GfK is a German-based company and trusted partner for market research, business consulting and prescriptive data analytics. This privacy notice provides information on how GfK generally collects and processes your personal data when you interact with us.
We provide additional privacy notices where necessary, for example if you take part in one of our panels or particular market research activities.
Personal data means any information about you which can be used to identify you as an individual. This excludes information where your personal data has been removed (anonymous data).
We regularly review our privacy notice and therefore encourage you to refer to this privacy notice on a regular basis.
GfK consists of the legal entities listed here, together forming the “GfK Group”. GfK SE is the entity responsible for this privacy notice and it is issued on behalf of the GfK Group.
GfK SE
Sophie-Germain-Strasse 3-5
90443 Nuremberg
Germany
Entered in the Commercial Register at the District Court: Nuremberg, HRB 25014
When referring to “GfK”, “we”, “us”, or “our” in this privacy notice, we are referring to the relevant entity of the GfK Group responsible for processing your personal data. We will inform you which GfK entity is the controller of your personal data, when we engage with you as a data subject.
GfK has appointed data protection officers (DPOs) as indicated in the list of GfK affiliates. If you have any questions about this privacy notice or our data protection practices, please contact dpo@gfk.com.
We collect, use, store, process, and transfer different types of personal data, depending on the collection purpose. We only collect data categories necessary, for achieving a specific purpose. Personal data we collect includes, but is not limited to:
Contact Data: first name, maiden name, surname, company name, job title / role, company email address and phone number, company billing address, delivery address, email address and telephone numbers
Employment Application Data: information we collect from you if you apply for a job at GfK such as, data concerning your professional life, information included in your CV, graduation or other relevant certificates, employers’ references
Financial Data: bank account and payment card details, details about payments to you or received from you, as well as details of products and services you have purchased from us
Internet Log-Data: internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our websites, information about how you use our website, products and services, device identifiers such as mobile advertising IDs, cookie IDs (please also refer to our cookie policy)
User Account Data: login credentials (username or similar identifier, password/password hash), preferences, any feedback you have provided us with
Marketing and Communications Data: your preferences in receiving marketing materials from us and from third parties, your preferred communication channels
Research Data: refers to all types of personal data we collect from you in the course of your participation in our research activities. Research Data includes the following categories, as detailed the privacy policies and consent forms for the respective market research activity:
Survey Data: your answers to online, paper & pencil or telephone surveys including sociodemographic information such as title, date of birth, age, gender, information regarding educational and income levels, occupation, marital status, number of children in household, etc.
Media Measurement Data: information regarding your TV and streaming media consumption, your overall usage of the internet, streaming and social media platforms and other (online) media channels, as well as your digital devices in general
Shopping Behavior Data: information regarding your household purchases
Research Data may include or reveal Sensitive Data as explained below.
Sensitive Data refers to special categories of personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, health, sexual orientation or aspects of an individual's sex life, genetic data, or biometric data.
We only process children’s personal data to the extent permitted by law, with and with prior consent of the legal guardian where necessary. If we become aware that personal data of a child has inadvertently been collected, we will delete such data without undue delay.
Participation in our market research is always voluntary. You may stop participating and/or providing personal data at any time. If you withdraw your consent to the processing of your personal data or terminate your membership in a panel, you will no longer be eligible for studies and consequently, any future incentives and compensations we may offer to members and other participants
If the processing of your personal data is necessary for the performance of a contract to which you are party to, and you fail to provide the necessary information, we may cancel our services under the contract. In this case, we will notify you in advance.
If the collection of your personal data is necessary to conclude an employment relationship with you and you fail to provide that data when requested, we may be unable to process your application.
In the following section we explain typical situations in which we collect personal data from or about you when you participate in our market research.
We collect and process Research Data from you when you participate in our market research activities such as answering surveys and registering for research panels.
We offer participation in different panels for which you may register upon invitation.
If you take part in a panel, we will collect your Contact Data. During your participation you will be asked to participate in research projects and GfK collects Survey Data and Behavioral measurement data. If the research is internet-based, we collect Internet Log-Data as well.
You may be invited to participate in our market research surveys even if you are not registered as a participant with GfK.
In any of the following scenarios, GfK is responsible as a data controller for the collection and processing of Internet Log-Data, whereas other parties may be responsible as controllers for other personal data concerning you.
If you are registered as a participant with other market research companies or panel operators, you could occasionally receive invitations to surveys conducted by GfK. In this case the other company is responsible as controller for your personal data, like name, address or email. If, in exceptional cases, there is a possibility that Research Data collected by us could personally identify you as an individual, we will inform you accordingly in advance.
We may receive your Contact Data from a client company who commissioned us to conduct a survey on their behalf with a specific group of people. For example, a client could send us a list of its end customers for this purpose. In this case, our customer is controller of both your Contact Data and the data that is collected from you during the survey. In such cases, we will disclose to you the identity of the customer who provided your Contact Data to us.
In some countries, we may use telephone numbers from public directories and/or numbers that we automatically generated based on numbers from public sources, using industry approved algorithms. Consequently, we may call your number even if you did not make it publicly available.
If you receive a phone call from GfK or one of our business partners and are asked to answer questions, for example, about certain brands and products, this does not necessarily mean that we have any of your personal data other than your telephone number in our possession.
Your answers to telephone surveys will be treated anonymously and not stored together with your telephone number. If you are randomly selected to take part in a survey and receive a call from us but refuse to participate and want us to refrain from calling you in the future, please let us know, and we will add your number to a blocking list.
We collect Media Measurement Data if you take part in our audience measurement panels.
We do so by hardware or software-based web-tracking and metering technologies such as tracking apps, browser add-ons, TV meters and proprietary internet routers, cookies and similar internet technologies like digital device fingerprinting.
We collect Shopping Behavior Data if you take part in our consumer panels.
We do this with the use of mobile apps and devices with which you scan barcodes of products that you purchased or take pictures of sales receipts, or by simply asking you to enter information regarding your purchases into online forms.
We use your Contact Data to directly communicate with you, for example, to keep you informed about our terms and policies or panel rules as well as incentives or prize draws / sweepstakes we offer to participants through email newsletters, to invite you to surveys and other panel activities and to select participants for specific surveys based on their sociodemographic profile.
In general, we process your Research Data in such a way that they do not allow recipients to identify you as an individual. Typically, we combine the Research Data of several respondents and generate anonymous aggregated data.
In some cases, we may report the Research Data on a participant’s level, using an internally assigned pseudonym (a number or code). Recipients are not able to identify you based on these pseudonyms.
If there is a possibility that a recipient of the Research Data can identify you as an individual, either directly or by combining it with other data, we will inform you in advance and obtain your consent if required.
We use Media Measurement and Shopping Behavior Data to enrich collected Research Data in order to provide better insights to our clients.
You may provide us with your Contact Data, User Account Data, and Financial Data by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:
We may collect additional information (Contact Data) about you from other sources if you are a representative of an interested party or a prospect from publicly available sources or existing client. Such sources are mainly, but not limited to, internet sources such as professional networks like linked.in and XING but also respective company websites and possibly other websites.
We will only use your personal data for the purposes for which we collected it and for and for purposes compatible with the original collection purposes.
We process your personal data if you are a potential customer of our products, an existing customer or a service provider for the establishment and performance of our business relationship with you.
If you register on our website to receive specific content, newsletters, or to attend webinars, or you contact us by email or otherwise, we will process your Contact Data and any information that you submit through our web forms or send us by email for the following purposes:
We process your Contact Data, Financial Data, Internet Log-Data, and User Account Data to deliver our services to you and to better understand how you use our solutions.
If you sign up or otherwise opt-in to receive invitations to our free webinars and events, thought-leadership articles, or product announcement emails, we will ask for your consent to use your email address for this purpose.
We may use your Contact Data, Internet Log-Data, and User Account Data to better understand what may be of interest to you and how this content is best presented to you.
We will obtain your opt-in consent before sharing your personal data with any third party for marketing purposes.
You may unsubscribe from marketing communications at any time by clicking the link to ‘unsubscribe’ at the bottom of any marketing email we have sent to you.
If you opt out of receiving such marketing communications, personal data provided to us as a result of a product/service purchase, warranty registration, product/service experience or other transactions will still be processed.
If you apply for a position at GfK we collect Contact Data and Employment Application Data from you in order to make decisions about the possible conclusion of an employment contract.
Should we require further categories of your personal data in the course of the job application process or intend to use this data for purposes other than those specified above, we will provide you all information in advance as required by law through an additional privacy notice.
If you interact with our website or software applications including cloud based or online applications, we will automatically collect Internet Log-Data about your equipment, browsing actions and patterns.
We use Internet Log-Data to enhance the users’ experience and improve the performance, user friendliness and security of the surveys and other solutions, and for quality assurance purposes.
We may also use Internet Log-Data to meet our internal and external audit requirements, information security purposes, or to protect or enforce our rights, privacy, safety, or property, or those of other persons. This includes the prevention and detection of fraud, disruptions to our services or IT systems. We may be required to use and retain personal data for legal and compliance reasons, such as the prevention, detection, or investigation of a crime, loss or IT security incident.
We collect personal data about you by using cookies, server logs and other similar technologies if you interact with our website or software applications including cloud based or online applications. We may also receive such data if you visit other websites by means of our cookies and similar technologies.
You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of our websites may become inaccessible or may not function properly.
We may obtain personal data about you from third parties and public sources. In these cases, we will inform you accordingly within a month upon receipt of your personal data or, if the data is intended for communication with you, we will inform you with our first communication to you. As part of the communication we will disclose the sources from which we obtained your data and provide you with all information required by the applicable privacy law. This includes which data specifically we obtained from which exact sources and how we intend to use it. In appropriate cases we will obtain your prior consent before we collect personal data concerning you from other sources.
In some instances, GfK’s clients are a source of personal data concerning you. For example, advertising companies or social media networks may provide us with information regarding your exposure to online advertisements or media. This is used by us to enrich this data with information that we previously collected from you as a market research participant, in order to prepare anonymous, aggregated statistics that clients then use for their business purposes.
We also process personal data collected by third parties using third party crawling and analytics tools such as Brandwatch (www.brandwatch.com) that archive social media data, which have been published in open profiles or channels on social media networks or platforms like Facebook, Twitter, Instagram , public online forums or rating portals of online-shops (e.g. eBay or Amazon). GfK may use information that you have made public on social media platforms and other websites to provide its clients with aggregated reports and links relating to public information in a systematic manner.
Please see also sec. 3.2 “Publicly available sources”.
We will only process your personal data for the purposes described above. We process your personal data as permitted by law:
We may be required to use and retain personal data for compliance with legal obligations and statutory retention provisions, such as commercial and tax laws as well as our legal obligation to maintain the security of processing pursuant to applicable privacy laws (see for instance sec. 4 on Internet Log-data.)
We may transfer your personal data to third parties on one or more of the legal bases and for the purposes as specified above. We require all recipients to ensure the security of your personal data and to treat it in accordance with applicable data protection laws.
Sometimes, it will also be necessary that we transfer your personal data to countries outside the European Union and the European Economic Area (EEA). Any transfers of personal data into countries other than those for whom an adequacy decision regarding the level of data protection was made by the European Commission, occur on the basis of contractual agreements using standard contractual clauses adopted by the European Commission or other appropriate safeguards in accordance with the applicable law.
Your personal data may be transferred to one or more GfK Group affiliated companies as needed for data processing, storage, analysis, enrichment, appending, to provide you with access to our services or customer support or otherwise fulfill the purposes for which we retained the data.
If necessary and compatible with the purposes, we share personal data with:
We transfer data, including personal data, to a reasonable extent and if necessary in the course of any company reorganization, restructuring, merger or sale, or other transfer of assets. We ensure that the receiving party agrees to respect your personal data in a manner that is consistent with applicable data protection laws and the original purpose. We will continue to ensure the confidentiality of any personal data and give affected data subjects notice before personal data is transferred to another controller.
We will only disclose your personal data to public bodies where this is required by law. GfK will, for example, respond to requests from courts of law, law enforcement agencies, regulatory agencies, and other public and government authorities, which may include authorities outside your country of residence.
Our websites as well as portals and registration pages for market research participants may contain links to websites that are not affiliated with, controlled, or managed by us. The policies and procedures we describe here do not apply to those websites. We are not responsible for the security or privacy of any data collected by these third parties. We suggest contacting those websites directly for information on their privacy policies.
GfK takes data security seriously. We apply appropriate levels of security to personal data transferred, stored or otherwise processed by GfK by means of implemented physical, electronic and administrative procedures to safeguard the data from accidental or unlawful destruction, deletion, loss, alteration, unauthorized disclosure and unauthorized access. Our information security policies and procedures are closely aligned with widely accepted international standards and are reviewed regularly and updated as necessary to meet our business needs, changes in technology and regulatory requirements. Access to your personal data is granted only to those personnel, service providers or GfK affiliates with a business need-to-know or who require it in order to perform their duties.
In the event of a data breach containing personal data, GfK will follow all applicable data breach notification provisions.
We will only retain your personal data for as long as reasonably necessary to fulfill the purposes we collected it for. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you. To determine the appropriate retention period for personal data, we consider the:
You may exercise your legal rights in relation to your personal data we are processing. GfK will respect your individual rights and will deal with your concerns adequately. Your rights include:
Right to withdraw consent: where the processing of personal data is based on your consent, you may withdraw this consent at any time by following the procedures described in the respective consent form.
Right to rectification: you may request the rectification of your personal data. We make reasonable efforts to keep personal data that are used on an ongoing basis, accurate, complete, current and relevant according to the most recent information available to us. In appropriate cases, we provide self-service internet portals where users have the possibility to review and rectify their personal data.
Right to restriction: you may request us to restrict the processing of your personal data, if:
Right to access: You can request information from us about your personal data to ensure we process it lawfully. You can also request a copy of the personal data you provided us and is undergoing processing, free of charge. However, we reserve the right to charge a reasonable fee for each additional copy you may request.
Right to transfer: At your request, we will transfer your personal data to you or a third party, where technically feasible, provided that the processing is based on your consent or necessary for the performance of a contract.
Right to erasure: You may request us to delete your personal data, where
unless the processing is necessary
Right to object: You may object – at any time – to the processing of your personal data due to your situation, provided that the processing is not based on your consent but on our legitimate interests or those of a third party. In this event we shall no longer process your personal data, unless we can demonstrate compelling legitimate grounds and an overriding interest for the processing or for the establishment, exercise or defense of legal claims. If you object to the processing, please specify whether you wish the deletion of your personal data or the restriction of its processing by us.
Right to lodge a complaint: In case of an alleged infringement of applicable privacy laws, you may lodge a complaint with the data protection supervisory authority in the country you live in or where the alleged infringement occurred.
Please note:
| Region | Data Protection Officer |
|---|---|
The Americas |
dpo.americas@gfk.com
GfK Custom Research, LLC |
Asia-Pacific & Middle East, Turkey, Africa (APAC & META) |
dpo-apacmeta@gfk.com
GfK Asia Pte Ltd |
Europe (excluding the UK and Switzerland) |
dpo@gfk.com
GfK SE |
The United Kingdom |
DataProtectionOfficerGfKUK@gfk.com
GfK UK Limited |
Switzerland |
dpo.ch@gfk.com
GfK Switzerland AG
Attn: Data Protection Officer Suurstoffi 18 Rotkreuz 6343 Switzerland |
CLIENT PORTALS
View all
