Market Research Privacy Statement
Bayer Public Limited Company, whose address is 400 South Oak Way, Green Park, Reading, RG2 6AD (hereinafter “us”, “our” and “we”), in its capacity as controller for the processing of your personal data, wishes to provide you with information on the processing of your personal data.
1 Purpose of processing and categories of personal data
Your contact information (for example name, telephone number, profession) will be used for performing market research, either by us or on our behalf.
- Where we have collected your personal data
Where we have collected data about you including in relation to our business interactions with you and stored in our customer relationship management system
We will use your contact details for the purpose of contacting you about market research in order to pursue our legitimate interest to improve how we communicate with our customers about, and to continuously improve, the products / services / information which we offer (the legal basis for processing is Art 6(1)(f)).
We, or an agency instructed by us, will only contact you if we believe that the area we are researching would be of relevance or interest to you on the basis of other information we hold about you which we use to create profiles in our customer records management systems. For example, if you indicate which treatment areas you are interested in receiving product/service updates about, and have previously provided feedback on the topic, we would consider you for market research relating to those treatment areas.
If you do not want to be contacted for market research purposes (including if you do not want us to use your information to create a profile for market research purposes), please let us know. You can do this either when we contact you or by email to the Data Protection Officer whose contact details are provided at the end of this statement.
If you participate in a market research project on this basis, we will usually only receive aggregate data such as statistical or demographic data (“Aggregate Data”) from the market research organization. Aggregate Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity.
If the market research organization does transfer any personal data about you to us, we would treat your personal data in accordance with this privacy statement.
- Where your personal data is held by a market research institute / organization or agency
In some cases, we may instruct a market research organization to carry out a particular piece of market research, but they will use their own contact lists.
If you participate in a market research project on this basis, we may still be considered a data controller in this instance for the purposes of data protection legislation as we decide what the market research organisation should ask you and how. However, as mentioned above, we will usually only receive Aggregate Data” from the market research organization.
If the market research organization does transfer any of your personal data to us, you would be made aware of this and we would treat your personal data in accordance with this privacy statement.
2 Transfer of personal data
2.1 Commissioned market research
For the processing of your personal data, we will to some extent use specialized service contractors who act as our data processors. Such service contractors are carefully selected and regularly monitored by us. They will only process personal data in accordance with our instructions and on the basis of an appropriate data processing agreement.
2.2 Processing of data outside the EU / the EEA
Your data will in part also be processed in countries outside the European Union (“EU”) or the European Economic Area (“EEA”), which may have a lower data protection level than European countries. In such cases, we will ensure that a sufficient level of protection is provided for your data, e.g. by concluding specific agreements with our contractual partners (copy available on request), or we will ask for your explicit consent to such processing.
3 Retention period
Your personal data stored in our CRM system for the purpose of contacting you will be stored for a period set out therein.
Responses to the market research project will only be stored by the market research organization for as long as is necessary to validate the outcomes presented in the Aggregate Data.
Aggregate Data may be kept indefinitely as it contains no personal data.
4 Legal basis for processing your personal data
|Purpose||Legal basis||Explanation||Provision of personal data required||Consequences of failure to provide personal data|
|Process your personal data for the purposes contacting you about participating in a market research project||Art 6(1)(f) General Data Protection Regulation (GDPR) – legitimate business interests||To continuously improve the products/services/ information that we offer to our customers||No, as this data is already held in our database||-|
|Process your personal data for for the purpose of conducting a market research project||Art 6(1)(f) GDPR – legitimate business interests based on your agreement to participate in the market research project; or Art 6(1)(a) GDPR – consent.||To continuously improve the products/services/ information that we offer to our customers||No||If you chose not to respond to the questions, you will not be able to participate in the market research project|
5 Information regarding your rights
You will always have the right to ask us about what personal data we have about you and ask us to correct it if it is wrong. You can also ask us to limit what we do with your data or ask us to delete it completely. You can also ask us to give you the information which you gave to us.
For any feedback you provide us, you can object to us using that at any time.
If you are not happy with how we have handled your personal data, you can complain to the data protection authority (for the UK that is the Information Commissioner’s Office https://ico.org.uk/).
For any questions you may have with respect to data privacy or if you wish to exercise your rights, please contact our company data protection officer:
Data Protection Officer
Legal and Compliance Department
400 South Oak Way
Telephone: +44 (0)118 206 3000
This privacy statement was drafted: 28.06.2018