Our use of sub-processors

Unknown.jpeg

YouGov engages different types of service providers to help us create and deliver our products and services to our clients. If any of the service providers we use process or otherwise have access to personal data that we are processing on behalf of our clients, then those service providers will be considered to be “sub-processors”. We evaluate the privacy and security practices of all of our sub-processors and require them to satisfy certain obligations by signing a data processing agreement that, among other things, ensures that they have adequate security controls in place and only use personal data as instructed.

This page outlines the types of sub-processors that we work with and explains the services that they provide to us. You can contact our Data Protection team at dataprotection@yougov.com if you have any questions or would like more information about any of these sub-processors.

Sub-processing provided within the YouGov Group

We are a global organisation, so some of the personal data that we collect may be transferred within the YouGov Group of global companies to enable us to provide our services.

There are three reasons that data may be shared with other YouGov Group companies:
  • 1
    Data processing
    Our operations hubs in Romania and India provide survey scripting and data processing services to other YouGov Group companies, and our Operations teams require access to personal data to create the research insights that we provide to our clients.
  • 2
    Storage
    YouGov Services Limited is a UK company that holds the contracts with third-party data storage providers that are used by the YouGov Group to store personal data. Our data storage sub-processors are listed below.
  • 3
    Multi-country research
    When our client’s ask us to carry out research across multiple countries we may need to share information between our Research and Panel teams in those countries to coordinate the project and ensure it is being run as efficiently as possible.

To ensure that the transfers of personal data within the YouGov Group are secure, all YouGov Group companies have entered into an Intra-Group Sharing Agreement that provides contractual safeguards in relation to all personal data shared between group companies. This Agreement utilises EU-approved Standard Contractual Contracts to address any data that is being transferred out of Europe.

Third party sub-processors

Data storage and security

We use a combination of co-located, cloud and offline data storage providers to hold the data that we use to provide our services. The providers currently used are located in the European Union (EU) and the United States, and we ensure that any data originating from the EU is only stored in the EU. The table below provides more information about the sub-processors that we use engage to store and secure personal data.

Sub-processor
Category
Storage location
Description of services provided
Sub-processor
Amazon Web Services (AWS)
Category
Data storage
Storage location
EU, US
Description of services provided
Cloud data storage. Data sourced in the United States is stored on AWS US, and all other data is stored on AWS Ireland.
Sub-processor
Digital Realty
Category
Data storage
Storage location
EU
Description of services provided
Co-located data centre storage. Digital Realty’s London data centre hosts the infrastructure that stores data collected globally (acting as a backup for US-sourced data stored on Equinix). Data stored in Digital Realty’s infrastructure is replicated to AWS Ireland.
Sub-processor
Equinix, Inc.
Category
Data storage
Storage location
US
Description of services provided
Co-located data centre storage. Equinix’s Silicon Valley data centre hosts the infrastructure that stores data collected in the United States. Data stored in Equinix’s hosted infrastructure is replicated to Digital Realty’s co-located data centre.
Sub-processor
Iron Mountain
Category
Data storage
Storage location
EU, US
Description of services provided
Offline data storage back-ups. Data stored in Digital Realty’s London Data Centre is backed up and stored in Iron Mountain’s storage vault in the United Kingdom. Data stored in Equinix’s US data centre is backed up and stored in Iron Mountain’s US storage vault.
Sub-processor
Imperva Incapsula
Category
Web Application Firewall
Storage location
EU, US
Description of services provided
A web application firewall that filters all HTTP and HTTPS based traffic to certain YouGov websites. The storage location is set on each website, so US-specific web applications are stored in the US and all other web applications are stored in EU.

Service specific sub-processors

The sub-processors described in the table below help us to provide specific services to our clients, so they will only be used when providing those services.

Sub-processor
Category
Storage location
Description of services provided
We will use this sub-processor when…
Sub-processor
NeverBounce
Category
Data cleaning
Storage location
US
Description of services provided
NeverBounce provides technology that ‘cleans’ contact data by removing duplicates and non-valid email addresses. NeverBounce can be used to clean the data of individuals outside of the EU.
We will use this sub-processor when…
A client asks us to clean the contact information in their own sample list before sending survey invitations.
Sub-processor
Validity
Category
Data cleaning
Storage location
EU
Description of services provided
Validity’s BriteVerify technology ‘cleans’ contact data by removing duplicates and non-valid email addresses. BriteVerify can be used to clean the data of individuals in the EU.
We will use this sub-processor when…
A client asks us to clean the contact information in their own sample list before sending survey invitations.
Sub-processor
SendGrid
Category
Communication technology
Storage location
US
Description of services provided
We use SendGrid’s technology to send survey invitations by email to individuals who are not members of our research panel.
We will use this sub-processor when…
We need to send survey invitations by email to individuals sourced from a client’s sample list.
Sub-processor
Twilio
Category
Communication technology
Storage location
US
Description of services provided
We use Twilio’s technology to send survey invitations by SMS. Twilio are also a data controller for ‘usage data’ (metadata, including phone numbers and IP addresses to make carrier interconnection payments, to pay taxes, to bill for the services, to troubleshoot network issues, and to prevent fraud).
We will use this sub-processor when…
We need to send survey invitations by SMS to individuals sourced from a client’s sample list.
Sub-processor
Zendesk
Category
Communication technology
Storage location
EU
Description of services provided
Zendesk’s helpdesk management technology is used to receive and respond to emails from research participants.
We will use this sub-processor when…
We receive correspondence from an individual sourced from a client’s sample list.

Other sub-processors

The sub-processors described in this section are the ones that we regularly use to help us to provide our services, but we may use additional sub-processors as and when required, depending on the type and size of research project. For example, we often use viewing facilities for focus groups when doing qualitative research or we may engage another organisation to carry out telephone interviews on our behalf. Where we do need to use additional sub-processors we will discuss this with you and ensure that we have your approval before we proceed.