1. Overview and consenTag’s role
This privacy notice provides information about how consenTag collects and processes certain data stored in or accessible to your device or browser for the purposes of receiving your consent preferences and passing the consent (or non-consent) you give through consenTag to others so that they may act on your preferences.
Crimtan has an arrangement with the proprietor (the Site Owner) of the website (the Site) where you engage with consenTag for these purposes.
When you access consenTag, it associates your browser or device and your Preferences (see 2 below) with an identifier stored on that browser or device (an ID). This identifier is not associated with any data that identifies anything other than your browser or device.
consenTag’s role is to collect the Preferences you select and convey them to service providers who wish to provide you with a service for which you have expressed a Preference through consenTag (Service Providers). This is done by means of a signal called a Consent Signal.
You have the option to set up a consenTag account should you wish (an Account), in which case you will need to provide an email address and pass-phrase. Should you choose to establish an Account, it will be used only to allow you to control your Preferences and for any other purposes specified in this notice.
2. Your preferences
consenTag provides you with the opportunity to give or refuse your consent to the following (each a Preference):
- The provision of enhanced Site content to you (Site Enhancement)
- Use of web analytics to make improvements to your experience of the Site (Experience Enhancement)
- Provision of relevant advertising to you on the Site (Relevant Advertising)
When you give consenTag a Preference, consenTag:
- associates that Preference with the ID; and
- time-stamps the giving of that Preference.
This is the Preference Data.
Only Preference Data is disclosed to Service Providers.
3. The ID-related data that is collected
consenTag wishes to ensure that the ID is as accurate and unique as possible, and that your Preferences for that ID are acted-on in ways that you have selected.
Therefore, consenTag collects and stores certain different kinds of data against the ID (referred to as ID-related Data). It is stored and used solely for the purpose of individually identifying the ID, associating your Preferences with that ID as accurately as possible and managing your Preferences. consenTag does not disclose ID-related Data to Service Providers.
ID-related Data may include any or all of the following:
ID-Recognition Data:
- the type and version of the web browser or device associated with your ID
- time zone setting and location of that web browser or device
- browser plug-in types and versions deployed by the web browser or device
- your ID’s appearance in Site cookies placed by or on behalf of the Site Owner
- http headers of parts of the Site accessed by your ID and (where available) any associated etag http response headers and internet protocol (IP) address(es)
Contact Data (Optional):
- email address and pass-phrase, where you choose to set up an Account in order to control your Preferences.
4. Purposes for which ID-related data is used
Set out below, in a table format, is a description of the ways consenTag uses and retains ID-related Data, and the legal basis for doing so.
Purpose/Activity: To set up an ID, associate your Preferences with it, and transmit a Preference (and associated Preference Data) by means of a Consent Signal to an individual Service Provider who requests it
Type of ID-related data: (a) ID (b) ID-Recognition Data (c) Preference Data (including consents and non-consents)
Lawful basis for processing: Necessary for storing your Preferences and transmitting them to relevant Service Providers for the purposes of the control of Preferences through consenTag as requested by you
Retention Period: Until you withdraw your Preferences through consenTag or exercise any of your rights to prevent processing of your Preferences by consenTag
Purpose/Activity: To set up an Account for you; establishing an Account is entirely optional
Type of ID-related data: (a) Contact Data
Lawful basis for processing: Necessary for the control of Preferences through consenTag requested by you; consenTag’s legitimate interest in providing the most responsive control of Preferences to you
Retention Period: Until you close your Account or exercise any of your rights to prevent processing of your Contact Data by consenTag
5. Changing or withdrawing preferences
You can withdraw or change your Preferences at any time:
- by visiting the Site, clicking on the “Manage Consent Preferences” (or similar) link and following the process prescribed there;
- through your Account, if you have set up an Account, accessing it by means of your nominated email address and pass-phrase; or
- by emailing dpo@crimtan.com.
6. Browsers blocking cookies or id creation
You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If your browser is set to disable or refuse cookies, please note that consenTag will not be able to give effect to some or all of the Preferences you specify.
7. International transfers
Whenever ID-related Data is transferred out of the EEA, consenTag ensures at least one of the following safeguards is implemented:
- the transfer of ID-related Data is made to a country deemed to provide an adequate level of protection for personal data by the European Commission;
- the transfer is made under a form of contract that gives personal data the same protection it has with the EEA; or
- where the transfer is made to the US, the other party operates under the Privacy Shield which requires them to provide similar protection for personal data to that under EEA laws.
Note that ID-Related Data is never given to Service Providers, and is only used for the purposes set out in the table in Section 4 above.
8. Data security
consenTag has put in place appropriate security measures to prevent ID-related Data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, consenTag limits access to ID-related Data to those employees, agents, contractors and other third parties who have a business need to know and are subject to a duty of confidentiality.
9. How long will consenTag use id-related data and preference data?
To determine the appropriate retention period for ID-related Data and Preference Data, consenTag considers the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure of the data, the purposes for which the data is processed, and the applicable legal requirements.
Details of retention periods for ID-related Data and Preference Data are set out in the table in Section 4 above.
10. Your legal rights
You have the right to:
- Request access to ID-related Data and Preference Data (commonly known as a “data subject access request”). This enables you to receive a copy of the ID-related Data and Preference Data that is held.
- Request correction of ID-related Data and Preference Data. This enables you to have any incomplete or inaccurate ID-related Data or Preference Data corrected, though consenTag may need to verify the accuracy of the new data you provide.
- Request erasure of ID-related Data or Preference Data. This enables you to ask consenTag to delete ID-related Data or Preference Data where there is no good reason for consenTag continuing to process it. You also have the right to ask consenTag to delete ID-related Data or Preference Data where you have successfully exercised your right to object to processing (see below), where consenTag has processed ID-related Data or Preference Data unlawfully or where consenTag is required to erase ID-related Data or Preference Data to comply with a legal or regulatory obligation. Note, however, that consenTag may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you.
- Object to processing of your personal data, including for the purpose of direct marketing or profiling, where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
- Request restriction of processing of ID-related Data or Preference Data. This enables you to ask consenTag to suspend the processing of ID-related Data or Preference Data in the following scenarios: (a) if you want consenTag to establish the data’s accuracy; (b) where consenTag’s use of the data is unlawful but you do not want it to be erased; or (c) where you need consenTag to hold the data even if consenTag no longer require it as you need it to establish, exercise or defend legal claims.
- Request the transfer of ID-related Data and Preference Data to you or to a third party. consenTag will provide to you, or a third party you have chosen, ID-related Data and Preference Data in a structured, commonly used, machine-readable format.
If you wish to exercise any of the rights set out above, please contact the consenTag DPO by email to the address specified below.
No fee usually required
You will not normally have to pay a fee to exercise any of your legal rights specified above. However, consenTag may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, consenTag may refuse to comply with your request in these circumstances.
What consentag may need from you
consenTag may need to request specific information from you to help it confirm your identity and ensure your right to access the relevant ID-related Data or Preference Data (or to exercise any of your other legal rights). This security measure is taken to help avoid ID-related Data and Preference Data being disclosed to a person who has no right to receive it. Note, however, that consenTag cannot be certain of the identity of the person who provided Preferences and ID-related Data, and consenTag must necessarily accept that contact made through the email address associated with an ID (where an Account has been established) or the browser/device associated with an ID (where an Account has not been established) is entitled to the legal rights associated with the relevant ID-related Data.
consenTag may also contact you to ask you for further information in relation to your request to help speed up its response.
Time limit to respond
consenTag will try to respond to all legitimate requests within one month. Occasionally it may take consenTag longer than a month if your request is particularly complex or you have made a number of requests. In this case, consenTag will notify you and keep you updated.
11. ConsenTag, its dpo and contact details
Crimtan Holdings Limited a company registered in England & Wales under company number 07810698 (Crimtan) is the provider of the consenTag service, and which is responsible for the collection of Preferences Data and ID-related Data.
Where this notice refers to consenTag, it means the consenTag service or Crimtan, according to the context.
consenTag has a data protection officer (DPO) who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact the consenTag DPO using the details set out below.
Title of DPO: Data Protection Officer
Email address of DPO: dpo@crimtan.com
Crimtan postal address: 84 Eccleston Square, Pimlico, London SW1V 1PX
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). Crimtan would, however, appreciate the chance to deal with your concerns before you approach the ICO, and would request that you contact Crimtan in the first instance.