As a resident of the EU/EEA, you are considered a Data Subject under the General Data Protection Regulation (GDPR). As such, you are entitled to certain disclosures about how your personal data is processed. You are also eligible for certain rights with respect to your personal data.

This privacy statement is applicable to all visits on our website (www.inprove-mysteryshopping.com) and our dashboard (www.inprove-dashboard.com). By visiting the website and/or the dashboard, you agree to this statement. Changes in this statement will be valid as soon as they are applied (see ‘Last updated’ above). When this statement changes, we will publish a notification on the website.

We, INPROVE Mystery Shopping B.V., called ‘INPROVE’ hereafter, are responsible for processing personal data as described in this privacy statement. Our contact details are:

Edvard Munchweg 61
1328 MK Almere
KvK: 78091756
E-mail: [email protected]

Basis for the processing

We collect and process your personal data to be able to provide you with the services you have requested in your contract with us. We will only process your personal data in a manner that is lawful, fair and transparent. We will only collect personal data for specific purposes relative to providing you services, and we will not process personal data in a manner that is incompatible with those purposes. We will limit the personal data we collect to information that is necessary and relevant and limited to the purpose for which it is needed, such as mystery shopping opportunities, or various audit services we may provide, to our clients. We will give you the ability to ensure that the information is accurate and kept up-to-date. We will give you the right to change it, or erase it, without undue delay. We keep the personal data no longer than needed for the purpose for which we collect it, except for archive purposes. We process it in a manner that ensures appropriate security of your personal data, including protection against unauthorized unlawful processing, accidental loss, destruction, or damage. We will only process the personal data that you provide to us in connection with providing the services to you, or where necessary, where you have given specific consent, or in connection with legal obligations or our legitimate business interests.

Purpose of processing

We process the personal data you give us in order to provide our services to you, such as providing you opportunities for mystery shopping or audit services, pursuant to your agreement. When you register as a mystery shopper on our platform, you engage in an agreement with us. To carry out this agreement, i.e. mystery shopping research, it is necessary for us to process some of your personal data. We’ll sum up the data we process:

• Name
• Sex
• Date of birth
• Address
• Phone number
• E-mail address
• Other data that is actively provided by creating a profile, in writing or by phone
• Personal interests
• Location details
• Banking details
• Financial remunerations

Without these details we are unable to hold our part of the agreement. In order to fulfill our legal and societal duties we will process data in the event of (suspected) cases of illegal activities by members of our mystery shopper community and provide them to authorities.

Recipients or categories of recipients of the personal data

Our internal staff will access the personal data you provide for the purposes of providing our services to you, and other internal or administrative business reasons.

We may disclose personal data about you to companies for whom you perform mystery shops, audits, or other service opportunities.

We may engage data processors to help provide data processing services in conjunction with providing our services to you or our clients. This includes systems, backups, and archives, which could be off-site.

We may transmit your personal data to processors in a third country not yet deemed to provide adequate protection laws within the meaning of the GDPR. We will only do so where we have agreements in place with each such processor to ensure that personal data is transferred with appropriate or suitable safeguards in accordance with the requirements of the GDPR.

We process your personal data to:

• Allow you to create an online account
• Assign one or more mystery shopping assignments to you
• Communicate with you in relation to the assignments
• Handle payments
• Analyze user behavior on our website and platform to improve our online tools and to adapt our services to your preferences
• Follow up on complaints and questions
• Carry out legal duties or court rulings, such as providing data for tax returns

We may also transfer your personal data to governmental authorities if required by law.

Required / optional personal data

Certain personal data we may ask for, such as your name and birthdate, are necessary for us to provide you with our services. Certain other personal data we may ask for, such as your GPS location information, is optional. However, if you elect not to provide the optional personal data, our ability to offer you service opportunities may be limited. To make your experience as a mystery shopper as good as possible, your date is saved in your online account. This way you won’t need to enter your data over and over again.

Information from a third-party

Where we obtain personal data about you from another party, we will share with you the categories of the personal data, and, to the extent possible, the sources.

The results from our researches go through a quality control before they are validated and sent to our clients. This approval process is carried out by INPROVE employees, but also by other members of the community (mystery shoppers). Community members with this capacity are called Proofreaders and are carefully selected by us. Therefore it is possible that another community member gets to view the questionnaire you send in. We take every possible step to decrease the chance a Proofreaders gets insight into personal data. Your questionnaire is anonymized and there is a blackout tool that can be used to blur out certain sections. However, you are personally responsible for the information you provide textually in your answers about yourself or other people in describing certain situations. The Proofreaders has the ability to edit and/or improve the answers you provide.

Period for which personal data will be stored

We will retain your personal data for as long as necessary to continue providing you with the services requested, including R&D, and for archiving, and legal compliance purposes.

We do not store your data any longer than is strictly necessary to achieve the goals they are collected for. Moreover, you can delete your account if you wish to do so, unless there is still an assignment to be carried out in that you are scheduled for.

If you exercise this right to be forgotten, your profile we be deleted from our platform immediately. All other personal data will be deleted after sending a request by e-mail to [email protected]. All personal data will be deleted within the space of two months, unless the data is required to comply with government regulations. With regards to the latter, we maintain a seven year storage period.

Why do we process personal data?

We process your personal data to:

• Being able to reach an agreement with the client
• Communicate with the client(‘s contacts) with regards to the agreement
• Handle payments
• Analyze user behavior on our website and platform to improve our online tools and to adapt our services to your preferences
• Follow up on complaints and questions
• Carry out legal duties or court rulings, such as providing data for tax returns

Your Rights:

As an EU resident the GDPR provides you with the following rights. This online system is designed with your data privacy rights in mind and gives you an easy way to exercise these rights. Your online profile may be edited by you, and there is a Privacy Dashboard available to you which allows you to perform additional actions to help ensure protection of your privacy. You can also submit privacy-related requests directly to us.

We will try to respond as quickly as possible, but within four weeks at the most. We would also like to point out the option of issuing a complaint with the Dutch national authority, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) through the following link: https://autoriteitpersoonsgegevens.nl/nl/contact-met-de-autoriteit-persoonsgegevens/tip-ons.

Your specific rights under the GDPR include:

• Right to request access

You have the right to access and review your personal data.

• Right to rectification

You have the right to correct or change the personal data you provide us.

• Right to erasure (“Right to be forgotten”)

You have the right to request that the personal data you provided us be erased.

• Right to data portability

You also have the right to obtain a copy of the personal data that you provided to us in a machine-readable format.

• Right to withdraw consent

Where we have obtained specific consents from you, you have the right to withdraw those consents.

• Right to restrict processing

You have the right to restrict how we are processing your personal data.

• Right to object

You have the right to object to how we are processing your personal data.

• Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a supervisory authority, available at:
http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080

• Automatic Profiling

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal or other significant effects for you.

• Breach notification

If a personal data breach occurs and is likely to result in a high risk to your rights and freedoms, we will notify you and the appropriate supervisory authority in a timely fashion.

Should you feel your data is not properly protected or there are signs of abuse/misuse of your data, please contact our team at [email protected]