Privacy notice

GfK is a German-based company and trusted partner for market research, business consulting and prescriptive data analytics. This privacy notice provides information on how GfK generally collects and processes your personal data when you interact with us.

We provide additional privacy notices where necessary, for example if you take part in one of our panels or particular market research activities.

Personal data means any information about you which can be used to identify you as an individual. This excludes information where your personal data has been removed (anonymous data).

We regularly review our privacy notice and therefore encourage you to refer to this privacy notice on a regular basis.

GfK consists of the legal entities listed here, together forming the “GfK Group”. GfK SE is the entity responsible for this privacy notice and it is issued on behalf of the GfK Group.

GfK SE
Sophie-Germain-Strasse 3-5
90443 Nuremberg
Germany

Entered in the Commercial Register at the District Court: Nuremberg, HRB 25014

When referring to “GfK”, “we”, “us”, or “our” in this privacy notice, we are referring to the relevant entity of the GfK Group responsible for processing your personal data. We will inform you which GfK entity is the controller of your personal data, when we engage with you as a data subject.

GfK has appointed data protection officers (DPOs) as indicated in the list of GfK affiliates. If you have any questions about this privacy notice or our data protection practices, please contact dpo@gfk.com.

In the following section we explain typical situations in which we collect personal data from or about you when you participate in our market research.

We collect and process Research Data from you when you participate in our market research activities such as answering surveys and registering for research panels.

If you interact with our website or software applications including cloud based or online applications, we will automatically collect Internet Log-Data about your equipment, browsing actions and patterns.

We use Internet Log-Data to enhance the users’ experience and improve the performance, user friendliness and security of the surveys and other solutions, and for quality assurance purposes.

We may also use Internet Log-Data to meet our internal and external audit requirements, information security purposes, or to protect or enforce our rights, privacy, safety, or property, or those of other persons. This includes the prevention and detection of fraud, disruptions to our services or IT systems. We may be required to use and retain personal data for legal and compliance reasons, such as the prevention, detection, or investigation of a crime, loss or IT security incident.

We collect personal data about you by using cookies, server logs and other similar technologies if you interact with our website or software applications including cloud based or online applications. We may also receive such data if you visit other websites by means of our cookies and similar technologies.

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of our websites may become inaccessible or may not function properly.

For more details please go to the GfK cookie notice.

We may obtain personal data about you from third parties and public sources. In these cases, we will inform you accordingly within a month upon receipt of your personal data or, if the data is intended for communication with you, we will inform you with our first communication to you. As part of the communication we will disclose the sources from which we obtained your data and provide you with all information required by the applicable privacy law. This includes which data specifically we obtained from which exact sources and how we intend to use it. In appropriate cases we will obtain your prior consent before we collect personal data concerning you from other sources.

In some instances, GfK’s clients are a source of personal data concerning you. For example, advertising companies or social media networks may provide us with information regarding your exposure to online advertisements or media. This is used by us to enrich this data with information that we previously collected from you as a market research participant, in order to prepare anonymous, aggregated statistics that clients then use for their business purposes.

We also process personal data collected by third parties using third party crawling and analytics tools such as Brandwatch (www.brandwatch.com) that archive social media data, which have been published in open profiles or channels on social media networks or platforms like Facebook, Twitter, Instagram , public online forums or rating portals of online-shops (e.g. eBay or Amazon). GfK may use information that you have made public on social media platforms and other websites to provide its clients with aggregated reports and links relating to public information in a systematic manner.

Please see also sec. 3.2 “Publicly available sources”.

We will only process your personal data for the purposes described above. We process your personal data as permitted by law:

• with your consent for a specific purpose: For example, we typically obtain your consent when conducting our market research activities;
• for preparation or performance of a contract with you, for example, if you are party to a contract as a client or an employee of GfK;
• to comply with legal obligations, for example, if we are required to respond to requests by public authorities or in order to comply with tax law;
• if necessary, to protect your vital interests, i.e., in life-threatening situations;
• if necessary, for the public interest, for example when we conducti scientific research in cooperation with or on behalf of universities;
• if necessary, for purposes of our legitimate interest (or those of a third party) and your interests and fundamental rights and freedoms do not override those interests. For example, we base our processing on our legitimate interests when engaging our clients and protecting our systems.

We may be required to use and retain personal data for compliance with legal obligations and statutory retention provisions, such as commercial and tax laws as well as our legal obligation to maintain the security of processing pursuant to applicable privacy laws (see for instance sec. 4 on Internet Log-data.)

We may transfer your personal data to third parties on one or more of the legal bases and for the purposes as specified above. We require all recipients to ensure the security of your personal data and to treat it in accordance with applicable data protection laws.

Sometimes, it will also be necessary that we transfer your personal data to countries outside the European Union and the European Economic Area (EEA). Any transfers of personal data into countries other than those for whom an adequacy decision regarding the level of data protection was made by the European Commission, occur on the basis of contractual agreements using standard contractual clauses adopted by the European Commission or other appropriate safeguards in accordance with the applicable law.

Our websites as well as portals and registration pages for market research participants may contain links to websites that are not affiliated with, controlled, or managed by us. The policies and procedures we describe here do not apply to those websites. We are not responsible for the security or privacy of any data collected by these third parties. We suggest contacting those websites directly for information on their privacy policies.

GfK takes data security seriously. We apply appropriate levels of security to personal data transferred, stored or otherwise processed by GfK by means of implemented physical, electronic and administrative procedures to safeguard the data from accidental or unlawful destruction, deletion, loss, alteration, unauthorized disclosure and unauthorized access. Our information security policies and procedures are closely aligned with widely accepted international standards and are reviewed regularly and updated as necessary to meet our business needs, changes in technology and regulatory requirements. Access to your personal data is granted only to those personnel, service providers or GfK affiliates with a business need-to-know or who require it in order to perform their duties.

In the event of a data breach containing personal data, GfK will follow all applicable data breach notification provisions.

We will only retain your personal data for as long as reasonably necessary to fulfill the purposes we collected it for. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you. To determine the appropriate retention period for personal data, we consider the:

• amount, nature and sensitivity of the personal data,
• potential risk of harm from unauthorized use or disclosure of the personal data,
• purposes for which we process your personal data and whether we can achieve those purposes through other means, and
• applicable legal, regulatory, tax, accounting, reporting or other such requirements.

You may exercise your legal rights in relation to your personal data we are processing. GfK will respect your individual rights and will deal with your concerns adequately. Your rights include:

Right to withdraw consent: where the processing of personal data is based on your consent, you may withdraw this consent at any time by following the procedures described in the respective consent form.

Right to rectification: you may request the rectification of your personal data. We make reasonable efforts to keep personal data that are used on an ongoing basis, accurate, complete, current and relevant according to the most recent information available to us. In appropriate cases, we provide self-service internet portals where users have the possibility to review and rectify their personal data.

Right to restriction: you may request us to restrict the processing of your personal data, if:

• you contest the accuracy of your personal data for the period we need to verify the accuracy,
• the processing is unlawful, and you request the restriction of processing rather than erasure of your personal data,
• we no longer need your personal data, but you require these to assert, exercise or defend a legal claim, or
• you object to the processing while we verify whether our legitimate grounds take precedence over yours.

Right to access: You can request information from us about your personal data to ensure we process it lawfully. You can also request a copy of the personal data you provided us and is undergoing processing, free of charge. However, we reserve the right to charge a reasonable fee for each additional copy you may request.

Right to transfer: At your request, we will transfer your personal data to you or a third party, where technically feasible, provided that the processing is based on your consent or necessary for the performance of a contract.

Right to erasure: You may request us to delete your personal data, where

• the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed for;
• you have a right to object further processing of your personal data (see below) and execute this right to object to the processing;
• the processing is based on your consent, you withdraw your consent and there is no other legal ground for the processing;
• the personal data has been unlawfully processed;

unless the processing is necessary

• for compliance with a legal obligation which requires processing from us;
• for statutory data retention requirements;
• for the establishment, exercise or defense of legal claims.

Right to object: You may object – at any time – to the processing of your personal data due to your situation, provided that the processing is not based on your consent but on our legitimate interests or those of a third party. In this event we shall no longer process your personal data, unless we can demonstrate compelling legitimate grounds and an overriding interest for the processing or for the establishment, exercise or defense of legal claims. If you object to the processing, please specify whether you wish the deletion of your personal data or the restriction of its processing by us.

Right to lodge a complaint: In case of an alleged infringement of applicable privacy laws, you may lodge a complaint with the data protection supervisory authority in the country you live in or where the alleged infringement occurred.

Please note:

• Time period: We will try to fulfill your request within 30 days. However, the period may be extended due to specific reasons relating to the specific legal right or the complexity of your request, in which case we will inform you accordingly.
• Restriction of access: In certain situations, we may not be able to give you access to all or some of your personal data due to statutory provisions. If we deny your request for access, we will advise you of the reason for the refusal.
• What we may need from you: We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights) can be granted. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
• Exercise your legal rights: In order to exercise your legal rights, please contact us in writing or text form, e.g. by email or letter. You may also address our Regional Data Protection Officers directly.