Is Konsumer Strategiez a data processor or data controller?

Konsumer Strategiez is a data controller due to the following reasons.

1. Konsumer Strategiez jointly with the client determine the purpose and means of the processing of personal data. Konsumer Strategiez determines why personal data is being collected, and how it will be processed and used.

2. Konsumer Strategiez collects personal data directly and via subcontracted data processors from individuals while onboarding consumers into WhatsApp chats.

3. Konsumer Strategiez decides who has access to it and for what purposes.

4. Due to the nature of the relationship which is direct, the individuals can contact the company directly with questions or concerns about their data.

Why do we have two data controllers?

Konsumer Strategiez is contracted by the client to process personal data hence client is also a data controller.

What is the liability of Konsumer Strategiez while processing personal data on behalf of a client?

Konsumers Strategiez has obligations under GDPR to ensure that personal data is processed securely and in compliance with GDPR requirements.

What is the care taken while subcontracting data collection to another Company?

The recruitment of consumers in various countries covered by the project will be subcontracted to a recruitment partner.

A written master service agreement is in place between the two parties, outlining the responsibilities and obligations of each party regarding the protection of personal data. This agreement outlines the following.

1. The purpose and duration of the processing.
2. The type of personal data to be processed.
3. The categories of data subjects.
4. The obligations and rights of the controller.
5. The technical and organizational security measures.
6. Requirement for audits and inspections.
7. The possibility of data transfers to third countries.
8. The conditions for termination of the agreement.

The subcontractor agrees to:

1. Process personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organization, unless required to do so by EU or Member State law to which the processor is subject.
2. Ensure that persons authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
3. Take all measures required to protect thesecurity of processing.
4. Assist the controller in ensuring compliance with the obligations taking into account the nature of processing and the information available to the processor.
5. At the choice of the controller, delete or return all the personal data to the controller after the end of the provision of services relating to processing, and delete existing copies unless EU or Member State law requires the storage of the personal data.

How does Konsumer Strategiez communicate with the individual participants of the research?

We use the following medium to communicate:

1. Individual participants signify acceptance online by indicating acceptance in the Consent form provided to them by the recruitment partner.
2. Email: Konsumer Strategiez or our recruitment partners use email as a medium to communicate with survey participants. While communicating we take care to ensure that the participant's personal data is not visible to anyone else.
3. Online survey platforms: Our recruitment partners use online survey platforms to communicate with survey participants. These platforms are designed to be GDPR-compliant and offer secure communication channels.
4. WhatsApp: Survey-related instructions, follow up, etc may be done via WhatsApp.
5. Phone: Our recruitment partners use phone calls as a means of communicating with survey participants after obtaining consent from the participant before making the call and they do not disclose any personal information over the phone.

What information is disclosed to consumers in the consent form for this project mention?

1. The identity of the data controller ie. names of the client & Konsumer Strategiez will be disclosed to the consumers.
2. Purpose of the data processing: (a)Individual consumers joining the WhatsApp groups will be required to contribute to the discussion regarding their behaviour, habits & attitudes, and opinions about products, brands and ideas. (b)The purpose of the data processing will be to gain a better understanding of a problem or phenomenon, to identify potential variables or factors that may influence the research problem, and to develop initial ideas and/or develop hypotheses about a topic to generate new research questions and avenues for future research.

Which rights of consumers are communicated to them prior to research?

1. Right to withdraw consent: Individuals can withdraw their consent to the processing of their personal data at any time by sending an email to privacy@konsumerstrategiez.com
2. Right to access and rectify: Individuals can exercise their rights to access and rectify their personal data by contacting Konsumer Strategiez via email. If there is a request to withdraw chats retroactively the consumer will follow the following protocol (a) If the request comes while the group is live, the group will be closed, all the chats contributed removed and a new group formed with other willing and eligible participants. (b) Should the request come later we will check if the WhatsApp group is already deleted and if not delete it immediately, Similar protocol is followed for Zoom conversations recorded by us. Further, all the Chats/videos containing personal information in our secured servers will be removed. (c) If the information has been shared with any one other person authorised to receive the same that person will be intimated about the requirement to delete all specific contents.
3. Consequences of holding consent: Individuals who choose not to provide consent will not be included as part of their search process and all related personal information will be deleted.
4. Automated decision-making: If the data will be used to make automated decisions, including profiling, individuals will be informed of this and given the right to object.
5. Konsumer Strategiez Provides individuals with information about their rights under the GDPR, such as the right to access their personal data and respond promptly to any requests.
6. Email id: privacy@konsumerstrategiez.com is solely devoted to receiving requests, feedback or complaints.

What Information about external parties who will monitor conversation is conveyed?

If external parties from client will be monitoring conversations in a WhatsApp group, or Zoom conversations, the participants should be informed of this fact in a transparent manner. This means that they should be made aware of who will be monitoring the conversations, for what purpose, and what personal data will be processed. Before recording Zoom conversations the zoom app automatically informs that recording is in progress and requests them to click to signify agreement.

What are the types of personal data obtained:

The following personal data is exposed to Konsumer Strategiez during the course of the study User’s profile picture on WhatsApp, name and status message. Participants can choose to hide their profile picture and status message from certain contacts or all on WhatsApp. In the case of zoom participants can share any name that that they want to share. Their email id available only to the recruiting organisation with whom they sign up to join the survey.

Our teams monitor the conversation live online to note any other personal information from the ones listed below gets recorded in the chat groups or Zoom conversations and take appropriate action to ensure compliance with GDPR regulations.

1. Full Name, address, email address, phone number, and other contact information
2. Date of birth, age, gender, and other demographic information
3. IP address, location data, and other online identifier
4. Employment history, education, and professional qualifications
5. Personal preferences, interests, and behaviour patterns which can be traced back to individual subject’s identity.

Management of photographs, Audio or Video recording collected as part of the market research project.

1. Konsumer Strategiez will gain permission to share such images from those data subjects whose faces are clearly visible and can be identified. If permission cannot be obtained, then the data subject’s image shall be pixelated or otherwise anonymised.
2. Konsumer Strategiez shall collect only the minimum amount of visual data necessary to achieve the research objective.

Discolosure about recipients of the data:

A list of any third parties whowill receive the data, including any data processors or sub-processors will be disclosed. For most projects the recruiting partner will be the data processor.

‍

Details about Data Storage protocol

1. The basis for processing the personal data will be a request by client to provide analysis / insights from the WhatsApp group / Zoom videos.
2. The personal data available after download of WhatsApp Chat data / Zoom Video is stored only for the specific purposes of providing consumer insights.
3. Information like individual mobile number and name available as part of the chat download or Zoom Video will be masked if possible prior to sharing with those provided access to our shared drives.
4. Konsumer Strategiez keeps personal data secure by implementing appropriate access controls.
5. We regularly review the personal data we hold and delete any data that is no longer needed after completion of the project.
6. Konsumer Strategiez have an internal process of detecting, reporting, and investigating data breaches if ever such an event occurs. All those involved in the process are required to report the same as soon as a breach comes to their knowledge.
7. Konsumer Strategiez provides individuals with information about their rights under the GDPR, such as the right to access their personal data, and respond promptly to any requests.
8. We keep records of our data processing activities, including any transfers of personal data outside of the European Union.

Meeting requirements for transfer of data outside European Union

While transferring data our side European Union the following actions will be mandatory followed.

1. Any personally identifiable information in thechats such as Name, Phone number of any other personal information in the chat output is removed from the chat prior to transfer.
2. Standard Contractual Clauses to ensure that adequate safeguards are in place to protect the rights of data subjects.
3. In an exceptional circumstance If any personal information is required to be transferred based on request by the client ,It will done only if the consent of data subject is explicitly available prior to consent to the transfer.

What is the data retention period ?

The WhatsApp Chat groups are closed within 7 days from the last day of research after informing all the participant.

‍

1. The WhatsApp Chat groups are deleted within 60 days from the closure date Zoom Video data is also deleted where appropriate following a similar protocol.
2. Personal Data stored in our secured shared drive will not be kept longer than is necessary for the purpose for which it is collected.

• All personal data is removed in from shared drive within 6 months after the completion of the project.

• Other WhatsApp chat conversations and Zoom videos which remain in our shared drive is routinely deleted once a year as part of our data maintenance protocol.