1. About this Privacy Statement

This Privacy Statement explains how Boscombe Insights Advisory collects, uses, stores and protects personal data when providing market research services and when people interact with our website or business.

Boscombe Insights Advisory is a UK sole trader business providing independent market research services to market research agencies, businesses and other organisations.

We are committed to respecting applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Statement explains:

• what personal data we may process;

• why we process it;

• the circumstances in which we may share it;

• how we protect and retain it;

• the rights available to individuals; and

• how to contact us about privacy and data protection matters.

This Statement applies to personal data relating to:

• participants in market research activities ("respondents");

• clients and individuals associated with our clients;

• suppliers, subcontractors and individuals associated with them;

• business contacts and prospective clients;

• users and visitors to our website; and

• other individuals who contact or interact with us in connection with our business activities.

2. About Boscombe Insights Advisory

Boscombe Insights Advisory provides market research services to clients who need to understand customers, markets, audiences, brands and business opportunities.

Our research activities may include:

• quantitative surveys;

• qualitative depth interviews;

• focus groups;

• online research forums and communities; and

• analysis and reporting of research findings.

We analyse and report research findings to help our clients make informed business decisions.

Boscombe Insights Advisory is not a research panel provider and does not operate its own consumer research panel.

We do not maintain a general-purpose database of individuals for the purpose of recruiting them into unrelated research projects.

Respondents participating in our research are generally recruited through independent research panel providers or directly through our clients. The relevant panel provider or client will generally be responsible for respondent recruitment, registration and the initial collection and management of respondent contact information in accordance with its own privacy information and applicable data protection obligations.

Boscombe Insights Advisory also does not operate its own survey hosting, respondent recruitment or online research community platforms. Depending on the requirements of a particular project, these services may be provided by a research panel provider, client or other third-party technology provider.

3. Our role in processing personal data

The role of Boscombe Insights Advisory in relation to personal data depends on the particular processing activity and the arrangements for each research project.

Depending on the circumstances, we may act as:

• a data controller, where we determine the purposes and means of processing personal data ourselves, for example in relation to our own business administration, website enquiries and business contacts;

• a data processor, where we process personal data on behalf of a client and in accordance with the client's documented instructions; or

• where applicable, a joint controller or another role determined by the specific arrangements for a particular activity.

Where we process personal data as part of providing research services, the respective roles and responsibilities of Boscombe Insights Advisory, our client, any research panel provider and other relevant service providers will depend on the contractual and operational arrangements for that particular project.

We only process personal data that is necessary for the relevant business or research purposes and apply appropriate technical and organisational measures to protect it.

4. Market research participants

4.1 How respondents are recruited

Boscombe Insights Advisory does not generally recruit respondents directly.

Respondents may be recruited:

• through independent research panel providers; or

• directly by our clients, for example from their own customer or contact databases.

The organisation responsible for recruiting respondents will generally provide the respondent with information about the relevant research activity, including any applicable privacy information, consent requirements and participation arrangements.

Where a research panel provider is involved, that provider may hold the respondent's name, contact details, panel membership information, participation history, incentive information and other information required to manage the respondent's participation.

Where a client recruits its own customers or contacts, the client will generally retain responsibility for the underlying contact information and the arrangements under which those individuals are invited to participate.

4.2 Information we may receive

Depending on the nature of the research project, Boscombe Insights Advisory may receive or have access to:

• research responses;

• survey answers;

• open-ended comments;

• a unique participant or response ID;

• demographic or profiling information relevant to the research;

• information provided during a depth interview or focus group;

• contributions made within an online research community or forum;

• photographs, images, audio or video recordings where relevant to the research;

• transcripts or other research materials; and

• in some circumstances, limited identifying information such as a respondent's name and email address where this is necessary to organise participation in a depth interview, focus group or online community.

We seek to minimise the amount of directly identifying information that we receive or retain.

In the majority of quantitative research projects, we do not receive respondents' names or direct contact details. Instead, responses may be associated with a unique response ID or other pseudonymous identifier.

4.3 Pseudonymised research data

A unique response ID does not normally directly identify an individual to Boscombe Insights Advisory. However, where the research panel provider or client retains information that can link that ID to an individual, the information may still constitute personal data.

For example, if our quality assurance process identifies a potentially invalid or incomplete response, we may flag the relevant response ID to the panel provider. The panel provider may then be able to identify the respondent using information that it holds and take any appropriate action.

We will not seek to obtain directly identifying information where it is not necessary for us to perform the relevant research service.

4.4 Qualitative research

Some of our research involves depth interviews, focus groups and online research communities or forums.

Depending on the nature of the research, participants may interact with us, our clients and/or other research participants.

For online research communities and forums, participants may be identified by a screen name rather than their real name. We recommend that participants choose a screen name that does not resemble their real name and avoid posting unnecessary personal information about themselves or other individuals.

Where participants voluntarily post personal information, we may remove information that is unnecessary for the research where appropriate in order to help protect their privacy.

In focus groups and research communities, information shared by participants may in some circumstances be visible to other participants as well as to the research team and, where this forms part of the research arrangements, the client.

Participants will be informed of the relevant arrangements before taking part in the research.

Where required for the purposes of delivering the research, qualitative materials may include photographs, images, audio recordings, video recordings, transcripts or participants' research contributions.

Any sharing of such information will be carried out in accordance with the applicable data protection requirements and the arrangements established for the particular research project.

5. How we use personal data

We may process personal data for the following purposes:

Market research

• conducting quantitative and qualitative research;

• administering and analysing research responses;

• carrying out quality assurance and data validation;

• conducting interviews, focus groups and online research communities;

• preparing research findings, presentations and reports;

• delivering research services to our clients; and

• communicating with research participants where this is necessary for the relevant research activity.

Client and business management

• managing client relationships;

• preparing proposals and quotations;

• delivering contracted services;

• communicating with clients, suppliers and business contacts;

• managing contracts and project documentation;

• processing invoices and payments;

• maintaining appropriate business records; and

• complying with legal, regulatory and accounting obligations.

Website and enquiries

• responding to enquiries submitted through our website;

• maintaining and securing our website;

• understanding and improving website usage where appropriate; and

• managing website cookies and similar technologies in accordance with applicable requirements.

We do not use market research responses obtained for one client to create marketing lists or customer profiles for another client.

We do not sell, rent or lease respondent personal data to third parties for direct marketing or sales purposes.

Participation in our market research activities will not, as a result of that participation alone, cause a respondent to be added to a sales or marketing list operated by Boscombe Insights Advisory.

6. Lawful bases for processing

We process personal data only where there is an appropriate lawful basis under applicable data protection legislation.

The lawful basis will depend on the nature of the processing and the particular circumstances.

Examples include:

Purpose

Typical lawful basis

Managing client relationships and providing contracted research services

Performance of a contract and/or legitimate interests

Responding to business enquiries and prospective client requests

Legitimate interests and, where applicable, taking steps at the request of the individual before entering into a contract

Accounting, tax and statutory record keeping

Legal obligation

Conducting research on behalf of a client

The lawful basis applicable to the particular project and the respective role of Boscombe Insights Advisory, the client and any research panel provider

Processing research participant information

The lawful basis applicable to the particular research project and the relevant controller/processor arrangements

Website operation and security

Legitimate interests and/or other applicable lawful bases depending on the processing

Non-essential cookies and similar technologies

Consent where required by applicable law

Where processing is based on our legitimate interests, those interests may include operating and developing our business, managing client and supplier relationships, delivering our services, maintaining business records, protecting our systems and ensuring the security and quality of our research services.

Where consent is the appropriate lawful basis for a particular processing activity, it will be obtained in accordance with applicable requirements. Where processing is based on consent, individuals may withdraw their consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

7. Special category and sensitive personal data

Some market research projects may ask participants about topics that could involve sensitive or special category personal data, such as information relating to health, ethnicity, religion, political opinions, sexual orientation or disability.

Where such information is processed by Boscombe Insights Advisory, we will ensure that an appropriate lawful basis under Article 6 of the UK GDPR and, where required, an appropriate additional condition under Article 9 and the Data Protection Act 2018 are in place.

The processing of such information will be limited to what is necessary for the relevant research purpose and subject to appropriate safeguards.

Not every research project will involve special category personal data.

8. Sharing personal data

We may share personal data with third parties where this is necessary and lawful for the relevant business or research activity.

These may include:

• our clients;

• research panel providers;

• suppliers and subcontractors involved in delivering research services;

• technology and software providers;

• cloud storage and business administration providers;

• providers responsible for fulfilling research incentives;

• professional advisers;

• legal, regulatory or law enforcement authorities where disclosure is required or permitted by law; and

• other service providers where their involvement is necessary to provide our services.

We will not share personal data obtained in connection with providing our services to one client with another client unless this is specifically authorised and lawful for the relevant purpose.

We will not sell, rent or lease personal data to third parties for their own direct marketing purposes.

Research panel providers and clients

Where respondents have been recruited through a research panel provider or directly by a client, that organisation may retain the information necessary to identify the respondent and manage their participation.

If Boscombe Insights Advisory only receives a pseudonymised response ID and does not have access to information that identifies the respondent, we may be unable to identify or directly respond to an individual's request without the assistance of the relevant panel provider or client.

9. Respondent rights and requests

Individuals have a number of rights under applicable data protection legislation. Depending on the circumstances, these may include the right to:

• access their personal data;

• have inaccurate or incomplete personal data corrected;

• request erasure of personal data;

• request restriction of processing;

• object to certain processing, including processing based on legitimate interests;

• request portability of personal data where the right applies;

• withdraw consent where processing is based on consent; and

• complain to the Information Commissioner's Office or another relevant data protection supervisory authority.

These rights are subject to certain legal conditions and exemptions and therefore may not apply in every circumstance.

Requests relating to market research participation

If you participated in a market research activity through a research panel provider or one of our clients, and your name or contact details were not provided to Boscombe Insights Advisory, we may not be able to identify your personal data directly.

In these circumstances, you should normally contact the research panel provider or client through which you were invited to participate. They may be able to identify you and coordinate any request with us.

Where we hold a response associated with a unique response ID, the relevant panel provider or client may provide us with that ID so that we can locate the relevant research data without unnecessarily receiving additional identifying information.

Where research data has been genuinely anonymised so that an individual can no longer reasonably be identified, it may no longer constitute personal data and individual rights relating to that data may not apply.

How to make a request

You can contact Boscombe Insights Advisory using the details in Section 13 of this Privacy Statement.

We may need to request sufficient information to verify your identity or locate the relevant records before responding to your request.

We will normally respond to a valid request without undue delay and within one month. Where permitted by law, this period may be extended by up to a further two months where a request is complex or we have received a number of requests. If an extension is required, we will inform you within the initial response period.

Requests are normally handled free of charge. Where permitted by law, we may charge a reasonable fee or refuse to act on a request where it is manifestly unfounded or excessive.

10. Data security

Boscombe Insights Advisory takes the security of personal data seriously and implements appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, destruction, alteration or disclosure.

Depending on the nature of the information and the systems involved, these measures may include:

• access controls and multi-factor authentication;

• strong and unique passwords;

• encryption of data in transit and, where supported by the relevant systems, at rest;

• secure cloud-based storage and technology services;

• device security, including password or biometric protection, encryption and appropriate anti-malware measures;

• restricting access to personal data to those who need it for legitimate business or research purposes;

• data minimisation; and

• secure deletion of personal data when it is no longer required.

We do not routinely download or retain raw research datasets on local devices where this is unnecessary for the work being undertaken. Where temporary local copies are required for analysis, they are protected appropriately and deleted when no longer required.

We select and use reputable technology and service providers and consider the security and data protection measures offered by those providers as part of our supplier management.

11. Data retention

We retain personal data only for as long as necessary for the purposes for which it was collected or otherwise processed, taking account of our contractual obligations, legal requirements, legitimate business needs and the nature of the relevant research project.

Our standard retention periods for research information are as follows:

Pseudonymised research responses

Individual research responses associated with unique response IDs are normally retained for a maximum of six months following formal completion of the research project.

This period allows us to undertake appropriate quality assurance, validation and any necessary follow-up work.

Once the retention period ends, the relevant response IDs will be securely deleted or removed from our systems where no longer required.

Qualitative audio and video recordings

Full, unedited audio or video recordings from depth interviews, focus groups or relevant online research activities are normally retained for a maximum of three months following completion of the research project, unless a different period is required by the particular project arrangements or applicable law.

Once the relevant retention period ends, the original recordings will be securely deleted.

Transcripts and research analysis

Transcripts and research analysis may be retained for longer where necessary for legitimate research, contractual or business purposes.

Where practical, transcripts will be de-identified by removing or replacing names, specific locations and other information that could unnecessarily identify an individual.

Our standard retention period for de-identified transcripts and associated analysis materials is up to two years, unless a different period is necessary for the relevant project, contractual or legal requirements.

Aggregated and anonymised research outputs

Final reports, statistical summaries and other genuinely anonymised or aggregated research outputs that cannot reasonably be used to identify individual participants may be retained indefinitely for historical, reference or tracking purposes.

Business and financial records

Certain business records, including contracts, invoices and financial records required for tax and accounting purposes, will be retained for the periods required by applicable law.

Other business correspondence and project records will be retained only for as long as necessary for legitimate business, contractual or legal purposes.

12. International transfers

Some of the technology, software and service providers used by Boscombe Insights Advisory or our clients and research partners may operate internationally.

Where personal data is transferred outside the UK, we will ensure that the transfer is made in accordance with applicable UK data protection law.

Depending on the destination and circumstances, this may include reliance on:

• UK adequacy regulations;

• appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum; or

• another lawful transfer mechanism or applicable exception.

Where we process personal data on behalf of a client, the arrangements for any international transfer may also be governed by the contractual and data protection arrangements between Boscombe Insights Advisory, the client and the relevant service provider.

13. Website cookies and similar technologies

Our website, www.boscombeinsightsadvisory.com, is hosted using Squarespace.

The website may use cookies and similar technologies provided by Squarespace and/or other third-party services.

Some cookies are necessary for the website to operate correctly. Other cookies, such as certain analytics or tracking technologies, may require consent before they are used.

We will provide appropriate information about the cookies and similar technologies used on our website and, where required, provide users with a mechanism to consent to or refuse non-essential cookies.

Our use of cookies and similar technologies may change as the website develops. We will review and update our cookie information when necessary.

For information about Squarespace's own processing activities, please refer to Squarespace's privacy information.

14. Legal and regulatory disclosures

We may disclose personal data to law enforcement agencies, courts, regulators or other authorised third parties where we are legally required or permitted to do so.

This may include circumstances where disclosure is necessary to:

• comply with a legal or regulatory obligation;

• investigate suspected unlawful activity;

• establish, exercise or defend legal rights; or

• protect the rights, property or safety of Boscombe Insights Advisory, our clients or other individuals.

We will only disclose information where we consider the disclosure to be lawful and necessary for the relevant purpose.

15. Data Protection Registration

Boscombe Insights Advisory is registered with the UK Information Commissioner's Office (ICO) as a data controller.

ICO registration number: ZC244311

Our registration can be verified through the ICO's public Data Protection Register.

16. Contact details

If you have any questions about this Privacy Statement, wish to exercise a data protection right, or have a concern about how your personal data has been handled, please contact Boscombe Insights Advisory:

Email: info@boscombeinsightsadvisory.com
Telephone: +44 (0) 7508 546712

17. Complaints

We would encourage you to contact us first if you have a concern about how we have processed your personal data so that we can try to resolve the issue.

You also have the right to complain to the UK's data protection supervisory authority:

Information Commissioner's Office (ICO)

Website: www.ico.org.uk
Telephone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

If you are based outside the UK, you may also have the right to complain to the data protection supervisory authority in the country where you live, work or believe your data protection rights have been infringed.

18. Changes to this Privacy Statement

We may update this Privacy Statement from time to time to reflect changes to our business, research activities, technology, legal requirements or data protection practices.

The latest version will be published on our website, together with the date on which it was last updated.

Where required, we will bring significant changes or new uses of personal data to the attention of affected individuals before the new processing begins.