Policy on the personal data of participants in our studies

Latest update: 30th January 2023.

I. Introduction

This Personal Data Protection Policy is provided by Kantar TNS-MB and Kantar Insights Consulting (hereinafter “Kantar”).
Our market research projects and opinion polls are conducted by Kantar Division Insights France

Personal data protection is an essential part of Kantar’s commitment to the participants surveyed for market research projects or opinion polls.

Kantar is committed to promoting personal data management and processing practices that comply with the laws and regulations in force, specifically Act n°78-76 of 6 January 1978 on Information Technology, Data Files and Civil Liberties, amended, the European Data Protection Regulation 2016/679 applicable since 25 May 2018, and the California Consumer Protection Act (CCPA).

We carry out market research projects and opinion polls for and on behalf of our clients. In the majority of cases, our client acts as the Data Controller and Kantar acts as the Sub-Processor.

The present policy defines the basis on which we process the personal data that we collect on you, or that you provide to us on https://www.kantar.com/fr (“our website”) or in the course of our research projects.

Participation in our research projects and opinion polls is voluntary and discretionary, except in cases of compulsory statistical surveys recognised as being in the general interest. For such surveys, the respondent is obliged to respond accurately and within defined time limits. Failing to respond to a compulsory survey may result in an administrative fine or even a criminal fine.

Please read this Personal Data Protection Policy attentively in order to understand our position and our practices with regard to your personal data and how it will be processed.
For the purposes of the present Personal Data Protection Policy, “personal data” refers to any information relating to an identifiable individual and/or to a household if you are located in California.

II. Legitimate collection and use of data

The present policy defines how Kantar collects, stores and processes your personal data collected when you register for a panel, when you participate in a survey conducted online, face to face, by phone, by mail, via our mobile apps or on social networks or using different parts of our website, or when it is transmitted by our clients or by third parties such as media groups.

We use your personal data for the following main purposes:

To contact you for research by e-mail, by phone (landline or mobile), by post, by notifications or messages on a mobile phone or any other means of communication
To inform you of updates to our services, of new features and of details likely to interest you, via various means of communication
To select you for future research projects
To assist you when you contact our support team
To enable us to allocate agreed compensation to you
To protect Kantar from fraudulent behaviours
To prevent multiple participation in research projects by the same person (in accordance with our General Terms and Conditions)
To update, enrich and clean our database in order to improve our use of data, to enable us to select you for research projects and send communications

Below you will find more detailed information on how we use your personal data. We are also required by law to explain the lawful basis for processing your personal data.

These lawful bases are set out below, and may be different for each case where your personal data is used:

You have given your consent for us to use your personal data
We need to use your personal data in order to perform a contract entered into with you
We need to process your data in order to comply with our legal obligations
We need to process your data in order to protect your vital interests or those of someone else
The processing is required for carrying out a task in the public interest
The use of your personal data is necessary for our legitimate interests (or those of our clients; in this case we will explain the nature of these interests to you).

We will never make false statements about ourselves or what we do. If you receive an e-mail that concerns you, claiming to be from us, please inform us as indicated below under the heading “How to contact us”.

Case	Purpose	Data collected / processed	Lawful basis	Source
Market research projects	To find out your opinion of certain products and services, or to understand your behaviour in different situations To validate your responses to a questionnaire that you have recently answered To manage your participation in a raffle, competition, etc. To contact participants during the course of a survey being conducted, or to follow up	Identifier, contact details, email address, voice, image, opinion	Voluntary participation in a survey in the course of which we ask your consent to use your personal data	In this case, we use the personal data that we have collected from you directly or that has been collected by a third party: our clients, public bodies or third party data resellers (directory, Sirène company database, etc.)
Scientific studies for academic institutions, public health bodies or research institutes	Including but not limited to: clinical studies, Health Economics Outcomes Results (HEOR), Non-Interventional Studies (NIS), Real World Research (RWR), observational studies, epidemiological research	Identifier, contact details, email address, health data, e.g. illness, state of health, diagnosis, treatment model, unmet needs	Voluntary participation in a survey in the course of which we ask your consent to use your personal data	In this case, we use the personal data that we have collected from you directly or that has been collected by a third party: our clients, public bodies or third-party data resellers (directory, Sirène company database, etc.)
Safety monitoring (pharmacovigilance : to report any undesirable effects)	To report any undesirable effects during our research projects to the competent authorities	Identifier, contact details, email address, illness, treatment, product taken and undesirable effects	Voluntary participation in a survey in the course of which we ask your consent to use your personal data	In this case, we use the personal data that we have collected from you directly or that has been collected by a third party: our clients, public bodies or third party data resellers (directory, Sirène company database, etc.)
Public disclosure	We provide information to the competent authorities pursuant to subpoenas, warrants or legal injunctions, or pursuant to similar legal or regulatory requirements	Identifier, contact details, email address, compensation received	Legal obligation	In this case, we use the personal data that we have collected from you directly or that has been collected by a third party: our clients, public bodies or third party data resellers (directory, Sirène company database, etc.)
Protection against fraud	Protection of our business interests against fraudulent behaviours or behaviours that do not comply with our General Terms and Conditions	IP address, browser characteristics, device characteristics, postal addresses, email addresses, official identification number (ME number)	Legitimate interest We have a legitimate interest in protecting our business interests against fraudulent behaviours or behaviours that do not comply with our General Terms and Conditions	In this case, we use the personal data that we have collected from you directly or that has been collected by a third party: our clients, public bodies or third party data resellers (directory, Sirène company database, etc.)
One-time participation in the survey	To prevent multiple participation in research projects by the same person, in accordance with our General Terms and Conditions	IP address, browser characteristics, device characteristics	Legitimate interest We have a legitimate interest in preventing multiple participation in a survey by the same person	In this case, we use the personal data that we have collected from you directly or that has been collected by a third party: our clients, public bodies or third party data resellers (directory, Sirène company database, etc.)
Tracking the responses of persons surveyed on a regular basis (special research technique projects)	When you participate in our surveys, we generally use a temporary identifier that anonymises your responses to the survey for our clients. However, some of our clients use a special research technique to learn how your opinions change over a given period of time. For projects of this specific type, which we call “tracking studies”, we will use permanent identifiers and this will be clearly communicated at the start of each such survey. Your responses to these surveys will be considered as personal data, and you will be authorised to access this data. Projects of this type will include a notification on the very first page of the survey, enabling you to identify these projects and decide whether or not you want to participate.	Unique permanent identifier associated with a specific project	Legitimate interest We have a legitimate interest in using a permanent dentifier for tracking studies in order to facilitate tracking the responses of persons surveyed on a regular basis	In this case, we use the personal data that we have collected from you directly or that has been collected by a third party: our clients, public bodies or third party data resellers (directory, Sirène company database, etc.)
Data matching and data enriching	We enrich the data we hold on you, by matching your personal data with that of third parties. This will help us to improve your panel profile and ensure that we select relevant surveys for you. We use data matching service providers (third parties specialised in data management) to acquire additional information on you from public and private data sources (such as social networks, resellers and content subscription service providers for which you have created an account) or to use your personal data for the purpose of facilitating the development of new or additional anonymous datasets (we compile your aggregate data with the data of other consumers to create a new segment corresponding to a lifestyle). The data matching service provider (our partner) holds the personal data that we share with it for a short period, matches the data with other information, and sends the combined information back to us. The partners are contractually required to delete the data that we share with them and are not authorised to use this data for anything other than this specific purpose.	Unique permanent identifier, contact details, email address, social login, cookie, mobile device identifier, official identification number (ME number)	Voluntary participation in a survey in the course of which we ask your consent to use your personal data	In this case, we use the personal data that we have collected from you directly or that has been collected by a third party: our clients, public bodies or third party data resellers (directory, Sirène company database, etc.)
Ad targeting and media buy research	We use your personal data to help our clients and our suppliers to enrich their data using lookalike modelling techniques. Your participation in our surveys and your profile data enable us to help our clients to better target their advertising and create better online advertising models, through lookalike modelling or similar research methodologies. We will match the personal data that we collect on you through profile creation and participation in surveys with data of third parties and other platforms (our partners) or through data matching. We include contractual guarantees to make sure that you are not automatically targeted for selling purposes after your data has been used to create a lookalike audience, and that our partners cannot use your data for any other purpose.	Unique permanent identifier, contact details, email address, social login, cookie, mobile device identifier, official identification number (ME number)	Voluntary participation in a survey in the course of which we ask your consent to use your personal data	In this case, we use the personal data that we have collected from you directly or that has been collected by a third party: our clients, public bodies or third party data resellers (directory, Sirène company database, etc.)
Advertising exposure and measurement	In addition to cookie-based matching (which you can control and accept from your panel account), we will use the personal data that you provide, such as your email address, in the context of a direct data matching process with third parties (our clients and partners) to determine whether you are a user of their services (such as social networks, websites or mobile applications) for purposes of advertising measurement research. We will identify the ads to which you may have been exposed on these websites and platforms, and we will measure the impact on sales of brand reviews and brand associations. The third parties with whom we work are not authorised to use your data for any other purpose.	Unique permanent identifier, contact details, email address, social login, cookie, mobile device identifier, official identification number (ME number)	Voluntary participation in a survey in the course of which we ask your consent to use your personal data	In this case, we use the personal data that we have collected from you directly or that has been collected by a third party: our clients, public bodies or third party data resellers (directory, SIREN company database, etc.)
Handling requests not to be contacted for telephone surveys	When you request Kantar not to contact you by phone anymore, we must keep your information to ensure that your request is respected	Name and phone number	Legitimate interest We have a legitimate interest in keeping your information in order to respect participants’ requests not to be contacted	In this case, we use the personal data that we have collected from you directly or that has been collected by a third party: our clients, public bodies or third-party data resellers (directory, SIREN company database, etc.)

We collect and process personal data for the purposes described above; we do not sell your personal data to third parties.

We may need to communicate your personal data to our sub-processers presenting sufficient security guarantees.

When you participate in our research project, we may ask you for a range of information, including, for example, your personal opinions and demographic information such as your age and the composition of your household, your health condition, etc. You may decide not to answer these questions or to withdraw from the research project at any time.

All our third-party partners are contractually bound to maintain the confidentiality of all information that they collect and disclose to us, or that we collect and disclose to them, and they must protect this information by means of security standards and practices equivalent to our own.

Regarding our survey procedures

In introducing our surveys to you, we state and explain the purpose of the research. The purpose of a research project is never to sell anything to the people surveyed. We are not in the business of advertising, promotion, direct marketing or direct selling. We will not later process your data for purposes incompatible with the initial research objective without your prior consent.

We conduct our surveys either with panellists (people who have agreed to respond to surveys on a regular basis), or with our clients’ contacts, or, for mail or phone surveys, by randomly selecting people from a directory database rented from a specialist service provider for the purposes of the specific survey, or by randomly generating telephone numbers (based on pre-existing roots) or postal addresses (based on a random route pattern from the interviewer in order to ensure that the survey is completely representative.

For telephone surveys, the randomly drawn numbers are dialled automatically by an automatic calling machine, and when calls are answered they go to the interviewers’ stations. The automatic calling machine may call the same number several times if no one picks up. Our telephone interviewers (or face to face interviewers) are recruited in accordance with high standards of quality and are thoroughly trained and supervised. A telephone survey call (which can take place between 9:00 and 21:00, Monday through Friday, and between 9:30 and 17:00 on Saturdays) may be monitored by a supervisor for training purposes.

If you wish to contact us to verify the origin of a call, please send a message to: direction.qualite@kantar.com.

In building our samples of participants for our studies, we usually apply the quota method: the sample is based on the same socio-demographic characteristics – often gender, age, socio-professional category, size of conurbation and region – as those of the population being studied (e.g. the profile of the French population established by INSEE).

III. Third parties and cross-border data transfer

You can be assured that we will protect your privacy. We may share your data with companies of our group (Kantar) or with third party service providers to address data processing requirements such as data matching, online advertising effectiveness measurement, data interaction on social media, scientific publication or pharmacovigilance / safety monitoring. When these transfers are across borders or outside the EEE, we put in place security measures to guarantee that the transfer is carried out by means of a legitimate method in compliance with EU data protection legislation.

Your personal information may be collected, stored, transferred or processed by our subsidiaries within the Kantar group, or by third party service providers, for research purposes such as data processing and implementation of incentive measures both inside and outside the EEE. All of these entities are contractually bound to maintain the confidentiality of all information that they collect and disclose to us or that we collect and disclose to them, and they must protect this information by means of security standards and practices equivalent to our own.

IV. Confidentiality, security and industry requirements

We take appropriate technical and organisational measures to protect the personal information submitted to us, both during transmission and once we have received it. Our security procedures comply with the business standards generally accepted and used to protect personal information. All information that you entrust to us shall be kept in our environment and on our secure servers. However, no data transfer can be 100% secure. Although we make every effort to protect your personal data, we cannot assure or guarantee the security of the information that you transmit to us when using one of our products or services; you therefore do this at your own risk. Once your information has been received, we take all necessary measures to assure and maintain the security standard of our servers.

All our employees are contractually bound to comply with our policies and procedures regarding confidentiality, security and respect of privacy.

We adhere to the following industry standards and requirements:

ESOMAR (European Society for Opinion and Marketing Research
SYNTEC (Chambre SYNdicale des SociéTés d'Études et de Conseils)

Kantar is a member of Syntec Etudes (French Market and Opinion Research Professional Association) and is committed to respecting the CCI / ESOMAR International Code for Market and Opinion Research (www.esomar.org) and the ESOMAR personal data protection checklist.

Your responses to a given survey are systematically combined with the responses of all the other participants in this same survey. These responses are thus transmitted in aggregate form to the client who commissioned the research.

Kantar does not disclose your personal data to unauthorised third parties or to its clients without your express prior authorisation.

The only exceptions allowing us to transmit your personal data or your survey responses to third parties are the following:

You request or agree to share your identification information and/or your individual responses with a third party for a specific purpose (lifting of anonymity);
Your individual responses may be transmitted to our clients for certain surveys; in such an instance they will be pseudonymised by default;
When we provide your responses to a sub-processor who is contractually bound to guarantee the confidentiality of your information and to use it only for research or statistical purposes.

For certain surveys, we may need to communicate your data to other companies of the Kantar group, or to partners and service providers authorised in the context of the research, such as emailing partners, pre-recruitment partners, directory database service providers, panel managers, etc. These actors may be in charge, for example, of managing gifts or processing questionnaires, and act under Kantar’s instructions.

Internally, our employees are contractually bound to comply with our policies and procedures regarding confidentiality, security and respect of privacye.

V. Disclosure of cookies

Cookies are small text files stored on your computer or your mobile device by a website that assigns a numerical user code and stores certain information about your online browsing. They are used by Web developers to help users navigate their websites efficiently and to perform certain functions. The website sends information to the browser which then creates a text file. Each time the user returns to the same website, the browser retrieves this file and sends it to the website server.

In the case of an online survey, we use cookies or tracers needed for IT equipment to function (e.g. computer, tablet, mobile phone). These so-called “technical” cookies enable the correct transmission of information to ensure that a respondent does not participate twice in the same survey, or to send a reminder message to this or that contact if the questionnaire has not been fully completed.

When we want to use other types of cookies, for example when we want to study exposure to certain advertisements, we request the contact’s explicit prior consent to leave cookies.

When cookies are necessary for using a platform belonging to one of our partners, this is stated in the confidentiality policy directly accessible from the relevant platform.

For behaviour tracking research, we use optional cookies / software applications, but only if you have given your explicit consent to use such cookies / applications.

As is the case for most online studies, we automatically collect certain information and store it in the research data files. This information may include things such as IP addresses, browser type, internet access provider (IAP), reference / exit pages, operating system and timestamp.

We use this automatically collected information to analyse trends such as browser use and to administer the site, for example to optimise the research experience depending on the type of browser. We may also use your IP address to ensure that there is not multiple participation in the research from the same IP address.

VI. Accuracy

We take all reasonable measures to keep the personal information in our possession or under our control, which is used on an ongoing basis, accurate, complete, up to date and relevant, based on the most recent information made available to us by yourself and / or by our client.

We rely on you to help us keep your personal information accurate, complete and up to date by answering our questions truthfully. You must ensure that the organisation responsible for processing the data (either us, or more often our client) is informed of any change in your personal data.

VII. Collecting data on children

Kantar recognises the need to put in place additional privacy protection measures when children’s data is collected. We never knowingly ask children under the legal age defined by the authorities of the country where you reside to participate in research projects without their parents’ agreement. If it is necessary and appropriate for a specific project to directly involve children under the legal age, we take measures to ensure that we have received the authorisation of a parent or legal guardian. We do not sell personal data belonging to a child.

Kantar will provide parents and guardians with information on the subject of the survey and inform them of any personal or sensitive information that might be collected from the children, how this data will be used and whether Kantar is likely to share this information and with whom.

While the child is participating in the survey, it is the responsibility of the parent or other responsible person to supervise him or her.

In certain circumstances, we may require additional consent for public health, regulatory or business reasons. When such consent is requested from you, we will provide you with explanations regarding this consent and why we require it.

VIII. Sensitive data

Kantar may collect personal data classed as belonging to “special categories” of personal data. This data includes data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. You have the choice to this data to us or not.

IX. Rights of individuals

Each time a request to exercise rights is received, this request is verified and processed by Kantar. We will respond to you within 4 weeks maximum.
If you contact us using an email address or contact information not known by us, you must provide a copy of a valid identification document issued by the competent authority.

You have the following rights with regard to your personal data :

The right to change your mind or withdraw your consent
The right to access your personal data
The right to rectify your personal data
The right to erase your personal data from our systems, unless we have legitimate reasons for continuing to process this information
The right to receive and transmit your personal data (right of portability)
The right to restrict the processing of your personal data
The right to oppose the processing of your personal data
The right to not be discriminated against for having exercised one of your rights guaranteed under the applicable data protection legislation

To request access to the personal data that we hold on you, you must submit your request in writing to the email address or postal address indicated below under “How to contact us”.

If you are a California resident, to exercise your rights under the California Consumer Privacy Act, please refer to the provisions of Article XII below.

We also inform third parties to whom we have transferred your personal data of any modification that we make in accordance with your request. Please note that although Kantar communicates with these third parties, Kantar is not responsible for the measures taken by these third parties to respond to your request. You may access your personal data held by these third parties and correct, modify or delete any data that is inaccurate.

X. Storing and keeping data

Personal information is kept only for the period appropriate for the defined and lawful use of this data. Apart from any exceptions of which you will be given details in the context of the relevant project (contractual obligation towards our clients) and unless the law provides otherwise, we will keep your data for a maximum period of twelve months after the completion of the study or project concerned. Personal information that is no longer necessary will be eliminated so as not to compromise its confidential nature. For certain methodologies such as our “panels” (databases of participants regularly called upon to respond to different surveys), you give your consent for us to keep your data for a longer period. The length of this period is specified in the panel participation terms and conditions. Within the framework of the company’s business continuity plan, and in certain cases as provided by law, our electronic systems are backed up and archived. These archives are kept for a defined period of time, in a strictly controlled environment. Upon expiration of this period, the data is erased and the physical storage medium is destroyed to ensure that the data is completely erased.

XI. Notification of significant modifications

We reserve the right to make amendments, additions or deletions to the present Personal Data Protection Policy at any time. Please read this page regularly to ensure that you are aware of any changes. We always provide the most recent policy on this webpage.

XII. How to contact us

Our Global Data Protection Officer is Ravinder Roopra. He has been designated by the Kantar Group, to which Kantar belongs, and is based in London. His missions consist in overseeing compliance and security regarding personal data processing and acting as a preferred interlocutor, both within Kantar and vis-à-vis the Commission Nationale de l’Informatique et des Libertés (CNIL). In France he is supported by a personal data protection officer.

Questions concerning the present Personal Data Protection Policy, as well as requests for access, should be addressed to: privacyfrance@kantar.com or to :
Kantar TNS-MB – Kantar Insights-Consulting
Service Privacy
3 avenue Pierre Masse 75014 Paris

If you are a resident of the state of California, the Kantar group has set up a dedicated toll free number that can be used to submit requests to exercise the rights guaranteed under the California Consumer Privacy Act. Please call the following number: +1 866- 471-1399.

XIII. Complaints and country-specific statements

If you feel that our processing of your personal data infringes on data protection laws, you have the right to file a complaint with a supervisory authority responsible for data protection. You may do this in the EU member State or from the competent court of your habitual residence, place of work or place of the alleged infraction. To find the contact information of the supervisory authority for your country, please consult our dedicated web page.

L'autorité de contrôle en France est la Commission Nationale de l'Informatique et des Libertés.

In France, the supervisory authority is the Commission Nationale de l’Informatique et des Libertés. You can find all necessary information for contacting the CNIL on: https://www.cnil.fr.

Useful links

Commission Nationale Informatique et Libertés (CNIL) : https://www.cnil.fr
Syntec Etudes : http://www.syntec-etudes.com
Worldwide Organisation for Market Research (ESOMAR) : https://www.esomar.org