Participant Privacy Notice

1 About us 

Kay McCarthy Communication Strategies Ltd, 1 Strand Street Great, Dublin 1, Ireland D01T3C6 trading as MCCP (MCCP , we , us ) is an independent brand strategy agency. We manage and carry out research studies on behalf of organisations who wish to gain insights into public and/or consumer sentiment about their business, their products and/or the sector in which they belong (Research Client). 

2 Who does this Privacy Notice apply to? 

This Privacy Notice applies to you if you or a child for whom you have responsibility (Participant) have been referred to us by a Fieldwork Agency (defined below) because you have agreed for yourself or for the child you are responsible to take part in market research surveys and/or focus groups (including by way of telephone interviews, social media groups, online conferencing and in-person discussion groups) which we will be carrying out for and on behalf of a Research Client (Project). 

3 Research Client – controller of personal data 

The Research Client for whom we are acting on behalf and whose identity has been made known to you by the Fieldwork Agency and/or in any research participant form we provide to you and/or any form of consent we provide to you is the controller of Participants’ personal data. This means the Research Client is responsible for deciding how and why it holds and uses Participants’ personal data. 

MCCP is not a controller of the personal data we receive about Participants in relation to the Project. We only collect and process Participants’ personal data for and on behalf of the Research Client and only for the purpose of the Project. 

While Research Client is controller of Participant’s personal data, Research Client does not normally know the identity of any Participants. Generally, Research Client is only interested in the Project report we prepare for it. On this basis, Research Client instructs us to process Participants’ personal data for the purpose of their Project and to only provide Research Client with aggregated Project-related information that does not in any way personally identify any Participant. Infrequently, Research Client may be present during a focus group session at which Participants attend or may instruct us to provide it with the personal data we obtain on its behalf. However, your identity and your survey or focus group responses are not attributed to you in the Project report that we prepare for and provide to such Research Client unless this is expressly notified to you in any research participant form and/or form of consent we provide to you on behalf of that Research Client. 

This Privacy Notice sets out the information that Research Client, as controller of personal data, must provide in accordance with Irish data protection laws, including the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Data Protection Acts 1988 to 2018, as these laws may be amended and supplemented from time to time (“data protection law”). Participants have certain rights in respect of their personal data, which are described in this Privacy Notice. By agreeing to participate in a Project you acknowledge the processing and use of your personal data as outlined in this Privacy Notice. 

4 Fieldwork Agency - controller of Participant personal data 

As part of the research services we provide for Research Client we engage third party fieldwork agencies (Fieldwork Agency) who recruit and contract with individuals of various demographic characteristics who wish to take part in market research surveys and focus groups. The Fieldwork Agency with whom you (or, if you are a child, your parent or legal guardian) have a contract is a controller of your personal data under data protection law. This means the Fieldwork Agency is responsible for deciding how it collects, holds and uses your personal data, including when sharing it with Research Client for the purpose of a Project. However, any use of your personal data by the Fieldwork Agency is covered by its own privacy notice, but not by this Privacy Notice. 

5 The types of personal data received about you 

“Personal data” means any information about an individual from which that person can be identified. It does not include data where an individual’s identity has been removed (anonymous data). 

“Special categories of personal data” is personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership; genetic data; biometric data for the purpose of uniquely identifying an individual or data concerning health or sexual orientation. 

Throughout this Privacy Notice we use the term "processing" to refer to all activities involving your personal data, including collecting, handling, storing, sharing, accessing, using, transferring, erasing and disposing of it. 

Where applicable, we will receive and process on behalf of Research Client the following categories of personal data about you: 

• Identity Data such as first name, surname, gender, date of birth, and recorded audio or audio-visual footage of your participation in the Project; 
• Contact Data such as residential address, e-mail address and telephone number; and 
• Profile Data such as your age, location, occupation, interests, preferences and feedback and other information which may be collected in the course of your participation in the Project including personal data contained in content or material you choose to submit, upload or transmit via social media platforms or WhatsApp groups, including but not limited to photos, videos and images. 

If you provide your explicit consent, we may also receive and process on behalf of Research Client the following special categories of personal data (which shall be anonymised shortly after we receive it): 

If you are an adult Participant: 

• Information about your attitudes towards sexual habits, preferences and/or drugs; 
• Information about your race or ethnicity; 
• Information about your health (e.g. whether you suffer from obesity). 

If you are a child Participant, information about your health (e.g. whether you suffer from obesity). 

Where Research Client needs to collect personal data by law and you fail to provide that personal data when requested, Research Client may instruct us to exclude you from participating in the Project. We will notify you if this is the case at the time. 

We provide Research Client with a report of the conduct and outcome of the Project. In order to minimise the processing of Participants’ personal data the Project report includes aggregated data such as statistical or demographic data, but does not in any way personally identify you unless this is expressly notified to you in any research participant form and/or form of consent we provide to you on behalf of that Research Client. We will retain personal data related to your participation in the Project on behalf of Research Client for the period set out in section 14 below. 

6 How your personal data is received 

If you, as a Participant, agree to take part in a Research Client’s Project we will receive as Research Client’s processor your contact details (or if you are a child, that of the person who has responsibility for you) from the Fieldwork Agency. 

Following this, we will typically receive your personal data directly from you through our direct interactions and communications when arranging your participation in the Project and conducting the Project. For example, where such data is provided directly to us by you, whether by email, phone, letter, online or paper surveys, during the course of research groups or discussions or other meetings, which may be conducted by various means including remotely online or in-person, or some other form of communication. 

7 The legal grounds for processing your personal data 

Research Client will only process your personal data when the law allows it to. In this regard, Research Client will typically process your personal data in the following circumstances: 

• where it is necessary for Research Client’s legitimate interests and your interests and fundamental rights do not override those interests; and 
• where it is necessary for the Research Client to comply with a legal obligation which it is subject. 

As outlined in section 5 above, the processing of special categories of personal data may be necessary in certain limited circumstances. To process a special category of personal data concerning you, Research Client will rely on your explicit written consent. 

Research Client may process your personal data for more than one lawful ground depending on the specific purpose for which it is using your personal data. Please contact the Research Client, using the contact details provided in the research participant form we provide to you, about the specific legal ground it is relying on to process your personal data. 

8 Purposes for processing your personal data 

We have set out below a description of the ways in which Research Client uses your personal data, and which of the legal bases it relies on to do so. We have also identified what Research Client’s legitimate interests are, where applicable. 

•  Research Client will process your Identity Data, Contact Data and Profile Data in order to maintain its records and/or to instruct MCCP to maintain records on its behalf. This may involve profiling. This is necessary for Research Client’s legitimate interest to respond to your enquiries and to keep its records up to date. 
• Research Client will process your Identity Data, Contact Data and Profile Data for the purpose of arranging, conducting, reporting and keeping a record of market research surveys and focus groups and sessions. This may involve profiling. This is necessary for Research Client’s legitimate interests for running its business, developing new business and gaining insights into public and/or consumer sentiment about its business, products and/or the sector in which it belongs. 
• Research Client will process your Identity Data, Contact Data and Profile Data for the purpose of de-identifying these categories of personal data so that they can no longer be associated with you. This is necessary for Research Client’s legitimate interests of minimising the processing of your personal data and so that such de- identified data can be used on an aggregated basis for statistical insights and other purposes. 

As outlined in sections 5 and 7 above, the processing of special categories of personal data may be necessary depending on the subject matter of the Project. Any special categories of personal data you reveal during or in connection with a Project will be de-identified shortly after it is collected and will not be contained in any Project report that is provided to Research Client following conclusion of the Project. 

9 Change of purpose 

Research Client will only use your personal data for the purposes for which it was collected, unless it reasonably considers that it needs to use it for another reason and that reason is compatible with the original purpose. 

10 Disclosure of personal data to others 

Except as set out in this Privacy Notice, Research Client does not disclose to any third party any of Participants’ personal data. Research Client will share your personal data with third parties where required by law, where it is necessary for your participation in the Project or where it has another legitimate interest or lawful reason for doing so. Research Client may have to share your personal data with the parties set out below for the purposes set out in section 8 above: 

• to MCCP so that we can provide our services to Research Client. In turn, we may disclose Participants personal data to third parties who assist us in providing our services to Research Client, for example, third party video sharing platforms, for the purposes of storing any recorded audio-visual footage of your participation in the Project; third party video and audio conferencing services, for the purpose of enabling you to participate in a Project by remote means; and members of our group of companies, which means our subsidiaries, our ultimate holding company and its subsidiaries, who assist us in the provision and administration of our services to Research Client; and 
• professional advisors such as accountants, auditors, lawyers, insurers and other outside professional advisors. 

We are required by Research Client to respect the security of your personal data and to treat it in accordance with the law. We do not allow our service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes that are in accordance with Research Client’s instructions. 

11 International data transfers 

Your personal data will not be transferred outside of the European Economic Area. 

12 Updating your personal data 

It is important that your personal data remains accurate and current. Please keep us informed by using the Contact MCCP information below if any of your personal data changes during your involvement in the Project. It is your responsibility to keep your personal data up to date at all times. 

13 Data security 

Research Client and MCCP are committed to maintaining the security of personal data processed pursuant to this Privacy Notice. MCCP maintains appropriate physical, procedural, organisational and technical security measures intended to prevent loss, misuse, unauthorised access, disclosure, or modification of personal data in our possession. However, you recognise that no entity can keep personal data 100% secure. If you have reason to believe that any of your personal data is no longer secure, please notify us immediately by contacting us and/or the Research Client using the contact information contained in the research participant form and/or form of consent we provide to you. 

14 Data retention 

Your personal data will be retained for no longer than is allowed under data protection law and, in any case, no longer than is necessary for the purpose for which it is processed. To determine the appropriate retention period for personal data, Research Client considers the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which it processes personal data and whether it can achieve those purposes through other means, and the applicable legal requirements. 

Unless otherwise notified to you, Research Client has instructed us to retain any personal data which you provide to us in connection with the Project for no more than 6 months following the completion of your involvement in the Project. 

15 Your legal rights 

Under certain circumstances you have rights under data protection law in relation to personal data, namely: 

•  Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of your personal data that Research Client controls and to check that it is being lawfully processed. 
• Request correction of the personal data. This enables you to have any incomplete or inaccurate data that Research Client controls corrected, though it may need to verify the accuracy of the new data you provide. 
•  Request erasure of your personal data. This enables you to ask Research Client to delete or remove personal data where there is no good reason for it continuing to process it. You also have the right to ask Research Client to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where Research Client may have processed your personal data unlawfully or where it is required to erase your personal data to comply with local law. Note, however, that Research Client may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. 
•  Object to processing of your personal data where Research Client is relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. In some cases, Research Client may demonstrate that it has compelling legitimate grounds to process your information which override your rights and freedoms. 
• Request restriction of processing of your personal data. This enables you to ask for the suspension of the processing of your personal data in the following scenarios: (a) if you want to establish the data's accuracy; (b) where the use of the data is unlawful but you do not want Research Client to erase it; (c) where you need Research Client to hold the data even if it no longer requires it as you need it to establish, exercise or defend legal claims; or (d) you have objected to the use of your data but Research Client needs to verify whether it has overriding legitimate grounds to use it. 
• Request the transfer of your personal data to you or to a third party. Research Client (or MCCP, if requested by Research Client to do so) will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine- readable format. Note that this right only applies to automated information which you initially provided consent for Research Client to use. 
• Withdraw consent at any time if and to the extent Research Client is relying on consent as the legal basis to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, you may not, or no longer, be able to participate in a Project. You will be advised of this if this is the case at the time you withdraw your consent. 

In order to exercise one or more of your rights in respect of your personal data, please contact Research Client using the contact information contained in the research participant form and/or form of consent we provide to you. 

If necessary, you can also contact MCCP using the information provided in the Contact MCCP section below. 

You have the right to make a complaint at any time to the Data Protection Commission, the Irish supervisory authority for data protection issues (www.dataprotection.ie). However, Research Client may be able to deal with your issue before you approach the Data Protection Commission so please contact the Research Client in the first instance using the information contained in the research participant form and/or form of consent we provide to you. 

16 CONTACT MCCP 

If you have any questions about this Privacy Notice, other than any requests to exercise your data protection rights (which should be sent to the Research Client), please contact us by email at gdpr@mccp.ie. 

MCCP’s data protection officer’s contact details is as follows: gdpr@mccp.ie 

Last updated [●] March 2020