Data Privacy Roles – Loqate Services Only

The following table sets out, in relation to a particular Loqate Service, in what capacity we will act when supplying the Services to you and in what capacity you will be acting when you supply your data to us and/or take the relevant Services. It is particularly important that you understand the capacity in which we both act so that you understand what laws you will need to abide by and which laws we will abide by. You will see that our Local Laws page sets out the laws applicable in each of the UK, EU, Canada and US.

  • If you are a US Customer, or take US data (which may also be included in our Global Datasets) you will need to review the US Privacy Laws 2023 – Loqate page.
  • If you are a customer based in Canada, or you take any of our Canada datasets (which may also be included in our Global Datasets), you will need to review the Canada Privacy Laws page.
  • If you are a customer based in the UK or the EEA, or take any datasets for any country within those areas (which may also be included in our Global Datasets), you will need to review the Europe and United Kingdom Laws - Loqate Services Only page.

GBG has focused on roles under GDPR and US legislation as it would be impossible to define for every single market. Where a jurisdiction not captured below, GBG would be happy to clarify on the Order Form.

Key: C = Controller  P = Processor  Y = Yes  N= No  N/A = Not applicable

Product Name/Activity

GBG role under

Comments

Data Network Option

Data Retention

International Transfers

GDPR Record of Processing Available

GDPR

US Law

Duration

Why

Product Processing Location

Loqate Capture & Verify

 

Address (Address Look-Up Only)

P

P

This solely pertains to the actual address verification and

pre-population processing.

Y

30 days

GBG holds data to deliver the service, which includes an IP address.

Load Balancer determines which Data Centre is used based on proximity to the data subject. It then aims to send it to UK, Belgium or US, however for system performance, it could go to any.

Y

Address (Post-Processing)

C

P

Infrastructure Logs, Usage Data & Account Data.

N

30 days

To maintain Infrastructure Logs, Usage Data, and Account Data for our internal business purposes only.

N

Electricity Enquiry Service

C

N/A

UK Only Service. Defined by RECCo as personal data as it is meter information, although GBG cannot identify an individual.

N

12 months

GBG Audit Trail

N

Gas Enquiry Service

C

N/A

N

12 months

GBG Audit Trail

N

Business Data

C

N/A

UK Only Service

N

30 days

Infrastructure Logs, Usage Data

N

Phone

C

P

  

Y

12 months

GBG Audit Trail

N

Bank

C

N/A

UK Only Service

N

12 months

GBG Audit Trail

N

Store Finder

P

P

  

N

30 days

Infrastructure Logs, Usage Data

Y

Verify - Data Quality Services (DQS)

C

N/A

UK Only Service

Y

30 days

12 months

Infrastructure Logs, Usage data

GBG Audit Trail

Load Balancer determines which Data Centre is used based on proximity to the data subject. It then aims to send it to UK or Belgium, however for system performance, it could go to any.

N

Loqate Data Maintenance

 

UK

C

N/A

GBG holds data and completes the matching. GBG places on SFTP to be downloaded by Customer.

Y

12 months

GBG Audit Trail

UK

N

EU

P

N/A

GBG utilises a sub-processor for this.

N

Variable

The data is only held whilst processed, which includes transferring it to a third party.

EU

Y

US/Canada (North America)

N/A

P

GBG may hold the data and complete the matching, or utilise a sub-processor for this.

N

21 days

This is held for the duration of processing.

US

N

Address Cleansing & De-Duplication

P

P

GBG cleanse and de-dupe addresses.

N

30 days

  

US

N

Data Healthcheck

C

P

This service processes customer data to create a report based on data quality. Only statistics are shared back with the Customer, but depending upon the data sent, this may or may not contain personal data.

Y

12 months

GBG Audit Trail

UK, US

N