we use automated means to process your personal data to analyse or predict your personal preferences, interests, or behaviour. This helps with our research – it enables us to work out how best to target other people with the same preferences, interests, or behaviours as you.

Our profiling activities allow us to learn about our clients’ target audiences so that we can determine when, where and how to market to those audiences. You can object to our profiling (see section 9 of this Notice, below).

• Attribute Matching (no personal data used)

In some instances, we use the responses you provided in the Survey to create audiences based on different attributes we assign. This is done with your anonymised Survey responses, so we cannot associate an audience with you.

These audiences may be shared with third parties to enable them to enrich the audiences they have created too, which in turn means our clients can market based on richer audiences than they would otherwise be able to.

3.) What are the legal grounds that allow us to process your personal data?

When we receive the types of personal data described in section 1 from the market research companies that administer the Survey, we process it on the basis of our legitimate interests. We have a legitimate interest in deriving insight into audiences that are relevant to Dentsu’s clients in order to assist them with their business strategy. We will not process your personal data if your interests, rights and freedoms override our interests.

Where we combine your Survey data with data from other sources, we do so with your consent, which you provide when completing the Survey.

Additionally, if you choose to provide us with “special category personal data” as described in section 1, we are relying on your consent to process it by you choosing to provide it to us. If you choose “prefer not to say” or “neither agree nor disagree” as responses to these Survey questions, we will not process any special category data relating to you.

4.) Where the personal data comes from

Dentsu UK employs market research companies to run the Survey. You will have voluntarily registered with one or more of these market research companies.

When you participate in the Survey online, a cookie may be set and stored in your browser. This cookie is a third-party cookie. The small amount of data derived from the cookie (as further described in section 1) is directed to the third-party cookie provider’s data management platform. The data is then stored in this platform for Dentsu, which processes the data in line with the purposes outlined in this Notice.

https://s3media-itwp-eu.surveycenter.com/CCS/GDPR/2022/en/cookie.html

In addition, we do receive data from other sources. Where we do use data from other sources, you will be notified separately when you provide your information to that other data source and they will be responsible for determining the correct lawful basis.

5.) Who gets to see your personal data?

Most of the research work described at section 2 of this Notice uses data from aggregated groups of Survey respondents, not individual responses. We share these aggregated data, not individual responses, with Dentsu staff responsible for creating consumer insight reports and media plan recommendations for clients. We also share this type of data with clients of Dentsu.

We share the personal data described in section 1 on an individual, rather than aggregated, basis with: (i) other companies within the Dentsu group so that they can use the data for the same purposes as described in section 2 (or help us to achieve the purposes described in section 2); (ii) companies that can assist us with the type of work described in section 2. For example, we use companies to help us carry out faster analysis, and the third-party cookie providers who help us process your cookie data; and (iii) a client of Dentsu where the client has commissioned a follow-up survey and has specifically requested access to personal data collected using the initial Survey.  In these cases, the client will not have access to your name or contact details, and our client will be an independent controller and responsible for providing you with information about how they are using your data).

6.) How long do we keep your personal data?

We will keep your personal data for as long as is necessary for the purposes described in section 2, and in accordance with our legal obligations. After this time, your personal data will either be securely deleted or anonymised so that it can be used for analytical purpose

7.) How We Protect Your Personal data

Our safeguards include robust systems and processes designed to ensure that we collect only the minimum personal data necessary to pursue the purposes for which we process your personal data described in section 2, and that only those who need to view your personal data can see it. We adhere to restrictions on our use of the personal data (such as making sure that no marketing or advertising is directed at individuals who have provided data through the Survey).

Under Dentsu’s Chief Information Security Officer, there is a group-wide security function tasked with understanding security threats. Policies have been implemented to help keep your personal data secure. These policies are aligned to applicable regulations and industry standards including ISO27001 and NIST and are applicable to all parts of Dentsu. 

8.) Participation in the Survey by children aged 15 - 17 years

We do not knowingly ask children aged 14 or under to participate in Surveys (except in India Thailand and Israel where we may ask individuals above the age of 12).  Where children aged 15 years or over participate in a survey, the market research company administering the Survey will seek consent for their participation from a parent/guardian subject to local applicable laws. If you have any concerns about your child’s privacy in relation to our services, or if you believe that your child may have provided personal data via the Survey without you first giving your consent, please contact us at dpo@dentsu.com.

9.) Your rights

You have rights (with some exceptions and restrictions) to:

• object to our processing of your personal data, including profiling. You can object, on grounds relating to your particular situation, at any time. In which case, we shall stop processing the data that your objection relates to, unless we can show compelling legitimate grounds to continue that processing;
• access your personal data. If you make this kind of request and we hold personal data about you, we are required to provide you with information on it, including a description and copy of the personal data and why we are processing it;
• request that we provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format;
• request erasure of your personal data in certain circumstances;
• request correction or updating of the personal data that we hold about you and that is inaccurate;
• request the restriction of our processing of your personal data in some situations. If you request this, we can continue to store your personal data but are restricted from processing it while the restriction is in place;
• complain to your local data protection authority about our collection or use of your personal data. For example, in the UK, the local data protection authority is the UK Information Commissioner's Office.

If you choose to exercise the rights described above, we may ask you to provide additional information so that we can satisfy ourselves of your identity before we take further action.

If you would like to exercise any of these rights in relation to any personal data that we hold about you, please contact us using the contact details in section 11 of this Notice.

10.) Transferring personal data overseas

Your personal data is kept on servers in multiple countries and may be transferred outside of your country or territory (for example, outside of the UK or the EEA) for the purposes described in this Notice. We may transfer personal data to countries where Dentsu group companies or clients are located so that they may review and use the research and insight.

When we transfer data, we take appropriate steps to ensure compliance with Global data protection laws. These steps might include, for example, transferring the personal data to a country which the exporting country has decided provides adequate protection for personal data, or to a company who has signed standard contractual clauses approved by the European Commission.

11.) How to contact us

If you have any questions about this Notice or would like to exercise any of the rights mentioned in section 9 of this Notice, you can contact our Data Protection Officer in any of the following ways:

Address: Data Protection Officer, Dentsu UK Limited, Regent’s Place, 10 Triton Street, London, NW1 3BF

Telephone: (+44) (0) 207 070 7700

Email: dpo@dentsu.com

12.) Changes to the Notice

We may make changes to this Notice on occasion. We will post any revised versions of this Notice at https://www.dentsu.com/lifestyle-survey . Please review this Notice periodically to see if any changes have been made.

SUPPLEMENTARY INFORMATION

In this Supplementary Information section, we explain some of the terminology used in the Notice.

• "controller" – the person or company that controls the purposes and means of processing personal data.
• "EEA” – the European Economic Area, which comprises the current countries in the European Union plus Iceland, Liechtenstein and Norway.
• "personal data" – any information that relates to you (or from which you can be identified).
• "processing" – doing anything with personal data. For example, collecting it, storing it, disclosing it and deleting it.

"profiling" – using automated means to process personal data in order to work out certain things about people, like analysing or predicting their performance at work, economic situation, personal preferences, interests, behaviour, location or moveme