Privacy Policy for AdGreen
AdGreen (Advertising Association AdGreen ltd) believes in being open about what data we collect and what we do with it. We work to the UK’s General Data Protection Regulation and the Data Protection Act (2018), which sets out comprehensive requirements for all companies handling the personal data. This includes a number of things we must tell you when we collect personal data from you.
In addition to personal data, we hold what might be termed ‘commercially sensitive data’, around things like levy payments, and activity information, budget details and carbon data in our carbon calculator.
We have provided all the information you need using a question-and-answer format. If you have any questions about our privacy policy, the data we hold on you, or you would like to exercise one of your data protection rights, please do not hesitate to contact us using info@weareadgreen.org. You can also write to us at: AdGreen, 5th Floor, 95 Aldwych, London WC2B 4JF UK.
WHAT KINDS OF PERSONAL DATA DO WE COLLECT, HOW DO WE COLLECT IT, AND WHY?
The type of personal data that we collect and use depends on the relationship you have with AdGreen, why you are interacting with us and whether you are using any of our products or services, such as the carbon calculator or online training.
AdGreen carbon calculator users
What personal information do we ask for and when?
The AdGreen carbon calculator will collect your first name, last name, and email address when you sign up for an account.
What do we use it for?
- To send you transactional emails regarding your account and the projects you’re connected to
- To send you more general carbon calculator related emails e.g., information about upcoming features, down periods, or requests for feedback
- To log actions such as logging in and out, password resets and profile updates
How long do we keep it for?
Your contact details will be retained until your user account is deleted. Depending on your user permissions you may have to contact your company administrator(s) for your account to be deleted. Note that if your user account has admin rights (i.e you are a company administrator), your account cannot be deleted until such time that another user account is granted admin rights, as every company must have one admin at all times.
Activity logs are deleted 365 days after the activity logged has taken place (even if the user’s account has been deleted in the interim).
What legal basis do we have for holding this data?
AdGreen has a legitimate interest in this data, to enable us to provide customer service relating to the carbon calculator, and to enable us to keep an audit history of the platform in the event of questions or concerns.
Where is the data kept?
The AdGreen carbon calculator is hosted on Amazon Web Services (AWS) servers in the USA. AWS use a raft of logical and digital security features to keep data stored on their servers secure. These security measures are detailed here.
The security and privacy standards provided by AWS are defined in their online Service Terms (found here). These terms incorporate a specific Data Processing Addendum (found here). This Addendum includes EU Model Clauses, which were approved by the European Union (EU) data protection authorities, known as the Article 29 Working Party, as well as clauses incorporating the UK’s International Data Transfer Addendum.
The transactional emails are sent by Postmark (privacy policy here), triggered by specific user actions.
Data location: USA
The activity logs are generated and stored by Heroku (privacy policy here), on AWS.
Other information about sub-processors of personal data can be found in the terms and conditions, here. The T&Cs are agreed to by the first user of each new company entity (who automatically becomes the company administrator), at the point the company is set up.
Finally, if you, or the company for which you are working, operates in the territory or territories covered by one or more of AdGreen’s international partners (as listed here, as updated from time to time), we may provide your data to the applicable international partner(s), which will process it on our behalf to help provide our services to you. Where this entails a transfer of personal data within the meaning of Chapter V of the UK GDPR, we will have in place appropriate safeguards with the relevant international partner(s), which will be the standard contract clauses unless stated otherwise on the AdGreen website.
Event and Training registration, Downloads, Newsletter signups, Contact and Feedback forms, as well as Advisory Board and Industry Partner contacts
What personal information do we ask for and when?
The relevant form will collect your first name, last name, email address and occasionally, job title, company and company type, plus location, when you sign up for the event/training session, download one of AdGreen’s reports or guides, sign up for the newsletter or contact us/provide feedback via a website form.
Please note for some events, training sessions and downloads, you are given the option to consent to your information being passed to our Industry Partner(s). If you have expressed an interest in hearing from one or more of our Industry Partners, we will pass your details as above to the relevant partner. In these cases, we would urge you to review the partner’s privacy policy (always included on the sign up form) before indicating you are happy to be contacted by them.
Individuals are not added to the newsletter mailing list whilst registering for events and training, unless they have specifically indicated they would like to receive newsletters.
What do we use it for?
- To send you details of the relevant event or training session
- To send you the relevant download
- To send you the newsletter (sometimes segmented based to send tailored communications about specific products and services, based on your job title, company type or location)
- To respond to your enquiry
- To contact you about your feedback
- To contact you regarding advisory board or industry partner matters
- To analyse training attendance and provide top line stats to our advisory board and to communicate the uptake in our PR (using employment and location information only)
In addition, from time to time we are asked to validate if a particular individual has attended a training session. For this reason we retain details of training attendance indefinitely. This is only done on request and we will always ensure the person requesting the information has the right to ask for it before it is provided to them.
How long do we keep it for?
Most of these registrations/communications are facilitated by AdGreen’s CRM, provided by Zoho, and leads and contacts are created/updated as required, enabling us to track the relationship between AdGreen and yourself so that future communication can be tailored. Contacts are deleted if AdGreen no longer has reason to hold the information e.g., the individual has left the industry. Zoho is also used to send newsletters to those who have subscribed.
Occasionally Eventbrite, eWebinar or a similar event booking platform is used instead. In these cases, attendance information is deleted after 2 years.
In addition, some contact forms (from either Zoho based communications or Webflow based website forms) trigger emails to Office365 inboxes, or enquiries come to inboxes directly. Emails are kept indefinitely, unless deleted by an employee.
Office365 and Zoho are also used to send emails to carbon calculator users as noted previously.
The completed forms are collated by Webflow (privacy policy here, location: EU), and details are kept on the company’s Office365 cloud and on Zoho (privacy policies as above). We will not use these details for any other purpose.
What legal basis do we have for holding this data?
AdGreen has a legitimate interest in this data, to enable us to provide customer service relative to the reason you have contacted AdGreen.
Where is the data kept?
At the time of writing of this AdGreen Privacy Policy, the various privacy policies were available as follows:
- Zoho here, data location: EU
- Eventbrite here, data location: USA
- eWebinar here, data location: Canada
- Office365 (Microsoft) here, data location: Multiple
- Webflow here, location: EU
Levy collectors and quarterly declarations
What personal information do we ask for and when?
The registration form and quarterly declaration form will collect your first name, last name, email address job title, and company when you sign your organisation up to the levy and file subsequent quarterly declarations. In the case of the declaration form, a telephone number is also requested.
What do we use it for?
- To contact you regarding levy matters, including requesting your quarterly declaration, and sending invoices
How long do we keep it for?
Information will be kept until an alternative contact is provided, or until such time that a company indicates that they no longer wish to be a registered levy collector.
What legal basis do we have for holding this data?
AdGreen has a legitimate interest in this data, to enable us to provide customer service relative to the levy.
Where is the data kept?
The completed forms are collated by Webflow, and details are kept on the company’s Office365 cloud and on Zoho (privacy policies as above).
Website analytics
In common with most other websites we use website analytics software which collects data about how people use our websites. However, this is anonymised and cannot be traced back to you. We use this to help make sure our web servers are working well and to see which parts of our websites are most/least popular. This helps us to improve the overall user experience.
WHAT KINDS OF COMMERCIALLY SENSITIVE DATA DO WE COLLECT, HOW DO WE COLLECT IT, AND WHY?
The types of commercially sensitive data that we collect and use is stored, is listed below:
Levy amounts collected
We request details of levy amounts collected (amount, client name) from all registered collectors each quarter. This is so that we know much to invoice each collector for, and which brands are participating. Information will be kept for at least 5 years after the 31 January submission deadline of the relevant tax year, in line with guidance.
Production and carbon details in the AdGreen carbon calculator
When using the carbon calculator, users add a number of details to projects including the budget (which is optional), and activity data relative to various production activities undertaken as relevant to the project. Visibility of this information is covered in schedule 2 of the terms and conditions, here.
Any data used to illustrate findings ascertained from the dataset has been and will only ever be presented in aggregate (for example in annual reports). Carbon data held in the AdGreen Carbon Calculator will be kept indefinitely so that progress can be tracked towards the ultimate goal, net zero emissions from advertising production. Projects can of course be deleted by users as required (this is also covered in the T&Cs).
The AdGreen carbon calculator is hosted on Amazon Web Services (AWS) servers located in the EU west region. AWS use a raft of logical and digital security features to keep data stored on their servers secure. These security measures are detailed here.
The security and privacy standards provided by AWS are defined in their online Service Terms (found here). These terms incorporate a specific Data Processing Addendum (found here). This Addendum includes EU Model Clauses, which were approved by the European Union (EU) data protection authorities, known as the Article 29 Working Party. This means that personal data stored on AWS servers is given the same high level of protection it receives in the EEA.
HOW DO WE LOOK AFTER PERSONAL AND COMMERCIALLY SENSITIVE DATA?
We have put in place appropriate security measures to help prevent your personal data, and commercially sensitive data from being accidentally lost, used or accessed in an unauthorised way. In addition, we limit access to your personal data and commercially sensitive data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data or commercially sensitive data on our instructions and subject to a duty of confidentiality.
We have also put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. The same applies to commercially sensitive data we hold.
Some technical tasks, such as configuring and securing our servers, require specialist expertise. We use specialist UK-based contractors to provide these services. These contractors are carefully vetted. All contractors must sign non-disclosure agreements which include a requirement that they keep all AdGreen data confidential.
WHAT ARE YOUR DATA PROTECTION RIGHTS?
We would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following rights. If you would like to exercise any of these rights, please contact us.
- The right to access – You have the right to request for copies of your personal data.
- The right to rectification – You have the right to request that we correct any information you believe is inaccurate. You also have the right to request us to complete information you believe is incomplete.
- The right to erasure – You have the right to request that we erase your personal data, under certain conditions.
- The right to restrict processing – You have the right to request that we restrict the processing of your personal data, under certain conditions.
- The right to object to processing – You have the right to object to us processing of your personal data, under certain conditions.
- The right to data portability – You have the right to request that we transfer the data that we have collected to another organisation, or directly to you, under certain conditions.
If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us.
PRIVACY POLICIES OF OTHER WEBSITES
The AdGreen website contains links to other websites. Our privacy policy applies only to our website, so if you click on a link to another website, you should read their privacy policy.
CHANGES TO OUR PRIVACY POLICY
AdGreen keeps its privacy policy under regular review and places any updates on this web page. This privacy policy was last updated on 21st June 2024.
HOW TO CONTACT THE APPROPRIATE AUTHORITY
Should you wish to report a complaint or if you feel that AdGreen has not addressed your concern in a satisfactory manner, please contact us in the first instance. However, you may contact the Information Commissioner’s Office at any time. You can also contact us using info@weareadgreen.org. You can also write to us at: AdGreen, 5th Floor, 95 Aldwych, London, WC2B 4JF, UK.