DATA PROTECTION POLICY
Advertising Association AdGreen ltd believes in being open about what data we collect from our users and what we do with it. We work to the UK’s General Data Protection Regulation and the Data Protection Act (2018), which sets out comprehensive requirements for all companies handling the personal data. This includes a number of things we must tell you when we collect personal data from you. We also hold what might be termed ‘commercially sensitive data’, around things like levy payments, and in our carbon calculator’s dataset.
We have provided all the information you need using a question-and-answer format. If you have any questions about our data protection policy, the data we hold on you, or you would like to exercise one of your data protection rights, please do not hesitate to contact us using info@weareadgreen.org. You can also write to us at: AdGreen, Lynton House, 7-12 Tavistock Square, London, WC1H 9LT United Kingdom.
WHAT KINDS OF PERSONAL DATA DO WE COLLECT, HOW DO WE COLLECT IT, AND WHY?
The type of personal data that we collect and use depends on the relationship you have with AdGreen, why you are interacting with us and which of our services or products you are using. We have listed the different services we offer below:
AdGreen calculator users
When you sign up to use the AdGreen carbon calculator we will ask for your first name, surname and email address in order to create an account for you to access the system. These details are required for us to be able log you in and to be able to send you transactional emails relating to your use of the AdGreen carbon calculator. Your contact details will be retained until your user account is deleted. Depending on your user permissions you may have to contact your company administrator to get your user account deleted.
If you are the administrator for a company, your contact details will be retained whilst your company is registered in the AdGreen carbon calculator until your company record is deleted, or an alternative company contact is provided.
We will not use these details for any other purpose.
If you, or the company for which you are working, operates in the territory or territories covered by one or more of AdGreen’s international partners (as listed here, as updated from time to time), we will provide your data to the applicable international partner(s), which will process it on our behalf to help provide our services to you. Where this entails a transfer of personal data within the meaning of Chapter V of the UK GDPR, we will have in place appropriate safeguards with the relevant international partner(s), which will be the standard contract clauses unless stated otherwise on the AdGreen website.
The transactional emails noted above, when triggered by specific user actions, are sent by Mailgun. At the time of writing of this AdGreen Data Protection Policy, the Mailgun privacy policy was available here.
Data location: USA
The AdGreen carbon calculator is hosted on Amazon Web Services (AWS) servers in the USA. AWS use a raft of logical and digital security features to keep data stored on their servers secure. These security measures are detailed here.
The security and privacy standards provided by AWS are defined in their online Service Terms (found here). These terms incorporate a specific Data Processing Addendum (found here). This Addendum includes EU Model Clauses, which were approved by the European Union (EU) data protection authorities, known as the Article 29 Working Party. This means that personal data stored on AWS servers is given the same high level of protection it receives in the UK.
Advisory Board Members and Industry Partners
The data we collect from both of these groups and the ways we use this data are broadly the same.
We will record name, title and email address details of any staff which the organisation wishes to take part in the meetings or receive updates. If your details have been passed to us by your organisation then your organisation should have directed you to this Data Protection Policy when they collected your details. Your details will be used to update you about, and/or invite you to take part in any events or initiatives which might be of interest to you or your organisation. Your details will be kept until such time that the company is no longer an Advisory Board Member or Industry Partner.
Event attendees in Eventbrite
If you attend an event run by AdGreen we will collect your name, email address and details of your employment for the purpose of promoting future AdGreen initiatives and events.
This data will be collected and stored by Eventbrite. When you register to attend an event, you are given the option to sign up for the AdGreen newsletter, and/or the option to consent to your information being passed to our Industry Partners (where relevant).
If you have indicated that you would like to receive the newsletter then we will use your name, title, company, country, company type and email address to send you the newsletter (which is occasionally targeted to those in specific countries and/or company types).
If you have expressed an interest in hearing from one or more of our Industry Partners, we will pass your details (name, title, company, country, company type and email address) to the relevant partner. In these cases, we would urge you to review the partner’s privacy policy before indicating you are happy to be contacted by them.
If you have any questions or concerns about the data stored by Eventbrite please refer to their Privacy policy. At the time of writing of this AdGreen Data Protection Policy, the Eventbrite privacy policy was available here. AdGreen uses the tools provided by Eventbrite to delete attendance for events after 2 years.
Data location: USA
Event Feedback Forms
After events are completed, the hosts distribute a link to a feedback form. Leaving your contact details (name, email) is optional and should only be done if you would like us to respond to your comments.
The form used is here. We will not use these details for any other purpose.
Training attendees in eWebinar
If you attend an online training session run by AdGreen we will collect your name, email address and details of your employment. We require these details in order to be able to contact you to send you details and reminders relating to the training and ultimately, on successful completion of the training, send you your badge.
This data will be collected and stored by eWebinar. When you register to attend a training session, you are given the option to sign up for the AdGreen newsletter. If you have indicated that you would like to receive the newsletter then we will use your name, title, company, country, company type and email address to send you the newsletter (which is occasionally targeted to those in specific countries and/or company types).
We also use job titles, company names, company type and country to analyse training attendance and provide top line stats to our advisory board and to communicate the uptake in our PR.
From time to time we are asked to validate if a particular individual has attended a training course. For this reason we retain details of training attendance indefinitely. This is only done on request and we will always ensure the person requesting the information has the right to ask for it before it is provided to them.
If you have any questions or concerns about the data stored by eWebinar please refer to their Privacy policy. At the time of writing of this AdGreen Data Protection Policy, the eWebinar privacy policy was available here.
Data location: Canada
Training Session Feedback Forms
After training sessions are completed, the hosts distribute a link to a feedback form. Leaving your contact details (name, email) is optional and should only be done if you would like us to respond to your comments.
The forms used are here and here. We will not use these details for any other purpose.
Newsletter subscribers
If you subscribe to one of our newsletters then we will need to hold your email address in order to email you. We also ask for a first and last name so that we can make our emails more friendly, as well as your company name, company type, title and country. This is so that we can segment our mailing list and send things that are most relevant to you.
You can subscribe to our newsletter in a variety of ways:
-
- via an Eventbrite event sign up, indicating you’d like to join on the custom questions
- via an Eventbrite event sign up, indicating you’d like to join via the ‘Keep me updated on the latest news, events, and exclusive offers from this event organiser.’ box
- via an eWebinar training session sign up, indicating you’d like to join
- via our newsletter sign up form (e.g. clicked on the link from AdGreen team email signatures or the website footer)
The above is reflected in the email footer of each email we send, along with the option to unsubscribe. We will retain your details as above until you unsubscribe from the Newsletter. Every newsletter we send includes an unsubscribe link at the bottom.
At the time of writing of this AdGreen Data Protection Policy, the Mailchimp privacy policy was available here.
Data location: USA
Website analytics
In common with most other websites we use website analytics software which collects data about how people use our websites. However, this is anonymised and cannot be traced back to you. We use this to help make sure our web servers are working well and to see which parts of our websites are most/least popular. This helps us to improve the overall user experience.
Levy collectors
Companies who register to collect the levy do so via an online form. This includes finance and production contacts (first, last, title and email in both cases) for the purposes of confirming any information as required, and to send declaration forms each quarter (see below). Information will be kept until an alternative contact is provided, or until such time that a company indicates that they no longer wish to be a registered levy collector.
The form used is here. We will not use these details for any other purpose.
Levy quarterly declarations
Companies who register to collect the levy will be contacted each quarter and asked to complete the quarterly declaration form. This includes the name of the person completing the form (first, last, title and email), and optionally, an additional space to provide an invoice contact (first, last, title email). These details are collected for the purposes of confirming any information as required, and to send invoices to. Information will be kept until such time that a company indicates that they no longer wish to be a registered levy collector.
The form used is here. We will not use these details for any other purpose.
Creative energy submissions
Companies wishing to enquire about switching to renewable energy via the Creative Energy project can complete a form which is sent to AdGreen, but also to the albert team managing the Creative Energy project. The form collects first, last, company, title, email and phone number for the purposes of confirming any information as required.
The form used is here, and albert’s privacy policy is here – see ‘Miscellaneous Contact Details’.
Creative Offsets
AdGreen has a partnership with Ecologi, which is our suggested offsetting company. Companies using Ecologi to offset emissions will be required to submit a number of personal details when setting up their organisation’s account, including first, last and email, along with a couple of details about the company. Personal details will also be requested for the purpose of completing payment transactions when purchasing offsets. Users are made aware of Ecologi’s privacy policy when setting up accounts.
Contact form submissions and miscellaneous contact details
During our normal day-to-day operations we receive enquiries and other communications from people by phone, email etc. If you contact us by phone, post, email or website contact form, then our CRM system (Zoho, Salesforce, HubSpot, Office 365 as relevant) may store any of the contact details you provide in doing so e.g. your email address.
We will use these details to contact you and to pursue AdGreen’s legitimate business interests. We may make a record of discussions we have with you over the phone so that we can provide a consistent and efficient service if you call again.
The website contact form is here.
At the time of writing of this AdGreen Data Protection Policy, the Salesforce privacy policy was available here.
Data location: USA
At the time of writing of this AdGreen Data Protection Policy, the HubSpot privacy policy was available here.
At the time of writing of this AdGreen Data Protection Policy, the Zoho privacy policy was available here.
Data location: USA
At the time of writing of this AdGreen Data Protection Policy, the Office365 (Microsoft) privacy policy was available here.
Data location: Multiple
WHAT KINDS OF COMMERCIALLY SENSITIVE DATA DO WE COLLECT, HOW DO WE COLLECT IT, AND WHY?
The types of commercially sensitive data that we collect and use is stored, is listed below:
Levy amounts collected
We request details of levy amounts collected (amount, client name) from all registered collectors each quarter. This is so that we know much to invoice each collector for, and which brands are participating. Information will be kept for at least 5 years after the 31 January submission deadline of the relevant tax year, in line with guidance.
Production and carbon details in the AdGreen carbon calculator
When using the carbon calculator, Principal Production Partners (PPPs) and Third Party Production Partners (TPPPs) will add a number of details to a campaign, and projects held within campaigns. This includes: brand, production consultancy, campaign name, brand position, project type, dates associated with the production, director/photographer name, the duration of assets being generated, production method, number of shoot days and the budget. With the exception of the budget field (which is only visible to the PPP and reviewer companies – that is the brand, brand parent, production consultancy and ad agency parent), all attributes for campaigns and projects are visible to everyone associated with the campaign (that is everyone who has been invited to either review it or contribute to it).
These campaign and project attributes are collected for one or both of the following reasons:
-
- To help users differentiate one campaign or project from another (e.g. project name or director/photographer)
- For AdGreen, reviewer companies and contributor companies (ad agencies, production companies and service companies) to be able to segment data and draw conclusions to inform actions
In addition to these attributes, contributor companies will also supply carbon data about the activities conducted in the course of a project, specifically linked to the areas of travel, powering offices, studios, locations and other spaces, materials used, and waste disposal. Again, carbon data for projects is visible to everyone associated with the project itself, and wider campaign (that is everyone who has been invited to either review it or contribute to it). For further detail on this, see schedule 2 of the tool terms and conditions, here.
Any data used to illustrate findings ascertained from the dataset has been and will only ever be presented in aggregate (for example in annual reports). Data held in the AdGreen Carbon Calculator will be kept indefinitely so that progress can be tracked towards the ultimate goal, net zero emissions from advertising production.
The AdGreen carbon calculator is hosted on Amazon Web Services (AWS) servers in the USA. AWS use a raft of logical and digital security features to keep data stored on their servers secure. These security measures are detailed here.
The security and privacy standards provided by AWS are defined in their online Service Terms (found here). These terms incorporate a specific Data Processing Addendum (found here). This Addendum includes EU Model Clauses, which were approved by the European Union (EU) data protection authorities, known as the Article 29 Working Party. This means that personal data stored on AWS servers is given the same high level of protection it receives in the EEA.
Creative Offsets
Any offsets purchased by those who have created Ecologi accounts for their organisation using the link from either the website, or via the tool once a project has been completed, will be part of the AdGreen forest and be visible on our profile here. The only information visible to the public (who might chose to view the AdGreen forest) is the organisation name, and how much has been offset.
AdGreen (as the parent) will be able to see further details (as provided by the offsetter), such as the project title relating to the offsets purchased. If preferred, an account can be created separate to the AdGreen forest, by using this link. There is no obligation to use Ecologi for offsetting.
HOW DO WE LOOK AFTER PERSONAL AND COMMERCIALLY SENSITIVE DATA?
We have put in place appropriate security measures to help prevent your personal data, and commercially sensitive data from being accidentally lost, used or accessed in an unauthorised way. In addition, we limit access to your personal data and commercially sensitive data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data or commercially sensitive data on our instructions and subject to a duty of confidentiality.
We have also put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. The same applies to commercially sensitive data we hold.
The AdGreen carbon calculator has been developed for AdGreen by a subsidiary of BAFTA called BAFTA Media Technology (BMT). BMT maintain the servers which store all of the AdGreen carbon calculator data. BMT staff have access to these servers, and therefore the data on them for maintenance purposes, but BMT are forbidden by their contract from using any of this data for any other purpose than providing the AdGreen carbon calculator service.
Some technical tasks, such as configuring and securing our servers, require specialist expertise. We use specialist UK-based contractors to provide these services. These contractors are carefully vetted. All contractors must sign non-disclosure agreements which include a requirement that they keep all AdGreen data confidential.
WHAT ARE YOUR DATA PROTECTION RIGHTS?
We would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following:
-
- The right to access – You have the right to request for copies of your personal data. Depending on the amount of effort required we may charge you a small fee for this service.
- The right to rectification – You have the right to request that we correct any information you believe is inaccurate. You also have the right to request us to complete information you believe is incomplete.
- The right to erasure – You have the right to request that we erase your personal data, under certain conditions.
- The right to restrict processing – You have the right to request that we restrict the processing of your personal data, under certain conditions.
- The right to object to processing – You have the right to object to us processing of your personal data, under certain conditions.
- The right to data portability – You have the right to request that we transfer the data that we have collected to another organisation, or directly to you, under certain conditions.
- If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us.
PRIVACY POLICIES OF OTHER WEBSITES
The AdGreen website contains links to other websites. Our privacy policy applies only to our website, so if you click on a link to another website, you should read their privacy policy.
CHANGES TO OUR DATA PROTECTION POLICY
AdGreen keeps its privacy policy under regular review and places any updates on this web page. This data protection policy was last updated on 3rd November 2022.
HOW TO CONTACT THE APPROPRIATE AUTHORITY
Should you wish to report a complaint or if you feel that AdGreen has not addressed your concern in a satisfactory manner, please contact us in the first instance. However, you may contact the Information Commissioner’s Office at any time. You can also contact us using info@weareadgreen.org. You can also write to us at: AdGreen, Lynton House, 7-12 Tavistock Square, London, WC1H 9LT United Kingdom.