KPMG Logo

KPMG Nunwood Consulting Limited Research Participation Privacy Policy

23 May 2018


1. WHO ARE WE?

This Privacy Policy applies to KPMG Nunwood Consulting Limited (“KPMG Nunwood", "we" or “us”), a subsidiary of KPMG Holdings Limited, a subsidiary of KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative ("KPMG International"), a Swiss entity. KPMG International provides no client services.

KPMG Nunwood is dedicated to protecting the confidentiality and privacy of information entrusted to us.

The information we process that is governed by this Privacy Policy will be treated with the strictest confidence and in accordance with the Market Research Society (MRS) Code of Conduct.

We comply with the EU General Data Protection Regulation (GDPR) and the UK Data Protection Act. Please review this Privacy Policy to learn more about your rights, what information we may collect about you and how we use it.


2. WHO TO CONTACT FOR QUESTIONS OR CONCERNS?

If you have questions or comments about this Privacy Policy or how we handle personal data, please direct your correspondence to KPMG LLP, Data Protection and Privacy Office, 15 Canada Square, London UK E14 5GL or email dataprivacy@kpmg.co.uk. We aim to respond within 30 days from the date we receive privacy-related communications.

For any other questions on our research programmes, please contact us at info@kpmg-nunwood.co.uk.

You may contact the UK Information Commissioner’s Office at https://ico.org.uk/concerns/handling/ to report concerns you may have about our data handling practices.


3. HOW DO WE OBTAIN YOUR PERSONAL DATA?

 DIRECTLY
We may collect personal data through our surveys, but only after you have provided a clear consent for us to do so.

INDIRECTLY
We may obtain personal data indirectly from our clients when they transfer customer data for the purpose of conducting research.

As part of research programmes for our clients, we may ask our suppliers to recruit research participants for telephone interviews and focus groups on our behalf.  In these cases, our suppliers will explain the purpose of the research.  They will confirm the research participants’ agreement to take part in the research and to pass on their contact details to us for arranging the research.


4. WHAT CATEGORIES OF PERSONAL DATA DO WE COLLECT?

We may obtain the following categories of personal data about individuals through direct interactions with us, or from information provided through client engagements, from our clients, our suppliers and through other situations including those described in this Privacy Policy.

Personal data: Customer contact details such as email addresses and telephone numbers.
Sensitive personal data: We typically do not collect sensitive or special categories of personal data about individuals for research studies. In cases where the research requires us to collect special categories of personal data, we will ask for direct participant consent at the time of collection.
Children: We do not contact children under the age of 16 without consent from a parent or guardian.


5. WHAT LAWFUL REASONS DO WE HAVE FOR PROCESSING PERSONAL DATA?

We may rely on the following lawful reasons when we collect and use personal data to carry out our research programmes:

  • Contract - We may process personal data in order to perform our contractual obligations.
  • Consent - We may rely on your freely given consent at the time you provided your personal data to us or through our participant recruitment suppliers.
  • Legitimate interest - We may rely on legitimate interests based on our / our clients’ evaluation that the processing is fair, reasonable and balanced. These include:
    • Delivering services to our clients - To deliver the professional services our clients have engaged us to provide.
  • Legal obligations and public interests - We may process personal data in order to meet regulatory and public interest obligations or mandates.


6. WHY DO WE NEED PERSONAL DATA?

We aspire to be transparent when we collect and use personal data and tell you why we need it, which typically includes:

  • Sending invitations to participate in our research studies
  • Providing access to research participants attending our focus group events, webinars or client sponsored surveys
  • Responding to queries and providing technical assistance to research study participants
  • Delivering research study services
  • Carrying out customer satisfaction or other research programmes on our clients’ behalf
  • Our services may include reviewing client survey results for quality assurance purposes, which may involve processing personal data for the relevant client
  • Administering, maintaining and ensuring the security of our information systems, applications and websites.

Personal data we obtain will only be used for the purposes outlined to you when you participate in the research study. This may include data analysis at aggregate levels. Your responses remain completely confidential unless stated otherwise.

We will not use personal data that you provide through one of our surveys for any sales or marketing activity without your consent.

Telephone Calls - Calls made for the purpose of research are exempt from the UK Telephone Preference Service (TPS) which only applies to sales and marketing calls. We are also permitted to call ex-directory numbers, however, we will not release your personal data to any third party without your consent.


7. DO WE SHARE PERSONAL DATA WITH THIRD PARTIES?

We may occasionally share personal data with trusted third parties to help us deliver efficient and quality services. These recipients are contractually bound to safeguard the data we entrust to them. We may engage with several or all of the following categories of recipients:

  • KPMG member firms, where necessary for administrative purposes and to provide professional services to our clients (e.g., when providing services involving advice from KPMG member firms in different territories).
  • Parties that support us as we provide our services (e.g., providers of telecommunication systems, mailroom support, IT system support, archiving services, document production services and cloud-based software services).
  • Research services suppliers (e.g., to recruit research participants, to carry out Computer Aided Telephone Interviews).
  • Law enforcement or other government and regulatory, or to other third parties as required by, and in accordance with, applicable law or regulation.


8. DO WE TRANSFER YOUR PERSONAL DATA OUTSIDE THE EUROPEAN ECONOMIC AREA?

We store personal data on servers located in the European Economic Area (EEA). We may transfer personal data to KPMG International, KPMG member firms, and reputable third party organisations situated inside or outside the EEA when we have a business reason to engage these organisations. Each organisation is required to safeguard personal data in accordance with our contractual obligations and data protection legislation.


9. DO WE USE COOKIES?

Our websites may use cookies. Where cookies are used, a statement will be sent to your browser explaining the use of cookies. To learn more, please refer to our cookie policy.


10. WHAT ARE YOUR DATA PROTECTION RIGHTS?

Your data protection rights are highlighted here. To submit a data request please follow this link.  Where your personal data was provided to us by a client, we will pass on your request to the client for action.

  • Access - You can ask us to verify whether we are processing personal data about you, and if so, to provide more specific information.
  • Correction - You can ask us to correct our records if you believe they contain incorrect or incomplete information about you.
  • Erasure - You can ask us to erase (delete) your personal data after you withdraw your consent to processing or when we no longer need it for the purpose for which it was originally collected.
  • Processing restrictions - You can ask us to temporarily restrict our processing of your personal data if you contest the accuracy of your personal data, prefer to restrict its use (rather than having us erase it), or need us to preserve it for you to establish, exercise, or defend a legal claim. A temporary restriction may apply while verifying whether we have overriding legitimate grounds to process it. You can ask us to inform you before we lift any temporary processing restriction.
  • Data portability - In some circumstances, where you have provided personal data to us, you can ask us to transmit that personal data (in a structured, commonly used, and machine-readable format) directly to another company if this is technically feasible.
  • Automated Individual Decision-making - You can ask us to review any decisions made about you which are solely based on automated processing, including profiling, that produced legal effects concerning you or similarly significantly affected you.
  • Right to Object to Direct Marketing including Profiling - You can object to our use of your personal data for direct marketing purposes, including profiling. We may need to keep some minimal information to comply with your request to cease marketing to you.
  • Right to Withdraw Consent - You can withdraw your consent that you have previously given to one or more specified purposes to process your personal data. This will not affect the lawfulness of any processing carried out before you withdraw your consent. It may mean we are not able to provide certain products or services to you and we will advise you if this is the case.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information or to exercise any of your other rights. This helps us to ensure that personal data is not disclosed to any person who has no right to receive it. No fee is required to make a request unless your request is clearly unfounded or excessive. Depending on the circumstances, we may be unable to comply with your request based on other lawful grounds.


11. WHAT ABOUT PERSONAL DATA SECURITY AND STORAGE?
We have put appropriate technical and organisational security policies and procedures in place to protect personal data (including sensitive personal data) from loss, misuse, alteration or destruction. We aim to ensure that access to your personal data is limited only to those who need to access it. Those individuals who have access to the data are required to maintain the confidentiality of such information. We may apply pseudonymisation, de-identification and anonymisation techniques in efforts to further protect personal data.
Please be aware that the transmission of data via the Internet is not completely secure. Whilst we do our best to try to protect the security of your personal data, we cannot ensure or guarantee the security of your data transmitted to our site; any transmission is at your own risk.


12. HOW LONG DO WE RETAIN PERSONAL DATA?

We retain personal data to provide our services and to comply with applicable laws, regulations and professional obligations that we are subject to. Unless a different time frame applies as a result of business need or specific legal, regulatory or contractual requirements, where we retain personal data in accordance with these uses, we retain personal data for up to 12 months. We will dispose of personal data in a secure manner when we no longer need it.


UNSUBSCRIBE

Research participation is voluntary and participants always have the opportunity to decline involvement, or to ‘opt out’ of the research, even after agreeing to participate.

If you wish to be excluded from any future KPMG Nunwood research survey, you can either exercise your right to withdraw consent (see Section 10), or contact us at info@kpmg-nunwood.co.uk. Alternatively, you will be able to unsubscribe via dedicated links in any email survey invitation you receive from us. Please note that if you wish to unsubscribe from future surveys, we will need to maintain your contact details (email address and/or telephone number) on a secure list for future exclusion purposes.


13. DO WE CHANGE THIS PRIVACY POLICY?

We regularly review this Privacy Policy. This Privacy Policy was last updated on 23 May 2018.