This policy describes the minimum standards of how Personal Data is processed, collected, handled and stored by Diffley Partnership demonstrating how it adheres to the GDPR standards.
In addition to this Policy, for its market research business Diffley Partnership adheres to the requirements of the ICC/Esomar International Code on Market, Opinion and Social Research and Data Analytics, which can be found here
2) Principles for Processing Personal Data
All Personal Data must be dealt with properly, irrespective of how it is collected, recorded and processed – whether on paper, in a computer file, database, or recorded on other material.
Diffley Partnership regards the lawful and correct treatment of Personal Data and maintaining the confidence of those with whom it deals as a vital component of its business operations.
Diffley Partnership respects the following principles, which are explained in more detail later, concerning Personal Data and that they are:
- Processed fairly and lawfully.
- Processed for limited purposes and in an appropriate way.
- Adequate, relevant and not excessive for the purpose.
- Not kept longer than necessary for the purpose.
- Processed in line with participants’ rights.
- Not transferred to third parties without adequate protection.
2.1. Lawfulness, Fairness and Transparency
2.2. Data Minimisation
Personal data must be adequate, relevant and limited to the purpose for which it is processed. It must be determined whether and to what extent the processing of Personal Data is necessary to achieve the purpose for which the processing is undertaken.
Personal Data must be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that Personal data is accurate, having regard for the purpose for which it is processed and is erased or rectified without delay.
2.4. Storage Limitation
Personal Data must not be retained in a form which permits identification of participants for longer than is necessary for the purpose for which the Personal Data is processed. Diffley Partnership will not keep Personal Data longer than is necessary for the purpose or purposes for which they were collected. Diffley Partnership will take all reasonable steps to destroy, or erase from its systems, all Personal Data which is no longer required. This will involve pseudonimsing personal data.
2.5. Integrity and Confidentiality
Personal Data must be processed in a manner that ensures appropriate security of the personal data from being revealed, disseminated, accessed or manipulated. Our information security processes avoid personal data being accessed by those who do not have a legal right to /process the data.
3) Legal Grounds for Data Processing
3.1.1. Consent to Data Processing
Personal data can be processed following consent by the research participant. Before giving consent, the participant must be informed about the full purposes of the research and how the data will be managed. Consent must be obtained in writing or electronically for the purposes of documentation. In some circumstances, such as telephone surveys, consent can be given verbally. In all cases, the granting of consent must be documented.
Any consent will only be valid if it constitutes a freely given, specific, informed and unambiguous indication of the participants wishes.
3.1.2. User Data and Internet
If personal data is collected, processed and used on websites or in apps, the participant will be informed of this in a privacy statement including, if applicable, information about cookies or similar technical measures. The privacy statement and any cookie information must be integrated so that it is easy to identify, directly accessible, easily understandable and consistently available. The privacy statement specifically in relation to this website (www.markdiffley.co.uk) can be found from point 9 onwards in this document.
3.1.3. Personal Data Provided by Clients
Transfer of personal data to Diffley Partnership by its clients to provide us with sample or to enhance existing sample can be enabled if a Data Processor Agreement is in place. This agreement will stipulate that Diffley Partnership will be the data processor and may only process the Personal Data in accordance with the instructions agreed with or received from the client. The client is the data controller under this contract.
Irrespective of any client requirements, any personal data provided by a client may only be:
- a) Processed for the purpose they were provided for;
- b) Not be kept for longer than is required for the purpose;
- c) Subject to the same security requirements applicable to Diffley Partnership’s own personal
3.1. Marketing Contacts
Generally marketing contacts are no different than respondents in respect of the privacy protections accorded to them. Their contact details constitute Personal Data, even if they are business related. Only if the contact details are truly generic like “firstname.lastname@example.org”, will they not fall under this Policy.
Any subsequent communication with marketing contacts will include the option to refuse marketing content, and if they don’t opt out at this point, they are given a simple way to do so in all future messages.
4) Outsourced/Third Party Data Processing
In many cases Diffley Partnership is using external providers to process personal data. In these cases, an agreement on data processing on behalf of Diffley Partnership must be concluded with such provider. This can be done either by way of including appropriate provisions in the agreement governing the overall relationship with the provider or in a separate and specific document.
5) Rights of the participant
Every participant has the following rights.
- Right of access: The participant may request information on which Personal Data relating to him/her have been stored, how the data was collected and for what purpose. If Personal Data is transmitted to 3rdparties, information must be given about the identity of the recipient or the categories of recipients, including other Diffley Partnership companies.
- Right to rectification: If Personal Data is incorrect or incomplete, the participant can demand that they are corrected or supplemented.
- Right to withdraw consent: Where the Personal Data is processed on the basis of Consent the participant can object to the processing at any time. These Personal Data must be blocked from the processing that has been objected to.
- Right to erasure. The participant may request his or her data to be deleted if the processing of such data has no legal basis, or if the legal basis has ceased to apply. The same applies if the purpose behind the data processing has lapsed or ceased to be applicable for other reasons. Existing retention periods and conflicting interests meriting protection must be observed.
- Right to object: The participants generally has a right to object to his/her data being processed and this must be taken into account if the protection of his/her interest takes precedence over the interests of the data controller.
- Right to data portability. The participant has the right to request for the Personal Data provided by him/her to be made available to such participant in an easily readable format, like a Word or Excel document.
6) Confidentiality of Processing
Employees may have access to Personal Data only as is appropriate for the type and scope of the task in question. This requires a careful breakdown and separation, as well as in limitation, of roles and responsibilities. A data flow is produced on each project to determine who will have access to personal data throughout the lifetime of a project.
Employees are forbidden to use Personal Data for their own private or commercial purposes, to disclose them to unauthorised persons, or to make them available in any other way.
7) Privacy by Design and Default
Diffley Partnership will use a Privacy by Design and Default approach in all its work. Our IT processes are compliant with the information security standards ISO27001 and all our documents containing personal identifiable data are encrypted.
8) Data Protection Audit
Compliance with this Data Protection Policy and the applicable data protection laws is checked regularly with data protection audits and other controls. The performance of these controls is the responsibility of the externally hired auditors. On request, the results of data protection audits will be made available to the responsible data protection authorities.
9) Privacy specifically in relation to www.diffleypartnership.co.uk
9.1 What personal data we collect and why we collect it
When visitors leave comments on the site we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection.
If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.
If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.
If you have an account and you log in to this site, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.
When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will persist for two weeks. If you log out of your account, the login cookies will be removed.
If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.
Embedded content from other websites
Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.
9.2 How long we retain your data
If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognise and approve any follow-up comments automatically instead of holding them in a moderation queue.
For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.
9.3 What rights you have over your data
If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.
9.4 Where we send your data
Visitor comments may be checked through an automated spam detection service.