এই তথ্য গোপনীয়তা বিজ্ঞপ্তির একটি বাংলা অনুবাদ এই লিংক এ পাওয়া যাবে। বাংলা সংস্করণটি কেবল তথ্যের জন্য এবং নির্ভরযোগ্য নয়। ইংরেজী সংস্করণ এবং বাংলা সংস্করণের মধ্যে যেখানে কোনও দ্বন্দ্ব রয়েছে, সেখানে ইংরেজি সংস্করণ প্রাধান্য পাবে।
Introduction
The goal of this project is to improve health outcomes and decrease the spread of COVID-19 in Bangladesh. In some cases we plan to collect personal information which will be used to incentivise people to complete our surveys and test the effectiveness of different posters and videos. This privacy notice sets out how we collect and use your personal and activity data if you are a participant in this research project.
If you are under the age of 18 you will not be able to sign up to participate in this research.
We are conducting this research in collaboration with BRAC Institute of Governance Development (BIGD). Your personal data will only be provided to this organisation under the circumstances described in section entitled “Who has access to your information?” below.
Behavioural Insights Ltd (the legal name of Behavioural Insights Team (BIT)) is the controller and is responsible for your personal data collected in connection with this project. This notice applies to the personal data we collect directly from you and personal data which is provided to us by third parties. Where we collect personal data from you directly, please make sure that any personal details you provide are accurate and up to date, and let us know about any changes as soon as possible.
We have appointed a Data Protection Officer (DPO) who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights in relation to your personal data, please contact the DPO:
Post: Behavioural Insights Ltd, 58 Victoria Embankment, London, EC4Y 0DS
Email: dpo@bi.team.
You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.
We promise to respect any of your personal information which is under our control and to keep it safe. We aim to be clear when we collect your information about what we will do with it and let you know of any material changes to this notice.
What personal data will we collect?
Through the use of different online platforms (chatfuel via Facebook Messenger and Predictiv) we will collect and process your data, some of which is classified as personal data. We will collect and process the mobile phone numbers and/or email addresses of participants who consent to providing this information, so that we can send any payments we offer in return for survey completion.
To refine the analysis of our results, we will also ask you for and process data regarding your age and education level. In the case where you enter the study via Facebook, we may also collect and process data regarding your gender and timezone, (collected via facebook). Finally, to measure whether the intervention increased participants’ comprehension of health messages we will ask you questions regarding your understanding of guidance regarding COVID 19 rules and other questions about health and hygiene practices (via an online survey).
Facebook and Chatfuel will separately collect other data through your Facebook account, under their own terms of service. BIT will not have access to any data Facebook or Chatfuel collects other than that listed above. Predictiv will not collect any of your data other than that listed above.
What do we do with information we collect?
The purposes for which BIT processes your personal data are to:
- send you payments / mobile phone credit in return for survey completion (if we offer this when we ask you to take the survey and if you choose to provide your contact information for this purpose, or if you are successful in any free prize draws we run);
- analyse your survey results as part of research in order to deliver an intervention to improve health outcomes and decrease the spread of COVID-19 in Bangladesh and test the impact and effectiveness of such different types of interventions.
What is our lawful basis for processing your personal data?
Data protection laws require us to meet certain conditions before we are allowed to use your data in the manner described in this notice, including having a lawful basis for the processing.
We are relying on the following lawful bases to process the personal data listed above:
- your consent (in relation to processing your contact information to send you payments). You can withdraw your consent at any time by contacting us through Predictiv or Facebook Messenger, or by contacting our DPO (see details above). If you do so, we will delete your contact information and will not make any future payments to you;
- our legitimate interest in carrying out behavioural science research in order to deliver an intervention to improve health outcomes and decrease the spread of COVID-19 in Bangladesh and test the impact and effectiveness of such different types of interventions (in relation to analysing the responses to our survey). This processing is carried out in a way which minimises the impact on your privacy, including by strict controls on the access to the information, and by not associating your survey results with directly identifiable information about you; and
- scientific research purposes (in relation to special categories of data, such as religion), in a way that respects the essence of the right to data protection and provides for suitable and specific measures to safeguard your fundamental rights and interests.
Who has access to your information?
Your information will be accessed by a limited number of researchers and advisors in BIT’s project team working on this project.
Your information will also be shared with BIGD and third parties in connection with the purposes of translating your responses. We may also share your information with BIGD in the future as part of a data sharing agreement.
Your contact information may also be shared with BIGD and third parties in connection with the purposes of making incentive payments to you for example third parties that provide mobile money transfer services, or phone credit top up services. These third parties will be instructed as data processors who process information on behalf of BIT. We have contractual terms, policies and procedures with these third parties in place to ensure that your personal data is protected.
We may also disclose your personal information if required by law, or to protect or defend ourselves or others against illegal or harmful activities, or as part of a reorganisation or restructuring of our organisations.
International Transfers
Once collected in Bangladesh your data will be processed and stored in the United Kingdom, or on our company’s servers in the Republic or Ireland. We may transfer your data back to third party services in Bangladesh for the purpose of translation or incentivisation. Apart from these cases we will not transfer your personal information outside of the United Kingdom or the European Economic Area (EEA). However, Facebook or Chatfuel may transfer personal data outside of the United Kingdom or the EEA. Please refer to Facebook’s privacy policy which can be found here: https://www.facebook.com/policy.php. Please refer to Chatfuel’s privacy policy which can be found here: https://chatfuel.com/files/PrivacyPolicy.pdf
Security
We take reasonable steps to protect your personal information and follow procedures designed to minimise unauthorised access, alteration, loss or disclosure of your information.
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk of processing.
We ensure that those who have permanent or regular access to personal data, or that are involved in the processing of personal data, are trained and informed of their rights and responsibilities when processing personal data. We provide such access on a need-to-know basis, and have measures in place which are designed to remove that access once it is no longer required.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
Data Retention
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. When it is no longer necessary to retain your personal data, it will be securely deleted. For this project, your personal data will be processed and retained for 12 months from July 2020. Your personal data will be then be deleted by July 2021. Any personal data collected in order to make a payment to you will be deleted once the payment has been made.
Please note that Facebook and Chatfuel may continue to process your personal data after the project has ended. Please refer to their terms and conditions and privacy notice for their data retention periods.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
In some circumstances, we will retain an anonymised dataset (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
Your legal rights
Under certain circumstances, you have rights under data protection laws in relation to your personal data, including rights to:
- Request access to your personal data: this enables you to receive a copy of the personal data we hold about you and to check we are lawfully processing it.
- Request correction of your personal data: this enables you to have any incomplete or inaccurate data we hold about you corrected.
- Request erasure of your personal data: this enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it.
- Object to processing of your personal data: for example, you can object where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms.
- Request restriction of processing your personal data: This enables you to ask us to suspend the processing of your personal data.
- Data portability: Where the processing takes place on the basis of your consent or contract, and is carried out by automated means, you have the right to request that we provide your personal data to you in a machine-readable format, or transmit it to a third party data controller, where technically feasible.
- Right to withdraw consent to the processing of your personal data: This applies where we have relied on consent to process personal data. Please note that withdrawal of consent will not affect the lawfulness of any processing carried out before withdrawing your consent.
- Right not to be subject to decisions based purely on automated processing where it produces a legal or similarly significant effect on you. Please note that BIT does not engage in automated decision making without manual intervention in its research projects.
If you wish to exercise any of the rights set out above, please contact the Data Protection Officer with your specific request by email to: dpo@bi.team
It is important to understand that the extent to which these rights apply to research will vary and that in some circumstances your rights may be restricted.
Ordinarily, you will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
Please also note that we can only comply with a request to exercise your rights during the period for which we hold personal information that directly identifies you. If we have only collected pseudonymised information (e.g. where we have not collected any names or contact details) or personal data has been irreversibly anonymised and has become part of the research data set, it will not be possible for us to comply.
Changes to this Notice
We may change this Privacy Notice from time to time. If we make any significant changes in the way we treat your personal information we will make this clear by contacting you directly.
Company details
Behavioural Insights Ltd is a limited company registered in England and Wales. Registration number: 08567792
Registered office: 58 Victoria Embankment, London, EC4Y 0DS