OUR PRIVACY POLICY

Effective 21 December 2022

OUR PRIVACY PROMISE

Our priority is building trust with our customers. As part of this we are fully committed to respecting our customers’ privacy and ensuring that their data is secure at all stages of their journey with us.

The purpose of this document (“Policy”) is to let you - as one of our customers - know about how your data is being handled by us when you visit or use our sites, so that you can feel confident using our services from day one.

Who we are

When you use our services, Supply Trades ("Supply Trades" or "we") acts as a 'data controller' (meaning a company responsible for protecting your privacy). We are registered as a data controller at 47, KimPur, Mumbai - 313563, with CIN: U01631KA2010PTC096843.

Your data rights 

Did you know that, by law, you have certain rights in relation to your data? These include the right to revoke your consent and the right to object to direct marketing at any time. You may exercise any of these rights via Your Privacy Choices.

- - - - - - - - - - - - - -

NAVIGATING OUR POLICY

To make it easier for you to navigate our Policy, we have numbered each of the sections, as listed below. This will allow you to quickly scroll or skip to the sections that you want to know more about.

1. OUR SERVICES
2. HOW OUR SITES WORK
3. WHAT INFORMATION WE COLLECT & HOW WE USE IT
4. SHARING YOUR DATA
5. COOKIES & EVENT TRACKING
6. STORING YOUR DATA
7. YOUR DATA RIGHTS
8. TRANSFERRING YOUR DATA
9. HOW TO EXERCISE YOUR RIGHTS & CONTACT US
10. PRIVACY NOTICE FOR CALIFORNIA CONSUMERS
11. SECURING YOUR INFORMATION
12. CHANGES TO THIS POLICY

1. OUR SERVICES

Depending on which of our sites you are visiting, Supply Trades offers a number of different services. When you are on our sites, it should always be clear which service applies to you.

• Requests for quotes or information - We endeavour to put our customers in contact with relevant providers (“Suppliers”) of a product or service (“Product”) they are interested in. The request could be in order to receive a quote, further information or to book an initial consultation or appointment.
• Earning opportunities - We enable our customers to find and participate in online surveys and other earning opportunities (“Offers”) with market research companies (also referred to as “Suppliers”).
• Editorial content - Our writers create useful Product reviews, articles and newsletters to help our readers make informed decisions as to the Products they wish to enquire about, purchase or trial, or the Offers they wish to sign up to.
• Competitions, prize draws and events - From time to time, we run competitions, prize draws and events.

2. HOW OUR SITES WORK

Our aspiration is to help our customers make easier buying decisions and to connect them with relevant Suppliers at a click of a button. Our services are obligation-free so whether or not you go on to purchase or trial a Product, book an appointment or sign up to any Offer, the decision is entirely yours!

Unless you are on our site just to read more about a Product or Offer (in which case, please read on), our services generally rely on our customers to submit information to us via a webform. If you choose to submit a webform with us, we’ll do our best to connect you with one or more relevant Suppliers as follows:

• Requests for quotes or information - when you complete and submit our webforms, we will share this information with relevant Suppliers. We’ll tell them who you are and your Product requirements (based on the information you have provided to us) and, depending on your request, they’ll then follow up with you directly by phone, email or SMS message. For certain Products, before connecting you with relevant Suppliers, we may call you to confirm your details or requirements or, if you have requested an appointment, to book an appointment. Our sites may also give you the option to click out directly to a Supplier’s website or to call the Supplier directly.
• Earning opportunities - when you complete and submit our webform, our sign-up process will ask you to select the specific Offers that you would like to participate in. Once you have submitted the webform, you will receive a confirmation email for each Offer that you expressly selected. The email will come from us, or from the Supplier that you selected, and it will ask you to confirm your choice by clicking on a link. If you still wish to participate in the Offer, then simply click on the link, which will take you through to the Supplier’s website. You will also receive a general email from us welcoming you to our survey-keen community!

RECEIVING MARKETING MESSAGES

We enjoy regularly updating our customers about other Products and Offers that might be of interest to them. This means that we may email or SMS message you about similar Products or Offers to your initial request, unless you opt-out of receiving such marketing messages.

You can change whether or not you receive these messages at any time through Your Privacy Choices. You also have the following options:

• To opt-out of emails - You can click on the unsubscribe link in an email
• To opt-out of SMS messages - You can text “STOP” in response to the SMS message

From time to time, we may also ask to send you browser notifications via a pop up box when you visit our sites (e.g. at the end of a webform). If you allow these notifications, you will receive regular messages from us about great offers, top tips, popular guides and more information about each Supplier. All our messages give you the option to unsubscribe by clicking on the notification settings and selecting 'Disable Notifications'.

3. WHAT INFORMATION WE COLLECT & HOW WE USE IT

If you visit our sites and use our services, we may collect certain information about you. We want you to understand:

• What information we collect and how we collect it
• Why we collect your information (i.e. what do we use it for and who we may share it with)
• What lawful basis we rely on to collect your information

The tables below explain this in more detail.

1. Contact details (e.g. name, email address, telephone number, postal code) and Product requirements

2. Sensitive Information (e.g. medical conditions and other information about your health) - We will only collect this information if you are using our services in relation to health Products.

3. IP address (this is a unique number associated with a computer or device, which enables it to communicate with other computers and devices over the Internet), other online identifiers, geolocation, device specification

4. Event Data (e.g. user agent, IP address, country, language, and browser/app used) - We may use third party device data collection tools and similar tracking technologies (that sit behind our ads and sites) to collect such data

In relation to Event Data that we share with TikTok for the purposes set out above, both Supply Trades and TikTok are joint data controllers. For any subsequent processing TikTok will be an independent controller.

• To find out more about how TikTok uses your data, you can visit their privacy notice here.
• Supply Trades has an agreement with TikTok that determines our respective data responsibilities as joint controllers (including that we have agreed to provide to you with the information set out above and that TikTok is responsible for enabling you to exercise your rights with regard to your personal data stored or otherwise processed by TikTok after the joint processing.)

5. Call recordings (Please be aware that sensitive personal data may be recorded where you voluntarily disclose health information to us over the phone)

6. Disposition data (i.e. information on whether or you have purchased a Product or signed up to an Offer with one of our Suppliers)

4. SHARING YOUR DATA

In providing our services to you, and to ensure that we are able to provide you with a good customer experience, we may share your data with third parties.

We work with the following categories of third parties:

• Suppliers - The Suppliers that we connect you with and who contact you in relation to the  Products or Offers. As explained above, if you submit our webform, we’ll pass your request to one or more relevant Suppliers (named on the consent statement). We will do this in a secure way e.g. using HTTP Secure (HTTPS), which means the data is encrypted. If you have expressed an interest in a financial product, some Suppliers may pass your data to third-party credit check agencies as part of your application but you will be made aware of this in the consent statement.
• Advertising platforms - We work with a number of companies (e.g. social media platforms and search engines) through which we run our marketing campaigns and reach new potential customers. In fact, this could be one of the ways in which you found out about our site! We may share data with these companies to monitor how our campaigns are performing or to reach new audiences who might benefit from our services (see our explanation of ‘customer and lookalike audiences’ below).
• Trustpilot - We work with Trustpilot to gather reviews from our customers. If you post a review of us on Trustpilot by clicking through the Trustpilot link on our pages, we share your name and email address with Trustpilot in order to enable them to set up an account for you to post the review, and to verify your review as genuine.
• Service providers who process data on our behalf - There are some companies who we engage to (i) provide a service essential to running our business (e.g. cloud storage providers, email service providers and cloud telephony providers) or (ii) provide analytics and consultancy services. We share data with these companies in order to provide our services to you as best we can.

In each case, we have appropriate contracts in place with these companies and Suppliers to ensure the protection and confidentiality of your information.

Custom and lookalike audiences

We like to work with Facebook, Google, TikTok and other platforms (“Platforms”) to reach out to you with adverts for other Products that you might be interested in. We also like to use Platforms to reach out to other people who might like to use our service.

We do this in two ways. In both cases, your information, along with other information, is used to create a custom audience and/or a lookalike audience. Whenever an audience is shared with a Platform, the data is first hashed and pseudonymised, meaning that any data within the audience that could identify a person is replaced with an artificial identifier. So, the process is secure. Also, we don’t share more data than we need to for the purpose of creating the audience.

• Custom audience – A custom audience is a list of our existing customers. From time to time, we share this with Platforms. As explained above, the data is first hashed and pseudonymised. The Platform uses this audience to show our customers our adverts for other Products that they might be interested in.
• Lookalike audience – A lookalike audience is an audience created by the Platform. From time to time, we share with Platforms a list of customers. The Platform uses this list to find and create lookalikes – i.e. other Platform users who have similar characteristics to the customers – to which it shows our adverts. Again, as explained above, the data is first hashed and pseudonymised.

Sharing calls

On occasion, we may pass calls to local police enforcement when necessary under the lawful basis of protecting the vital interests (e.g. the life or safety) of the individual involved.

5. COOKIES & EVENT TRACKING

Cookies

A cookie is a small text file that is placed on your computer by a website that you visit. They are widely used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site. Web browsers generally allow you to control cookies through the browser settings and you can clear your cookies at any time.

We use cookies on our sites. To find out more about the cookies we use (including the purposes for which we use them) and to manage your cookie settings, visit our cookies preference centre via the 'Cookies Settings' button found on our sites.  

Event Tracking

We may use click identifiers (i.e. a random unique sequence of letters and numbers) or hashing techniques for marketing attribution purposes, to identify new and returning visitors on our sites, or for other event tracking purposes.

Unlike the use of cookies, these techniques do not use any technology to store data on your device. These techniques rely on data voluntarily provided or supported by your browser (e.g. user agent string, IP address etc) and we will never attempt to use them to circumvent the browser or request excessive data about your device.

6. STORING YOUR DATA

We will only hold your information for as long as we need to in order to fulfil the purposes for which it was collected in the first place, as set out in this Policy. Specifically:

• We will keep the information we collect from you (as detailed in section 3) for 4 years after your webform submission to enable us to resolve any disputes or queries from Suppliers and as recommended or required by applicable data protection laws.
• If you haven’t opted out of receiving marketing from us, we will keep your details, and send you emails, until such time as you don’t engage with our emails for a period of 6 consecutive months.

• We will only store data inputted by you in a partially completed webform for 2 hours from when you leave the webform, subject to an automatic back-up of that data being made and stored for 30 days from the date you partially completed our form. Such back-up will not be readily accessible by us and your data will not be used for any other purpose.

7. YOUR DATA RIGHTS

Do you know, you have a number of data rights, which will be determined by the country in which you reside. We have set these out for you in the tables below.

To exercise any of your data rights, you can contact us via the details set out in the ‘HOW TO EXERCISE YOUR RIGHTS & CONTACT US’ section of this Policy.

1. The European Economic Area (“EEA”) / United Kingdom (“UK”)

If you reside in the EEA or the UK, you have certain rights under the GDPR and UK GDPR in relation to your information. In relation to our site, and the service that we provide, those rights are as follows:

2. California Residents

If you are a California resident (i.e. if you reside in California on more than a temporary basis), you will benefit from the rights afforded to you by the California Consumer Privacy Act (“CCPA”) and the California Privacy Rights Act (“CPRA”). These include the right to have your personal data deleted, and the right to object to your personal data being ‘sold’ to third-parties.

For more information, see the section below titled ‘YOUR CALIFORNIA RIGHTS - PRIVACY NOTICE FOR CALIFORNIA CONSUMERS’.

8. TRANSFERRING YOUR DATA

There may be instances where we need to transfer your information outside the UK. For example, where you are using our services outside of the UK, we may need to transfer your information outside the UK.

As of 1 January 2021, the UK is no longer a part of the EEA. Although the UK is no longer part of the EEA, we will still hold your data to the same level of protection as we did when we were part of the EEA. This means that for any transfer of your data outside of the UK, we will continue to take steps to ensure that it is protected to the same level of protection that applies to transfers of data outside of the EEA.

Certain countries have a European Commission adequacy decision, which means they are considered to offer an adequate level of data protection and we will continue to only transfer data to those countries on this basis.

Other countries do not have the same level of legal protection as countries in the EEA, or with an adequacy decision. If we do transfer your data in this way, we will take steps to ensure that it is protected to the same levels that apply in the EEA. This may include, for example, adopting the EU’s standard contractual clauses.

9. HOW TO EXERCISE YOUR RIGHTS & CONTACT US

There are 3 ways in which you can contact us and exercise your rights as explained in this Policy:

1. Via “Your Privacy Choices” - this is an easy-to-use portal through which you can withdraw your consent to being contacted by us and Suppliers at any time. A link can be found here.
2. Via email - our data protection team is on hand Monday to Friday to answer your data questions and action your requests. Please email us at [email protected] and we will try to respond to you or action your request as soon as we can.
3. Via post - you can also write to us at our registered office address: 47, KimPur, Mumbai - 313563
4. Via phone - if you are based in India, you can call us at the following toll-free number 0674 2702416.

Our lead supervisory authority for the processing set out in this Policy is the UK Information Commissioner’s Office (ICO). If you are unhappy with how we have processed your data, you have the right to make a complaint to the ICO.

If you are based outside of the UK, or you have a complaint concerning our activities outside of the UK, you may prefer to lodge a complaint with a different Supervisory Authority. A list of relevant authorities can be accessed here.

10. PRIVACY NOTICE FOR CALIFORNIA CONSUMERS

This section of our Policy applies to customers who are residents of the state of California, United States, in compliance with the California Consumer Privacy Act (“CCPA”) and the California Privacy Rights Act (“CPRA”).

Information we collect

When customers visit our sites, we may collect certain Personal Information about them (as defined by the CPRA). The table below explains what Personal Information we collected in the preceding twelve months since the section of this Policy was last updated, and how we used, disclosed, sold or shared (for cross-context behavioural advertising purposes) it, broken down by categories.

Please note that the categories of personal information set out above are obtained directly from you when you submit a webform through our site and indirectly from you (for example, through call recordings, cookies or other tracking mechanisms).

California Consumers’ Individual Rights

California consumers have certain rights in relation to their Personal Information. This section describes your rights and explains how you can exercise them.

Requests to know, delete and correct

1. Verification

Requests to know, delete, and correct must be verified. To begin the verification process, please email us at [email protected] and from there, we will take you through the process.

Verifiable consumer requests for access can only be made by you twice within a 12-month period. The request must also:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information (e.g. by verifying your identity through your email address).
• Describe your request with a sufficient level of detail that allows us to properly understand, evaluate and respond to it.

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity.

2. Response

Once we have received a verifiable request, we will aim to respond  within 45 days. Sometimes we may require more time. If we do, we will let you know by email with the reasons why and the period of extension.

3. Authorising an agent

If you are acting as an authorised agent to make a request to know, delete,  correct, or opt out on behalf of a California resident, email us at [email protected] and attach a written authorisation signed by the resident.

Other disclosures

• Minors

We do not knowingly sell or share Personal Information of customers under 16 years of age.

11. SECURING YOUR INFORMATION

We want you to be confident in trusting us with your information. To ensure that the necessary protection is in place, we have implemented a number of technical, organisational and security measures including:

• Measures that look  to ensure availability and access to your data is restored in a timely manner in the event of a physical or technical incident

• Implementing internal user identification and authorisation processes

• Measures that look  to ensure protection of your data during transmission

• Measures that look to ensure protection of your data during storage

• Measures that look to ensure the physical security of the locations where your data is being processed

• Measures that look to ensure that your data is not retained for longer than necessary  

• Measures that look to ensure we only collect data that is necessary

This list is not exhaustive and may change from time to time.

12. CHANGES TO THIS POLICY

This Policy is effective from the date specified at the top of this Policy and is our most up-to-date version, which supersedes any earlier version.

From time to time, we may update this Policy.