MRG Data Privacy Policy
Last updated on May 17, 2018
Management Research Group (MRG) is committed
to protecting your privacy. This Data Privacy Policy tells you about MRG’s
policy and practice for the collection, use, processing, storage, transfer, protection,
and disclosure of information that we may collect about you through our website, www.mrg.com, or all subdomains including https://questv2.mrg.com or
other MRG websites. As a result, by using any of our sites you are accepting the
practices described in this policy.
Before you access and use our websites, you will be asked to provide your authorization
and consent by agreeing to the terms and conditions of this MRG Data Privacy Policy
and consenting to the collection, your submission (if applicable), and processing
of information about you as described herein, in compliance with relevant data protection
laws.
The collection, use, processing, storage, transfer and disclosure of your Personal
Information (as defined below) will be limited to the terms under which you provide
MRG your authorization. MRG is committed to compliance with all relevant country-specific
data privacy laws, including EU Standard Contractual Clauses, model contracts /
transfer agreements, privacy statements and policies, and country-specific filings
if applicable. This Data Privacy Policy covers www.mrg.com and
all other MRG websites.
Collection of Your Personal Information
Personal information (“Personal Information”) is data that can be used
to identify, either directly or indirectly, an individual to whom the information
applies. The information that we may collect from you includes your name, email
address, contact preferences, marketing preferences, and as applicable, IP address.
MRG will not collect any Personal Information about you unless you voluntarily choose
to provide it to us or our partners, you provide your explicit consent, or unless
it is permitted by applicable laws and regulations. You can always “opt out”
at any time by clicking the "unsubscribe" link in any email or managing your subscription
preferences.
When you do voluntarily provide us with Personal Information, we will use it to
provide you information about our products, process your order, register you for
an event, create an account, provide customer service, respond to a specific question,
offer you the opportunity to register for webinars and certifications, or provide
access to additional information or offers. We also use the information we collect
to improve the content of our websites, to notify customers of updates to our websites,
products, and also to contact customers for marketing and sales purposes, including
renewals, that are related to a customer’s specific needs and interests.
Use of Your Personal Information to complete MRG Questionnaires
If you are being asked to complete one of MRG’s questionnaires; all information
is collected, stored and transmitted by MRG through the our Assessment websites,
Quest https://questv2.mrg.com and/or
Momentum https://momentum.mrg.com.
These websites are restricted access sites that allows our clients to manage their
MRG-related projects and administer questionnaires. Data collected via these websites
is used to create feedback reports for the purpose of individual and organizational
development. MRG works solely with strategic partners (agents) who have been trained
to facilitate feedback to individuals and organizations based on the results of
MRG questionnaires. Your MRG strategic partner (agent), as designated by you or
your company, will have access to the data you provide us in your questionnaire,
and may be involved in collecting, interpreting and/or reporting on that data.
Data Controllership
In the context of MRG Questionnaires, MRG acts as a data processor for
the Personal Information we process.
Basis of Processing
Within the scope of this policy, we may rely on one or more of the following legal
grounds for processing of your Personal Information:
- The need to perform our obligations under a contract or to perform related pre-contractual
duties;
- The legitimate interest of the “Participant” (i.e., the individual who
is being rated), such as to demonstrate leadership abilities; and
- Any other ground, as required or permitted by law in the specific respective context.
How We Receive Personal Information
We may receive your Personal Information through our Assessment websites, Quest https://questv2.mrg.com and/or Momentum https://momentum.mrg.com. We may also
receive your personal data from third parties, in which case we will notify you,
where required by applicable laws, without undue delay. In particular, we may receive your Personal Information in our Assessment websites, Quest https://questv2.mrg.com and/or
Momentum https://momentum.mrg.com when
you or third parties:
- create an assessment or pulse survey through our Assessment websites;
- invite an observer via through our Assessment websites; or
- complete an assessment or pulse survey through our Assessment websites.
Purposes of Processing
We may process your Personal Information for the purposes of:
- enabling the use of our Assessment websites;
- providing feedback reports for the purpose of individual and organizational development
to the parties concerned;
- sending you email notifications which you have specifically requested.
Data Retention
Data processed through our Assessment websites, Quest https://questv2.mrg.com and/or
Momentum https://momentum.mrg.com is
retained indefinitely. However, we will always respect your request(s) that we delete
your Personal Data, subject to the limitations described in this policy.
Data Ownership
MRG defines the Owner of the data as follows:
- Each person who completes a questionnaire is considered the Owner of those responses
and has the right to request, at any time, that those responses be removed from
the MRG system(s).
- Each person or organization that is the focus of a given report from the MRG system(s)
has the right to direct access to copies of those reports as they see fit to any
MRG strategic partner.
- Any person who has voluntarily provided their personal information to MRG outside
of taking a MRG assessment questionnaire is the owner of that personal data.
No Sharing of Information
MRG is committed to maintaining a healthy relationship with our customers and values
the information provided on its online platforms. MRG does not share customer information
with third parties for purposes outside the scope of the products and services we
provide. We will never share, sell, or rent your personal information to third parties
for promotional use.
MRG may disclose any information about you to government or law enforcement officials
or private parties as we, in our sole discretion, believe necessary or appropriate
to respond to claims, legal process (including subpoenas), to protect the property
and rights of MRG or a third party, the safety of the public or any person, to prevent
or stop any illegal, unethical, or legally actionable activity, or to comply with
the law.
MRG may also be required to disclose an individual’s personal information
in response to a lawful request by public authorities, including to meet national
security or law enforcement requirements.
Cookies and Other Technologies
MRG's websites, advertisements, emails, and online services may use certain automatic
data collection technologies such as cookies to collect data, including personal
information, about you while you use our website, our products, and when you interact
with us. Collection of user data helps us to understand our users’ behavior,
web searches, and where on our websites users have visited. Our website uses cookies
to distinguish you from other users of our website, helps us to provide you with
a good experience when you browse our website, and allows us to improve our website.
A cookie is a piece of information that is stored on your computer’s hard
drive by your web browser. When you visit www.mrg.com (or
any of the MRG websites), our server recognizes the cookie, giving us information
about your last visit to the website. Many browsers accept cookies automatically,
but you can adjust the settings in your browser to disable automatic acceptance
of cookies. If you choose not to use cookies, you may experience limited functionality
of our website. This Data Privacy Policy only covers MRG's use of cookies and does
not cover the use of any propensity management by advertisers. MRG complies with
global regulations including the EU Cookie Directive. Visitors to our websites are
advised of our use of cookies upon landing on our website.
Information collected by cookies and similar technologies are treated as non-personal
information except to the extent under local law that IP addresses (or like identifiers)
are otherwise considered Personal Information.
Accuracy and Retention of Personal Information
MRG strives to make it easy for you to keep your Personal Information up to date
and to help us maintain its accuracy. Your Personal Information will be stored only
for the time period necessary to fulfill the purposes outlined in this Privacy Policy
unless otherwise required or permitted by law.
Communications and Subscription Preferences
You have the choice to determine what information you receive from MRG about products
and services, and how such information is received by specifying your communication
preferences by your subscription details at the communication preferences page.
If you wish to discontinue receiving marketing and/or non-transactional e-mails
from us, you may do so using an "unsubscribe" link in any email or updating your
subscription details at the communication preferences page. We would like to emphasize
that this provision does not apply to transactional emails related to users’
business relationship with MRG, including completion of MRG’s assessment questionnaires.
In the event you choose not to provide certain personal information, we may not
be able to respond completely or adequately to your questions, provide updates,
and/or information about our products and services. You can always “opt out”
of receiving certain communications at any time by updating your subscription details
at the communication preferences page or clicking the "unsubscribe" link in any
email. We will however continue to use your Personal Information for the limited
purpose of sending you important notices relating to information about your purchases
and changes to our policies and agreements, or for other reasons permitted by applicable
law.
Data Security
MRG takes the security of Personal Information seriously. To protect your Personal
Information that you have provided us against accidental or unlawful destruction,
loss or alteration, MRG uses technical and organizational security measures to prevent
any unauthorized disclosure or access. We require you to enter a password to access
your account information. All payment transactions are processed through a gateway
provider and credit card information is not stored or processed on our servers.
Data Security Breach
MRG has implemented strict security controls, intrusion detection software and processes
to alert us in the case of a potential or actual intrusion of our information systems.
If any data security breach occurs and it may impact your Personal Information,
you will be notified as soon as possible once the breach has been determined. MRG
also commits to notifying all applicable DPAs without undue delay, and within 72
hours if feasible, after becoming aware of a breach.
Collection and Use of Non-Personal Information
When you access www.mrg.com (or other
MRG websites), we may automatically collect non-Personal Information even if you
don’t register. For example, this information may include the operating system
used, the domain name of the website that directed you to our website, the number
of visits, average time spent on a page and what pages you viewed. We may use this
data and share it with our worldwide affiliates to monitor the content and relevancy
of the content on our websites to improve the performance, content or your experience
on our websites.
Through your use of services to access our website, your communications data (for
example, Internet Protocol Address, or IP Address) or utilization data (information
on the telecommunications services you accessed) may be technically generated and
could, depending on the applicable law, constitute Personal Information. To the
extent it is a necessity, the collection and processing of your communications or
utilization data, and the subsequent use of such data will only occur and be performed
in accordance with the applicable data privacy protection framework and laws.
Forums, Blogs, Third Party Websites and Links
MRG is only responsible for privacy practices of Management Research Group and its
websites. MRG’s website may contain links to other websites for additional
information and convenience. MRG does not control those other websites, endorse
or make any representation about other websites, and is not responsible for the
privacy practices of those other websites. Some of MRG websites contain interactive
elements such as discussion forums and blogs that allow users to publish their own
content. Any information posted on these blogs and forums becomes public, which
means it could be read, collected or used by other users in any manner. MRG is not
responsible for any Personal Information you choose to submit in forums. Given the
inherent operation and nature of the Internet, all Internet submissions are done
at user’s own risk.
Consent to Transfer, Process, and Store Personal Information
MRG is a global organization so the information you provide to MRG may be transferred
or accessed by MRG entities in the European Union, Switzerland and other countries
around the world, each of which are responsible for the Personal Information which
it collects and protects your Personal Information in accordance with this Privacy
Policy. Management Research Group complies with the EU-U.S. Privacy Shield Framework
and the Swiss-U.S. Privacy Shield Framework as set forth by the U.S. Department
of Commerce regarding the collection, use, and retention of personal information
transferred from the European Union and Switzerland to the United States. Management
Research Group (MRG) has certified to the Department of Commerce that it adheres
to the Privacy Shield Principles. If there is any conflict between the terms in
this privacy policy and the Privacy Shield Principles, the Privacy Shield Principles
shall govern. To learn more about the Privacy Shield program, please visit https://www.privacyshield.gov/.
In compliance with the Privacy Shield Principles, MRG commits to the following:
Notice:
When MRG collects your personal information, we’ll give you timely and appropriate
notice describing what personal information we’re collecting, how we’ll
use it, and the types of third parties with whom we may share it.
Choice:
MRG gives you choices about the ways we will use and share your personal information,
and we’ll respect the choices you make. If MRG were to ever engage in any
onward transfers of your data with third parties other than our agents, we would
provide you with an opt-out choice to limit the use and disclosure of your personal
data.
Onward Transfer:
MRG will not disclose your information to unaffiliated third parties without first
obtaining your permission, unless of course it’s to meet national security
or law enforcement requirements. In cases of onward transfer to third parties of
data of EU individuals received pursuant to the EU-US Privacy Shield, we are liable
for appropriate onward transfers of personal data to third parties.
Security
MRG takes appropriate physical, technical, and organizational measures around
security, availability, processing integrity, and confidentiality to protect personal
information from loss, misuse, unauthorized access or disclosure, alteration or
destruction.
Data Integrity:
MRG takes appropriate steps to make sure the personal information in our records
is accurate.
Relevance:
MRG collects only as much personal information as we need for specific, identified
purposes, and we won’t use it for other purposes without obtaining your consent.
Retention:
MRG keeps your personal information for as long as required to fulfill the purposes
for which it was collected, or as permitted by law.
Access:
MRG acknowledges that EU individuals have the right to access the personal information
that we maintain about them. MRG provides ways for you to access your personal information,
as required by law, so you can correct inaccuracies (see Access to Information below).
Enforcement:
MRG regularly reviews how we’re meeting these privacy promises, and we provide
an independent way to resolve complaints about our privacy practices. MRG commits
to cooperate with EU data protection authorities (DPAs) and the Swiss Federal Data
Protection and Information Commissioner (FDPIC) and complies with the advice given
by such authorities with regard to all data transferred from the EU and Switzerland.
MRG is also subject to the investigatory and enforcement powers of the Federal Trade
Commission (FTC).
Independent Recourse:
MRG commits to resolve complaints about our collection or use of your personal
information. EU individuals with inquiries or complaints regarding our Privacy Shield
policy should first contact MRG at:
Data Privacy Officer, 14 York Street, Suite 301, Portland, Maine 04101 USA
MRG also commits to refer unresolved privacy complaints under the EU-US Privacy
Shield Principles to the EU DPAs/Swiss FDPIC. If your complaint is not resolved
through these channels, under limited circumstances, a binding arbitration option
may be available before a Privacy Shield Panel.
Access to Information
MRG gives you access to the following information about you for the limited purpose
of viewing and, in certain cases, updating that information. This list may change
as the MRG online systems evolve.
- Your Profile Account
- Your Shopping Cart
Right to be Forgotten
MRG is committed to taking reasonable steps to ensure that any Personal Information
requests to be forgotten can be erased with our existing technology will be done
so in a reasonable time of the request. However, this doesn’t apply to information
that you have made public by posting on our forums, blogs, or have made available
to third parties yourself, this is beyond the reach of what MRG can erase. MRG will
do everything possible to erase your Personal Information if you withdraw your consent
(opt out) from receiving information for us and request the right to be forgotten.
However, MRG will not be able to erase all of your Personal Information if it is
technically impossible due to limitations to existing technology, or for legal reasons
(MRG is mandated by local law to keep the Personal Information).
Children’s Privacy
MRG will not knowingly collect Personal Information from any person that is not
a legal adult, as defined by local law, without insisting that they seek prior parental
consent, if such consent is required by applicable law. MRG does not target children
in connection with its products, services, and websites. In the event MRG uses or
discloses Personal Information of a person that is not a legal adult, MRG will seek
parental consent pursuant to local laws and regulations in order to protect the
person that is not a legal adult.
Changes to this Privacy Policy
As a global company, our systems will mature and change as will this Data Privacy
Policy. Changes to this Data Privacy Policy with the most recent revision date will
be posted at www.mrg.com. We encourage you
to review this Privacy Policy periodically for any changes or updates.
Contact Us
MRG is committed to responding to reasonable requests to review any of your Personal
Information we may have and to amend, correct, or delete any inaccuracies. To have
your information amended, corrected, or deleted, or if you have any questions that
weren’t answered in this Data Privacy Policy, you can contact us at Management
Research Group 14 York Street, Suite 301, Portland Maine 04101 USA or email us at privacy@mrg.com. If requested to remove data,
we will respond within a reasonable time frame.
For our clients that require Data Processing Agreements, Standard Contractual
Clauses:
The European Commission’s SCCs, otherwise known as model contracts or clauses,
are contract terms developed and approved by the European Commission as ensuring
adequate protection for data subjects in accordance with the EU Data Protection
Directive 95/46/EC when transferring personal data from the EEA to the U.S. If you
are a MRG client or partner transferring personal data in connection with MRG products
and services, please promptly complete, sign and return a copy of the MRG Standard Data Processing Addendum to privacy@mrg.com.