Last Updated: 24 September 2024

This Survey Privacy Notice is effective as of 2 September 2024 and any personal data collected from a GWI survey (Survey) that we process is subject to our Survey Privacy Notice in effect at the time that personal data is collected. This Survey Privacy Notice will regularly be updated to reflect any changes in the way we handle your personal data or any changes in applicable laws. 

For the purposes of this Survey Privacy Privacy Notice, when we refer to: 

• “you” “your”, “survey respondents” we mean the individual(s) who complete a Survey;

• “we”, “us”, ”our” “GWI” we mean Trendstream Limited.

GWI also has a more general Privacy Policy that provides personal data on what personal data we process  outside the context of a Survey. You can find it here: https://www.gwi.com/privacy

Welcome to our Privacy Notice.

Each Survey is conducted by Trendstream Limited. We are a global consumer research company that aims to understand the views of internet users. We process your personal data in accordance with this notice in the United Kingdom, in the European Union and at times in the United States of America and in Singapore (where some of our suppliers and affiliate offices are located). 

Your privacy is our priority. So, we’ve outlined what personal data we collect about you, how we use it and where we store it.

We’ve tried to make everything as clear as possible, but if you have questions, you can contact us, and we’ll be happy to help. (See the Contact Us section below.)

Purposes of the policy

This Survey Privacy Notice aims to give you information on how we collect and process personal data you provide to us when you complete one of our Surveys.

It is important that you read this Survey Privacy Notice together with any other privacy notice or fair processing notice provided to you on specific occasions when we are collecting or processing the personal data you give us so that you are fully aware of how and why we use it. This Survey Privacy Notice supplements the other notices you may be  given and is not intended to replace them.

What we do

Our aim is to help companies understand online audiences.  In other words, how and why people use the internet, and how they feel about various brands, products, services and marketing campaigns. As such, we conduct regular research across the world, speaking to over a million people each year to ask them what they do on the internet, which devices they own, and what their views are on a wide range of topics. We collect this personal data by asking you to complete a Survey.

We collect your survey responses (Survey Responses) along with unique alphanumeric identifiers (from the Panel Provider and generated by GWI) (each an Identifier) along with those of others who have also completed the Survey.  We combine your responses and Identifiers with responses collected from other respondents to form our survey data set that we use to generate our products. The Identifiers also allow us to ask the panel providers to recontact you to invite you to take further surveys based on your answers or based on ads or websites you have seen (where you have consented to cookies). For our core syndicated services, we anonymize and aggregate all Survey Responses (including yours) and generate anonymized and aggregated insights  (Anonymized Insights), which we provide to our clients to help them understand the general characteristics and demographics of the people who visit their websites, use their products and services or see their advertising. 

We may provide your Survey Responses and the responses of others to our clients in a non-aggregated form (Respondent Level Data or RLD) either on an anonymous basis (Anonymized RLD) or with your unique Identifiers (Pseudonymized RLD). Sometimes, we provide your Identifiers to our Third Party Partners as seed data to enable them to build a lookalike model (i.e. an audience of consumers like you) (Activations). The lookalike model created by our Third Party Partners removes your Identifier and does not include any of your personal data. Further details on how we use your data can be found in the section ‘How is your personal data used?’ below. 

In some cases, where we conduct research on behalf of our clients, we may act as a processor (and our client is the controller) and in other cases as a joint controller with our client. When that is the case, we will notify you and present you with an appropriate privacy notice.

We also use a cookie (GWIQ) in order to establish connections to help our clients understand the profile of the audience interacting with their website or ad campaign and to evaluate effectiveness and targeting of their ad campaigns. We report to our customers anonymous and aggregated insights to demonstrate for example X% target audience was exposed to a customer advert on one channel as compared to another channel.

The data we collect about you

Personal data means any information about an individual from which that person can be identified. We may collect, use, store and transfer different types of your personal data:

• Identity Data. As part of our research, we receive an alphanumeric identifier from our Panel Providers and  we assign an alphanumeric identifier to the Survey Responses we collect from you so that we can identify your response from the other responses to the Survey.
• Survey Data. When you complete a Survey, we collect your Survey Responses to the questions to the Survey. This may include personal data depending on the Survey you are completing. For example, it may include questions about you and your interests such as questions about your health and your online habits, your shopping preferences, the country you live in, your favorite brands, family set up etc.
• Technical Data. As part of our Survey activities, we might also collect your internet protocol (IP) address, browser type and version, time zone setting and location, user agent, language, host browser headings and attributes (described in our Survey Cookie Policy), browser plug-in types and versions, operating system (type and version), cookies and similar technology or other identity data and information about device (type and version) you use to access and complete the Survey.
• Cookies. Like many websites and surveys, we use cookies and similar analytics-driven technologies. Please see Cookies - GWIQ section below and our Cookie Notice for further information on our use of cookies.

Where we combine the data above with any other personal data we collect from you, we treat all of that combined data as personal data.

Some personal data you provide as part of your Survey Responses may reveal personal data about you which is considered to be a special category of personal data. For example sensitive data such as details about your race or ethnicity, health, religious beliefs, sexual orientation or political opinions. We will only ask questions which relate to special categories of data where: (i) we are permitted to do so by law, and (ii) if you have given us your consent before starting our Survey. We will also give you an option to ‘prefer not to say’ in the Survey as a response to any questions that concern any special categories of personal data so that you have the option to not provide that response.

How is your data collected?

We use different methods to collect personal data from and about you including through:

• Direct interactions. We use third-party panel providers (Panel Providers) who provide us with survey respondents to complete Surveys. The Panel Providers have an existing relationship with you. We use either: (i) an industry standard third party software tool, or (ii) our own messaging tool (each a ‘tool’ and together ‘tools’) to create and host the Surveys. The Panel Provider or GWI sends you a link to our Survey hosted within the relevant tool. 
  
  You provide us with your Survey Responses when you complete one of our Surveys within the tool. We receive alphanumeric identifiers (Panel IDs) from the Panel Provider and GWI generates an additional alphanumeric identifier (GWI ID). Both enable GWI to identify your response from the other responses to the Survey.      
  
  GWI does not collect your name or address. Panel Providers do not provide us with your name or address and we will never ask the Panel Provider to provide these details to us. 
  
  
• Automated technologies or interactions. As you complete the Survey online, we may automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies. Please see our Cookie Notice for further details.

Children’s personal data

We do not knowingly solicit or collect personal data from children under the age of 13 without parental consent. If we learn that we have collected personal information from a child under age 13 without parental consent, we will either seek parental consent or promptly delete that information. If you believe that a child under age 13 may have provided us with personal information without parental consent, please contact us as specified below.

When GWI asks children to complete the Surveys, we will process the child’s data in accordance with this Survey Privacy Notice and with our GWI Kids Survey Privacy Notice. 

How is your personal data used?

Whilst our Survey questions ask for information about you, your online behavior and beliefs, we do not use this information to identify you, however we do use Identifiers and Technical Identifiers to distinguish your Survey Responses from other survey respondents. 

We use your Survey Responses to provide audience insights and consumer research services to our clients. These services can either be: 

• Syndicated Services: where we conduct Surveys and provide aggregated insights to multiple clients. Clients predominantly access these services through our platform (GWI Platform) or an application programming interface (API). We may share Anonymized Insights with clients to create new combined anonymous market research services that are sold to end clients through fusions or data integrations.  
• Data Services: this includes where our clients ask us to provide Anonymized Insights delivered through the GWI Platform, GWI API or offline report. This work may include running a new Survey for a client on a bespoke topic to supplement the GWI Syndicated Services or recontacting you through the Panel Provider or a mix of these (Data Services). We use the Panel ID to identify you and request that the Panel Provider reach out to you.  
• Anonymized RLD: we anonymize your Survey Responses by cryptographically ‘hashing’ the GWI ID and any unique identifiers associated with your Survey Responses to create a randomized, hashed ID (Anonymization Process). As a result of the Anonymization Process, it is not possible for our clients to identify you from the Anonymized RLD. 
• Activations: we provide your Panel ID as seed data to our Third Party Partners to enable them to build a lookalike model (i.e. an audience of consumers like you). The lookalike model created by our Third Party Partners removes your Panel ID. The lookalike model sold by the Panel Provider does not include your Identifiers or any of your personal data. 

Our clients use Syndicated Services, Data Services and Anonymized RLD  to understand general internet user behavior. Our Panel Providers use your Panel ID to build a lookalike model and the end product does not include your Identifiers or any of your personal data. While such Anonymized Insights may be derived from personal data, its aggregated and/or anonymized nature means that it is not possible for our clients to identify you from the Anonymized Insights or in the case of Activations the end lookalike model.

In addition to the services referred to above, we may provide the following  to our clients: 

• Pseudonymized RLD: instead of the Anonymization Process, we provide the Panel Provider a match table with the GWI ID and the Panel ID. The Panel Provider will in turn match the GWI ID to the unique identifier held by our clients for you and provide a match table to the clients (through the Panel Provider’s own contractual arrangement with the clients). Whilst our clients cannot identify you from the Pseudonymized RLD that GWI provides to them, they are able to re-identify you and match your Survey Responses to you where they already have access to your personal data as a result of their own relationship with you (e.g. because you are a customer of theirs, a consumer they have engaged with, or they otherwise hold personal data about you), and through their own direct relationship with our Panel Providers and therefore receive personal data from the Panel Providers.

Before providing any special category data (as described above) within the Pseudonymized RLD to any of our clients, we will always have obtained your consent to this and we will always give you notice (in this Survey Privacy Notice or otherwise) of who we will be providing it to before you start the Survey. 

Any processing of your personal data by Panel Providers and subsequent processing by the relevant clients will be done in accordance with their own privacy and cookie notices/policies. 

We currently share Pseudonymized RLD with the following clients (including all their affiliates and companies in each client’s group of companies): 

• Cookies - GWIQ: For our GWIQ services, we drop a cookie and similar technologies on your device to collect Technical Data to identify the websites you use and your exposure to our customer’s online adverts and websites. This means that GWI is able through its GWIQ Services to provide customers with anonymous and aggregated insights about their advertising campaigns in relation to the real world. The GWIQ Services include: i) reporting on whether a target audience (made up of you and others that are not identifiable to our customer) have seen our customer’s online advert (GWIQ Audience Validation) and ii) reporting on whether a target audience (made up of you and others that are not identifiable to our customer) have seen our customer’s website. We also use the cookie to see if you have seen an advert and then invite you back to complete an additional survey based on whether you did or didn’t see an advert or website (GWIQ Advertising Effectiveness). For example, GWI may report to customers: X% of your target audience was exposed to your online advert in magazine website one vs Y% in magazine website two or 75% of your target audience watched 80% of your video advert before closing it. For more information about cookies and how to opt out see our Cookie Notice.
  
  
• Technical Data: GWI uses this to help us to invite the correct people to take part in our Surveys and also allows us to build up a picture of how people from similar groups are likely to answer a question or what things they might do on the internet. For example, if you tell us that you are a male aged 25-34, then we might combine your Survey Response with those of hundreds or thousands of other males aged 25-34 to understand more about that particular group.

Our legal basis for processing your data

We will only use your personal data when the law allows us to. Below is a  description of all the purposes for which we use your personal data, and which of the legal bases we rely on to do so.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your personal data for an unrelated purpose, before doing so, we will ask the Panel Provider to notify you and we will explain the legal basis which allows us to process personal data for such unrelated purpose.

Please note that we may process your personal data without your knowledge or consent where required or permitted by law.

Disclosures of your personal data

We may disclose your data or it may be collected directly by third-parties such as:

• Other members of our group of companies in the European Union, US and in Singapore;
• Panel Providers who source survey respondents and send you invites to complete the Surveys;
• Survey scripting tool partners who provide scripting technology to support the delivery of the Surveys to you and store your Survey responses;
• Translation partners who provide translation services for our Surveys and your Survey responses as required;
• Suppliers of GWI who provide IT and administration services to us to help us to provide our services;
• Fraud Prevention suppliers may collect your personal data or we may share it with them in order to undertake deduplication and fraud checks. If fraud or duplication is detected, you could be refused to continue with our survey;
• Professional advisers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services; 
• Third-parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them;
• Third Party Partners who build lookalike models for Activations.

We require all third-parties to respect the security of your personal data to treat it in accordance with applicable law and process it for specified purposes.

We may also share your data to clients where we have agreed to provide access to our Pseudonymized RLD, or where we have agreed to undertake a survey on their behalf, or where we have agreed to assist them in monitoring the effectiveness of their advertising campaign, or where we have agreed to cookie sync or facilitate a similar sync using online or unique identifiers. Our Clients ultimately act as controllers of your personal data as set out above, we do not allow our third-party partners to use your personal data. 

Please note that although we will not use the personal data that we receive or collect to identify you, we can never fully know what other personal data a third-party holds about you already, and it may be that third-parties are able to link the personal data we provide to other personal data that you have previously shared directly with them. For example, third-parties such as our clients (and our clients’ own customers) are likely to have databases of their own, and it may be that you have consented to them holding personal data about you that could allow them to match their records if we have provided them with pseudonymized RLD. Similarly, if we share data with social networks, it may be that they can match our data with the other personal data that you have permitted them to hold about you. Please note that third-parties should only lawfully be able to undertake this matching if you have given them specific permission to hold and use your data in such a way.

Other things to know

Within our Surveys, we might ask you about your views or interactions with well-known websites, apps, social networks and so on. Often, we might include their logos and relevant privacy notices in our Survey so that you know which sites we are talking about. The fact that we use their name or logo is not an endorsement, authorization or representation that we are affiliated with that websites, app, social networks and so on network, nor is it an endorsement of their privacy or information security policies or practices. Nor does it necessarily mean that we will be sharing any Survey Responses with them directly, although some of them could be among our clients.

International transfers

We may share your personal data with other companies within our group and with third-party partners who are based outside the UK and/or the European Economic Area (EEA), which will involve a transfer of data outside the UK and/or the EEA.

Whenever we transfer your personal data out of the UK and/or the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the UK and/or the European Commission.
• We may use specific contracts approved by the UK and/or the European Commission which give personal data adequate protection.
• We may use the EU-US Data Privacy Framework and the UK Extension EU-UK DPF as set out by the US Department for Commerce.

Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third-parties who have a business need to access your personal data. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

How long will you use my personal data for?

We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal requirements such as showing that we are complying with data protection laws when we handle your data.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

When we anonymize your personal data we may use this information indefinitely without further notice to you because it cannot be used to identify you and therefore data protection laws do not apply to anonymized data.

Your legal rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data:

• The right of access: your right to obtain confirmation as to whether or not your personal data are being processed, and, where that is the case, access to the personal data along with details regarding the nature of processing.
• The right of rectification: your right to obtain the rectification of inaccurate personal data.
• The right of portability: your right to receive your personal data in a structured, commonly used and machine-readable format.
• The right to be forgotten: your right to erase your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. Please note that this right is not absolute and we may be entitled to refuse requests, wholly or partly, where exceptions under applicable laws apply (i.e. we may refuse a request if we need to comply with a legal obligation or necessary for the establishment, exercise or defense of legal claims, or if the request is manifestly unfounded or excessive). We will inform you of why we might be unable to carry out your request. 
• The right to restrict processing: your right for your data to be effectively ‘frozen’; stored and to no longer be processed. 
• The right to object: your right to object to how your personal data is processed where we are relying on a legitimate interest (or those of a third-party). Please note that this right is not absolute. 
• The right to complain: You have the right to complain to the UK’s data protection authority (the ICO)  if you have any concerns about our processing of your personal data. For more information, please visit their website: https://ico.org.uk 
• The right to withdraw your consent: Where we are relying on consent to process your personal data, you have the right to withdraw consent at any time. However, this will not affect the lawfulness of the processing carried out before you withdraw your consent.

Contacting Us - What we may need from you

We do not receive your name or email address. We only receive your Panel IDs. Therefore we are not able to identify you directly. In order to process your request we will need you to tell us which Panel Provider you received the Survey invite from. We will have to request additional personal data from the Panel Provider in order to identify you from your Panel IDs and process your request.

If you would like to exercise one of your rights listed above please use the table below to send the relevant information we require for this purpose in an email to: legal@gwi.com.

Where you wish to exercise one of the rights, we may need to request additional specific personal data (in addition to the details set out above) from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Where we are not able to determine with any degree of certainty whether the personal data requested by you relates exclusively to you, our disclosure of such personal data to you may pose a privacy risk to a third-party (for example, where a cookie is associated with a device used by more than one person). We will assess each request to exercise any of the rights listed above individually on its merits and will disclose the requested personal data where we are satisfied that such disclosure does not represent a privacy risk to any third-party.

Authorized Agents

Please note that we will only respond to verifiable requests. ‍In certain circumstances, you may be permitted to use an authorized agent to submit requests on your behalf. If an individual or entity claiming to be your authorized agent submits a request to access, delete, or correct your personal information, we will require the following information to verify the request: (a) a power of attorney valid under the relevant law from you or your authorized agent; or (b) sufficient evidence to show that you have: (i) provided the authorized agent signed permission to act on your behalf; and (ii) verified your own identity directly with us pursuant to the instructions set out above or otherwise directly confirmed with us that you provided the authorized agent permission to submit the request on your behalf.

California Privacy Statement

If you are a California consumer, for more information about your privacy rights, please see below our California Consumer Privacy Statement. It applies solely to California residents and addresses personal information GWI collects. It does not apply to personnel or job applicants. 

This Statement uses certain terms that have the meaning given to them in the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) and its implementing regulations (collectively, the “CCPA/CPRA”).

GWI may collect (and may have collected during the 12 month period prior to the Last Updated date of this Survey Privacy Notice) the following categories of personal data about you:

• Identifiers: identifiers such as unique personal identifier, cookies, online identifier, Internet Protocol address  and other similar identifiers;
• Protected Classifications: characteristics of protected classifications under California or federal law, such as age and gender;
• Commercial Information: such as your use of our services.

The categories of personal data we collect about you will depend on the specific products and services you use. 

GWI will only collect and disclose your personal data in accordance with this Survey Privacy Notice.  Please read it for further information on GWI’s legal purpose for processing above in the legal basis for processing.

Selling or Sharing 

GWI does not sell or share your personal data to third parties as defined by CCPA/CPRA and so it does not offer an opt out. 

California Consumer Privacy Rights

As a California resident, you have the following additional rights to those set out above regarding the personal data we collect about you: 

• Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not deny you use of our services or provide you a different level or quality of services.
• Opt-Out of Sale or Sharing: You may have the right to opt out of the sale of your personal information or the sharing of your personal information for cross-context behavioral advertising purposes. As set out above GWI does not sell or share personal data with third parties. 
• Shine the Light Request: You also may have the right to request that we provide you with (1) a list of certain categories of personal information we have disclosed to third parties for their direct marketing purposes during the immediately preceding calendar year and (2) the identity of those third parties.

Washington Consumer Health Data Privacy Statement

If you are a Washington consumer, for more information about your privacy rights, please see our Washington Consumer Health Data Privacy Statement.

Updates to our Privacy Notices

We may update this Privacy Notice from time to time without prior notice to you to reflect changes in our personal data practices with respect to our services. We will indicate at the top of the policy when it was most recently updated.

Contact Us

If you want to ask us any questions, please get in touch with us at legal@gwi.com. Or you can write to us at the following address:

Trendstream Limited
Nexus Building
Floor 2
25 Farringdon Street
London
EC4A 4AB