DATA PROTECTION POLICY

DATA PROTECTION POLICY

AdGreen believes in being open about what data we collect from our users and what we do with it. We work to the UK’s General Data Protection Regulation and the Data Protection Act (2018), which sets out comprehensive requirements for all companies handling the personal data. This includes a number of things we must tell you when we collect personal data from you. We also hold what might be termed ‘commercially sensitive data’, around things like levy payments, and in our carbon calculator's dataset.

We have provided all the information you need using a question-and-answer format. If you have any questions about our data protection policy, the data we hold on you, or you would like to exercise one of your data protection rights, please do not hesitate to contact us using info@weareadgreen.org. You can also write to us at: AdGreen, Lynton House, 7-12 Tavistock Square, London, WC1H 9LT United Kingdom.

WHAT KINDS OF PERSONAL DATA DO WE COLLECT, HOW DO WE COLLECT IT, AND WHY?

The type of personal data that we collect and use depends on the relationship you have with AdGreen, why you are interacting with us and which of our services or products you are using. We have listed the different services we offer below:

AdGreen calculator users

When you sign up to use the AdGreen carbon calculator we will ask for your first name, surname and email address in order to create an account for you to access the system. These details are required for us to be able log you in and to be able to send you transactional emails relating to your use of the AdGreen carbon calculator. Your contact details will be retained until your user account is deleted. Depending on your user permissions you may have to contact your company administrator to get your user account deleted.

If you are the administrator for a company, your contact details will be retained whilst your company is registered in the AdGreen carbon calculator until your company record is deleted, or an alternative company contact is provided.

We will not use these details for any other purpose.

The transactional emails noted above, when triggered by specific user actions, are sent by Mailgun. At the time of writing of this AdGreen Data Protection Policy, the Mailgun privacy policy was available here.

Data location: USA

The AdGreen carbon calculator is hosted on Amazon Web Services (AWS) servers in the USA. AWS use a raft of logical and digital security features to keep data stored on their servers secure. These security measures are detailed here.

The security and privacy standards provided by AWS are defined in their online Service Terms (found here). These terms incorporate a specific Data Processing Addendum (found here). This Addendum includes EU Model Clauses, which were approved by the European Union (EU) data protection authorities, known as the Article 29 Working Party. This means that personal data stored on AWS servers is given the same high level of protection it receives in the UK.

AdGreen company registrations

Companies who want their staff to use AdGreen’s carbon calculator will need to be set up by the AdGreen team. To speed things up, we invited companies to register using an online form. This includes a contact (first, last, email) for the purposes of confirming any information as required, and an admin (first, last, email) for the purpose of setting them up to approve new user accounts.

The form used is here. We will not use these details for any other purpose, and once loaded into the system, records are deleted.

Board Members and Industry Partners

The data we collect from both of these groups and the ways we use this data are broadly the same.

We will record name, title and email address details of any staff which the organisation wishes to take part in the meetings or receive updates. If your details have been passed to us by your organisation then your organisation should have directed you to this Data Protection Policy when they collected your details. Your details will be used to update you about, and/or invite you to take part in any events or initiatives which might be of interest to you or your organisation. Your details will be kept until such time that the company is no longer a Board Member or Industry Partner.

Event and Training attendees in Eventbrite

If you attend an event or training session run by AdGreen we will collect your name, email address and details of your employment for the purpose of promoting future AdGreen initiatives and events.

This data will be collected and stored by Eventbrite. When you register to attend an event or training session, you are given the option to sign up for the AdGreen newsletter, and/or the option to consent to your information being passed to our Industry Partners (where relevant).

If you have indicated that you would like to receive the newsletter then we will use your name, title, company, country, company type and email address to send you the newsletter (which if occasionaly targeted to those in specific countries and/or company types).

If you have expressed an interest in hearing from one or more of our Industry Partners, we will pass your details (name, title, company, country, company type and email address) to the relevant partner. In these cases, we would urge you to review the partner's privacy policy before indicating you are happy to be contacted by them.

If you have any questions or concerns about the data stored by Eventbrite please refer to their Privacy policy. At the time of writing of this AdGreen Data Protection Policy, the Eventbrite privacy policy was available here. AdGreen uses the tools provided by Eventbrite to delete attendance for events after 2 years. For details of how long training session details are kept, see below.

Data location: USA

Training attendee details for AdGreen's purposes

If you attend a course that is run by AdGreen then we will collect your email address and name, along with your company name, company type, title and country.

We require these details in order to be able to contact you to send you details and reminders relating to the training and ultimately, on successful completion of the training, send you your badge (which is sent by our freelance trainers).

We may also use these details from time to time send you updates and invitations about AdGreen events, initiatives and job opportunities. We will not add you to our mailing list unless expressly indicated when you sign up for a training session.

We also use job titles, company names, company type and country to analyse training attendance and provide top line stats to our advisory board and to communicate the uptake in our PR.

From time to time we are asked to validate if a particular individual has attended a training course. For this reason we retain details of training attendance indefinitely. This is only done on request and we will always ensure the person requesting the information has the right to ask for it before it is provided to them.

Newsletter subscribers in Mailchimp

If you subscribe to one of our newsletters then we will need to hold your email address in order to email you. We also ask for a first and last name so that we can make our emails more friendly, as well as your company name, company type, title and country. This is so that we can segment our mailing list and send things that are most relevant to you.

You can subscribe to our newsletter in a variety of ways:

  • via an event or training session Eventbrite sign up, indicating you'd like to join on the custom questions
  • via an event or training session Eventbrite sign up, indicating you'd like to join via the 'Keep me updated on the latest news, events, and exclusive offers from this event organiser.' box
  • via our newsletter sign up form (e.g. clicked on the link from AdGreen team email signatures or the website footer)

The above is reflected in the email footer of each email we send, along with the option to unsubscribe. We will retain your details as above until you unsubscribe from the Newsletter. Every newsletter we send includes an unsubscribe link at the bottom.

At the time of writing of this AdGreen Data Protection Policy, the Mailchimp privacy policy was available here.

Data location: USA

Website analytics

In common with most other websites we use website analytics software which collects data about how people use our websites. However, this is anonymised and cannot be traced back to you. We use this to help make sure our web servers are working well and to see which parts of our websites are most/least popular. This helps us to improve the overall user experience.

Levy collectors

Companies who register to collect the levy do so via an online form. This includes finance and production contacts (first, last, title and email in both cases) for the purposes of confirming any information as required, and to send declaration forms each quarter (see below). Information will be kept until an alternative contact if provided, or until such time that a company indicates that they no longer wish to be a registered levy collector.

The form used is here. We will not use these details for any other purpose.

Levy payers

Companies who register to pay the levy do so via an online form. This includes the contact details of the person completing the form (required) and the marketing contact (optional). First, last, title and email are collected in both cases, for the purposes of confirming any information as required.

The form also includes optional fields to enter information about principle production partners (PPPs) the brand works with, including a contact name, title and email. This is for the purpose of discussing levy collection with any PPPs who have been declared. Information will be kept until an alternative contact if provided, or until such time that a company indicates that they no longer wish to be a registered levy payer.

The form used is here. We will not use these details for any other purpose.

Levy quarterly declarations

Companies who register to collect the levy will be contacted each quarter and asked to complete the quarterly declaration form. This includes the name of the person completing the form (first, last, title and email), and optionally, an additional space to provide an invoice contact (first, last, title email). These details are collected for the purposes of confirming any information as required, and to send invoices to. Information will be kept until an alternative contact if provided, or until such time that a company indicates that they no longer wish to be a registered levy collector.

The form used is here. We will not use these details for any other purpose.

Creative energy submissions

Companies wishing to enquire about switching to renewable energy via the Creative Energy project can complete a form which is sent to AdGreen, but also to the albert team managing the Creative Energy project. The form collects first, last, company, title, email and phone number for the purposes of confirming any information as required.

The form used is here, and albert's privacy policy is here - see 'Miscellaneous Contact Details'.

Contact form submissions and miscellaneous contact details

During our normal day-to-day operations we receive enquiries and other communications from people by phone, email etc. If you contact us by phone, post, email or website contact form, then our systems may store any of the contact details you provide in doing so e.g. your email address.

We will use these details to contact you and to pursue AdGreen's legitimate business interests. We may make a record of discussions we have with you over the phone so that we can provide a consistent and efficient service if you call again.

The website contact form is here.

WHAT KINDS OF COMMERCIALLY SENSITIVE DATA DO WE COLLECT, HOW DO WE COLLECT IT, AND WHY?

The types of commercially sensitive data that we collect and use is stored, is listed below:

Levy amounts collected

We request details of levy amounts collected (amount, client name) from all registered collectors each quarter. This is so that we know much to invoice each collector for, and which brands are participating. Information will be kept for at least 5 years after the 31 January submission deadline of the relevant tax year, in line with HMRC guidance.

Production spend data

Production spend data for 2018 and 2019 has been previously supplied by a number of parties in order that we understand the scale of production spend in the UK. All surveys have been treated securely and financial data supplied has only ever been presented in aggregate (for example in the Levy Guide). Production spend data for relevant years is also occasionally supplied by organisations wanting to contribute to the levy in bulk. Information will be kept until it is deemed no longer relevant or useful in reference to calculating the levy percentage, or individual organisation's contributions, and we expect this to be after 5 years.

Production and carbon details in the AdGreen carbon calculator

When using the carbon calculator, Principal Production Partners (PPPs) and Third Party Production Partners (TPPPs) will add a number of details to a campaign, and projects held within campaigns. This includes: brand, production consultancy, campaign name, brand position, project type, dates associated with the production, director/photographer name, the duration of assets being generated, production method, number of shoot days and the budget. With the exception of the budget field (which is only visible to the PPP and reviewer companies - that is the brand, brand parent, production consultancy and ad agency parent), all attributes for campaigns and projects are visible to everyone associated with the campaign (that is everyone who has been invited to either review it or contribute to it).

These campaign and project attributes are collected for one or both of the following reasons:

  • To help users differentiate one campaign or project from another (e.g. project name or director/photographer)
  • For AdGreen, reviewer companies and contributor companies (ad agencies, production companies and service companies) to be able to segment data and draw conclusions to inform actions

In addition to these attributes, contributor companies will also supply carbon data about the activities conducted in the course of a project, specifically linked to the areas of travel, powering offices, studios, locations and other spaces, materials used, and waste disposal. Again, carbon data for projects is visible to everyone associated with the project itself, and wider campaign (that is everyone who has been invited to either review it or contribute to it), although there are a number of additional security rules in terms of the detail available to the various parties.

Any data used to illustrate findings ascertained from the dataset has been and will only ever be presented in aggregate (for example in annual reports). Data held in the AdGreen Carbon Calculator will be kept indefinitely so that progress can be tracked towards the ultimate goal, net zero emissions from advertising production.

The AdGreen carbon calculator is hosted on Amazon Web Services (AWS) servers in the USA. AWS use a raft of logical and digital security features to keep data stored on their servers secure. These security measures are detailed here.

The security and privacy standards provided by AWS are defined in their online Service Terms (found here). These terms incorporate a specific Data Processing Addendum (found here). This Addendum includes EU Model Clauses, which were approved by the European Union (EU) data protection authorities, known as the Article 29 Working Party. This means that personal data stored on AWS servers is given the same high level of protection it receives in the EEA.

HOW DO WE LOOK AFTER PERSONAL AND COMMERCIALLY SENSITIVE DATA?

We have put in place appropriate security measures to help prevent your personal data, and commercially sensitive data from being accidentally lost, used or accessed in an unauthorised way. In addition, we limit access to your personal data and commercially sensitive data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data or commercially sensitive data on our instructions and subject to a duty of confidentiality.

We have also put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. The same applies to commercially sensitive data we hold.

The AdGreen carbon calculator has been developed for AdGreen by a subsidiary of BAFTA called BAFTA Media Technology (BMT). BMT maintain the servers which store all of the AdGreen carbon calculator data. BMT staff have access to these servers, and therefore the data on them for maintenance purposes, but BMT are forbidden by their contract from using any of this data for any other purpose than providing the AdGreen carbon calculator service.

Some technical tasks, such as configuring and securing our servers, require specialist expertise. We use specialist UK-based contractors to provide these services. These contractors are carefully vetted. All contractors must sign non-disclosure agreements which include a requirement that they keep all AdGreen data confidential.

WHAT ARE YOUR DATA PROTECTION RIGHTS?

We would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following:

  • The right to access – You have the right to request for copies of your personal data. Depending on the amount of effort required we may charge you a small fee for this service.
  • The right to rectification – You have the right to request that we correct any information you believe is inaccurate. You also have the right to request us to complete information you believe is incomplete.
  • The right to erasure – You have the right to request that we erase your personal data, under certain conditions.
  • The right to restrict processing – You have the right to request that we restrict the processing of your personal data, under certain conditions.
  • The right to object to processing – You have the right to object to us processing of your personal data, under certain conditions.
  • The right to data portability – You have the right to request that we transfer the data that we have collected to another organisation, or directly to you, under certain conditions.
  • If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us.

PRIVACY POLICIES OF OTHER WEBSITES

The AdGreen website contains links to other websites. Our privacy policy applies only to our website, so if you click on a link to another website, you should read their privacy policy.

 

CHANGES TO OUR DATA PROTECTION POLICY

AdGreen keeps its privacy policy under regular review and places any updates on this web page. This data protection policy was last updated on 27th September 2021.

 

HOW TO CONTACT THE APPROPRIATE AUTHORITY

Should you wish to report a complaint or if you feel that AdGreen has not addressed your concern in a satisfactory manner, please contact us in the first instance. However, you may contact the Information Commissioner’s Office at any time. You can also contact us using info@weareadgreen.org. You can also write to us at: AdGreen, Lynton House, 7-12 Tavistock Square, London, WC1H 9LT United Kingdom.