Privacy Notice
Last updated: 5 October 2026
This notice describes what personal information Play Verto Global Ltd processes, why, who it is shared with, and how long it is kept.
Who this notice is for
This Privacy Notice for Play Verto Global Ltd (doing business as Play Verto) ("we", "us", or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:
- Visit our website at https://playverto.com, or use the VertoNow application at https://app.playverto.com, or any website of ours that links to this Privacy Notice
- Take part in a Verto (a set of questions published through VertoNow), whether or not you hold an account with us
- Engage with us in other related ways, including any marketing or events
Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. For our own Vertos and Services, we are responsible for making decisions about how your personal information is processed. Where another organisation runs a Verto, the section below explains who is responsible. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please email us at dpo@playverto.com.
Who is in charge of your data
- Vertos run by other organisations. The organisation that runs a Verto (a charity, council, school, funder or research partner) decides what to ask and why. It is the controller for the responses collected through that Verto, and we process them on its behalf. Its own privacy information applies alongside this notice.
- Everything else. We are the controller for our own Vertos, for accounts, for our website and app, for building the Data Commons from answers to Commons questions and contributed data, and for aggregated data.
Summary of key points
What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use.
Do we process any sensitive personal information? Our standard questions do not ask for "special" or "sensitive" information, such as racial or ethnic origin, health, sexual orientation or religious beliefs. An organisation running a Verto may choose to ask about these topics, and free-text answers may include them. Where that happens, the organisation is responsible for having a lawful basis and telling respondents, and we protect those answers in the same way as all other responses.
Do we collect any information from third parties? Yes. We receive research data from partner organisations that have run their own studies, which we host and analyse on their behalf. We do not buy personal information from data brokers, and we do not collect it from public databases or social media for marketing purposes.
How do we process your information? To provide, improve, and administer our Services, to produce aggregated research insight, to communicate with you, for security and fraud prevention, and to comply with law. We process your information only when we have a valid legal reason to do so.
In what situations and with which parties do we share personal information? With the organisation that commissioned the Verto you took part in, and with the service providers that run our infrastructure. Through the Data Commons we share aggregated and anonymised insight only, never individual responses.
How do we keep your information safe? We have organisational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure.
What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information.
How do you exercise your rights? Email us at dpo@playverto.com, or write to us at the postal address at the end of this notice.
1. What information do we collect?
Personal information you disclose to us
We collect personal information that you voluntarily provide when you register on the Services, express an interest in our products and Services, take part in a Verto, or otherwise contact us. This may include:
- names
- email addresses
- passwords
- usernames
- contact or authentication data
- contact preferences
- age band
- gender
- location (a place name you choose, such as a town, city or region)
- answers you give within a Verto
- industry or sector, where a Verto asks for it
- employer or organisation name, where a Verto asks for it
Age. We ask respondents which age band they fall into, rather than for a date of birth, so that we hold less identifying information: where a Verto uses the age band question, no date of birth is recorded at all. Some Vertos published before we moved to age bands still ask for a birth month and year, and where one does, that month and year is held with the response. Those questions can be replaced with the age band question while the Verto is live, and we are working through them; where one has been replaced, no birth date is held.
Sensitive information. Our standard questions do not ask for sensitive information. Where an organisation’s Verto asks for it, or a respondent volunteers it in a free-text answer, we hold it encrypted, without a name or account attached, and on that organisation’s instructions.
Social login data. We offer you the option to register and sign in using your Google account. If you choose to do this, we receive your name and email address from Google. We do not receive contact lists, photographs, or any other Google account content.
Information automatically collected
We automatically collect certain information when you visit, use, or navigate the Services. This does not reveal your specific identity but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, and information about how and when you use our Services.
Log and usage data. Service-related, diagnostic, usage, and performance information our servers record in log files, including your IP address, device information, browser type, the pages and files viewed, the features used, and error reports.
Device data. Information about the computer, phone, tablet, or other device you use, including IP address, device and application identification numbers, browser type, hardware model, internet service provider, operating system, and system configuration.
No session recording or third-party analytics. We do not record your screen, your keystrokes or your cursor movements, and we use no third-party analytics, session-replay or advertising tools anywhere on the Services — not on our website, not in the creator app, and not in the respondent player. We previously used a session-replay analytics product (Microsoft Clarity) on our website and creator app. It was removed from the platform in October 2026 and no recordings it made are retained.
Response integrity. When you answer a Verto, the player records a few compact engagement signals and sends them with your answers: how long you spent on each question, whether you reached the end of a list of options long enough to scroll, whether a slider was ever moved before its opening position was recorded as an answer, whether the same position was chosen repeatedly across a block of questions, and whether free-text answers were left effectively blank. From these we calculate a score and a band for the response. They are stored with the response itself, are deleted when it is, and are used only to report on the integrity of results and to decide what is eligible for the Data Commons. The score describes the response, not the person: it is never used to profile, contact or make a decision about an individual, and creators see the score and band, not the underlying signals. The player does not record your screen, your keystrokes or your cursor movements, and we use no third-party analytics or session-replay tools.
We do not derive your location from your IP address or from device sensors, and we do not track your movements. The only location information we hold is the place name a respondent chooses to give as an answer.
Google API. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Drive access solely to create and write export files at your request, and Google Forms access solely to read the structure of a form you ask us to import. We do not transfer this data to third parties, use it for advertising, or allow humans to read it except where required for security, legal compliance, or with your explicit consent.
Information collected from other sources
We receive research data from partner organisations that have carried out their own research. This may include the answers respondents gave in those studies and, where the partner collected it, limited demographic information such as age. This data is supplied to us under agreement with the partner organisation, for hosting, analysis and aggregate reporting and, where the partner agrees, for inclusion in aggregated and anonymised form in the Data Commons.
We do not obtain personal information from data brokers, affiliate programmes, public databases, or social media platforms, and we do not acquire information about you for targeted advertising or event promotion.
Where we receive personal information about you from a partner organisation rather than from you directly, we will provide you with the information required by applicable law unless doing so proves impossible or would involve disproportionate effort — for example, where the data we hold contains no means of contacting you. In those cases, this notice serves as the public information about that processing.
2. How do we process your information?
We process your personal information for the purposes below. A retention period is stated for each, and those periods are what section 9 refers to.
| Purpose | What it means | Retention |
|---|---|---|
| Account creation and authentication | So you can create and sign in to your account, and keep it in working order | For as long as the account is active. Deleted on request, together with any link between the account and the respondent’s answers |
| Delivering the Services | To provide you with the requested service | Verto responses are retained for as long as the research they form part of remains in use, and are not deleted automatically. For a Verto run by another organisation, responses are kept for as long as that organisation instructs, and deleted within 30 days of it deleting the Verto or closing its account. Responses are held without a name, email address or account attached, so in most cases we have no means of identifying whose responses are whose. Where a respondent can provide information that lets us locate their responses — a session token, a respondent code, or an account email address — we will locate and erase them on request |
| Responding to enquiries and support | To answer your enquiries and resolve issues | For as long as needed to resolve the matter and handle any follow-up, and no longer than 24 months after the last message |
| Administrative information | Details about our products and services, and changes to our terms and policies | For as long as the account is active |
| Requesting feedback | To ask for feedback and contact you about your use of the Services | For as long as the research programme the feedback relates to remains in use |
| Protecting the Services | Keeping the Services safe and secure, including fraud monitoring and prevention | Security, error and abuse-prevention logs are retained for up to 12 months |
| Identifying usage trends | Understanding how the Services are used so we can improve them | We use no third-party analytics, advertising or session-recording tools anywhere on the Services. Usage trends are derived from our own server-side records, which are retained for up to 12 months. Aggregate usage statistics indefinitely |
| Marketing campaign effectiveness | Understanding which campaigns are relevant | Linked to an individual recipient for as long as they remain subscribed. Aggregate campaign statistics indefinitely |
| Research and aggregate insight | Analysing Verto responses, including research data supplied by partner organisations, to produce aggregated and anonymised insight about communities and topics, and building the Data Commons described in section 14. This analysis is carried out at a group level and is never used to make decisions about an individual | Aggregated and anonymised insight indefinitely. Identifiable response data for as long as needed to deliver and support the research programme it belongs to |
| Response integrity | Checking whether answers were given with care, so that results and the Data Commons can be relied on | Retained with the response, for as long as the response is held |
| Age-appropriate access | Asking for an age band and using it to determine whether account creation is available | Retained with the response, for as long as the response is held |
3. What legal bases do we rely on?
If you are located in the EU or UK
The GDPR and UK GDPR require us to explain the valid legal bases we rely on. We may rely on the following:
Consent. Where you have given us permission to use your information for a specific purpose — for example, marketing emails, or taking part in a Verto after reading what it collects. You can withdraw your consent at any time.
Performance of a contract. Where processing is necessary to fulfil our contractual obligations to you, including providing our Services, or at your request before entering into a contract.
Legitimate interests. Where processing is reasonably necessary to achieve our legitimate business interests and those interests do not outweigh your interests and fundamental rights. For example, in order to:
- analyse how our Services are used so we can improve them
- support our marketing activities
- diagnose problems and prevent fraudulent activity
- produce the group-level findings that respondents take part to create and that our partners commission, noting that this analysis is never used to make decisions about an individual
- check the integrity of responses, so that results can be relied on
- build the Data Commons from answers to Commons questions and from data contributed with the agreement of the organisation that collected it
- prevent children below the applicable minimum age from creating accounts, and keep the service age-appropriate
Legal obligations. Where processing is necessary for compliance with our legal obligations, such as cooperating with a law enforcement body or regulator, exercising or defending our legal rights, or disclosing information as evidence in litigation.
Vital interests. Where processing is necessary to protect your vital interests or those of another person, such as situations involving potential threats to the safety of any person.
If you are located in Canada
We may process your information where you have given express consent, or in situations where your permission can be inferred (implied consent). You can withdraw your consent at any time.
In some exceptional cases we may be legally permitted to process your information without your consent, including: where collection is clearly in the interests of an individual and consent cannot be obtained in a timely way; for investigations and fraud detection and prevention; for business transactions meeting certain conditions; where it is contained in a witness statement necessary to settle an insurance claim; for identifying injured, ill, or deceased persons and communicating with next of kin; where we have reasonable grounds to believe an individual may be a victim of financial abuse; where seeking consent would compromise the availability or accuracy of information being investigated; where disclosure is required by a subpoena, warrant or court order; where the information was produced in the course of employment, business or profession and collection is consistent with those purposes; where collection is solely for journalistic, artistic, or literary purposes; and where the information is publicly available and specified by the regulations.
We may disclose de-identified information for approved research or statistics projects, subject to ethics oversight and confidentiality commitments.
4. When and with whom do we share your personal information?
We may share your data with third-party vendors, service providers, contractors, or agents who perform services for us or on our behalf and require access to do that work. We have contracts in place with these third parties designed to safeguard your personal information. They cannot do anything with your personal information unless we have instructed them to, they will not share it with any organisation apart from us, and they commit to protecting the data they hold on our behalf and to retaining it only for the period we instruct. The exception is Google, when you choose to sign in with a Google account, which acts as an independent controller under its own privacy terms.
Our service providers
| Purpose | Provider | Notes |
|---|---|---|
| AI service provider | Anthropic | Processes inputs and outputs for our AI features only |
| Website hosting, database and cache | Render | Germany |
| Cloud file and image storage | Amazon Web Services (AWS) | |
| Error and performance monitoring | Sentry | |
| Email delivery | Brevo (Sendinblue) | France |
| Account registration and authentication | Google Sign-In | Independent controller for your Google account |
| Connecting your own third-party account (Drive, Sheets, Forms) | ||
| Address and place-name lookup | LocationIQ (Unwired Labs) |
We may also need to share your personal information in the following situations.
Commissioning organisations. Each Verto is commissioned by an organisation — such as a charity, council, school, funder or research partner — that decides what to ask and why. The responses collected through that Verto, including the demographic answers, are made available to that organisation in its results and exports. An organisation sees only the responses collected through its own Vertos, and never those collected by another organisation.
Data Commons. Aggregated and anonymised insight only, as described in section 14. No individual response is ever shared through the Data Commons.
Business transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
5. Do we use cookies and other tracking technologies?
We set no analytics, advertising or session-recording cookies, and no third party sets cookies through our Services. Every cookie we set is strictly necessary for the Services to work, which is why you are not asked to make a cookie choice and will not see a cookie banner. We use no web beacons or tracking pixels on our website, in the creator app or in the respondent player.
The cookies we set keep you signed in to a creator account or a respondent account, remember the interface language you have chosen, and — on a shared translation-review link only — remember the name you chose to give. Our Cookie Notice lists each one.
Information stored on your device
So that a Verto can be answered on a poor connection and finished offline, the respondent player keeps a small amount of information in your browser's local storage rather than in cookies: answers waiting to be sent when you are next online, a record that this device has already taken a Verto where the organisation running it has asked that each person answers once, and your chosen text size. None of it is used for analytics, advertising or profiling, none of it is shared with anyone, and clearing your browser data removes all of it.
In the marketing emails we send, we use standard open and click tracking to understand which messages are useful. You can stop receiving those emails at any time using the unsubscribe links described in section 11.
We do not use advertising or retargeting technologies. We do not display advertisements, we do not tailor advertisements to your interests, and we do not permit third parties to use our Services to build advertising profiles.
Specific information about how we use these technologies and how you can refuse certain cookies is set out in our Cookie Notice: https://app.playverto.com/cookie-policy
6. Do we offer artificial intelligence-based products?
As part of our Services, we offer products, features, and tools powered by artificial intelligence and similar technologies ("AI Products"). The terms in this Privacy Notice govern your use of them.
We provide the AI Products through a third-party service provider, Anthropic. Your input and the resulting output are shared with and processed by that provider to enable your use of our AI Products, for the purposes outlined in section 3. You must not use the AI Products in any way that violates the terms or policies of that provider.
We do not build, train, or fine-tune AI models, and the data you provide is not used to train them.
Our AI Products are designed for the following functions:
- AI insights
- Text analysis
- Translation of Verto content into the languages a Verto is published in
- Moderation of text and images submitted to the platform
All personal information processed using our AI Products is handled in line with this Privacy Notice and our agreement with the provider.
7. How do we handle your social logins?
Our Services offer you the ability to register and sign in using your Google account. Google is the only sign-in provider we offer.
Where you choose to do this, we receive your name and email address from Google. We do not receive your contact list, your photographs, or any other content from your Google account.
We will use the information we receive only for the purposes described in this Privacy Notice or otherwise made clear to you. We do not control, and are not responsible for, other uses of your personal information by Google. We recommend that you review their privacy notice to understand how they collect, use, and share your personal information, and how you can set your privacy preferences.
8. Is your information transferred internationally?
Our application servers and database are located in Germany. Our email delivery provider is located in France.
Some of the service providers listed in section 4 are located in the United States, and information may be transferred to, stored by, and processed in their facilities.
If you are a resident in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, those countries may not have data protection laws as comprehensive as those in your own. We take the measures described below to protect your personal information.
Standard Contractual Clauses. We have implemented measures to protect your personal information, including the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum, in our agreements with our third-party providers. These require all recipients to protect personal information originating from the EEA or UK in accordance with European data protection law. Where a provider is certified under the EU–US Data Privacy Framework and its UK Extension, we also rely on that certification. Copies of our Standard Contractual Clauses can be provided on request.
9. How long do we keep your information?
We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law. The retention period for each purpose is stated in the table in section 2.
Aggregated and anonymised information is retained indefinitely. Once information has been aggregated so that it no longer identifies any individual, it is no longer personal data — see section 14.
When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise it, or, if this is not possible (for example, because it has been stored in backup archives), we will securely store it and isolate it from any further processing until deletion is possible.
10. How do we keep your information safe?
We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal information we process. These include encryption of data in transit and at rest, encryption of free-text answers, one-way hashing of respondent and device identifiers, the automatic removal of email addresses, phone numbers, web addresses and social handles from free-text answers before they are stored, and minimum group sizes below which a result is withheld rather than shown. Insight published through the Data Commons requires a group of at least 10 respondents; within an organisation’s own results, a breakdown by place or demographic group requires at least 5 (section 14).
However, despite our safeguards, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Transmission of personal information to and from our Services is at your own risk.
11. What are your privacy rights?
In some regions (like the EEA, UK, Switzerland, and Canada), you have certain rights under applicable data protection laws. These may include the right (i) to request access to and obtain a copy of your personal information; (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; (iv) if applicable, to data portability; and (v) not to be subject to automated decision-making. In certain circumstances you may also have the right to object to the processing of your personal information. You can make such a request using the contact details in section 17.
An important limit on these rights. Verto responses are stored without a name, email address or account attached. For most respondents we therefore hold no means of identifying which responses are theirs, and we are not required to obtain additional information solely to identify you. If you can give us information that lets us locate your responses — such as a session token, a respondent code, or the email address of an account you created — we will find and act on them. Where a Verto was run by another organisation, we will pass your request to that organisation or help it respond.
Complaints
If you are located in the UK and are unhappy with how we have handled your personal information, you can complain directly to us at dpo@playverto.com, or by post to the address in section 17. This is in addition to the rights you have under the UK GDPR and the Data Protection Act 2018.
We will acknowledge your complaint within 30 days of receiving it, investigate without unjustifiable or excessive delay, and keep you informed of progress and the outcome.
If you are not happy with our final response, you can refer your complaint to the Information Commissioner’s Office, the UK supervisory authority:
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or the UK data protection authority. If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.
Withdrawing your consent
If we are relying on your consent, you have the right to withdraw it at any time, by contacting us or by updating your preferences. This will not affect the lawfulness of processing before its withdrawal, nor processing conducted on lawful grounds other than consent.
Opting out of marketing communications
You can unsubscribe at any time by:
- clicking the unsubscribe link in any email we send;
- using the per-organisation unsubscribe link in any message, which stops emails from a single organisation without unsubscribing you from everything else;
- emailing dpo@playverto.com asking to be removed from the marketing list; or
- contacting us using the details in section 17.
We may still send service-related messages necessary for the administration and use of your account, to respond to service requests, or for other non-marketing purposes.
Account information
To review or change the information in your account, sign in to your account settings, or contact us. On request to terminate your account, we will deactivate or delete your account and information from our active databases. We may retain some information to prevent fraud, troubleshoot problems, assist with investigations, enforce our legal terms, or comply with legal requirements.
Cookies and similar technologies
Because every cookie we set is strictly necessary for the Services to work, there is no analytics or advertising choice for you to make or withdraw. Most web browsers accept cookies by default, and you can set yours to remove or reject them, though doing so will stop you staying signed in and may prevent a Verto from being finished offline.
12. Controls for Do-Not-Track features
Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature you can activate to signal that you do not want your online browsing activities monitored. No uniform technology standard for recognising and implementing DNT signals has been finalised. We do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online, including Global Privacy Control signals. If a standard is adopted that we must follow, we will inform you in a revised version of this notice.
California law requires us to let you know how we respond to web browser DNT signals. Because there is currently no industry or legal standard for recognising or honouring them, we do not respond to them at this time.
13. Do United States residents have specific privacy rights?
If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent. These rights may be limited in some circumstances by applicable law.
Categories of personal information we collect
| Category | Examples | Collected |
|---|---|---|
| A. Identifiers | Real name, alias, postal address, telephone number, unique personal identifier, online identifier, IP address, email address, account name | Yes |
| B. California Customer Records statute | Name, contact information, education, employment, employment history, financial information | Yes |
| C. Protected classification characteristics | Gender, age, date of birth, race and ethnicity, national origin, marital status, other demographic data | Yes — age band and gender only, see the note below |
| D. Commercial information | Transaction information, purchase history, financial details, payment information | No |
| E. Biometric information | Fingerprints and voiceprints | No |
| F. Internet or other network activity | Browsing history, search history, online behaviour, interest data, interactions with websites and applications | Yes |
| G. Geolocation data | Device location | Yes — see the note below |
| H. Audio, electronic, sensory information | Images and audio, video or call recordings | No |
| I. Professional or employment-related information | Business contact details, job title, work history, professional qualifications | Yes |
| J. Education information | Student records and directory information | No |
| K. Inferences drawn from collected personal information | Profiles or summaries about an individual’s preferences and characteristics | No |
| L. Sensitive personal information | — | Not in our standard questions |
Note on Category G. The examples in this table are the statutory illustrations and are broader than what we hold. The only location information we collect is a place name a respondent chooses to give as an answer — a town, city or region. We do not collect device location, we do not derive location from IP addresses or device sensors, and we do not track movements.
Note on Category C. We collect an age band and gender, which respondents can skip. Our standard questions do not ask about race, ethnicity, national origin or marital status.
How long we retain each category
- Category A — Email addresses and account identifiers for as long as the account is active, deleted on request. Session tokens and per-device identifiers stored with a Verto response are held as one-way digests, with no name or account attached, for as long as the response is retained. Identifiers in security and error logs for up to 12 months.
- Category B — Name for as long as the account is active, deleted on request. Employer or organisation name and industry, where given as answers within a Verto, for as long as the research they form part of remains in use, held without a name or account attached.
- Category C — Age band, gender and location given as part of a Verto, for as long as the research they form part of remains in use, held with no name or account attached. Where a respondent holds an account, it is deleted on request together with any link between the account and their answers.
- Category F — Server-side log and usage records, including IP address, for up to 12 months. Response-integrity signals, for as long as the response they belong to is held. Aggregate usage statistics indefinitely. We use no third-party analytics or session-recording tools.
- Category G — Location given as an answer within a Verto, for as long as the research it forms part of remains in use, held with no name or account attached.
- Category I — Employer or organisation name and industry, where given as answers within a Verto, for as long as the research they form part of remains in use, held with no name or account attached.
- Category L — We do not ask for sensitive personal information in our standard questions. See the summary at the start of this notice.
Selling, sharing and disclosure
We may use your personal information for our own business purposes, such as undertaking internal research for technological development and demonstration. This is not considered to be "selling" of your personal information.
We have not sold or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We have disclosed categories A, B, C, F, G and I to third parties for a business or commercial purpose in that period. The third parties are listed in section 4.
Your rights
These rights are not absolute, and in certain cases we may decline a request as permitted by law. They include the right to know whether we are processing your personal data; to access it; to correct inaccuracies; to request deletion; to obtain a copy of data you previously shared with us; to non-discrimination for exercising your rights; and to opt out of processing used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects.
Depending on your state, you may also have rights to access the categories of personal data being processed; to obtain a list of the categories of third parties, or the specific third parties, to which we have disclosed personal data; to obtain a list of third parties to which we have sold personal data; to review, understand, question and correct how personal data has been profiled; to limit use and disclosure of sensitive personal data; and to opt out of the collection of sensitive data and data collected through a voice or facial recognition feature.
How to exercise your rights. Email us at dpo@playverto.com, or write to us at the postal address in section 17. You can designate an authorised agent to make a request on your behalf; we may deny a request from an agent who does not submit proof of valid authorisation.
Request verification. We will need to verify your identity to determine that you are the person about whom we hold information. We will only use personal information provided in your request to verify your identity or authority. If we cannot verify your identity from what we already hold, we may request additional information for verification and fraud-prevention purposes.
Appeals. If we decline to act on your request, you may appeal by emailing dpo@playverto.com. We will inform you in writing of any action taken or not taken, with reasons. If your appeal is denied, you may submit a complaint to your state attorney general.
California "Shine The Light" law. California residents may request, once a year and free of charge, information about categories of personal information we disclosed to third parties for direct marketing purposes and the names and addresses of those third parties. We do not disclose personal information to third parties for their own direct marketing purposes.
14. Aggregated data and the Data Commons
Aggregated data means information that has been combined and summarised so that it no longer identifies any individual and cannot reasonably be linked back to one. Once data has been aggregated in this way it is no longer personal data.
What goes into the Data Commons. Not everything collected through VertoNow goes into the Data Commons. Only the following data does, and only as the aggregated figures, themes and redacted quotes described in this section:
- Answers to Commons questions. These are questions from our question library, including the standard demographic questions at the end of each Verto. Where a Verto includes Commons questions, its consent step says so.
- Contributed data. Answers to an organisation’s own questions, where that organisation chooses to contribute them and we have reviewed and accepted them.
- Partner research data. Research data from partner organisations, where the partner has agreed to its inclusion.
Answers to an organisation’s own questions stay with that organisation, and are never included unless it chooses to contribute them.
Two gates, both required. A Verto’s answers are used to build the Data Commons only where the organisation that collected them has offered it, has not withdrawn it, and Play Verto has accepted it after review. An offer can be narrower than a whole Verto — an organisation may contribute the Commons questions while keeping its own questions out — and a question outside what was offered never becomes part of the Commons.
Withdrawal. A contributing organisation can withdraw a Verto at any time, without giving a reason. Withdrawal takes effect immediately: from that moment its data answers no further questions. Figures already combined into an aggregate cannot be separated back out, so withdrawal stops future use rather than unpicking published aggregates — which is why nothing is contributed without the offer described above.
Quality. We decide what is included. We include only responses that pass our response-integrity checks (section 1), and only data collected with a sound method and from enough respondents to be meaningful. Question types we have not decided how to report are left out rather than included by default, and questions that collect contact details are never contributed under any circumstances.
Protecting individuals. Nothing is published through the Data Commons or returned by Ask Verto about a group of fewer than 10 respondents. Within an organisation’s own results, a breakdown by place or by demographic group is withheld below 5. The floor is applied to each figure rather than to the group as a whole, so a group large enough overall is still withheld on a question most of them skipped; and a withheld figure is absent rather than shown as zero, because a published zero in a small group is as identifying as a published one.
One characteristic at a time. Figures are broken down by age band, or by gender, or by country — never by two of them together. Combinations are where re-identification actually happens, so they are not produced at all rather than produced and withheld.
Free-text answers and quotes. Where a contributed Verto asked an open question, the Data Commons holds the themes found across the answers and a small number of the answers themselves, word for word. Before any answer can be quoted: contact details, web addresses, social handles and long runs of digits are removed; what remains is assessed for whether it could still identify its author and dropped if it could; answers longer than 300 characters are rejected rather than shortened, because a long answer is far easier to trace to one person; and a member of staff reads every quote before the Verto it came from is accepted. Answers held by a moderator are never quoted. No other part of an individual response is published.
Data in the Data Commons, alongside Play Verto’s own primary data, is used in the following ways:
- To submit research and reports, and respond to calls for evidence on subjects we have insight on.
- To share aggregated and distilled data and trends with issue-based organisations and impact leaders, where it may positively affect their strategy or advocacy work.
- To share aggregated data and trends within academia.
- To build a meta-database that can be queried through our Ask Verto feature, which is accessible to subscribers and to anyone to whom Play Verto grants access, including on a paid basis.
Apart from the quotes described above, no individual response is pooled, sold or shared across organisations, and each organisation that commissions a Verto sees only the responses collected through its own Verto.
We do not sell the Data Commons or licence it as a dataset, and access to Ask Verto never buys a larger share of it: what any reader can see is decided by what has been contributed and accepted, never by who they are or what they pay. We do not use the Data Commons to make or support a decision about an individual, for advertising or audience targeting, or to train or fine-tune AI models.
Why the Data Commons exists. It helps make sure the voices of lived experience are part of the decisions that affect them: an organisation with 300 responses can say little about how its community compares with anyone else’s, and the same 300 responses alongside tens of thousands can. Organisations that contribute get access to the aggregated insight they help build, and subscriptions to Ask Verto keep Play Verto sustainable.
Because aggregated data is no longer personal data, we retain it indefinitely.
15. Children’s data
Respondents can take part in a Verto without creating an account, and those responses are held without a name, email address or account attached.
Account creation is not available to anyone under 16, or under 18 where local law sets a higher age.
We ask for an age band rather than a date of birth, so that we hold less identifying information about every respondent, including children. There is no session recording and no third-party analytics or advertising technology anywhere in the respondent player, and the player sets no cookie that is not strictly necessary for a Verto to be answered.
Where a Verto is run by a school, council, charity or youth organisation, that organisation decides what to ask and why, and is responsible for obtaining any consent required from parents or guardians for children taking part in its research.
If you believe we have collected information from a child in a way that does not meet these arrangements, please contact us at dpo@playverto.com and we will take appropriate steps.
16. Do we make updates to this notice?
Yes. We may update this Privacy Notice from time to time. The updated version will be indicated by an updated date at the top. If we make material changes, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification.
17. How can you contact us about this notice?
If you have questions or comments about this notice, you may contact our data protection lead by email at dpo@playverto.com, or by post at:
Play Verto Global Ltd (company number 09474024), Data Protection Lead, 5 Ashford Gardens, Cobham, Surrey KT11 3HN, United Kingdom
18. How can you review, update, or delete the data we collect from you?
You have the right to request access to the personal information we collect from you, details about how we have processed it, to correct inaccuracies, or to delete your personal information. You may also have the right to withdraw your consent. These rights may be limited in some circumstances by applicable law.
To request to review, update, or delete your personal information, please email dpo@playverto.com or write to us at the postal address above.
Please note the limit described in section 11: Verto responses are held without a name, email address or account attached, so we can only locate and act on your responses where you are able to give us information that identifies them.