Privacy Policy

InsurThoughtCommunity Panel Privacy Notice

Last updated: 26 January 2021

Who are we?

We are Toluna Group Limited, part of the Toluna Holdings Limited worldwide group (“we” “our” “us or Toluna”). You can see who our group members are by clicking on the link below:

Toluna are an online data collection group focused on providing high-quality market research data to its clients who are in various business sectors, including other market research agencies and other global and corporate clients of all sizes. We also build and maintain large online consumer panels, providing real-time digital consumer insights to our clients via our market research client surveys and analytics platforms. We host and administer the online platform and help our Client to recruit online community members, like you and we build and manage this site.

What is our Privacy Commitment to you?

We respect your privacy and are committed to protecting your personal data. This privacy notice describes how we collect, use, share and protect personal data that you provide on (the “site”) when you become a community member and participate in our Client’s surveys and/or research studies (“surveys”). Our client is Aviva Central Services UK Limited which operates in the Insurance industry (“Client” or “Aviva”). 

This privacy notice explains your privacy rights and how laws that may be applicable to you may protect you and tells you:

  • Who are we?
  • What is our Privacy Commitment to you?
  • What personal data do we collect about you and how do we use your personal data?
  • Who do we share your personal data with?
  • Do we transfer your personal data to other countries?
  • What cookies do we use on the site?
  • What other tracking technologies do we use?
  • How do you access your information; use the member services area and/or update, correct or delete your information?
  • How do you opt out from your community membership?
  • How do you ask a question or make a complaint?
  • What is our winner’s policy?
  • What security measures do we undertake to protect your personal data?
  • What are our data retention and destruction policies?
  • Links
  • Children’s privacy
  • Your legal rights if you are in the UK
  • What are the legal bases we rely on when processing your personal data?
  • Who is the data controller?
  • Changes to the privacy notice and your duty to inform us of changes
  • Privacy contact details

What personal data do we collect about you and how do we use your personal data?

Community Members

When you agree to become one of our Client’s community members and complete the registration form on the site, you are able to participate in our surveys. As part of your registration, you will provide us with your Identity data and Contact data and we will through your participation in the Surveys obtain, use and share certain other data about you, such as; Demographic/Profile data, Technical data, video recordings containing facial images and voice data and Pseudonymised data.

We use your Identity data and Contact data for:

  • Contacting you for any reason connected with your panel community membership;
  • Incentive fulfilment - when you earn incentive points through your participation in the surveys, the points are deposited into your account. When you wish to redeem them, we will use your Identity data and Contact data to send you your rewards.
  • Sending you invitations for your participation in surveys - to ask you if you are interested in participating in our upcoming surveys.  We may also make you aware via your online panel community membership account of surveys you may be suitable to participate in, based on our knowledge of your personal data.

We may from time to time ask you to provide us with Special Categories of personal data about yourself for specific surveys and if required by applicable law, we will ask you for your consent before processing such Special Categories of personal data. We will also obtain your consent before asking you to record and upload videos of yourself.

We use your Demographic/Profile data for matching you with appropriate surveys to see if you qualify for particular surveys and your birth date is automatically updated so that we may ensure we select individuals, based on their age as may be required for the relevant survey.

Categories of personal data we may process about you

      1. Identity data name (includes first, last, maiden and married names), date of birth, marital status, gender, panellist id, username and video footage comprising facial images and voice data.
      2. Contact data postal address, email address and telephone number.
      3. Special categories of personal data ethnic/racial origin, health, genetics, political opinion, religion, sexual orientation and sex life and biometrics data.  In this context “biometrics data” are data resulting from specific technical processing relating to the physical, physiological, or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or fingerprint data and used for ID purposes.
      4. Demographic/Profile data - interests, preferences, feedback and survey responses and including, but not limited to; age, marital status, gender, birthday, household size, income, education and employment status.
      5. Technical data includes internet protocol (IP) addresses, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website.
      6. Pseudonymised data is identifiable data as unique identifiers such as panellist ID’s are used, however direct identifiers, such as; name and Contact data are removed.

Who do we share your personal data with?

All of the responses we collect from you via our surveys are collected by us in aggregated or pseudonymised form. This means that information is provided about groups of individuals and not on an individual level but may include Pseudonymised data.  However, when videos are uploaded by you this contains personal data, being your facial image and voice data.

We share video uploads and the results of surveys with our Client, and this data may be pseudonymised. We do not allow our Client to process any other personal data about you, unless we have first received your consent and confirmed with them that their use is in accordance with applicable law.  Where we provide your personal data to our Client, such use shall be for specific surveys, for the purposes of capturing feedback for research, reporting and analysis and for campaign and product planning. .

We have engaged Amazon Web Services (AWS) (located in Ireland) to host the Community platform and to provide back-up services.

We share video recordings of you with our Client (Aviva), for the purposes of capturing your feedback in real-time and for our Client’s reporting and analysis and campaign and product planning purposes  when our Client has specifically requested such videos in relation to a particular survey or project. Our Client is not allowed to use your facial images and voice data for any other reason and we have a contract with them to ensure your data is kept secure and erased in accordance with our data retention and destruction policies as set out in our Panellist Privacy Notice. (Erasure will take place within thirty days of the Community closing.)  Aviva will only use these videos itself for market research purposes and the videos will not be shared with any third party, save for Aviva’s internal business uses to other Aviva group companies, and where your consent is obtained in advance these videos may be shared on the Community platform itself, so other members of the Community can see them.  Aviva will process your personal data in accordance with their privacy policy, which is available at 

Though we make every effort to preserve your privacy, we may be required to disclose your personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements; or to comply with a subpoena or other legal process, when we believe in good faith that disclosure is necessary to protect our rights, to protect your safety or the safety of others, to investigate fraud or breaches of the site terms, or to respond to a government request.

Do we transfer your personal data to other countries?

In addition to AWS in Ireland, which hosts the Community platform and provides back-up services (including the videos you may upload) from time to time your personal data is transferred and/or accessed from a Toluna company that is located in Europe to a country that has not been recognised as providing equivalent protection. Toluna has put in place transfer agreements using the Standard Contractual Clauses for the transfer of personal data to third countries as decreed by the European Commission. A list of the Toluna companies to whom data may be transferred or who may access such data is set out below:

Toluna Office


Mechanism for transfer under the GDPR

Toluna USA Inc.,

21 River Road,


CT 06897


Hosting and back up of data and Community management support

EU Standard Contractual Clauses

Toluna Canada Ltd

10, Sheppard Ave. East,

Suite 311


Community management

Adequate country

Toluna Romania Srl


Brediceanu 10,

Judeţul TIMIȘ,


Support and maintenance

Member of the EU

Toluna India Pvt Limited

Unitech Trade Center,

1st Floor, Sushant Lok Phase-1 Gurgaon, 1220022,


Support and Maintenance

EU Standard Contractual Clauses


Toluna Technology Limited

25 MATAM Tech Centre,

POB 15075,

Haifa 31905,


Provision of analytics services (incl, TolunaAnalytics™)

Adequate country

What Cookies do we use on the site?

Cookies are used on the site to distinguish you from other users of the site, helping us to provide you with a good experience when you browse our site and allowing us to improve the site. For detailed information on the cookies we use and the purposes for which we use them, see our Cookie Policy

What other Tracking Technologies do we use?

Automated technologies or interactions. As you interact with the site, we will automatically collect Technical data about your equipment, browsing actions and patterns. We collect this Technical data by using cookies, server logs, digital finger printing technologies and other similar technologies. We may also receive Technical data about you if you visit other websites employing our cookies.  Please see our cookie policy for further details.

Server log files: We may collect Internet protocol (IP) addresses, browser type, internet service provider (ISP), referring/exit pages, operating system, date/time stamp, and/or clickstream data.  This Technical data may be combined with other information collected about you for the purposes of improving our services, site functionality and collecting analytical data.

Fingerprint technologies:  In general, digital Fingerprinting technologies assign a unique identifier or "Machine-ID" to a user's computer to identify and track your device (“Technology”).  The Technology will analyse publicly available information and data obtained from your computer's web browser and from other publicly available data points, including the technical settings of your computer, the characteristics of your computer, and its IP Address, to create a unique identifier, which will be assigned to your device.  We use the Technology for quality control, validation, and fraud detection and prevention purposes, including assisting us in ensuring the integrity of survey results. Appropriate technical and operational processes and procedures will be put in place to ensure that the Technology is safe, secure and does not cause undue privacy or data security risks and the Technology will be used and distributed in a professional and ethical manner and in accordance with (a) this privacy notice, (b) any other statements and/or disclosures made to you as a member of the community and (c) applicable laws and market research codes of practice.  In the event any unethical conduct is discovered in connection with the use of the Technology, or that the Technology is being used in a manner that is inconsistent with privacy notice, immediate action will be taken to prohibit such unethical conduct and to ensure the proper administration of the Technology.

How do you access your information; use the member services area and/or update, correct or delete your information?

Upon request, we will provide you with information about what personal data we may hold about you.  As you are based in the UK, you should refer to the section entitled Your legal rights if you are in the UK to understand more about your rights.  You may access, correct, or request deletion of your personal data, or terminate your membership by logging into your Community Account. By following the appropriate directions, your information should be automatically updated in our database. For these purposes, and if you are unable to correct your personal data yourself via your Community Account you may write to us at the postal address found at the end of this Privacy notice, or contact us by email at  We will respond to all requests within a reasonable timeframe.

How do you opt out from your panel community membership?

If you choose to end your membership with the Community or require us to cease processing your personal data, you may discontinue your membership by going to “Account” and selecting “Unsubscribe Options” in the footer. By following the appropriate directions, your record will be marked as "do not contact", and you will no longer receive invites to participate in future Surveys from Toluna. In addition, you will forfeit any incentive balance that has not been requested as of the time you opt out. In most cases it will take 2 to 3 days to process this change, but please allow up to two full weeks for your status to be finalised. Please note that you may continue to receive communications during this short period after changing your preferences while our systems are fully updated.

You may also send an email directly to requesting to be removed. Email links are provided on the site so that you may contact us directly with any questions or concerns you may have. Each email we receive is read and responded to individually; please allow two to three business days for us to get back to you.

If you decide to terminate your membership, we will no longer use your Identity data or Contact data, except for archival purposes and we will process your personal data in accordance with our backup procedures.  Your personal data will eventually destroyed in accordance with our Data Retention and Destruction Policies and we will continue to employ the security procedures and technologies to keep your personal data safe.

How do you ask a question or make a complaint?

You can direct any questions or complaints about the use or disclosure of your personal data to our Privacy Contact.  We will investigate and attempt to resolve any complaints or disputes regarding the use or disclosure of your personal data within one month of receiving your complaint.

If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, then please refer to your rights to make a complaint under the section entitled Your legal rights if you are in the UK. 

What is our winner’s policy?

Community members may receive points for their participation in surveys and as being a member of the community and may also be randomly selected to win prizes for participation in surveys, polls, and other promotions. All winners are notified by email of their winnings. For more information, please visit our Terms and Conditions page. Toluna shall post the usernames or first name and first initial of last name of winners on the Reward Page or communicate them via newsletter to all panellists.  For more information about earning points, please visit our terms and conditions page here

What security measures do we undertake to protect your personal data?

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data in accordance with our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator or supervisory authority of a breach where we are legally required to do so.

What are our data retention and destruction policies?

How long will you use my personal data for?

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances you can ask us to delete your data: see the section entitled Your legal rights if you are in the UK below for further information.

Once the Community is closed, we erase all member personal data within thirty days.

As the results of the surveys and other aggregated or Pseudonymised data are used for research and/or statistical purposes, we, our Client and other third parties may use this information in accordance with the terms indefinitely without further notice to you.


From time to time we may offer visitors the ability to voluntarily link to other sites. We do not review and are not responsible for, the content or effect of the privacy policies of these sites.

Children’s privacy

We will not knowingly collect any information online from any child under the age 16 without permission from his/her parents, legal guardian or an adult responsible for the care of the child.  Eligible ‘young people’ (individuals aged between 16 and 17) may be invited to participate in our Teens panel from time to time.  We comply with COPPA, the EU “Safer Internet programme”, the General Data Protection Regulation and the ESOMAR guidelines in relation to online surveys concerning children and young people.

Your legal rights in the UK

You have rights under data protection laws in relation to your personal data. If you wish to exercise any of the rights set out below, please contact us.

You have the following rights:

  • Request access to your personal data and we may conduct ID checks before we can respond to your request.
  • Have your personal data erased, corrected or restricted if it is inaccurate or requires updating. You may also have the right under certain circumstances to request deletion of your personal data; however, this is not always possible due to legal requirements and other obligations and factors. You can update your account information via your Account or by contacting us at the address given below.
  • Object to the processing your personal data if we are not using your personal data for the purposes set out in this privacy policy.
  • Have your personal data transferred to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
  • Make a complaint at any time to a data protection regulator. A list of National Data Protection Authorities can be found here: we would, however, appreciate the chance to deal with your concerns before you approach the data protection regulator so please contact us in the first instance.

What are the legal bases we rely on when using your personal data?

The law on data protection in the UK sets out a number of different reasons for which a company that is processing personal data may collect and process such personal data, including:

Consent In certain cases, we collect and process your personal data with your consent e.g. when you participate in surveys.

Legitimate interest In specific situations, we require your data to pursue our legitimate interests in a way which might reasonably be expected as part of running our business and which does not materially impact your rights, freedom or interests e.g. conducting customer satisfaction research by getting your feedback on our products and/or services and sharing that feedback with the Client.

Contractual obligations In some circumstances, we may need to process your personal data to comply with a contractual obligation e.g. when we use your personal data to send you your rewards.

Legal compliance If the law requires us to, we may need to collect and process your personal data in response to lawful requests by public authorities or if e.g. we believe in good faith that disclosure is necessary to protect our rights, to protect your safety or the safety of others, to investigate fraud or breaches of the site terms, or to respond to a government request.

Who is the data controller?

The Toluna company with whom you registered with as a community member is a controller and responsible for your personal data.  Due to the nature of the information the Client processes about you, whilst the Client is never allowed to process your name or Contact data, the Client is also a data controller. 

We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact the DPO using the details set out below.

Changes to the privacy notice and your duty to inform us of changes

This version was last updated on the date at the top of this privacy policy.

The data protection law in the UK requires that you have certain rights under law, we will respond to some of your requests (for example, a request for the transfer or erasure of your personal data).

If we decide to change our privacy notice, we will post those changes to this privacy statement on the homepage, or other places we deem appropriate so that you are aware of what information we collect, how we use it, and under what circumstances, if any, we disclose it.

We reserve the right to modify this privacy statement at any time, so please review it frequently. If we make material changes to this policy, we will notify you here, by email, or by means of a notice on our home page prior to the change becoming effective.

It is important that the personal data we hold about you is accurate and current. Please keep your Account details updated if your personal data changes during your relationship with us.

Privacy contact details

You may contact us by writing to:

The Data Protection Officer

Toluna Group Limited

85 Uxbridge Road,


W5 5TH

United Kingdom

W5 5TH

United Kingdom