Data Protection Policy for Participants
Participants of Market Research Commissioned by Brandspeak Limited – Version dated 25 August 2026 (replaces the version dated 25 May 2018)
Brandspeak Limited, registered office 701 Stonehouse Park, Sperry Way, Stonehouse, GL10 3UT, company number 10107500.
Brandspeak Limited is referred to in this document as “Brandspeak”, “we” and “us”. This Data Protection Policy explains how we process your personal data in accordance with UK data protection law – the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025 – and, where applicable, the EU General Data Protection Regulation.
Data Protection Policy for Clients and Third-Party Contractors
Brandspeak distinguishes between:
a) clients that engage its services to carry out market research and branding services (its “Clients”) and other third-party contractors that Brandspeak engages; and
b) individual participants that Brandspeak or its third-party agents source and interview on behalf of a Client, as part of the qualitative or quantitative market research projects Brandspeak undertakes (“Participants”).
Please see our Data Protection Policy for Clients and Third-Party Contractors for more information.
The personal data we collect about you
Personal data collected, used, stored and transferred by us may include:
- Identity Data, including forename(s) and last name
- Contact Data, including personal address, email address and telephone number(s)
How do we collect your personal data?
Personal data is collected by us directly when you communicate with a member of the Brandspeak team in person, by phone or by email. It is also collected through our third-party market research (recruitment) agents, when you communicate with them in person, by phone or by email.
How do we use your personal data?
We use your personal data in the following circumstances, relying on the following lawful basis for processing:
| Purpose/Activity | Type of Data | Lawful Basis of Processing |
|---|---|---|
| Market research purposes | Identity, Contact | Consent |
| To administer our business | Identity, Contact | Necessary for our legitimate interests (including using details of fees paid to a participant to prepare our financial statements and audits) |
If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so.
Changes to this policy
If and when changes are made to this policy, participants will be provided with an up-to-date copy at the research event they take part in with Brandspeak.
Marketing communications
Your personal information will not be passed to any third-party organisation for marketing purposes.
Data security
Brandspeak has put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way. Access to your personal data is limited to members of the Brandspeak team, freelance advisers, business partners and suppliers who have a business need to know. They will only process your personal data on our instructions and are subject to a duty of confidentiality. We have procedures in place to deal with any suspected personal data breach, and we will notify you and the ICO where we are legally required to do so.
Sharing of personal data outside the United Kingdom
Some of our external suppliers are based outside the United Kingdom, so their processing of your personal data will involve a transfer of data outside the UK. Where we use providers based outside the UK, we require them to provide a similar level of protection for personal data as it has within the UK, for example through UK-approved International Data Transfer Agreements or by transferring only to countries assessed by the UK government as offering an adequate level of protection.
Who we disclose personal data to
Your personal data may be shared with third parties for the following purposes:
| Type of Recipient | Reason |
|---|---|
| Within Brandspeak | Depending on our Client’s requirements, it may be necessary to share your personal data with Brandspeak’s team of freelance market research specialists. |
| External market research agencies | Depending on our Client’s requirements, it may be necessary to share your personal data with market research agencies, so they can carry out research we have assigned to them. |
| Third-party contractors | Your data (in particular, the consent forms you sign when agreeing to take part in market research) is retained by our external auditors, to confirm participant expenses in our financial records. |
These companies are required to have appropriate security measures in place, to maintain the confidentiality of your personal data, and to use it only in the course of providing such services and in accordance with our instructions.
How long is your personal data retained?
Brandspeak retains your personal data for up to 1 year following completion of our contractual relationship with our Client. Our external auditors retain your consent forms for 7 years from the date of the audit to which they relate.
After the relevant retention period, if there is no ongoing need to hold your data for an active Client relationship, your personal data will be securely deleted.
Your legal rights
Under UK data protection law, you have the right to:
- request access to your personal data
- request correction of your personal data
- request erasure of your personal data
- object to our processing of your personal data
- request restriction of our processing of your personal data
- request transfer of your personal data (data portability), where this applies
- withdraw your consent at any time, where we are relying on consent as our lawful basis
Questions and complaints
If you have any questions or concerns about how we use your personal data, or wish to exercise any of your rights, please contact us at enquiries@brandspeak.co.uk, marked for the attention of our Data Protection Officer.
You do not need to use a special form or address to complain – we will treat any communication that expresses dissatisfaction with how we have handled your personal data as a complaint under this process, however it reaches us (for example by phone, email, post or social media). We will acknowledge it within 30 days, investigate it promptly, keep you updated on progress, and confirm the outcome to you without undue delay.
If you remain unhappy with our response, you have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk.