This privacy notice describes who Indicia are, where we obtain your personal information, what we do with it and how we ensure your data protection rights are respected at all times. It applies to all individuals whose personal information we process in the course of operating our business, in particular the marketing services we provide for our clients.
This policy applies to the following types of personal information we may hold about you:
- Your contact details, including your name, postal address and email address. We use this data to send marketing information to you via post and (where we have your consent) email.
- Information we receive from our clients and data partners about you (whether actual or modelled), which helps us to identify whether our client’s products and services would be suitable for you, and to learn more (or make inferences) about the types of products and services you might be interested in receiving.
You can learn more about the types of data we process, and our legal basis for doing so, below.
Who Are Indicia?
Indicia Limited (company number 03896557) is a marketing agency that help our clients deliver marketing campaigns to our client’s existing and/or new customers who we think might be interested in our client’s products and services. We are a wholly-owned subsidiary of Konica Minolta Ltd.
Our registered office is 9400 Garsington Road, Oxford Business Park, Oxford, OX4 2HN and our team operate from three locations:
- Bristol – 40 Queen Square, Bristol, BS1 4QP
- London – 2nd Floor, 322 High Holborn, London, WC1V 7PB
- Edinburgh – 15 Links Place, Edinburgh, EH6 7EZ
Indicia’s Data Protection Officer is Steve Lowell, Director Of Data & Insight who can be contacted at firstname.lastname@example.org or 0117 934 0761.
Where We Obtain Personal Information
Indicia do not use your personal information to market our own goods and services. When using your personal information, we operate exclusively on behalf of our clients. Also, Indicia do not capture personal information directly from you; we rely on our data partners and our clients to provide us with this information. Where your personal data is being processed by one of our clients or data partners, their use of that data will be regulated by their own privacy policies. We have provided links to the privacy policies of our clients and data partners at the relevant points below, together with their contact details.
Our data partners provide us with your contact details and a range of other information (discussed further below) to help us identify products and services that are appropriate to you. For the purposes of data protection regulation, Indicia act as a Joint Data Controller alongside our data partners. We expect our data partners to be transparent with you that they will share the data they obtain from you with us.
Our data partners gather this information via a number of means:
- The Edited Electoral Roll – a refined version of the Electoral Register which is in the public domain and can be accessed by any person, company or organisation.
- Websites or telephone surveys, where an individual provides their personal information along with their consent for it to be used by another party such as Indicia and our clients for marketing purposes.
- ‘Modelled data’, where statistical models are used to identify the likely characteristics of an individual based on a number of factors, including an individual’s age and occupation.
We use the data provided by our data partners as follows:
|How Do We Use The Data||Lawful Basis For Processing||Why Do We Do This?|
|To identify whether we think you might be interested in our clients’ products and services and to provide our clients with additional information about the types of products and services you might be interested in. As part of this process, we may match personal data provided by our clients with personal data provided by our data partners.||Legitimate Interest||Indicia has a legitimate interest in using this data to provide marketing services to our clients. It is of benefit, to both our clients and the individuals whose data is being processed, for us to identify products and services which are relevant to these individuals.|
|To deliver marketing communications to you via a number of channels – postal direct mail, email or other forms of digital communication such as social media targeting.||Consent (for Email and other digital channels).
Legitimate Interest (for direct mail).
|We only use digital marketing channels where you have provided your express consent for ourselves and/or our clients to do so. Where we rely on your consent to send you digital marketing, such consent is collected on our behalf by our clients and/or our data partners.
For postal direct mail, we use the details provided by you from the Edited Electoral Roll. The Edited Electoral Roll is updated and published every month and can be sold to any person, organisation or company for a wide range of purposes. Users of the register include companies such as Indicia who use the data for direct marketing activity.
A list of our data partners, along with their contact details and privacy policies, details of the types of personal information they provide to Indicia and where they capture this information, is shown below.
||Raj Afghan||0207 602 6000|
||James Monkman||T: 01422 849 788
|DLG||Click here||Email addresses with the appropriate consent to be used by Indicia and our clients for marketing communications||Online sites – surveys.co.uk & dlg.co.uk||Samantha Pocock||01923 281700
|MyOffers||Click here||Email addresses with the appropriate consent to be used by Indicia and our clients for marketing communications||Members signed up to MyOffers website registered to receive online offers & information||Ivan Southall||0207 932 4188
Our clients provide us with personal information they capture when you purchase or otherwise receive a product or service from them. We use this information with our clients to ensure that any marketing communication we deliver for them is relevant and appropriate to you.
The types of personal information our clients will disclose to us varies between clients. However, they typically include the following:
- Name, address, email address and other personal characteristics such as date of birth;
- The nature of your relationship with our client – for example, the type of products you hold or services you have received from our client.
How we use data provided by our clients:
|How Do We Use The Data||Lawful Basis For Processing||On What Basis Are We Using The Data|
|To identify existing customers who might be interested in other products and services from our client, and to provide our clients with additional information about the types of products and services you might be interested in. As part of this process, we may match personal data provided by our clients with personal data provided by our data partners.||Legitimate Interest||Indicia has a legitimate interest in using this data to provide marketing services to our clients. It is of benefit, to both our clients and the customers whose data is being processed, for us to identify the most appropriate products and services for each customer.|
|To deliver marketing communications to these customers – via direct mail, email or other forms of digital communication such as social media targeting||Consent and/or Legitimate Interest||When using data from our clients’ customer databases, we ensure that we only communicate to customers using the guidance provided by our client. For example, some clients will choose to operate under the lawful basis of consent whereas others will operate under legitimate interest. Where consent is the lawful basis, we ensure we can clearly identify customers that have provided their explicit consent to receive marketing communication from our client. Where our client is operating under legitimate interest, we ensure we are not selecting customers that have opted out of communication from our client.|
Indicia may be acting as a Data Processor or a Joint Data Controller in respect of the personal information, depending upon the nature of the services being provided to each client. Further information on this is provided below.
|Client||Client Privacy Notice||Data Held By Indicia On Behalf Of Our Client||Indicia’s Role In The Processing Of Personal Information||Contact Details – Data Protection Office|
|Shop Direct Group (trading under the brands of Very and Littlewoods)||Shop Direct – click here
Very – click here
Littlewoods – click here
|Shop Direct customer data, used to support analysis and marketing campaigns Indicia deliver on behalf of Shop Direct||Indicia operate as both a Joint Controller and a Processor||0844 292 1089
|Nissan GB||Click here||Nissan GB customer data, used to support analysis and marketing campaigns Indicia deliver on behalf of Nissan GB||Joint Data Controller|
|ITV||Click here||ITV provide Indicia with ITV registered user data and, using data from the “open” electoral register, Indicia match the ITV user data with additional data held by Indicia which includes demographic data about individuals. ITV use the combined data to provide its users with adverts which are more relevant to them unless that user has opted out of being shown personalised advertising. Indicia also help ITV process the data which it holds to help ITV understand its users better, and tailor the advertising they see – for example – ITV may supply Indicia with a postcode and Indicia will translate that into a regional area. Indicia only uses the data provided by ITV for these purposes and does not transfer this data to any third parties.||Data Processoremail@example.com|
|Rail Delivery Group||Click here||RDG passenger data, used to support analysis and marketing campaigns delivered by RDG||Data Processorfirstname.lastname@example.org|
More information about our legal basis for processing your data
Where we have a legal basis to use your personal information without consent (as we have described above), this policy fulfils our duty to process personal information transparently, and helps us to do so fairly and lawfully and in a manner that you would expect given the nature of our relationship with you, by giving you appropriate notice and explanation of the way in which your personal information will be used.
Where consent is required for our use of your personal information, our data partners and/or clients will ask you to positively opt-in by ticking the appropriate consent box or otherwise communicating your consent.
Indicia use a range of statistical techniques to identify which products and services offered by our clients will be relevant to you. We do this by comparing the characteristics of individuals that have purchased products to the characteristics of people who haven’t yet purchased.
This information is provided by our data partners who, in turn, build models to identify these characteristics. For example, by using anonymous research surveys, our data partners are able to identify certain features of the likely lifestyle of a consumer, based upon other information known about that individual. This information is passed to Indicia, who will then use it as part of our own data modelling. A full list of the characteristics our suppliers provide to us is shown below;
- Gender and age
- Household composition
- Most likely income
- House type and size
- Car ownership
- Preferred shopping habits
- Most likely holidays taken
- Attitudes towards green issues
- Attitudes towards lifestyle
- Newspaper readership
- Attitudes towards technology
- Most likely types of internet usage
- Most likely financial services held
At no point does Indicia operate any modelling that is solely automated. At all times, Indicia’s data team are managing how these models are working and they are not left to run independently and so there is human decision-making involved in the modelling process.
Sharing Personal Data
Indicia sometimes discloses personal information to our clients in the course of providing our marketing services, in order to enable our clients to improve their interactions with you and deliver more relevant content to you. Please check our clients’ privacy policies for further information about how they use this data.
We require our clients to take appropriate and stringent security measures to protect your personal information in line with data protection laws.
We may also need to share your personal information with a regulator or otherwise to comply with the law or to respond to valid legal process, including from law enforcement or other government agencies.
Processing Personal Data
Indicia work closely with our Data Partners to ensure the data we’re using is accurate and fit for purpose at all times. Our suppliers provide us with regular updates to the data they provide to ensure we can identify individuals who have opted out of receiving marketing communication from Indicia and our clients.
In addition, Indicia automatically remove any individual who unsubscribes from an email communication we deliver on behalf of our clients.
Data Protection Laws
We are fully committed to protecting your privacy and will only use any information we hold about you lawfully and in accordance with all regulatory requirements, including but not limited to the Data Protection Act (1998), the Privacy and Electronic Communications Act (2003) and, (once in force) the General Data Protection Regulation “GDPR” and any laws enacted in replacement and/or to complement the GDPR.
Equally, we recognise you have a number of rights under these laws. Please see below for how Indicia enable you to exercise these rights.
Indicia respect your rights regarding the processing of your personal information and we have processes in place to ensure we can support these.
Right To Be Informed
Right To Data Access
You have the right to request Indicia provide you with details of all the personal information they hold on you. If you would like Indicia to provide you with these details, please submit a request by clicking here.
Right To Rectification
You have the right to request that Indicia correct any data that you identify as inaccurate or missing. If you require Indicia to do this, please submit a request by clicking here.
Right To Be Forgotten
You have the right to request that Indicia remove your personal information from all processing activities. If you require Indicia to remove your personal information from our records, please submit a request by clicking here.
Right To Restriction Of Processing
You have the right to request that Indicia restrict the processing that we do on your personal information. If you wish to exercise this right, please submit a request by clicking here.
Right To Data Portability
You have the right to request that Indicia transfer a copy of your personal information in a secure and safe way to allow you to use this for another purpose.
Right To Object
You have the right to request that your data is not processed by Indicia for marketing purposes. To exercise this right, please submit a request by clicking here.
Rights In Relation To Automated Decision Making
You have the right to opt out of Indicia using your personal information for automated decision making. The exercise this right, please submit a request by clicking here. In addition, Indicia are obliged to confirm to you how we do automated decision making. This is covered in the Data Modelling section above.
Data Transfer Outside Of The UK
Indicia operate solely within the UK and so your personal information will not be processed or sent to any other country.
We are committed to only holding personal information where there is a valid reason for doing so and for no longer than is necessary for fulfilling that purpose. Your personal information is retained in line with our internal data retention policy.
We do not knowingly collect information from anyone under the age of 16.
Keeping Your Information Secure
All personal information that you provide to us is stored on secure servers. We have put in place (and require anyone we share your information with to put in place) appropriate measures to protect the security of your information. We will use strict procedures and security features to try to prevent unauthorised access or inadvertent disclosure.
In addition, we limit access to your information to those of our employees, agents, contractors and other third parties who have a business need to know. We will require them only to process your information on our instructions and they are subject to a duty of confidentiality.
In the unlikely event that we identify a data breach, we will operate in accordance with the guidance from the Information Commissioner’s Office (ICO) and ensure this is reported to the ICO within 72 hours of it being identified.
Once the complaint is received, we will review it & will contact you within 3 working days to acknowledge receipt and to confirm next steps.
Who To Contact
If you have any questions regarding how Indicia process your personal information which are not covered by any of the above, please contact Steve Lowell, Director Of Data & Insight at email@example.com or by following this link.