Privacy Policy - Opinion Bureau an Online Market Research

Choose your location to get a site experience tailored for you.

Privacy Policy

 

Internet Research Bureau

Last Updated: 20 April 2023

1. Who we are and what we do

Who we are

We are Internet Research Bureau (“IRB”, “us”, “we”, “our”) and we own and operate www.opinionbureau.com (“Opinion Bureau”). We are a limited company registered in New Delhi under the registration U74140DL2011PTC218975, with our office at Pegasus Tower, A-10, 8th Floor, Sector-68, Gautam Buddha Nagar, Noida, Uttar Pradesh – 201301.

In England and Wales our company registration number is 11717717, with our registered office at 128 City Road, London, United Kingdom, EC1V 2NX. We are registered with the UK supervisory authority, Information Commissioner’s Office (“ICO”), in relation to our processing of Personal Data under registration number ZB527489.

We are also registered in California, USA under the Federal Tax Identification No. 32-0476406, our registered office is 1055 West, 7th Street Penthouse, Los Angeles, CA-90017.


What we do

IRB is an online and telephonic market research survey data collection company. We help clients from various sectors, verticals, and regions to collect high-quality survey research data to gain consumer insight. We build and manage consumer and b2b panels of survey research participants. Our members participate in market research surveys to share their opinion and feedback for various brands .We control and manage the personal data that you share with us after signing up to the Opinion Bureau website.

IRB is a member of the Market Research Society UK (“MRS”), Insight Association (US) and Market Research Society of India (“MRSI”). We manage our online panel, personal data of our members and conduct research surveys in accordance with the MRS Code of Conduct, MRSI Code of Conduct, Insight Association Code of Standard and ESOMAR Codes and Guidelines.

2. Purpose of this privacy notice

The purpose of this privacy notice is to explain what Personal Data we collect about you and how we process it. This privacy notice also explains your rights, so please read it carefully. If you have any questions, you can contact us using the information provided below under the ‘How to contact us’ section.

The privacy statement does not apply where you have agreed to participate in surveys administered by our clients, or any other third parties. In cases where you share your personal data with our clients or a third party, please read their privacy policy before consenting to share your information. In the cases where you share your personal data with our clients or third-party, they will be responsible for controlling and managing your personal data.



3. Who this privacy notice applies to

This privacy notice applies to you if:

  • You register an account on our website;
  • You partake in surveys on our website;
  • You use our app [Android and IOS];
  • You sign up to receive newsletters and/or other promotional communications from us.


4. What Personal Data is

In this privacy notice, our use of the term “personal data” includes other similar terms under applicable privacy laws, such as “personal information” and “personally identifiably information”. In general, personal data means any information that identifies, relates to, describes, or is reasonably capable of being associated with an individual (the data subject).

In Argentina alone, personal data also includes legal entities.

In South Africa alone, personal data also includes “juristic persons” such as companies.

Special Category Personal Data. Our use of the term ‘Special Category Personal Data’ also includes other similar terms, such as “sensitive personal data” and “sensitive personal information”. In general, Special category personal data is more sensitive Personal Data and includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purposes of uniquely identifying someone, data concerning physical or mental health or data concerning someone’s sex life or sexual orientation and requires an added level of protection.

In India alone, special category personal data also includes an individual’s password(s).

In the Philippines alone, special category personal data also includes information about an individual’s education.

In Japan alone, special category personal data also includes the social status of an individual.



5. Personal Data we collect

At the time of registration, Opinion Bureau asks you to provide your basic personal information. Once you are registered, Opinion Bureau further asks you to update more personal information in your profile, which helps us to find suitable surveys for you. Below is an example of the different categories of personal data we may collect and process about you.

  • Full name
  • Date of Birth
  • Address
  • Phone number
  • Email address
  • Social media profile URL
  • Occupation information
  • Educational information
  • Household information
  • Religion
  • Sexual orientation
  • Financial information
  • Lifestyle information (e.g., shopping habits, food and drink preferences)
  • Medical information (e.g., illnesses and medical issues)
  • Hobbies and interests

The information we collect is not mandatory in order to participate in our surveys, however providing additional profile information enables us to ensure you receive the most suitable surveys.



6. How we collect data

We collect personal data about from the following sources:

  • From the information you input onto our website, upon sign up and when populating your online profile.
  • From cookies: We use cookies on our website that identify you when you visit us and tell us what pages you are viewing. We also use the information to trigger sales and marketing activity (for more information, see the cookie policy section below)
  • From social media: If you choose to communicate to us via any of the social media platforms.
  • Verbal and written communications: When you send us an email, call or write a letter
  • From your device used to access our website or application.


7. How we use your personal data

We use your personal data for various activities, which include the following:

  • To create an account on our website
  • To contact you about surveys, reward information, newsletters, and company updates.
  • To verify who you are and check your authenticity.
  • To invite you to participate in research surveys with the qualifying criteria that best match your profile information.
  • If you have opted for follow-up surveys, we may contact you in cases where we need additional feedback.

The above list is non-exhaustive and representative. For more information about how we use personal data for specific activities you can contact us using the details provided in Section 19.



8. Lawful basis for processing

Applicable Data Protection legislation requires us to identify appropriate lawful bases to process personal data. The lawful basis we rely on as a data controller are detailed below with brief examples for when they may apply:

Lawful Basis Purpose of processing
Consent
*Explicit Consent
For opting into marketing communications and newsletters
*When collecting special category information from you for the purpose of populating your profile information
Contract To provide our survey service to you
Legal Obligation Where required by law and/or a government request
Legitimate Interests To provide you with relevant surveys


9. Sharing your Personal Data

The Personal Identifiable Information collected by Opinion Bureau is only used for market research studies and no other purposes. Opinion Bureau does not sell or share personally identifiable information of its panel members or individuals not registered with us to any third party without your consent.

We may provide your personally identifiable information to companies that provide services to help us with our business activities such as reward management, customer support (helpdesk), email delivery or shipping your order. These companies are authorized to use your personally identifiable information only as necessary to provide these services to us, and to fulfil our obligations to you.

In certain situations, Opinion Bureau may be required to disclose personal data in response to lawful requests by public authorities. We may also disclose your personally identifiable information as required by law, such as to comply with a subpoena, or similar legal process and when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.



10. International Transfers

For UK Data Subjects

Your Personal Data may be processed outside of the UK. This is because the organisations we use to provide our service to you are based outside the UK.

We have taken appropriate steps to ensure that the Personal Data processed outside the UK has an essentially equivalent level of protection to that guaranteed in the UK. We do this by ensuring that:

  • Your Personal Data is only processed in a country which the Secretary of State has confirmed has an adequate level of protection (an adequacy regulation), or
  • We enter into an International Data Transfer Agreement (“IDTA”) with the receiving organisation and adopt supplementary measures, where necessary. (A copy of the IDTA can be found here international-data-transfer-agreement.pdf (ico.org.uk)).

For Data Subjects not in the UK or EEA

Your Personal Data may be processed outside your jurisdiction This is because the organisations we use to provide our services to you are located outside of your jurisdiction.

We have taken appropriate steps to ensure that the Personal Data processed outside your jurisdiction has an essentially equivalent level of protection to that guaranteed in your jurisdiction. We do this by ensuring that:

  • Your Personal Data is only processed in a country which the European Commission has confirmed has an adequate level of protection (an adequacy decision); or
  • We enter into Standard Contractual Clauses (“SCCs”) with the receiving organisations and adopt supplementary measures, where necessary. (A copy of the SCCs can be found here Standard Contractual Clauses (SCCs)) .

For Data Subjects in the EEA

Your Personal Data may be processed outside the European Economic Area (“EEA”). This is because the organisations we use to provide our services to you are located outside of the EEA.

We have taken appropriate steps to ensure that the Personal Data processed outside the EEA has an essentially equivalent level of protection to that guaranteed in the EEA. We do this by ensuring that:

  • Your Personal Data is only processed in a country which the European Commission has confirmed has an adequate level of protection (an adequacy decision); or
  • We enter into Standard Contractual Clauses (“SCCs”) with the receiving organisations and adopt supplementary measures, where necessary. (A copy of the SCCs can be found here Standard Contractual Clauses (SCCs)) .


11. Your Data Protection Rights

Argentina

If you live in Argentina, we comply with the Convention 108+ for the Protection of Individuals with Regard to Processing of Personal Data and you have the following rights in relation to the processing of your Personal Data, including to:

  • Right to be informed
    According to Section 6 of the Act, data subjects must be informed in an express and clear manner about:
    • the purposes for which data will be processed and any possible third-party addressees or types of addressees;
    • the existence of the relevant database and the identity and address of its controller;
    • whether providing the information is mandatory or voluntary and the consequences of refusing to provide information or providing false information; and
    • the possibility to access, update, correct, and delete their data, and the mechanism to do so.
  • Right of access access (commonly known as a “Subject Access Request”)

    Section 14 of the Act provides that data subjects have the right to request and obtain information about their personal data held in databases. According to Section 4(6) of the Act, data must be stored in a way that enables data subjects to exercise their right of access. The data controller or data user must provide the requested information within ten calendar days from the request.

  • Right to rectification

    Section 16(1) of the Act establishes that data subjects have the right to require the rectification, update, and, where applicable, the suppression or confidentiality of their data stored in databases. The data controller or data user of such databases must take all the relevant measures within a maximum of five business days, following the receipt of the data subject's claim or gaining knowledge of the error (Section 16(4) of the Act).

  • Right to object to processing

    This is not applicable under the Argentinian jurisdiction.

  • Right to withdraw consent

    If you have provided your consent for us to process your Personal Data for a specific purpose, you have the right to withdraw your consent at any time. If you do withdraw your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we are permitted by law to do so.

  • Right to complain

    You have the right to complain about us to the Argentinian Data Protection Authority ('AAIP').


Australia

If you live in Australia, we comply with the Australian Privacy Act 1988 (Cth) and you have the following rights in relation to the processing of your Personal Data, including to:

  • Right to be informed

    You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this.

  • Right of access (commonly known as a “Subject Access Request”)

    You have the right to access and receive a copy of the Personal Data we hold about you.

  • Right to rectification

    You have the right to have any incomplete or inaccurate information we hold about you corrected.

  • Right to object to processing

    You have the right to object to us processing your Personal Data and to stop receiving unwanted direct marketing.

  • Right to withdraw consent

    If you have provided your consent for us to process your Personal Data for a specific purpose, you have the right to withdraw your consent at any time. If you do withdraw your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we are permitted by law to do so.

  • Right to complain

    You have the right to complain about us to the Office of the Australian Information Commissioner (“OAIC”), if you think we have mishandled your Personal Data whose contact details are:

    Contact us - Home (oaic.gov.au)


Brazil

If you live in Brazil, we comply with the LGPD and you have the following rights in relation to the processing of your Personal Data, including to:

  • Right to be informed

    The LGDP specifies that data subjects have the right of access to information concerning the data processing of their personal data (Article 9 of the LGPD). The LGPD does not explicitly refer to a difference in requirements for the right to be informed when personal data is obtained directly from the data subject or third party.

  • Right of access (commonly known as a “Subject Access Request”)

    The LGPD provides that data subjects have the right to obtain, at any time and by means of request, information regarding the data subject's personal data that is being processed (Article 18 of the LGPD).

  • Right to rectification

    The LGPD provides that data subjects have the right to the correction of incomplete, inaccurate, or out-of-date data, at any time and by means of request (Article 18(III) of the LGPD).

  • Right to object to processing

    The LGPD outlines that a data subject can request the blocking of unnecessary or excessive data or data processed in non-compliance with the provisions of the LGPD (Article 18(IV) of the LGPD).

    Under the LGPD, the right to restriction is referred to as 'blocking' which the LGPD is defined as the temporary suspension of any processing operation, by means of retention of the personal data or the database (Article 5(XIII) of the LGPD). Also, data subjects have the right to request the removal of its personal data which is processed under the legal base of consent, with an exception applied to data stored for:

    • compliance with legal or regulatory obligation by the controller;
    • studies by a research body ensured, whenever possible, the anonymisation of personal data; and
    • transfer to third parties, provided that in compliance with the data processing requirements set forth LGPD.
  • Right to withdraw consent

    Consent must be in writing, or another means that demonstrates the manifestation of the will of the data subject. Data subjects must be told of their right not to provide consent and the consequences of such refusal. Data subjects can also withdraw consent, which must be possible through a free and easy procedure.

  • Right to complain

    You have the right to complain about us to the Brazilian Data Protection Authority ('ANPD').


California

If you live in California, we comply with the California Consumer Privacy Act of 2018 (CCPA) and the California Privacy Rights Act of 2020 (CPRA) and you have the following rights in relation to the processing of your personal data:

  • Right to be informed

    The CCPA as amended provides that a business that controls the collection of a consumer’s personal information shall, at or before the point of collection, inform consumers as to:

    • The categories of personal information to be collected and the purposes for which the categories of personal information are collected or used and whether such information is sold or shared;
    • If the business collects sensitive personal information, the categories of sensitive personal information to be collected and the purposes for which the categories of sensitive personal information are collected or used and whether such information is sold or shared; and
    • The length of time the business intends to retain each category of personal information, including sensitive personal information, or if that is not possible, the criteria used to determine such period.
  • Right to access

    A consumer has the right to request that a business that collects their personal information disclose the following upon a verifiable request:

    • The categories of personal information is has collected about that consumer;
    • the categories of sources from which the personal information is collected;
    • the business or commercial purpose for collecting, selling, or sharing personal information;
    • the categories of third parties to whom the business discloses personal information; and
    • the specific pieces of personal information it has collected about that consumer.
  • Right to rectification

    A consumer has the right to request that a business that maintains inaccurate personal information about the consumer to correct that inaccurate personal information, taking into account the nature of the personal information and the purposes of the processing of the personal information. In addition, a business must disclose to the consumer their right to request the correction of inaccurate personal information.

  • Right to Erasure

    A consumer has the right to request, free of charge, that a business delete any personal information about the consumer which the business has collected from the consumer. In addition, a business that collects personal information about the consumer must disclose to the consumer their right to request the deletion of their personal information.

    In response, the business must delete the consumer’s personal information from its records and direct any service providers to delete the consumer’s personal information from their records.

  • Right to object/opt-out

    A third party is prohibited from selling personal information about a consumer that has been sold to the third party by a business unless the consumer has received explicit notice and is provided an opportunity to op-out.

    A consumer has the right, at any time, to direct a business that sell or share personal information about the consumer to a third party or to not sell or share the consumer’s personal information which is also known as the opt-out right.

  • Right to data portability

    A business must provide the specific pieces of personal information obtained from the consumer in a format that is easily understandable to the average consumer, and to the extent technically feasible, in a structured, commonly used, machine-readable format, which also may be transmitted to another entity at the consumer’s request without hindrance.

  • Right to not be subject to automated decision-making

    The CCPA as amended does not explicitly refer to a right to not be subject to automated decision making, but it does stipulate that the attorney general may adopt regulations in this area.

  • Other rights
    • A consumer has the right to not be discriminated against because of the exercise of any of the consumer’s rights;
    • A consumer has the right to direct a business that collects sensitive personal information about the consumer to limit its use of the consumer’s sensitive personal information to what is necessary to perform the services or provide the goods reasonably expected.

Colorado

If you live in Colorado, we comply with the Colorado Privacy Act (CPA), and you have the following rights under the CPA which will enter into effect on 1st July 2023:

  • Right to be informed

    Controllers must provide consumers with a privacy notice that includes:

    • The categories of personal data collected or processed by the controller or a processor;
    • The purpose for which the categories of personal data are processed;
    • How and where consumers may exercise the rights pursuant to the CPA, including the controller’s contact information and how a consumer may appeal a controller’s action with regard to the consumer’s request;
    • The categories of personal data that the controller shares with third parties, if any;
    • The categories of third parties, if any, with whom the controller shares personal data; and
    • If a controller sells personal data to third parties or processes personal data for targeted advertising, the controller shall clearly and conspicuously disclose the sale r processing, as well as the manner in which a consumer may exercise the right to op out of the sale or processing.
  • Right to access

    A consumer has the right to confirm whether a controller is processing personal data concerning the consumer and to access the consumer’s personal data.

  • Right to rectification

    A consumer has the right to correct inaccuracies in the consumer’s personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer’s personal data.

  • Right to erasure

    A consumer has the right to delete personal data concerning the consumer.

  • Right to object/opt-out

    A consumer has the right to opt out of the processing of personal data concerning the consumer for purposes of;

    • Targeted advertising;
    • The sale of personal data; or
    • Profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer.
  • Right to data portability

    when exercising the right to access personal data, a consumer has the right to obtain the personal data in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another entity without hindrance. A consumer may exercise this right no more than two times per calendar year.


Connecticut

If you live in Connecticut, we comply with the Senate Bill 6 for an Act Concerning Personal Data Privacy and Online Monitoring (CTDPA), and under the CTDPA you have the following rights;

  • Right to be informed

    Consumers have the right to confirm whether a controller is processing the consumer’s personal data. Controllers are also required to provide customers with a reasonably accessible, clear, and meaningful privacy notice that includes:

    • The categories of personal data processed by the controller;
    • The purpose for processing personal data;
    • How consumers may exercise their consumer rights, including how a consumer may appeal a controller’s decision with regard to the consumer’s request;
    • The categories of personal data that the controller shares with third parties;
    • The categories of third parties, if any, with whom the controller shares personal data; and
    • An active electronic mail address or other online mechanism that the consumer may use to contact the controller.
  • Right to access

    A consumer has the right to confirm whether or not a controller is processing the consumer’s personal data and access such personal data unless such confirmation or access would require the controller to reveal a trade secret.

  • Right to rectification

    A consumer has the right to correct inaccuracies in their personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer’s personal data.

  • Right to erasure

    A consumer has the right to delete personal data provided by, or obtained, about them.

  • Right to object/opt-out

    Consumers have the right to opt out of the processing of the personal data for purposes of:

    • Targeted advertising;
    • The sale of personal data except as provided in Section 6 of the CTDPA; or
    • Profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.
  • Right to data portability

    Consumers have the right to obtain a copy of their personal data processed by the controller, in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means, provided such controller will not be required to reveal any trade secret.

  • Right to not be subject to automated decision-making

    Consumers have the right to opt out of the processing of their personal data for purposes of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.


Indonesia

If you live in Indonesia, you have the following rights under Regulation No.20 of 2016 on Personal Data Protection in Electronic Systems (“Kominfo Regulation 20”)

  • Right to be informed

    You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this.

  • Right of access (commonly known as a “Subject Access Request”)

    You have the right to access and receive a copy of the Personal Data we hold about you.

  • Right to rectification

    You have the right to have any incomplete or inaccurate information we hold about you corrected.

  • Right to erasure (commonly known as the right to be forgotten)

    You have the right to ask us to delete or de-identify your Personal Data.

  • Right to object

    You have the right to object to us processing your Personal Data in certain circumstances.

  • Right to Complain

    The data protections laws pertaining to data held electronically are mainly enforced by the Ministry of Communication and Information ("Menkominfo"). Jl. Medan Merdeka Barat No. 9
    Jakarta 10110
    Indonesia
    https://kominfo.go.id/


India

If you live in India, we comply with the India data protection requirements, namely the Information Technology Act, 2000 ('the IT Act') and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ('the SPDI Rules'). You have the following rights in relation to the processing of your Personal Data, including to:

  • Right to be informed

    Companies that collect, receive, possess, store, deal with, or handle personal information, including sensitive personal data, are required to have a privacy policy in place detailing the type of personal data collected, purpose of collection and use of personal data, disclosures, and the security practices and procedures adopted.

  • Right of access (commonly known as a “Subject Access Request”)

    Individuals have the right to review the information that body corporates may have on them.

  • Right to rectification

    Individuals have the right to seek the correction or amendment of inaccurate or deficient information that body corporates may have on them.

  • Right to object to processing

    Data principals have the right to withdraw consent under the SPDI Rules.


Japan

If you live in Japan, we comply with the Act on the Protection of Personal Information (Act No. 57 of 2003 as amended in 2020) (“APPI”).

You have the following rights in relation to the processing of your Personal Data, including to:

  • Right to be informed

    You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this.

  • Right of access (commonly known as a “Subject Access Request”)

    You have the right to access and receive a copy of the Personal Data we hold about you.

  • Right to rectification

    You have the right to have any incomplete or inaccurate information we hold about you corrected.

  • Right to erasure (commonly known as the right to be forgotten)

    You have the right to ask us to delete or de-identify your Personal Data.

  • Right to cease processing

    You have the right to request that we cease processing your Personal Data.

  • Right to Complain

    If you are concerned about the way in which we are handling your Personal Data, you can contact the Personal Information Protection Commission for Japan whose contact details are:

    Personal Information Protection Commission
    Kasumigaseki Common Gate West Tower 32nd Floor, 3-2-1, Kasumigaseki, Chiyoda-ku, Tokyo, 100-0013, Japan
    TEL: +81-(0)3-6457-9680
    www.ppc.go.jp


Malaysia

If you live in Malaysia, we comply with Malaysia’s Personal Data Protection Act (“Malaysia’s PDPA”). You have the following rights in relation to the processing of your Personal Data, including to:

  • Right to be informed

    You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this.

  • Right of access (commonly known as a “Subject Access Request”)

    You have the right to access and receive a copy of the Personal Data we hold about you.

  • Right to correction

    You have the right to have any incomplete or inaccurate information we hold about you corrected.

  • Right to object

    You have the right to object to us processing your Personal Data for direct marketing purposes.

  • Right to prevent processing

    You have the right to prevent processing likely to cause damage or distress.

  • Right to withdraw consent

    If you have provided your consent for us to process your Personal Data for a specific purpose, you have the right to withdraw your consent at any time. If you do withdraw your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we are permitted by law to do so.

  • Right to complain

    You have the right to complain to the to the Personal Data Protection Commissioner (“PDP Commissioner”) for Malaysia if the data user does not cease processing your Personal Data for direct marketing purposes following your request. The PDP Commissioner contact details are:
    Aras 6, Kompleks Kementerian Komunikasi dan Multimedia
    Lot 4G9, Persiaran Perdana, Presint 4
    Pusat Pentadbiran Kerajaan Persekutuan
    62100 Putrajaya
    Malaysia
    www.pdp.gov.my


Mexico

If you live in Mexico, we comply with the Federal Law on Protection of Personal Data Held by Private Parties ('FLPPDPP'), Regulations to the Federal Law on Protection of Personal Data Held by Private Parties ('the Regulations'). You have the following rights in relation to the processing of your Personal Data, including to:

  • Right to be informed

    Data controllers must inform data subjects, prior to collecting their personal data, of the characteristics of the processing. The document must include, at a minimum, the following information:
    -the identity and address of the data controller;
    -the purposes of the processing; the options and means offered by the data controller to the data subject to limit the use or disclosure of his/her data;
    -the means for exercising access, rectification, cancellation, and opposition ('ARCO') rights;
    -the means for exercising the right to revoke consent to the processing;
    -the transfers of data that the data controller intends to make, if any;
    -the procedure and means by which the data controller will notify the data subject of any changes to the privacy notice; and
    -identification of any sensitive personal data that will be processed.

  • Right of access (commonly known as a “Subject Access Request”)

    Data subjects have the right to request access to their personal data from data controllers.

  • Right to rectification

    Data subjects have the right to request that their personal data be rectified where it is either out of date or inaccurate.

  • Right to object to processing

    Data subjects have the right to object, on legitimate grounds, to the processing of their personal data.

  • Right to withdraw consent

    If you have provided your consent for us to process your Personal Data for a specific purpose, you have the right to revoke your consent at any time. If you do withdraw your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we are permitted by law to do so.

  • Right to complain

    You have the right to complain about us to the National Institute for Access to Information and Protection of Personal Data ('INAI'). If you think we have mishandled your Personal Data.


Nigeria

If you live in Nigeria, we comply with The Nigerian Data Protection Regulation, 2019 ('NDPR') and you have the following rights in relation to the processing of your Personal Data, including to:

  • Right to be informed

    A data controller is required to take appropriate measures to provide any information relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, and for any information relating to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means (Section 3.1(1) of the NDPR).

  • Right of access (commonly known as a “Subject Access Request”)

    A data subject has the right to receive the personal data concerning them, which they have provided to a data controller, in a structured, commonly used and machine-readable format, and have the right to transmit that data to another data controller without hindrance from the data controller to which the personal data has been provided (Section 3.1(14) of the NDPR).

  • Right to rectification

    A data subject has the right to be notified by the data controller of the rectification of data (Section 3.1(13) of the NDPR).

  • Right to object to processing

    Under the NDPR, data subjects have the right to withdraw their consent to the processing of their personal data at any time. In addition, a data subject may choose to object to the processing of personal data relating to them which the data controller intends to process for the purpose of marketing (Section 2.8 of the NDPR).

  • Right to complain

    At the moment there is no specific regulator for data protection in Nigeria. Thus, the regulatory body for each sector has been responsible for protecting data. For instance, the Central Bank of Nigeria ('CBN') oversees matters relating to protecting financial data and the Nigerian Communications Commission ('NCC') regulates data collected or processed by internet service providers and telecommunications companies.


South Korea

If you live in South Korea, we comply with the Personal Information Protection Act 2011 (as amended in 2020) ('the PIPA').
You have the following rights in relation to the processing of your Personal Data, including to:

  • Right to be informed

    Under the PIPA, data handlers and ICSPs are required to provide notice of the following matters when obtaining consent from data subjects for the collection and use of personal data:

    • the purpose of the collection and use of personal data;
    • the items of personal data to be collected/used;
    • the period for retaining and using the personal data; and
    • the data subject's right to refuse his/her consent and outline any disadvantages, if any, which may follow from such refusal.
  • Right of access (commonly known as a “Subject Access Request”)

    You have the right to access and receive a copy of the Personal Data we hold about you.
    The PIPA Enforcement Decree specifies that the data subject may request access to any of the following information from the data handler:

    • the items of personal data concerned;
    • the purpose for collecting/using the personal data;
    • the retention and use period of the personal data;
    • the status of any provision of personal data to third parties; and
    • the fact that the data subject consented to the data handler's processing of personal data.

    The PIPA provides that a request must be made in accordance with the procedures determined by the data handler. Such procedure should meet the following requirements:

    • the methods available to the data subject in making the request need to be data subject-friendly, such as in writing, by telephone or electronic mail, or via the internet;
    • data subjects must be able to request access at least through the same window or in the same manner that the data handler uses to collect such personal information, unless a justifiable reason exists (e.g. difficulty in continuously operating such window); and
    • details regarding the manner and procedure for exercising the right to request access is to be posted on the website operated by the data handler (if such website exists).
  • Right to rectification

    The PIPA provides data subjects that have accessed their personal information with a right to request the rectification of such information from the relevant data handler. Since only data subjects who have accessed their personal data may request rectification of such information, data subjects who were denied access to their personal data may not exercise their right to request rectification.

  • Right to erasure (commonly known as the right to be forgotten)

    The PIPA provides data subjects that have accessed their personal information with a right to request the erasure of such information from the relevant data handler. However, the erasure is not permitted when the collection of the personal information is required by other laws or the data subject's right to access has been denied by the data handler.

  • Right to Complain

    If you are concerned about the way in which we are handling your Personal Data, you can contact the Personal Information Protection Commission ('PIPC').


UK/EU

You have certain rights in relation to the processing of your Personal Data, including to:

  • Right to be informed

    You have the right to know what personal data we collect about you, how we use it, for what purpose and in accordance with which lawful basis, who we share it with and how long we keep it. We use our privacy notice to explain this.

  • Right of access (commonly known as a “Subject Access Request”)

    You have the right to receive a copy of the Personal Data we hold about you.

  • Right to rectification

    You have the right to have any incomplete or inaccurate information we hold about you corrected.

  • Right to erasure (commonly known as the right to be forgotten)

    You have the right to ask us to delete your Personal Data.

  • Right to object to processing

    You have the right to object to us processing your Personal Data. If you object to us using your Personal Data for marketing purposes, we will stop sending you marketing material.

  • Right to restrict processing

    You have the right to restrict our use of your Personal Data.

  • Right to portability

    You have the right to ask us to transfer your Personal Data to another party.

  • Automated decision-making.

    You have the right not to be subject to a decision based solely on automated processing which will significantly affect you. We do not use automated decision-making.

  • Right to withdraw consent

    If you have provided your consent for us to process your Personal Data for a specific purpose, you have the right to withdraw your consent at any time. If you do withdraw your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we are permitted by law to do so.

  • Right to lodge a complaint

    You have the right to lodge a complaint with the relevant supervisory authority, if you are concerned about the way in which we are handling your Personal Data. The supervisory authority in the UK is the Information Commissioner’s Office who can be contacted online at:
    Contact us | ICO
    Or by telephone on 0303 123 1113
    For supervisory authorities in other countries within the EU see the link below:
    https://edpb.europa.eu/about-edpb/about-edpb/members_en


Utah

If you are in Utah, we comply with Senate Bill 227 for the Consumer Privacy Act (UCPA), and under the UCPA you have the following rights:

  • Right to be informed

    Consumers have the right to confirm whether a controller is processing the consumer’s personal data. Controllers are also required to provide customers with a reasonably accessible and clear privacy notice and inform them of:

    • The categories of personal data processed by the controller;
    • The purposes for which the categories of personal data are processed;
    • How consumers may exercise a right;
    • The categories of personal data that the controller shares with third parties, if any; and
    • The categories of third parties, if any, with whom the controller shares personal data.
  • Right to access

    Consumers have the right to access their personal data.

  • Right to erasure

    Consumers have the right to delete their personal data.

  • Right to object/opt-out

    Consumers have the right to opt out of the processing of their personal data for purposes of targeted advertising or the sale of personal data.

  • Right to data portability

    Consumers have the right to obtain a copy of their personal data in a format that:

    • To the extent technically feasible, is portable;
    • To the extent practicable, is readily usable; and
    • Allows the consumer to transmit the data to another controller without impediment, where the processing is carried out by automated means.

Virginia

If you live in Virginia, we comply with the Consumer Data Protection Act (CDPA), and under the CDPA you have the following rights:

  • Right to be informed

    Consumers must be informed through the provision of a privacy notice that includes:

    • The categories of personal data processed by the controller;
    • The purpose for processing personal data;
    • How consumers may exercise their consumer rights provided by the CDPA, including how a consumer may appeal a controller’s decision with regard to the consumer’s request;
    • The categories of personal data that the controller shares with third parties, if any; and
    • The categories of third parties, if any, with whom the controller shares personal data.
  • Right to access

    Consumers have the right to confirm whether or not a controller is processing their personal data and access such personal data.

  • Rectification

    Consumers have the right to correct inaccuracies in their personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer’s personal data.

  • Right to erasure

    Consumers have the right to delete personal data provided by or obtained about the consumer.

  • Right to object/opt-out

    Consumers have the right to opt out of their processing of their personal data for purposes of:
    Targeted advertising;
    The sale of personal data; or
    Profiling in furtherance of decisions that produce legal or similarly significant efforts concerning the consumer.

  • Right to data portability

    Consumers have the right to obtain a copy of their personal data that they previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means.

  • Right not to be subject to automated decision-making

    Consumers have the right to opt out of the processing of their personal data for purposes of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

  • Other rights

    Consumers have the right to appeal a controller’s refusal to take action following a consumer’s request to exercise their rights.


How to exercise your rights

You will not usually need to pay a fee to exercise any of the above rights. However, we may charge a reasonable fee if your request is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

If you wish to exercise your rights, you may contact us using the details set out below within the section called ‘How to contact us’. We may need to request specific information from you to confirm your identity before we can process your request. Once in receipt of this, we will process your request without undue delay and within one month. In some cases, such as with complex requests, it may take us longer than this and, if so, we will keep you updated.



12 Children’s Privacy

Our services are not specifically designed for children and for those under the age of 16. If we do become aware of anyone using our services who may be under 16, we will take all reasonable steps to ensure we do not process their data any further and will communicate this to them directly. If you are a parent or guardian of a child under 16 and become aware that your child has provided personal data to us and you are not aware of such processing, please contact to our privacy contact at privacy@opinionbureau.com.



13 Automated Decision-Making and Profiling

Profiling is part of what we do, as it enables us to ensure you receive surveys that are most suited to you as an individual. We don’t use automated decision-making and profiling in a way that produces legal effects, or significantly affects you. If you have any questions about this, you can contact us using the details in the ‘Contact Us’ section.



14 Use of Cookies and Similar Technologies

Our website, survey service and app utilise cookies and similar technologies. You can find out more by viewing our cookie notice available here.



15 Mobile data

We may obtain information through mobile applications that you install on your mobile device to access and use our website, applications.
We gather following information:

  • Device Id
  • Device Type
  • Device Name
  • Ip Address


16 Security and storage of information

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

If we become aware of any loss, misuse, alteration of personal data we will work closely with our IT team, DPO and other parties as necessary to investigate the incident at hand. We have put into place the relevant procedure and policies in place to investigate, mitigate and report (when needed to relevant parties) such instances.



17 Data Retention

We will not keep Personal Data longer than is necessary, for the purpose or purposes for which they were collected. IRB will take all reasonable steps to destroy, or erase from its systems, all Personal Data which is no longer required. This does not apply to anonymised data.



18 How to Contact Us

If you wish to contact us in relation to this privacy notice, please contact us as follows:

UK office: 128 City Road, London, United Kingdom, EC1V 2NV
New Delhi headquarters: Pegasus Tower, A-10, 8th Floor, Sector-68, Gautam Buddha Nagar, Noida, Uttar Pradesh – 201301
US office: 1055 West, 7th Street Penthouse, Los Angeles, CA-90017
You can email us using the following details:
privacy@opinionbureau.com
help@opinionbureau.com

We have also appointed an external data protection officer (DPO) and their details are as follows:

Evalian Limited
West Lodge
Leylands Business Park
Colden Common
Hampshire
SO21 1TH
United Kingdom

Email: dpo@irbureau.com Phone: +44 (0)333 050 0111
Website: www.evalian.co.uk
Please mark your communications FAO the ‘Data Protection Officer’.

19 EU Representative

We take the protection of personal data seriously, and have appointed DataRep as our Data Protection Representative in the European Union, so that you can contact us directly in your home country. DataRep has locations in each of the 27 EU countries and Norway & Iceland in the European Economic Area (EEA), so that our customers can always raise the questions with us.
If you want to raise a question to us, or otherwise exercise your rights in respect of your personal data, you may do so by:
  • sending an email to DataRep at irbureau@datarep.com,
  • contacting us on our online webform at www.datarep.com/data-request, or
  • mailing your inquiry to DataRep at the most convenient of the addresses listed here


20 Changes to this privacy notice

We may update this notice (and any supplemental privacy notice), from time to time as shown below. We will notify of the changes where required by applicable law to do so.
Last Modified: 23 June 2023
You may request previous versions of this notice by contacting us at privacy@irbureau.com.

Experience Opinion Bureau App on Mobile