GDPR: processing of collected personal data

Personal data collected by AD’HOC RESEARCH are processed in compliance with the following general principles.

Information

In the event of direct contact between AD’HOC RESEARCH and the respondent, AD’HOC RESEARCH shall disclose to the respondent beforehand the subject of the study, the purpose of the collected data as well as the contemplated transfers of data.

People shall be informed that participation to a study is entirely voluntary, and that they have the possibility to cancel their participation at any time, including during the course of the study. They shall also be informed that there is no commercial approach and no direct marketing or sales.

Purpose

The data being collected for a specific purpose, they shall not be reused afterwards in a way that is incompatible with the purpose for which they were collected.

Confidentiality

AD’HOC RESEARCH shall ensure that the personal data used during the study are entirely protected against any unauthorised access and that they are not disclosed without the explicit consent of the person.

AD’HOC RESEARCH shall always act in an ethical manner and shall refrain from doing anything that may adversely affect a respondent or the reputation of the market research profession.

In accordance with the code of ethics of research institutes, if the study is presented as anonymous, regardless of its collection mode (face-to-face, telephone or online study), AD’HOC RESEARCH shall commit not to disclose the participants’ personal data to the study sponsor without the respondents’ prior consent.

For information, as part of our international studies, we occasionally work with local vendors, all being ESOMAR members like us, who are carefully selected by us (including according to their experience, expertise, and quality) based on the guarantees they offer in terms of data protection. In doing so, AD’HOC RESEARCH validates the GDPR policy of its suppliers beforehand. These suppliers are responsible for recruiting and collecting information from the participants, which means they may collect the participants’ personal data, including sensitive data such as health data.

AD’HOC RESEARCH may receive video and/or audio recordings, consumption booklets, activity journals filled out online, sometimes containing personal data such as name/email address/postal contact details

If applicable, AD’HOC RESEARCH shall follow the usual procedures described in the Safety section.

The information shall be shared and consent shall be obtained by the partners, as described in their GDPR procedure.

As recipient of video/audio recordings or other documents, AD’HOC RESEARCH shall commit to destroy these documents within 3 months of delivering the results to the client.

Safety

AD’HOC RESEARCH shall take reasonable safety measures in order to protect the data in its possession, in compliance with the following commitments:

1. We host personal data exclusively within the European Union.

2. We identify and localise the servers hosting the data.

3. With regards to the tools, applications or services that we use, we take into account the principles of data protection from conception and of data protection by default.

4. We guarantee the safety and confidentiality of the personal data that are entrusted to us.

5. We limit the collection and/or processing of personal data to the sole data that are suitable and relevant for the study.

6. We do not copy any personal data, except whenever the personal data are necessary to provide our services, if applicable.

7. We do not use any personal data for purposes other than those specified for the relevant project.

8. Personal data are processed exclusively by the team responsible for the project.

9. We do not disclose any personal data to third parties, whether it be private or public entities, natural persons or legal entities.

10. We use anonymisation techniques to protect the respondents’ personal data. The data are processed in such a manner that it is not possible anymore to identify the person they are related to. All personal data are separated from the responses given as part of the study.

11. We ensure an absolute separation between personal data, and any other data or information that we may store or process on our own behalf or on the behalf of any third party, including other clients.

12. We set up a system to safeguard and preserve the integrity of personal data.

13. We ensure that the people authorised to process personal data are committed to maintain confidentiality. The whole staff of AD’HOC RESEARCH is made aware via a training and communication plan (inserted in the company’s internal rules of procedures). A strict confidentiality clause is inserted in the contracts of each employee who has access to personal data.

Data storage

Personal data have an expiration date. We shall set a reasonable duration of data retention, depending on the study we are processing. In general, this duration shall not exceed 3 months following the end of the study.

Exercise of respondents’ rights

As part of our studies and in accordance with the European Regulation on Data Protection, respondents have the following rights in relation to their data: right of access, of rectification, to object, to erasure, to portability and to restriction of processing. If they wish to do so, they are invited to contact us using one of the following channels:

• sur notre formulaire internet disponible sur ce lien : lien formulaire
• via email to: dpo@adhocresearch.com
• via postal mail to: AD’HOC RESEARCH, 34 quai Charles de Gaulle – Cité internationale 69006 LYON – France