Data Protection Policy for Clients

Version dated 25 August 2026

Brandspeak Limited is referred to in this document as “Brandspeak”, “we” and “us”. This Data Protection Policy explains how we process your personal data in accordance with UK data protection law (the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025) and, where we are working with clients based in the European Union, the EU General Data Protection Regulation.

Separate Data Protection Policy for Participants

Brandspeak distinguishes between:

• clients that engage its services to carry out market research and branding services (its “Clients”) and other third-party contractors that Brandspeak engages; and

• individual participants that Brandspeak or its third-party agents source and interview on behalf of a Client, as part of the qualitative or quantitative market research projects Brandspeak undertakes (“Participants”).

Please see our separate Data Protection Policy for Participants for more information.

The personal data we collect about you

Personal data collected, used, stored and transferred by us may include:

• Identity Data, including forename(s) and last name

• Contact Data, including business address, email address and telephone number(s)

How do we collect your personal data?

We collect personal data directly from you when you communicate with a member of the Brandspeak team in person, by phone or by email.

How do we use your personal data?

We use your personal data in the following circumstances, relying on the following lawful basis for processing:

Purpose/ActivityType of DataLawful Basis of ProcessingTo initially engage with you to discuss your requirementsIdentity, ContactNecessary for our legitimate interestsTo manage our relationship with youIdentity, ContactPerformance of a contract with you; necessary for our legitimate interestsTo administer our businessIdentity, ContactNecessary for our legitimate interests

If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so. We may process your personal data without your knowledge or consent, in compliance with the above, where this is required or permitted by law.

Changes to this policy

We keep this policy under regular review and will let you know when we update it.

Marketing communications

Your personal information will not be passed to any third-party organisation for marketing purposes.

Data security

Brandspeak has put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way. Access to your personal data is limited to members of the Brandspeak team, freelance advisers, business partners and suppliers who have a business need to know. They will only process your personal data on our instructions and are subject to a duty of confidentiality. We have procedures in place to deal with any suspected personal data breach, and we will notify you and the ICO where we are legally required to do so.

Sharing of personal data outside the United Kingdom

Some of our external suppliers are based outside the United Kingdom, so their processing of your personal data will involve a transfer of data outside the UK. Where we use providers based outside the UK, we require them to provide a similar level of protection for personal data as it has within the UK, for example through UK-approved International Data Transfer Agreements or by transferring only to countries assessed by the UK government as offering an adequate level of protection.

Who we disclose personal data to

Your personal data may be shared with third parties for the following purposes:

Type of RecipientReasonWithin BrandspeakDepending on your requirements, it may be necessary to share your personal data with Brandspeak’s team of freelance market research specialists.Third-party contractorsYour data may be accessed by our external telephone operations provider, in order to take telephone messages from you and pass the information to Brandspeak.OthersThird parties to whom we may choose to sell, transfer or merge parts of our business or assets. If we acquire or merge with another business, the new owners may use your personal data in the same way as set out in this policy.

These companies are required to have appropriate security measures in place, to maintain the confidentiality of your personal data, and to use it only in the course of providing such services and in accordance with our instructions.

How long is your personal data retained?

Brandspeak retains your personal data for 1 year following completion of our contractual relationship with you, unless we need to keep it for longer to meet a legal, regulatory, tax or accounting requirement, or to establish, exercise or defend legal claims. After this period, if there is no other ongoing relationship, your personal data will be securely deleted.

Your legal rights

Under UK data protection law, you have the right to:

• request access to your personal data

• request correction of your personal data

• request erasure of your personal data

• object to our processing of your personal data

• request restriction of our processing of your personal data

• request transfer of your personal data (data portability), where this applies

• withdraw your consent at any time, where we are relying on consent as our lawful basis

Questions and complaints

If you have any questions or concerns about how we use your personal data, or wish to exercise any of your rights, please contact us at enquiries@brandspeak.co.uk, marked for the attention of our Data Protection Officer.

You do not need to use a special form or address to complain: we will treat any communication that expresses dissatisfaction with how we have handled your personal data as a complaint under this process, however it reaches us (for example by phone, email, post or social media). We will acknowledge it within 30 days, investigate it promptly, keep you updated on progress, and confirm the outcome to you without undue delay.

If you remain unhappy with our response, you have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk.