IRI Global Privacy Policy

Any questions concerning the material presented in this document can be addressed to the contacts listed below. General inquiries may also be submitted through the IRI privacy inbox, which can be found at Privacy@IRIworldwide.com

IRI’s Global Code of Conduct

IRI’s Information Security Policy

IRI’s GDPR Privacy Notice

Various internal policies and procedures

IRI assesses privacy implications while developing its products and services and incorporates appropriate privacy protections and data minimization techniques. IRI takes into account the privacy principles and regulations that may apply in a certain jurisdiction (for instance the GDPR in Europe) or by industry.

In many jurisdictions organizations are required to establish a lawful basis for their use of personal data. IRI has established different lawful bases for different types of processing. In almost all cases, IRI’s basis for processing personal data will be Legitimate Interest, Performance of a Contract, or Consent.

Legitimate Interests. IRI may process personal data based on a legitimate interest in performing market research or other marketing services because the benefits of improving services to existing clients and offering services to new clients would likely outweigh the risk of any harm.

Performance of a contract. Many of IRI’s services are engaged in on the basis of a contract. IRI’s clients engage us contractually in order to perform analytics, offer access to data through our platforms, and to manage CRMs and panels on the client’s behalf.

Consent. IRI typically acts as a data processor, or service provider, to organisations known as data controllers. IRI relies on consent obtained by the data controller because it has a direct relationship with the individual and obtains consent.

IRI is committed to complying with applicable laws regarding the collection of data about children.

IRI has invested in and implemented a series of controls to ensure that personal information is maintained according to our overarching principles of confidentiality, integrity, and availability. Personal Information is housed in physically and electronically secure facilities with protections against intrusion. Protections include extensive physical security, multiple layers of firewalls, and intrusion detection at the network and host level. Additionally, systems, servers and networks are encrypted to prevent loss or unauthorized modification of data.

In this section you can find out more about

• the types of personal information we collect
• when we collect personal information
• how we use personal information
• the legal basis for using personal information

We collect information about you if you:

• use our websites;
• do business with us as a representative of one of our customers or suppliers;
• apply for a position with IRI - in which case, you should refer to our separate privacy notices for applicants
• contact us with any form of query or complaint;
• visit an IRI office or site;
• subscribe to marketing communications from us; or attend an IRI event, collectively ("you").

We also process personal information on behalf of our customers when we provide our services to them.

When we do this, we act as a “data controller”. We may also act as a "data processor" under relevant data protection laws, when we receive your information from our customer (or potentially a third party) that will be the relevant "data controller". If you have concerns or questions about our processing of your personal information in the contexts of IRI's services, you should contact our customer. Please note that if you contact us directly, we may need to disclose your request to the relevant customer.

Depending on the context in which we interact with you, the information we collect is likely to include:

• your name;
• your contact details;
• profile / log-in details;
• your marketing preferences;
• CCTV images or identification details (such as in a visitor signing-in book) which may be captured if you visit an IRI office or site;
• any other personal information you provide in correspondence with us, for example where this is relevant to a complaint or query.

Through your use of our websites, we will also collect information - such as IP address and browser generated information (browser type, operating system), as well as information about your browsing session. We do not use this information to identify you as an individual, but in order to tailor or enhance your browsing experience, or in aggregate with data of other users for statistical purposes.

Your personal information will be used for the purposes listed in the table below. We will only collect, use and share your personal information where we are satisfied that we have an appropriate legal basis to do this. We have also described the legal bases which we rely in the table. The legal basis we rely upon will impact which rights you have in relation to your personal information (see section below for more details):

In this section you can find out more about how we share personal information:

• within IRI
• with third parties that help us provide our products and services; and
• our regulators; and other third parties.

We share your information in the manner and for the purposes described below:

• within IRI, where such disclosure is necessary to provide our customers with our services or to manage our business;
• with third parties who help manage our business and deliver services. These third parties have agreed to confidentiality restrictions and use any personal information we share with them or which they collect on our behalf solely for the purpose of providing the contracted service to us. These include IT service providers who help manage our IT and back office systems, marketing automation providers and events companies;
• with our regulators, such as data protection supervisory authorities, to comply with all applicable laws, regulations and rules, and requests of law enforcement, regulatory and other governmental agencies.
• we may share in aggregate, statistical form, non-personal information regarding the visitors to our website, traffic patterns, and website usage with our partners, affiliates or advertisers.
• If, in the future, we sell or transfer some or all of our business or assets to a third party, we may disclose information to a potential or actual third party purchaser of our business or assets.

In this section you can find out more about

• how we use personal information to keep you up to date with our products and services.
• how you can manage your marketing preferences
• when and how we undertake profiling and analytics
• when and how we carry out automated decision making

We may use personal information to let you know about IRI products and services that we believe will be of interest to you. We may contact you by email, post, or telephone or through other communication channels that we think you may find helpful. In all cases, we will respect your preferences for how you would like us to manage marketing activity with you.

To protect privacy rights and to ensure you have control over how we manage marketing with you:

• we will take steps to limit direct marketing to a reasonable and proportionate level and only send you communications which we believe may be of interest or relevance to you;
• you can ask us to stop direct marketing at any time - you can ask us to stop sending email marketing, by following the 'unsubscribe' link you will find on all the email marketing messages we send you.
Alternatively you can contact us at Privacy@IRIworldwide.com. Please specify whether you would like us to stop all forms of marketing or just a particular type (eg email); and
• you can change the way your browser manages cookies, which may be used to deliver online advertising, by following the settings on your browser.
• We recommend you routinely review the privacy notices and preference settings that are available to you on any social media platforms as well as your preferences within your IRI account.

In this section you can find out more about:

• how we operate as a global business and transfer data internationally.
• the arrangements we have in place to protect your personal information if we transfer it overseas.

IRI operates on a global basis. Accordingly, your personal information may be transferred and stored in countries outside of the EU under relevant data protection laws, including in particular, countries that are subject to different standards of data protection. IRI will take appropriate steps ensure that transfers of personal information are in accordance with applicable law and carefully managed to protect your privacy rights and interests and transfers are limited to countries which are recognized as providing an adequate level of legal protection or where we can be satisfied that alternative arrangement are in place to protect your privacy rights.. To this end,:

• transfers to IRI in the United States are covered by all appropriate safeguards under UK GDPR including contractual mechanisms such as the Standard Contractual Clauses or supplementary measures surrounding the circumstances of the transfer;
• where we transfer your personal information outside IRI or to third parties who help provide our products and services, we obtain contractual commitments from them to protect your personal information. Some of these assurances are well recognized appropriate safeguards or contractual mechanisms such as the Standard Contractual Clauses; or
• where we receive requests for information from law enforcement or regulators, we carefully validate these requests before any personal information are disclosed

You have a right to contact us at Privacy@IRIworldwide.com for more information about the safeguards we have put in place (including a copy of relevant contractual commitments) to ensure the adequate protection of your personal information when this is transferred as mentioned above.

In limited circumstances, transfers of your personal information may be based on context specific derogations which permit transfers in the absence of safeguards, such as where a transfer is necessary for the establishment, exercise or defence of legal claims