Kantar Service Measurement Postal Panels
Privacy Notice
Last Updated: 07/07/2026
Introduction
This Privacy Notice sets out the commitment of Kantar UK Ltd, TNS House, Westgate, London W5 1UA, and its affiliates (altogether “we”, “our” or “us”), a Kantar Group company ("Kantar"), to the privacy of its panel members (“panellists”, “panellist” or “you”), and governs panellists’ rights regarding privacy and data protection. If you are not a panellist but have visited our panel website, this Privacy Notice also describes how we the process the personal data of general visitors to the site.
This Privacy Notice applies to the Kantar Service Measurement Postal Panels, identified in this Privacy Notice as the “panel”. For the purposes of this Privacy Notice, ‘personal data’ means any data or information that relates to an identified or identifiable living individual (or the equivalent applicable term in your jurisdiction).
Panellists are members of the panel, operated by Kantar on behalf of its clients. This Privacy Notice sets out the information where Kantar is the ‘data controller’, responsible ‘business’ and ‘personal information processor’ (or equivalent term) for the purposes of applicable data protection law, and where Kantar is therefore responsible for your personal data for the panel. Kantar is independently responsible for your personal data for general panel management purposes of the panel, including the processing of: your login information to the panel platform, your contact and address information for panel postal operations, and the general processing of your personal data for reports related to our clients’ markets and service research.
Taking part in our panel, surveys and research activities is entirely voluntary. By registering to the panel and accepting these terms, you confirm that you have read and understood this Privacy Notice. We ask you to read this Privacy Notice carefully.
Lawful Collection and Use of Data
We collect your personal data in several ways such as through our website(s) (for example our panel portal), our mobile applications and other research activities. We may also collect personal data to contact you in recruitment for our panel via our Self Recruit Portal. In the recruitment process, we may have received your personal data from one of our partner sample providers, for example Toluna or Neoteric. Our surveys may require you to download and use our mobile app on your smartphone. The mobile app will not collect contact information or other data from your phone but is limited to information that you agree to send us.
We may add other ways and activities moving forward but we will always operate in compliance with this Notice.
We have set out below, more detailed information about how we use your personal data. Data protection law requires that we have a ‘lawful basis’ for our processing, which is a legal justification that has been pre-defined by the relevant law for collecting, storing and using personal data. For your information where that requirement exists, we have set out below the relevant lawful basis alongside the applicable purpose. These legal bases are listed below and could be different for each use case:
We will never misrepresent ourselves or what we are doing. If you receive an email that concerns you, purporting to be from us, please let us know as shown below in the ”How to Contact Us” section of this Notice.
| Case | Purpose | Personal Data | Source | Legal Basis |
|---|---|---|---|---|
| Operating our website(s) | Ensure that content from our site is presented effectively, according to the device you are accessing it on. See the “Cookie Disclose” section below for more information. | IP address, operating system information, browser type | We obtain this data from you directly | Necessary for the performance of a contract – where essential to provide our website service to you |
| Website analytics | Analyse statistical data about user(s) browsing actions and their patterns. See the “Cookie Disclose” section below for more information. | IP address, operating system information, browser type, browsing information of our website | We obtain this data from you directly | Consent |
| Panel recruitment and incentive management | To recruit you to the panel and administer your panel incentives and cost reimbursements following the completion of panel activities. To administer your panel participation by communicating with you, including informing you about the panel, selecting you for future surveys, inviting you and contacting you to participate in surveys and other research activities. | Name, email address, postal address, mobile device ID, account login credentials, demographics and any detail you share with us about yourself and your household | We obtain this data from you directly | Voluntary participation in the panel whereby we ask for your consent to use your personal data |
| Providing you with information | Provide you with information regarding products or services that you request from us, or that we have determined may be of interest to you. | Name, email address, IP address, phone number, postal address, job title | We obtain this data from you directly, for example when you download reports or other content from our website, or when you make an enquiry with us. | We will seek your consent or we have determined that we have a legitimate interest in using your details to provide you with relevant information. You can withdraw your consent or opt out of communications from Kantar at any time. |
| Postal market research | To understand and analyse the postal experiences of potential consumers of our clients in the postal industry. As well as tracking mail, we may seek your views and opinions. | Name, postal address, email address, phone number, views and opinions. | We obtain this data from you directly | Voluntary participation in the panel whereby we ask for your consent to use your personal data. |
| Disclosure to Authorities | To share or disclose pursuant to judicial or other government subpoenas, warrants, orders or pursuant to similar and other legal or regulatory requirements, we will provide such information to the appropriate authorities | Identifier, name, contact details, email address, incentive received | We obtain this data from you directly, or combined with other secondary database | Legal obligation |
| Security and fraud Protection | Protection of our business interests against fraudulent behaviour and to protect the security and performance of our equipment, property, facilities, personnel, intellectual property, networks, applications and other relevant systems | IP address, browser specifications, device specifications, postal addresses, email addresses, official identification number | We obtain this data from you directly | Necessary for the performance of a contract – in order to enter and perform the agreement between us and our panellists (the Terms and Conditions), we and/or our clients must ensure that those terms are being adhered to, in particular that no fraudulent, illegal or prohibited behaviour is being conducted by panellists. |
| Business Transactions | Manage a business transition or financial transaction, such as a merger, acquisition, divestiture, restructuring, reorganisation, dissolution or sale of all or some of our assets. | Your panel profile, including your name, email address, postal address, mobile device ID, demographics and any detail you share with us about yourself and your household. | We obtain this data from you directly | Legitimate interest or where necessary to comply with a legal obligation. |
Incentives and Rewards
To incentivise you to participate in the panel and market research surveys, we may reward you with prize draws or other rewards.
Our incentive program is subject to our panel terms and conditions.
The incentive we offer to you in connection with your submitted information in surveys depends on the amount and type of information you submit and direct us to share with third parties as described in this Notice. If you wish to no longer receive incentives or rewards for your participation, please contact us via the “How to Contact Us” section of this Notice.
Third Parties
We may share your personal data (including your sensitive personal data) with companies in the Kantar Group, and our third-party vendors and processors to perform panel management related activities in order to deliver panel services and activities to you. This could include vendors managing or assisting us in managing our panel databases, quality checks and fraud prevention, incentive management, and customer care. Some vendors will specifically work with us on enriching your panel profile, such as vendors specialized in, but not limited to, cross-channel consumer classification. Categories of personal data shared with these vendors would typically be, but may not be limited to, address, postcode, and panellist ID.
Kantar Group companies and our third-party data partners and publishers are all contractually bound to keep any information they collect and disclose to us, or that we collect and disclose to them, confidential and must protect it with security standards and practices that are equivalent to our own.
To conduct the panel activities and operations, Kantar uses the following third-party vendors for the processing of your personal data:
Selling and Sharing of Personal Data
Under some data protection laws (for example, the California Consumer Privacy Act), ‘sales’ of personal data are broadly defined. As part of the services that we provide to you as a panel member, you have agreed to participate in panel activities which may necessarily involve sharing your personal data with our client, , that sponsors and generally manages the panel. For example, we will share your contact information with them where you have successfully been recruited to their panel. We consider that this is not a ‘sale’ of your personal data, as you have joined the panel to intentionally disclose your personal data as part of the service (i.e., for panel incentives). In any event, your participation in the panel is always voluntary and we seek your consent.
Otherwise, we do not sell your personal data and have not done so in the last 12 months, and we do not sell or share sensitive personal data, nor do we sell or share any personal information about individuals who we know are children as defined under applicable law.
Sharing of Personal Data to other panellists
To conduct our postal market research, our panel members send each other items in the post so that we can track the postal experience. This means we require that postal information (names, address and contact information) are shared between our panellists. When each panellist joins the panel, we explain this to them and obtain consent to proceed. We also ensure that each panellist agrees not to use the personal data of another panellist for any other purpose, including not to share this information with others.
Data Transfers
Your personal data may be collected, stored, transferred or processed by companies within the Kantar Group, or third-party service providers for research-related purposes, such as data processing and enrichment, both within and outside your territory. All parties are contractually bound to keep any information they collect and disclose to us or, we collect and disclose to them, confidential and must protect it with appropriate security standards and practices. If your personal data is transferred to, stored at or otherwise processed outside your country or territory, and that country or territory has not been recognized as providing an adequate level of data protection, we will put in place additional safeguards to protect your personal data, as required by applicable law. For example, if you are in the UK, standard contractual clauses issued by the Information Commissioner’s Office and further appropriate protective measures would be used if we process your data outside the UK, where appropriate. Where required by law, we will also request your consent for these transfers in accordance with this Notice and any other necessary information that we provide to you separately.
Confidentiality, Security and Industry Requirements
We take appropriate technological and organisational measures to protect your personal data, both during transmission and once we receive it. Our security procedures are consistent with generally accepted standards used to protect personal data.
Your account information and personal data are password protected so that you and only you have access to your information. In order to keep your personal data safe, we recommend that you do not divulge your password to anyone. We will never ask you for your password in an unsolicited phone call or in an unsolicited email. Also, please remember to sign out of your panel account and close your browser window when you have finished visiting our site. This is to ensure that others cannot access your personal data and correspondence if you share a computer with someone else or are using a computer in a public place like a library or Internet cafe. Please change your password regularly.
In the case of an unfortunate personal data security incident, we will, in a timely manner and in accordance with laws and regulations, inform you of the basic conditions and possible impacts of the security incident, response measures that are already taken or to be taken by us, suggestions for you regarding self-prevention and risk mitigation, our remedial measures for you, etc. We will inform you of such information by email, fax, telephone, or push notification, etc., and when it is difficult to notify each individual panellist individually, we will properly and effectively issue a public notice. At the same time, we will also take the initiative to report the handling of personal data security incidents in accordance with regulatory requirements.
Public disclosure
We will only publicly disclose your personal data under the following circumstances:
Industry Standards
We adhere to various standards and industry codes depending on your location, including:
Cookie Disclosure
Cookies are small text files stored on your computer or mobile device by a website that assigns a numerical user ID and stores certain information about your online browsing. They are used to help users navigate websites efficiently and perform certain functions. The website sends information to the browser, which then creates a text file on the user’s computer or mobile device. Every time the user goes back to the same website, the browser retrieves and sends this file to the website's server.
We use cookies for both necessary purposes (i.e., website functionality and security) and unnecessary purposes (i.e., website analytics). For the latter type, we only do this with your consent. You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly.
Details of the cookies that we utilise on our website and panel platform are as follows. Click on the name of any third-party Provider to access that parties’ privacy information.
| Cookie Name | Provider | Purpose | Expiry | Type |
|---|---|---|---|---|
| ASP.NET_SessionId | Microsoft | ASP. Net_SessionId is a cookie used to identify the users' session on the server. The session used to store data in between off HTTP requests on server.The use of this cookie is strictly necessary. | Expired as soon as closed the browser | HTTP |
| AspNet.ApplicationCookie | Microsoft | This cookie is created by the server on user request and is stored by the browser. AspNet. ApplicationCookie gets sent with each subsequent request to inform the server the identity of the logged in user. The is a website analytical cookie. | Expired as soon as closed the browser | HTTP |
| Google Analytics _ga _gat _ga_* | These cookies are used to collect information about how visitors use our site. We use the information to compile reports and to help us improve the site. The cookies collect information in an anonymous form, including the number of visitors to the site, where visitors have come to the site from and the pages they visited. The use of this cookie is strictly necessary. | two years | HTTP | |
| Application Insights ai_session ai_user | Microsoft | These cookies are used to collect information about how visitors use our site. We use the information to compile reports and to help us improve the site. The cookies collect information in an anonymous form, including the number of visitors to the site, where visitors have come to the site from and the pages they visited. The use of this cookie is strictly necessary. | One year | HTTP |
| UserCookiesIsAdmin | Kantar | Determine the admin role if this user is an admin user. The use of this cookie is strictly necessary. | Expired as soon as closed the browser | HTTP |
| _RequestVerificationToken | Microsoft | To help prevent CSRF attacks, ASP.NET MVC uses anti-forgery tokens, also called request verification tokens. The client requests an HTML page that contains a form. The server includes two tokens in the response. One token is sent as a cookie. The use of this cookie is strictly necessary. | Expired as soon as closed the browser | HTTP |
| OpenIdConnect.nonce | Kantar | To support the OpenIDConnect - used to store the login token that used for authentication purposes. The use of this cookie is strictly necessary. | 15 minutes | HTTP |
Accuracy
We take reasonable steps to keep personal data in our possession or control accurate, complete and current, based on the most recent information made available to us by you and/or by our clients.
We rely on you to help us keep your personal data accurate, complete and current by answering our questions honestly. You are responsible for ensuring that you notify us of any changes to your personal data.
Children's Data
We recognise the need to provide further privacy protections with respect to personal data collected from children. We never knowingly invite children under the legal age set by the authorities in the country in which you reside to participate in research studies without appropriate permission. If it is necessary and appropriate to a particular project to directly involve children, we take measures to ensure we have obtained permission by a parent and/or legal guardian. We will provide parents and/or a legal guardian information about the survey topic, any personal or sensitive information which may be collected from the children, the way the data will be used and whether and with whom we may share such information.
While the child is completing the survey, it is the responsibility of the parent and/or guardian to supervise them.
Sensitive Personal Data
From time to time, we may collect personal data that is classified as “sensitive” or “special category” personal data. The meaning of this type of personal data varies under data protection laws of different countries. Taking this into account, we treat sensitive personal data as personal data that, if misused or leaked, could potentially endanger an individual’s safety, damage their reputation or health, or lead to discriminatory treatment. This includes racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.
During your time on the panel and in your participation of surveys, you may be asked if you want to provide sensitive personal data. You can always choose whether to provide this data to us. We have included the types of sensitive personal data we ask to collect from you in the “Lawful Collection and Use of Data” section above, including the relevant purpose for processing.
Rights of Individuals
You have the following rights in respect to your personal data based on applicable data protection laws:
| Right | Description |
|---|---|
| Withdraw consent | The right to change your mind and to withdraw your consent. This will not affect the lawfulness of any processing carried out before you withdraw your consent. It also means that we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent. |
| Sale opt-out | The right to opt-out of the sale of your personal data, where we sell your personal data. |
| Access | The right to access copies of your personal data (commonly known as a "data subject access request"). This enables you to request a copy of the personal data we hold about you and to check that we are processing it lawfully. |
| Rectification / correction | The right to rectify your personal data. This enables you to have any incomplete or inaccurate information we hold about you corrected. |
| Object | The right to object to the processing of your personal data. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms. |
| Deletion | The right to ask us to delete or remove your personal data where we have no sufficient legitimate reason to continue to process it. You may also wish to exercise this right where you have successfully exercised your right to object to processing or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. |
| Port | The right to port your personal data (portability right). This allows you to transfer your personal data to another party in a portable format. |
| Restrict processing | The right to restrict processing of your personal data. This enables you to ask us to suspend the processing of personal data about you — for example, if you want us to establish its accuracy or the reason for processing it |
| Restrict sensitive data processing | Limit the use and disclosure of any sensitive personal data in certain circumstances. |
| De-register | The right to de-register from a survey at any time. After de-registration, we will stop providing you with our services and delete your personal data according to our retention policy and your request, unless laws and regulations specify otherwise. | Automated decision-making | Rights in respect to any automated decision-making. If you become subject to automated decision-making, in advance we will provide you with meaningful information about the logic involved, the significance and the envisaged consequences. You also have the right to obtain human intervention, express your own point of view, obtain an explanation of the decision and challenge the decision. |
| Complain to a relevant authority | The right to lodge a complaint regarding how we process your personal data. See the “Complaints” section below. |
Your rights may be limited — for example, if fulfilling your request would reveal personal data about another person, where it would infringe the rights of a third party (including our rights) or if you ask us to delete data which we are required by law to keep or have compelling legitimate interests in keeping. We will inform you of relevant exemptions we rely upon when responding to any request you make.
If necessary, we shall also notify third parties to whom we have transferred your personal data of any changes that we make on your request. Note that while we communicate to these third parties, we are not responsible for the actions taken by these third parties to answer your request. You may be able to access your personal data held by these third parties and correct, amend or delete it where it is inaccurate.
Accessing Personal Data Rights
To request access to personal data that we hold about you, please see the contact details in the ”How to Contact Us” section. When you make a request, you should provide your panellist ID or any other relevant identifiers. If you contact us using an email address or contact details for which we do not hold a record of, we may also request you provide a copy of a valid government issued or official identification (such as drivers licence or passport) to verify your request. We do not discriminate against you for exercising any of the rights listed above or any other rights you may have.
You may be entitled to use a third party to submit a request to us on your behalf (sometimes referred to as an ‘authorised agent’ or similar). For this purpose, we will require proof that you gave that third party signed permission to submit the request, which may be in the form of a power of attorney. We may also require additional verification, such as the identity of the third-party individual.
We aim to respond to your requests to access your personal data rights as soon as possible. However, we will respond within the timeframes determined by the applicable data protection law. In some countries, that is one calendar month or 30 days from receipt of the request. Timeframes under data protection laws may be paused whilst we collect essential information from you, such as verification of your identity.
We will not charge you for your reasonable requests in principle. However, where permissible under application laws, a fee to reflect the cost will be imposed as appropriate on repeated requests beyond reasonable scope. As for repeated requests that are groundless and need excessive technological means (e.g. developing a new system or fundamentally changing the current practices) to fulfil, involve risks to others’ legitimate rights and interests or are impractical (e.g. involving information stored on a backup disk), we may reject your request, subject to applicable data protection laws.
Some data protection laws also prevent us from granting your access to your personal data rights, such as where this affects national, defence or public security; major public interests; criminal investigations, prosecutions, trials or enforcement of judicial decisions; the life, property or other important legal rights and interests, or those of other individuals; and trade secrets.
Data Storage and Retention
Personal data shall be retained only for such period as is appropriate for its intended and lawful use. We shall retain your personal data for as long as you are a member of the panel. In the event that you unsubscribe from the panel, we shall retain data for no longer than 12 months, unless otherwise required by law. Personal data that is no longer required shall be disposed of in a manner that ensures that the confidential nature is not compromised.
As part of the Company Business Continuity Plan and as required by ISO 27001, ISO 9001, ISO 20252 and in certain instances the law, our electronic systems are backed up and archived. These archives are retained for a defined period of time in a strictly controlled environment. Once expired, the data is deleted and destroyed to ensure the data is erased completely.
Automated Decision-making
You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you. In such instances, you are also entitled to other related rights (see the “Rights of Individuals” section of this Notice).
Updates to our Privacy Notice
We keep our Privacy Notice under regular review and it may be amended from time to time and at least every 12 months. We will always have the most up-to-date Notice on our website, or within your panel portal. We will record when the Notice was last revised. Non-material changes to this Privacy Notice will be announced through the panels’ sites only.
Original version: 15/02/18
Latest version: 07/07/2026
How to Contact Us
If you have any questions or concerns relating to your privacy or to Kantar privacy practices, or you wish to access your rights or unsubscribe, you can contact Kantar:
The Kantar Group Data Protection Officer can be contacted as follows:
Complaints
If you consider that our processing of your personal data infringes data protection laws, or you have a related complaint, you may have a legal right to lodge a complaint with a local authority, regulator or supervisory authority responsible for data protection in your country. However, we would appreciate the opportunity to address your concerns before you do this, so please contact our privacy team in the first instance at dataprotection@kantar.com .