Last updated: 24.08.2022

Introduction

As a global data company and provider of research insights, we take privacy and data security very seriously, and believe that everyone’s personal data should be handled responsibly and ethically.

This privacy notice applies to both our clients (someone who is employed or otherwise engaged by a client of YouGov) and prospective clients (anyone who is not a YouGov client, but we believe may be interested in becoming one) of YouGov.

We’ve tried to make this notice as easy to read as possible, but if anything is unclear, please contact us at dataprotection@yougov.com, and we’ll be happy to clear it up.

What this notice covers

As an organisation that relies on the use of personal data, YouGov is responsible for collecting and using your data in a responsible and secure way, and that starts with clearly telling you how we collect, use and protect your personal data. This notice sets out:

The personal data we may collect from you;
How and why we use your personal data;
Why we may share personal data within YouGov and with other organisations; and
The rights and choices you have when it comes to your personal data.

YouGov is made up of a number of companies, each of which separately controls the data it collects about its clients and prospective clients. Being a data controller means we choose why and how that data is processed –

If you are a client, the YouGov group company with which your organisation has a contract or agreement for services is the controller of your personal data.
If you are a prospective client, the YouGov group company named on any communication we send you, or in any privacy notice you encounter when interacting with us, is the controller of your personal data.

Personal data we collect

In this section we explain what personal data we may collect when you are a YouGov client or prospective client, as well as data that we may collect from other sources.

If you are a YouGov client, you provide us with personal information that enables us to provide our products and services to you – from your day-to-day interactions with our account managers and researchers, to your use of YouGov’s online tools (for example, BrandIndex and Profiles). If you are not a YouGov client, we may contact you to tell you about our products and services.

You can find out more about the data we collect from you in the table below.

When you contact us about our products or services, or become a YouGov client, we collect:	Personal details such as your name, address, email, telephone number, company name and address and job role and level A history of our correspondence with you
When you use one of YouGov’s online tools, we collect:	Information about your use of our online tools, such as logins and sessions, collected by analytics platforms that use of cookies and similar technologies (see the ‘Cookies and similar technologies’ for more information) Any information you provide when you contact us for assistance, for example if you have forgotten your password, need to report a bug or have any general queries
When you complete a form on one of our websites, we collect:	Personal details such as your name, email, company name, job role and level and industry Payment information, if you use a ‘Checkout form’ to purchase our products or services

Personal data collected from other sources

We may also use personal data about you that we have obtained from other sources:

Public sources: for example, we may obtain your contact details from LinkedIn or your company’s website so we can contact you about YouGov’s products and services.
Companies that maintain databases: we may obtain your contact details from organisations that maintain databases of information; for example, some organisations provide us with contact details so that we can contact you about our products and services.
Publication partners: we collaborate with industry thought leaders to produce content such as reports and white papers, and if you download our content from one of our partners, they may send us your contact details so that we can contact you about our products and services.
Your employer: if you work for an organisation that is a YouGov client, your employer may provide us with your contact details if you will be using our products and services.

If we contact you using information that we have not received directly from you, as outlined above, you have the right to ask us where we got your details from, and we will give you the option to opt-out of receiving further communications from us. You can find out more about the communications we may send to you in the ‘Emails and notifications’ section of this privacy notice.

How long we’ll keep your data

In this section we explain that how long we keep your personal data depends on how it is used

If you are or have been a YouGov client, we will keep the data we collected from you in providing our services until you ask us to delete it (which is explained in the section aboutYour rights). We keep your data to ensure we have an accurate record of who we have worked with in the past, which is especially useful if we are to work together again in the future.

Where we have collected your data for marketing purposes, we keep careful records of whether you have given consent (if that is required) or unsubscribed (opted out) of receiving marketing communications from us. When you unsubscribe from receiving marketing from us, we will keep your data so we can continue to respect your marketing preferences, for example by ensuring that we do not send you marketing emails where you have told us you do not want to receive them. Of course, you still have the right to ask us to delete your data, as explained in the section about Your rights.

How and why we use your personal data

In this section we explain how and why we use your personal data

We use the data that you share with us, or that we receive from the other sources, to contact you about our products and services and to give you the best possible experience as a prospect or client. Our use of personal data is described in more detail in the table below.

We use personal data to…	For example…
Register and authenticate your YouGov account	If you are a YouGov client, we will use your personal details to set up your account and to contact you about the products and services we provide If your organisation has granted you access to one of our online tools, we will use your email address and password to create your account and authenticate your identity each time you log on
Communicate with you about the products and services that we provide	If you are a YouGov client, we will use your data to contact you about research projects that you are involved in, and to respond to your queries
Enable you to create and approve a survey within YouGov Collaborate	We will use your email address and phone number to validate your approval of a survey, and we will send you helpful notifications (for example, when your survey has been completed) We show your name alongside your messages in our chat rooms, and use your account details to help us to answer your questions when you contact us
Monitor your use of YouGov’s online tools	We will track your logins and session activity to help us understand your use of our tools to fix bugs, respond to any issues or questions you may have, and provide insights for internal product development, training and other improvements
Send you marketing communications	Where we are permitted to do so, we will use your contact details to contact you (by email, post or telephone) about our products and services. You can unsubscribe from receiving future marketing communications at any time

Legal grounds for processing your personal data

YouGov is committed to the lawful, fair and transparent use of personal data. In processing personal data for the purposes of providing our clients with our products and services, we process your personal data on the grounds that our processing is necessary for legitimate interests we pursue as a business, namely that our business relies entirely on the ability to use your personal data to work with you to produce research and insights.

If we send you marketing communications to tell you about our products and services, we rely on one of the following legal grounds for processing:

Legitimate interests; or
Consent

Because marketing rules vary between countries, the legal ground for processing that we rely on will depend on (1) which YouGov company is sending the marketing communications, and (2) your geographic location.

If you have any questions about the grounds under which we process your personal data, or would like to find out more about the approach we take to determine that these grounds apply, please contact our Data Protection Officer using the contact details in the ‘How to contact us’ section.

In order to use your personal data in the ways described above, we may share it within YouGov, with trusted third parties who provide services to us, and on rare occasions with clients (but only if you have specifically agreed to that). Here is some more information about the types of organisation and what we may share with them:

YouGov Group companies	YouGov is a global organisation. This means that some of the personal data that we collect may be transferred to companies in the YouGov group that are in different countries. For example, on multi-country accounts our account managers and researchers will work with their counterparts in other countries to best serve our clients.
Our clients	From time-to-time, our clients request usage reports for YouGov’s online tools. For example, some clients use information about the use of our online tools to understand the penetration of the tool within the business. We may also share your name with other clients or prospective clients as part of a testimonial, but only with your permission.
Our publication partners	We may collaborate with other organisations to produce industry reports or white papers. If you download this content via an online form on our website or a partner’s website, we may share your contact details with the co-author of the content (we will only do this where we are permitted to do so, and we will always make you aware of this before you download the content).
Our service providers	We work with trusted service providers that carry out certain functions on our behalf so we can provide our services to you. These organisations process data on our behalf. They only have access to the personal data that they absolutely need to provide the specific service to us, and in all cases we have contractual safeguards in place to ensure that they do not disclose or use it for any other purposes. Our service providers fall within the following categories: Data collection technology (enables us to securely collect data submitted by research participants and others, and to collect anonymized data about the use of our websites, mobile applications and online tools) Cloud & physical data storage (data storage, which is managed by YouGov Services Limited) Web application firewall (protects web applications by filtering and monitoring HTTP traffic between a web application and the Internet) Communications platforms and technologies (enables us to communicate with people who engage with us) Payment providers (allows you to pay us for some of our services) Business management software (allows us to manage our pipeline of work) Postal and courier providers (used to send communications by post)
Other organisations	These circumstances are unusual, but we may share personal data with other organisations if: we have to share your information to comply with legal or regulatory requirements (or we reasonably believe that we need to disclose your information for such purposes); we need to share personal data in order to establish, exercise or defend our legal rights, including with our legal and other professional advisors; we restructure our business or if we buy or sell any business or assets we may share your data with the prospective buyer or seller; all or substantially all of our company assets are acquired by another party, your data will be one of the transferred assets

Transferring personal data outside the EEA

If you are based in the European Economic Area (“EEA”), or Switzerland, we take all steps possible to ensure that your personal data remains within those areas. However, in some cases we need to share data with other YouGov group companies or third parties that are in countries outside those areas. These countries may not have similar data protection laws and so they may not protect the use of your personal information to the same extent.

In these cases, we put in place appropriate safeguards to make sure your personal data remains adequately protected. Specifically, we make use of the following:

Standard contractual clauses: we use standard contractual clauses for the transfer of personal data to organisations outside the EEA. These contractual commitments have been adopted by the European Commission and ensure adequate protection for personal data transferred to countries outside the EEA by binding recipients of personal data to certain data protection standards including obliging them to apply appropriate technical and security measures. We use standard contractual clauses when we transfer data to other YouGov Group companies and for transfers to recipients that are not located in a country covered by an adequacy decision (see below).
Adequacy decisions: where the European Commission, or other relevant competent authority, has determined that a country outside the EEA or Switzerland offers an adequate level of data protection, personal data may be sent to that third country without implementing any other safeguards mentioned above. YouGov may rely on adequacy decisions when transferring data to companies based in countries where such assurances have been given.

How we store and protect your personal data

We know how important it is to protect your personal data while we have it. This section describes some of the measures we take to ensure that it is kept secure

We do everything we can to protect your personal data from loss or misuse, and from unauthorised access, disclosure, alteration and destruction. This section describes some of the measures we take to ensure that your personal data is secure:

We use data centres that have a high level of physical security measures to host and protect your data and our systems;
We conduct independent penetration tests on an annual basis and are continuously scanning our systems and applications for vulnerabilities in our systems; if you ever think that you have found a security issue or vulnerability in one of our systems please let us know at security@yougov.com;
We use encryption to secure your personal data whilst it is in transit using TLS and in storage using AES256 encryption;
We allow access to attributable data (by which we mean data that directly identifies you) only to those YouGov employees and contractors who need it to carry out their job responsibilities, for example our support team to allow them to respond to you when you contact us;
We make security the responsibility of all our employees and contractors and we train our staff to identify security risks and protect your data.

Our website may from time to time contain links to and from other websites. If you follow a link to any of those websites, please note that those websites ought to have their own privacy notices and that we do not accept any responsibility or liability for those websites. Please check those privacy notices before you submit your information to those websites.

Emails and notifications

This section explains the choices you have when it comes to emails and notifications we may send to you

If you are a client of YouGov, it is important that we can send you emails and notifications about research projects that you are involved with. If you would prefer not to receive these service messages, you will not be able to continue as a YouGov client, and you should contact us if you want to discuss this further. In relation to these service messages, we rely on our legitimate interest in running our business as the legal grounds for this processing.

If you are a prospective client, we would like to send you marketing communications to tell you about our products and services, which could include information about industry insights, our data tools updates and emails direct from our sales teams. Because marketing rules vary between countries, the legal ground for processing that we rely on will depend on (1) which YouGov company is sending the marketing communications, and (2) your geographic location. You can read more about the legal grounds of processing that we rely on in sending these marketing communications in the ‘How and why we use your personal data’ section above.

Cookies and similar technologies

We use “cookies” to improve your experience by collecting data about how you use our website, mobile applications, and online tools. This section tells you about the cookies that we use, what they do and your choices when it comes to cookies.

Cookies are small data files that allow a website to collect and store a range of data on your desktop computer, laptop or mobile device. We use cookies and similar technologies, such as tags and pixels (“cookies”) to help us to provide features and functionality on our online tools and generally improve the way they work.

We use both cookies that YouGov sets (called ‘first party cookies’) and third-party cookies (which are not set by YouGov, but by other sites with YouGov’s permission). The table below lists and describes the cookies that we are placed on our online tools.

Cookie type/1st or 3rd party?	What the cookies are used for	Cookies we use to achieve this
Analytics, 1st and 3rd	We use analytics cookies to understand how you use our online tools so we can monitor performance and ultimately improve them. For example, by understanding how you use certain features, we can identify and fix page errors and improve the design and navigation.	Google Analytics _ga _gid _ga_xxxxxxxxxx _gat_gtag_UA_xxxxxxxx_x _gat_UA-xxxxxxxx-x _gcl_au Hotjar _gjAbsoluteSessionInProgress _hjDonePolls _hjFirstSeen _hjid _hjIncludedInPageviewSample _hjIncludedInSessionSample _hjMinimizedPolls _hjSession_ _hjSessionRejected _hjSessionUser_ HubSpot __hstc Hubspotutk __hssrc Visual Website Optimiser _vwo_uuid_v2, _vwo _vis_opt_test_cookie
Authentication, 1st	Authentication and tracking of your use of our online tools.	screen_session session_cookie_name session-id-newbrandindex termsaccepted token
Communication, 3rd	We use Intercom cookies to communicate with you, and you with us. For example, users provide feedback on our online tools.	intercom-id-tqufpmtd intercom-session-tqufpmtd
Marketing, 3rd	We use a Marketo cookie so we can identify existing and potential Marketo leads across our sites.	_mkto_trk
Payment, 3rd	We use Stripe to securely collect and storing credit card information.	_stripe_mid _stripe_sid
Security, 1st	We use Imperva Incapsula cookies to provide security to our sites by assigning an anonymous ID to visitors.	visid_incap_1896749 incap_ses_688_1896749 visid_incap_1944844

Your choices when it comes to cookies

Managing cookies via your preferences

When you accessed this website you were presented with an alert that offered you a choice about whether to accept or reject cookies, with the exception of strictly necessary cookies (which are outlined above).

Managing cookies on your device

You can also choose how web browser cookies are handled by your device via your browser settings. If you choose not to receive cookies at any time, websites may not function properly and certain services will not be provided. Each browser and device is different, so use the following links to find information on how to manage cookie settings on certain browsers via the following links:

Email tracking

Some of the emails we send to you may contain a ‘web beacon pixel’ or tracked links which allows us to identify when you have opened the email and to verify which links contained in the email you have accessed. We use this information to determine which parts of our emails are of most interest to you. You can delete the pixel by deleting the email.

Your rights

This section explains the rights that you have in relation to the personal data that we hold about you

You have certain rights in relation to the personal data that we hold about you, which are designed to give you more choice and control over your personal data. These rights are explained below.

Right	What does this mean?
The right to request access to personal data	You can request confirmation that we are processing your personal data, and a copy of the data we hold about you and related information (including when you gave us permission to use your data).
The right to request rectification of personal data	You can ask us to correct any inaccurate data about you and to complete any incomplete data that we hold about you.
The right to request erasure of personal data	You can request that we delete the personal data we hold about you. Please note that by asking us to delete your personal data you will no longer be able to participate research opportunities.
The right to withdraw consent	Whenever you have given us your consent to use your personal data, you have the right to change your mind at any time and withdraw that consent.
The right to request a restriction on processing of personal data	You can request that we restrict our use of your data to storage only, that we stop using it for all other purposes or that we retain data that was due for deletion.
The right to object to the processing of personal data	You can object to certain types of processing of your personal data in certain specific circumstances.
The right of data portability	Whenever you have given us your consent to use your personal data, you have the right to receive a copy of your personal data in a structured and machine-readable format and, where possible, have this sent to another organisation.

Automated decision making

We do not envisage that any decisions that will have a legal or other significant effect on you will be taken about you using purely automated means, however we will update this notice if this position changes and notify you of those changes.

Exercising your rights

You can exercise any of these rights by using the contact details below. Once you have submitted your request, we may contact you to request further information to authenticate your identity (because we want to make sure it is actually you requesting your data) or to help us to respond to your request. Except in rare cases, we will respond to you within 1 month of receiving this information or, where no such information is required, after we have received full details of your request. While some rights apply generally, some are only available in certain circumstances, so if we feel that any right is not available to you we will let you know along with the reason for our decision.

Lodging a complaint with a regulator

You have the right to lodge a complaint with a data protection regulator where your legal rights have been infringed, or where your personal information has or is being used in a way that you believe does not comply with data protection regulations. You may also be entitled to seek judicial remedy. You can find the contact details of the appropriate regulator online, for example by searching for ‘Data Regulator’ and the country you live or work in. However, we encourage you to contact us before making any complaint and we will seek to resolve any issues or concerns you may have.

How to contact us

If you have questions about this notice, or about how we collect, store and use personal data, you can contact our Data Protection Officer –

By email:

dataprotection@yougov.com

By mail:

The Data Protection Officer

YouGov Plc

50 Featherstone Street
London
EC1Y 8RT
United Kingdom

If you would exercise any of the rights described in the Your rights section of this privacy notice, you can contact us –