Research project: Privacy policy and prize terms and conditions

Eden Stanley (the Company) respects your privacy and is committed to treating any information that we obtain about you with as much care as possible and in a manner that is compliant with all applicable data protection legislation including the UK General Data Protection Regulation 2020 (“UK-GDPR“) and the Data Protection Act 2018 (collectively, “Data Protection Legislation“).

Please read this Privacy Notice carefully. Among other things, it explains:

• what personal data we may collect about you in connection with your participation in the Research Project (including your Responses);
• how we collect, store, disclose, transfer, protect and otherwise process that personal data (and for what purposes); and
• other important information, such as the lawful basis or bases by which we process your personal data, how long we retain your personal data, and the rights you have in relation to the personal data we hold about you.

We collect personal data about you when you:

• access and use our platform and submit Responses;
• register for an account with us or register your interest in participating in a Research Project;
• contact us (whether in writing, by email, by telephone or otherwise);
• claim any Reward;
• request technical support or other customer care support; or
• otherwise interact with us in connection with the Research Project.

Where lawful, we may also obtain personal data from third parties or public sources (for example, the open electoral register or credit reference agencies) and we may process that information where it is an essential component of our products and services.

The type of personal data we process may include (if and as applicable):

• the basic contact information you provide when becoming a participant (which may include your name, username, email address, postal address and telephone number);
• information that you choose to include in your Survey Responses (where your Response takes the form of audio-visual content, this may include your image, likeness, and recordings of your person and voice);
• information which you provide in any correspondence with us; and

We do not require you to provide, and you agree not to include in your Responses:

• any personal information about criminal convictions and offences; or
• any personal information about children under the age of 18.

You acknowledge and agree that any special categories of personal data (including details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data) is provided by you voluntarily and with your consent.

We use the personal data referred to in paragraph 2 above for the purposes of (if and as applicable):

• coordinating and undertaking the Research Project, including obtaining, collating, analysing and reporting the results of the Research Project (which may include some or all of your Responses);
• providing you with access to our products and services (including the ability to use the platform and earn any Rewards);
• processing any Reward payments;
• internal training and other internal uses to improve our services and customer experience;
• responding to any correspondence from you including enquiries, comments, complaints and request for technical assistance;
• market research and demographic studies; and
• otherwise carrying out our business activities in circumstances where you ought reasonably to have an expectation that we will process your personal data for a particular purpose (including as may be provided for in any Participation T&Cs).

We may process your personal data for the purposes set out in paragraph 3 ourselves or in conjunction with our third party service providers (in accordance with paragraph 6).

We will rely on your consent as a lawful basis for processing your personal data. This includes where you choose to provide us with any sensitive data as described in paragraph 2.5 above. You are not required to provide any such special category personal data, but if you do:

• you will be giving the Company your express, freely given consent to process it in accordance with the terms of this Privacy Notice; and
• you may withdraw that consent at any time by contacting us (but the withdrawal of your consent shall not affect the lawfulness of processing based on consent before withdrawal or the lawfulness of processing based on other lawful grounds).

We may process your personal data as may be necessary or desirable in order to perform our obligations and exercise our rights under this agreement.

We may also need to process certain personal data to comply with any applicable laws or regulations.

Occasionally, processing your personal data may be permitted on the grounds of pursuing the legitimate interests pursued by us or third parties, particularly in relation to furtherance of the Research Project and related projects. These legitimate interests include the purposes identified above in paragraph 3.

You do not have to provide us with any personal data. However, where we need to collect personal data by law, or under the terms of an agreement we have with you, and you fail to provide that data when requested, we may not be able to perform the contract or arrangement we have or are trying to enter into with you (for example, to provide you with the opportunity to participate in the Research Project and earn Rewards). This is because the collection of certain personal data is integral to our business and the Research Project.

Our Clients

• We are carrying out the Research Project on behalf of or in collaboration with one of our clients, a registered charity, and that client will have access to the results of the Research Project, including your Responses.
• Due to the nature of the Research Project, you acknowledge and agree that we may not tell you the identity of that client until all of your Responses have been obtained. This is because one of the aims of the Research Project is to measure and ascertain participants’ attitudes towards certain brands, and knowledge of who the underlying client is may cause bias or otherwise skew those results.
• We will tell you who the client is at the conclusion of your participation in the Research Project, if not sooner.

From time to time, we will also need to share personal data with the following third party service providers who we engage to provide services which facilitate our business and who may need to process your personal data to the extent necessary to provide those services:

• Barclays Bank or Paypal, in order to fulfil any Rewards;
• Our platform provider;
• any similar or replacement third parties from time to time (only to replace current processing requirements, i.e. for financial processing of rewards or services from our platform provider. A new sub processor would not be engaged for a new purpose without consultation and additional notice).

We seek to ensure that any third party engaged by us who processes your personal data in connection with the purposes listed above has policies and procedures in place to ensure compliance with the Data Protection Legislation.

For any third parties that are based, or process data, outside of the UK & EEA, we only engage such third parties in accordance with paragraph 7.

Unless otherwise disclosed to you from time to time, we will remain the data controller in respect of your personal data notwithstanding that:

• third parties may be engaged as data processors;
• Our client may be a joint controller with us, as notified to you.

We may also share your personal information with third parties where we are required to do so by law or regulation (such as in connection with an investigation of fraud or other legal enquiry) or in connection with other legal proceedings (including where we believe that your actions violate applicable laws, breach any T&Cs or threaten the rights, property, or safety of our Company, our users, or others).

From time to time it may be necessary for us to transfer your information internationally. In particular your information may be transferred to and/or stored on the servers of the third parties identified in paragraph 6 which are based outside of the UK or EEA.

However, we will not transfer your personal data outside of the UK or EEA unless:

• such transfer is to a country or jurisdiction which the EU Commission has approved as having an adequate level of protection (including to the USA bases on the UK’s extension to the EU-US Data Privacy Framework if appliable).
• appropriate safeguards are in place as set out in Article 46 GDPR or equivalent provisions of other Data Protection Legislation; or
• the transfer is otherwise allowed by applicable Data Protection Legislation (such as in the form of a derogation under Article 49 GDPR).

Subject to any conditions or requirements set out in the relevant Data Protection Legislation, you may have some or all of the following rights in relation to the personal data we hold about you:

• the right to request a copy of your personal data held by us;
• the right to correct any inaccurate or incomplete personal data held by us;
• the right to request that we erase personal data we hold about you, which is no longer in use for the purpose for which it was collected;
• the right to request that we restrict the processing of your data;
• the right to have your personal data transferred to another organisation;
• the right to object to certain types of processing of your personal data by us; and
• the right to complain (please see paragraph 2 of this notice).
• Please note however that these rights are not absolute in all situations and may be subject to conditions and provisos set out in relevant Data Protection Legislation. The Company cannot therefore guarantee that any request from you in connection with the rights set out above will be agreed to. For further information, or to see if you can exercise any particular right, please contact us.

As a minimum, we need to store your data for as long as is necessary to enable us to complete and release/commercialise the results of the Research Project. However, we will retain certain of your personal data for longer if we think it is reasonably necessary to do so in the circumstances, taking into consideration factors such as:

• our rights and obligations under any Participant T&Cs including our intellectual property rights in and to the Responses;
• our legitimate interests in processing the data in order to further the Research Project or related Research Projects;
• our need to answer any queries or resolve any problems you may have;
• your continued consent to receive marketing and other emails and communications from us (if applicable);
• your continued use of the platform;
• our need to comply with legal requirements (e.g. relating to record keeping).

If you tell us that you would like to delete your data, we will take steps to delete all the personal data we hold about you once it is no longer necessary for us to hold it (e.g. to fulfil any outstanding Research Projects, resolve disputes, or as is permitted by applicable law or regulation). We may keep anonymised versions of your personal data and Responses.

For as long as we do store your data, the Company follows generally accepted industry standards and maintains reasonable safeguards to attempt to ensure the security, integrity, and privacy of the information you have provided. The Company has security measures in place designed to protect against the loss, misuse, and alteration of the information under our control. Personal data collected by the Company in connection with this notice is stored in secure operating environments that are not available to the public. Any Rewards are fulfilled according to the high security level provided by our payment processor.

We will notify you as soon as reasonably practicable if we have reason to believe that there has been a personal data breach by us which could adversely affect your rights and freedoms.

The platform may link or redirect to other apps or websites that are beyond our control. Such links or redirections are not endorsements of such apps or websites or representation of our affiliation with them in any way and such third party content is outside the scope of this notice.

If you access such third party apps or websites, please ensure that you are satisfied with their respective privacy policies before you provide them with any personal data. We cannot be held responsible for the activities, privacy policies or levels of privacy compliance of any content operated by any third party.

For all questions or complaints about this notice, we would appreciate the chance to deal with your concerns before you approach the relevant data protection authority. Please contact us in the first instance.

You have the right to make a complaint at any time to the relevant supervisory authority for data protection issues, which in the UK is the Information Commissioner’s Office (ICO) (ico.org.uk) or call using the ICO helpline on 0303 123 1113 or use their live chat service on their website.