Controller
Based on the General Data Protection Regulation ("GDPR"), GetWhy is the data controller in relation to the processing of personal data relating to You necessary for the fulfillment of the Agreement entered into in accordance with the Terms and Conditions and the additional purposes listed below.
Our contact information is GetWhy A/S, CVR no. 33 51 06 08, Langebrogade 4, 1411 Copenhagen, Denmark. Further, You may contact us at privacy@getwhy.io.
Purpose and legal basis of the processing
Administrating the Agreement
For GetWhy to administrate the Agreement with You, certain personal data is processed. This includes your name, contact information, information on remuneration, and account number.
The legal basis for the processing is Article 6(1)(b) of the GDPR, as the processing is necessary for the performance of a contract (the Agreement) to which You are party.
Access to Sites and Platform
We process personal data as part of the signup flow when You use and access Sites and Platform.
This includes login information, such as email address, name, and password. Additionally, if necessary for the Study, we may collect your address, telephone number, financial information, gender, date of birth, occupation, nationality, generic health information, marital status, employment status, and generic insurance coverage status.
As per the Agreement, You are obligated to sign up to the Sites and Platform provided by GetWhy.
Therefore, the legal basis for the processing is Article 6(1)(b) of the GDPR, as the processing is necessary for the performance of a contract (the Agreement) to which You are party.
With regard to any additional processing of persona data when using Sites and Platform (such as cookies and similar technologies), please refer to our general Privacy Policy https://getwhy.io/privacy-policy/.
Participant Content provided in relation to a Study for products and services to Clients
As stipulated in the Agreement, when GetWhy conducts a Study, You are asked to provide feedback to various text, images, sounds, videos, etc. provided by the Client via Sites or the Platform. In relation hereto, GetWhy will process the feedback from You, including answers to questions, "think-out-loud-tests", sentiments etc. The personal data will include your personal view on various items and will include voice and video recordings, your specific actions, completion of various tasks, etc., as further specified in the specific study description. The personal data is disclosed to the specific Client as part of the individual Study (see under "Categories of recipients" below).
The legal basis for GetWhy's processing is Article 6(1)(b) of the GDPR, as the processing is necessary for the performance of a contract (the Agreement) to which You are party.
You are explicitly prohibited from sharing any special categories of personal data as part of the Study. This includes personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning health or data concerning sex life or sexual orientation as well as personal data related to criminal convictions or offences. Should You decide to include any of the abovementioned special categories of personal data, if relevant for the Study, this will be considered made manifestly public by You, see Article 9(2)(e) of the GDPR.
Participant Content provided in relation to a Study for developing GetWhy's Sites and Platforms
As stipulated in the Agreement, the personal data listed under the headline "Participant Content provided in relation to a Study for products and services to Clients" is also processed for the purpose of further development of GetWhy's Sites and Platforms, including training of GetWhy's AI models.
For the legal basis and limitations, please refer to what is stated under the headline "Participant Content provided in relation to a Study for products and services to Clients".
Participant Content provided in relation to a Study for marketing GetWhy's services
As stipulated in the Agreement, the personal data listed under the headline "Participant Content provided in relation to a Study for products and services to Clients" is also processed for the purpose of further marketing GetWhy's services to potential clients and investors.
For the legal basis and limitations, please refer to what is stated under the headline "Participant Content provided in relation to a Study for products and services to Clients".
Bookkeeping purposes and other legal obligations
In order for GetWhy to adhere to legal obligations, we also process personal data on You.
With regard to bookkeeping obligations, we process personal data stated on invoices, including name, physical address, bank account information, as well as remuneration based on services performed for specific Studies. The legal basis is Article 6(1)(c) of the GDPR, as the processing is necessary for compliance with a legal obligation to which GetWhy is subject. These legal obligations derive from the Danish bookkeeping legislation.
Should you have a registered Danish company with a VAT number, we are also required to pay out and claim such information from SKAT. The legal basis is Article 6(1)(c) of the GDPR and Section 11(2) of the Danish Data Protection Act.
Categories of recipients
Your personal data will be disclosed to GetWhy's Clients in connection with delivery of the Services that GetWhy provide to its Clients, as set out in the Agreement. The Client will operate as independent controller with regard to the personal data disclosed under a specific Study, and we refer to the privacy notice or similar that You may receive from the Client in that connection.
Further, as stipulated above, we disclose the necessary information to relevant public authorities, such as SKAT.
Moreover, we also disclose personal data to our external auditors, lawyers or other advisors if necessary for the purpose of carrying out a particular task. This may be the case if we need auditing or legal assistance in a matter in which You are involved and which, therefore, requires the relevant personal data.
Also, the personal data will be made available to GetWhy's processors who, for example, host and support Sites and Platform.
Third country transfers
The above-mentioned processing activities include transfer of the personal data to third countries. This includes GetWhy Clients and processors located in third countries.
With regard to Clients, the transfer is based on article 49(1)(b) of the GDPR, as the transfer will be necessary for the performance of the Agreement.
In relation to processors, we transfer personal data to Ireland, France, Germany, and the United States of America. The transfer is based on Standard Contractual Clauses.
Storage periods
The personal data processed in order to administrate the Agreement will be processed as long as the Agreement apply and up to 5 years after the Agreement is terminated or no longer applies.
With regard to use and access Sites and Platform, personal data will be processed up to 5 years after the last activity.
Personal data processed in relation to a specific Study (the Participant Content) will be processed by GetWhy as long as the Study is ongoing an up to 5 years after the Study has been completed.
In relation to bookkeeping purposes, the personal data will be processed up to 5 years after the end of the financial year in the Agreement is terminated or no longer applies.
Data protection rights
Based on the GDPR, You have e.g. the following rights:
Right of access: You have the right to have confirmed whether collection or processing your personal data has taken place, and, if so, You have the right to request a copy of your personal data in a digital format.
Right of rectification: You have the right to require that we correct any inaccurate personal data, and that we complete incomplete personal data.
Right of erasure: In certain circumstances, You have the right to request that we erase personal data concerning you; for example, if it is no longer necessary for the purposes in which it was originally collected.
Right to restrict processing: In certain circumstances, You have the right to request that we restrict the processing of your personal data, for example, if you believe that the personal data is not accurate or lawfully processed.
Right to object to the processing: In certain circumstances, You have the right to request that we stop processing your personal data.
Right to data portability: In certain circumstances, You have the right to receive the personal data you have provided us with in a structured, commonly used, machine readable format, and the right to have us transmit the data to another entity, where technically feasible.
You can read more about your rights in the Danish Data Protection Agency's guidelines on data subjects' rights, which is available at datatilsynet.dk (in Danish) and at datatilsynet.dk (in English). Please contact us if you wish to exercise any of your rights.
If you want to lodge a complaint with a supervisory authority about our processing of your personal data, You can do so by contacting the Danish Data Protection Agency via their website, www.datatilsynet.dk.
Statutory requirements etc.
Under the GDPR, You are entitled to be informed of whether the provision of personal data is a statutory requirement, or a requirement necessary to enter into a contract, and of whether you are obligated to provide the personal data and of the possible consequences of failure to provide such data.
If you do not wish to provide the information that you are required to provide necessary for fulfilling the Agreement, or any other information which we are required to collect from you by law, You will be unable to participate in a Study.
Should You have any questions to the processing of personal data by GetWhy, you are more than welcome to reach out to us at privacy@getwhy.io.
GetWhy A/S
Langebrogade 4
DK-1411 Copenhagen
DK33510608
+45 77 34 86 85