Privacy policy for panelists

The Policy applies to you if:

you have completed a Mediapanel research questionnaire (even if only in part) that displays when you browse the Internet or that you have otherwise received

and

you have installed a plug-in for Mediapanel research in your browser and/or
you have installed the NetPanel application on your mobile device.

(We refer to the NetPanel application and the plug-in for Mediapanel research installed in your browser as Software in the Policy)

If you are a panelist who has completed a Mediapanel research questionnaire but has not installed the Software, the privacy policy that applies to you accepts when you complete the Mediapanel research questionnaire. To recall its contents, please contact us in accordance with the information in the section " Contacting us about the data processing".

If you are a panelist in the "Smartphone for Panelist" project, the privacy policy for this project can be found here.

Principles of processing personal data of panelists in Mediapanel research("Research")

The aim of the Research is to define the profile of internet users who use internet resources, i.e., who visit websites, and use applications, including a statistical profile of media audiences, including the profile of recipients of advertising campaigns carried out on the Internet. The collected data allow us to present collective statistical information on the media users.

To properly implement the purpose of the Research, we need socio-demographic data collected through the Research questionnaire. After completing the Research questionnaire, we may ask you to install the Software.

Our identity and responsibilities

Because the Policy specifies how we process data in the different markets in which we operate, we indicate the controller of your personal data in the Research questionnaire.

If you did not complete the Research questionnaire but installed the Software, your data controller is Gemius S.A., based in Warsaw, 48 Domaniewska Street (02-672). However, since, in such a case your data is useless to us for conducting the Research, we kindly ask you to uninstall the Software.

If you are unsure who is your personal data controller, we kindly ask you to contact us at the address in the section "Contacting us about the data processing".

When and how do we collect data?

We collect your data when you visit sites monitored by us that participate in the Research. We do this through cookies in accordance with the Cookie Policy available on our website. The publishers of the sites you visit inform you about this kind of data processing in their policies.

Per our agreements with publishers, we may invite you to participate in the Research by showing you a Research questionnaire with socio-demographic questions. When you complete it, you become a panelist in the Research. Sometimes we may ask you to install the Software at the end of the Research questionnaire.

From time to time, we may ask you to update your data through additional questionnaires.

In some markets, you may receive such an invitation to participate in the Research, complete a Research questionnaire or install the Software by other means, such as email.

Below you will find a description of what data we collect from our panelists and what sources we obtain it from.

What kind of data is collected?

The data we collect and the sources of this data are presented in the table below.

Data	collected by a Research questionnaire	collected by the browser plug-in	collected by the Netpanel application
Socio-demographic data, such as age, sex, education, etc. These might also involve data on shopping preferences or information on the way of using the internet.	YES	NO	NO
For some markets, we may ask you to provide contact information such as email address or phone number.	YES	NO	NO
The data on the internet websites you visit (e.g. the URL of the website you visit and the time the website was opened) and on the content displayed.	NO	YES	YES
Online IDs of a device, browser ID, and technical data of the device used by you (screen resolution, operating system.	YES	YES	YES
The data about your clicks on the websites that you visit, including the information on your interaction with the adverts, displayed to you.	NO	YES	NO
The data on purchases made on the Internet, including goods, methods of payments, and deliveries.	NO	YES	NO
Location data approximate or accurate, depending on the settings of the mobile device.	NO	NO	YES
Advertising ID, which is an ad display ID assigned by Google Play Services that you can reset or block using your operating system settings;	NO	NO	YES
User agent, which is a string of characters contains information on, for example, the type of mobile device, operating system, version of the application and your identifiers;	YES	YES	YES
Data about the applications you open on your mobile device and the time you use them	NO	NO	YES
Metadata of audio files played on your mobile device within a given application, i.e., album name, song name, artist, time, name of the application on which the audio file was played	NO	NO	YES

Purposes of data processing and data retention

Processing purpose	Legal basis	Data retention
Conducting the Research in accordance with this Policy	Your consent. (Article 6(1)(a) of the GDPR) You can withdraw it at any time	The data is processed for the period of conducting the Research in a given country, and then for the period of expiry of claims that be directed to us by our contractors. After that period, the data is anonymized. The data is also anonymized when you withdraw your consent
Technical support provision	Legitimate interest of the data controller(Article 6(1)(f) of the GDPR)	The data is processed for the period of expiry of claims resulting from the provided technical support unless you object to the processing earlier, and it will be positively considered.
Contacting you in particular in the following circumstances: providing information and interesting facts about the Research, inviting you to wider participation in the Research, inviting you to participate in lotteries, competitions, or loyalty programs	Legitimate interest of the data controller (Article 6(1)(f) of the GDPR)	The data is processed for the period of conducting the Research in a given country unless you object to the processing earlier.

To whom may we disclose your data?

We may share your data with the following:

our subcontractors, including providers of IT systems and analytical and hosting services;
a company that orders Research on a given market – to verify our calculations and statistics. In such a situation, the shared data scope is minimalized by us;
our business partners for their research and statistical purposes consistent with the purposes of the Research. In such a situation, we provide your data in a form that prevents any direct or indirect identification (for example, we can limit the data scope, encrypt the identifiers, replace part of the data with a pseudonym, and take other measures of data protection);
entities organizing competitions or loyalty programs - if we organize such activities.

Is your data passed outside the European Economic Area (“EEA”)?

The data is not passed outside the EEA.

If you are a Panelist from outside the EEA, your data may be transferred to the country you come from. In such a situation, we apply appropriate agreements and regulations so as to ensure the appropriate standard of processing security and the legality of such an operation.

If it is necessary to transfer your data outside the EEA, then we will follow the relevant provisions of law, in particular:

- we will ask you for your express consent to such transfer and

- we will inform you about the risks associated with such a transfer.

What are your rights?

Respecting your personal rights, we support data protection according to the binding law regulations. You have the right to:

withdraw your consent at any time;
erasure of personal data which concerns you;
rectification of your data;
restriction of your data processing;
right to request access to the data which concerns you;
object to the processing of your data;
data portability of your data.

To exercise these rights, contact us at the email address privacy[at]gemius.com, at the postal address of the data controller, or visit the Gemius Privacy Tool website. Remember that if you have filled out the Research questionnaire, installed the Software, and then want to withdraw your consent, you should also uninstall the Software. If you reinstall it, it will indicate to us that you are giving us your consent again to process your data.

Obligation to provide data

You do not have to share your data. You can always withdraw the consent given by contacting us at privacy[at]gemius.com or at the postal address of the data controller. Such an action brings on that your data are not processed for the purposes of the Research anymore. If you object to e-mail communication (e.g., you click the appropriate link in the e-mails you receive), you will not receive invitations to competitions or loyalty programs.

Additionally - if you had installed Software, you should uninstall it. If you do not do this, the data will be sent to us, however, after the consent withdrawal, the data will not be used for the Research statistics calculations.

Are your interests or other information predicted on the basis of the collected data?

No, we do not use the data for the purposes of profiling.

Contacting us about the data processing

Any questions and doubts about the scope of data processing might be sent to the e-mail address netpanel [at] gemius.com, or at the postal address of the data controller.

We have also appointed a Data Protection Officer - Jacek Grabowski. You can contact him at the e-mail address privacy [at] gemius.com.

You have the right to complain

If you think that we act against this Policy or have any questions, please contact us at the address above. You can also apply with a formal complaint to the personal data protection authority.

Updates to this Policy

We protect your rights and freedoms in accordance with the law. If we make a vital change to this Policy, we will make all reasonable efforts to inform you at least 14 calendar days before implementing this vital change.