Data Protection Policy for Participants
Participants of Market Research Commissioned by Brandspeak Limited – Version dated 25 August 2026 (replaces the version dated 25 May 2018)
Participants of Market Research Commissioned by Brandspeak Limited. Version dated 10 November 2026 (replaces the version dated 25 August 2026).
Brandspeak Limited, registered office 701 Stonehouse Park, Sperry Way, Stonehouse, GL10 3UT, company number 10107500.
Brandspeak Limited is referred to in this document as “Brandspeak”, “we” and “us”. This Data Protection Policy explains how we process your personal data in accordance with UK data protection law (the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025) and, where applicable, the EU General Data Protection Regulation. We are a member of the Market Research Society (MRS) and carry out research in line with the MRS Code of Conduct.
Who this policy covers
Brandspeak distinguishes between:
a) clients that engage its services to carry out market research and branding services (its “Clients”) and other third-party contractors that Brandspeak engages; and
b) individual participants that Brandspeak or its third-party agents source and interview on behalf of a Client, as part of the qualitative or quantitative market research projects Brandspeak undertakes (“Participants”).
This policy is for Participants. Please see our Data Protection Policy for Clients for Clients and third-party contractors.
How research participation works
You may take part in our research in one of three ways:
Recruited by Brandspeak or a recruitment agency for interviews, group discussions or other qualitative research. In this case Brandspeak is the controller of your personal data.
Invited through an online research panel for a survey. The panel company already holds your details and is responsible for them under its own privacy notice, which you agreed to when you joined the panel. Brandspeak is the controller of the survey data it receives.
Invited from our Client’s own customer or contact records. Our Client shares your contact details with us, or with our recruiter, so that we can invite you to take part. In this case our Client is the controller of your personal data and Brandspeak acts as its processor: we use your details only on our Client’s instructions, to invite you and to run the research, and our Client is responsible for telling you how it uses your data.
Our Clients receive anonymised, aggregated results, which do not identify you. We do not pass your name, contact details, recordings or other information that identifies you to our Client unless you have agreed to this in advance. For example, you may agree to a Client observing a session, to video clips being shared, or, in qualitative research, to your comments, quotes or feedback being attributed to you in what we report to our Client.
The personal data we collect about you
Personal data collected, used, stored and transferred by us may include:
Identity Data, including forename(s) and last name
Contact Data, including personal address, email address and telephone number(s)
Research Data, including your answers, opinions and comments, and demographic details such as age, gender, region and household make-up
Recordings, including audio and video recordings of interviews and group discussions, transcripts, and photographs or other images you share with us
Technical Data, such as the device and browser used to complete an online survey, collected to check that responses are genuine
Incentive Data, including the details needed to pay you a thank-you payment and the record that it was paid
Some research asks about health, ethnicity, religion or other sensitive matters, or about products from which these could be inferred (for example health supplements). This is “special category” data. We, or the panel or recruiter acting for us, will only collect it with your explicit consent, asked for separately before any such questions. You do not have to answer them.
How do we collect your personal data?
Personal data is collected by us directly when you communicate with a member of the Brandspeak team in person, by phone, by email or through an online research platform. It is also collected through our third-party market research (recruitment) agents and online research panels, when you communicate with them or complete a survey. Where you are invited from our Client’s own records, we receive your contact details from our Client.
How do we use your personal data?
We use your personal data in the following circumstances, relying on the following lawful basis for processing:
| Purpose/Activity | Type of Data | Lawful Basis of Processing |
|---|---|---|
| Market research purposes | Identity, Contact, Research, Recordings, Technical | Consent (explicit consent for special category data) |
| To pay incentives and keep financial records | Identity, Contact, Incentive | Necessary to comply with a legal obligation (accounting and tax records) |
| To administer our business | Identity, Contact | Necessary for our legitimate interests (including preparing our financial statements and audits) |
If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so.
Withdrawing your consent
You can withdraw your consent at any time by contacting us at the address below, or by telling the interviewer or moderator during a session. We will stop processing personal data that we process on the basis of your consent and, where applicable, securely delete it. We may retain information where we have a separate lawful basis to do so, for example where we are required to keep financial records by law. Once your responses have been irreversibly anonymised and can no longer be linked to you, it will not be possible to identify or remove your contribution from the research results.
Participants under 18
We rarely involve people under 18. Where we do, it is only with the consent of a parent or guardian, and in a way that suits the young person’s age and understanding, in line with the MRS Code of Conduct.
Changes to this policy
We keep this policy under regular review. The current version, with its date, is always available on our website, and participants will be provided with an up-to-date copy at the research event they take part in with Brandspeak.
Marketing communications
Your personal information will not be passed to any third-party organisation for marketing purposes, and we will not use your taking part in research to sell to you.
Data security
Brandspeak has put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way. Access to your personal data is limited to members of the Brandspeak team, freelance advisers, business partners and suppliers who have a business need to know. They will only process your personal data on our instructions and are subject to a duty of confidentiality. We have procedures in place to deal with any suspected personal data breach, and we will notify you and the ICO where we are legally required to do so.
Sharing of personal data outside the United Kingdom
Some of our external suppliers are based outside the United Kingdom, so their processing of your personal data will involve a transfer of data outside the UK. Where we use providers based outside the UK, we require them to provide a similar level of protection for personal data as it would have within the UK, for example through UK-approved International Data Transfer Agreements or by transferring only to countries assessed by the UK government as offering an adequate level of protection.
This includes Anthropic, the provider of the AI tool we use, which stores data in the United States and may process it in the US, Europe, Asia and Australia. These transfers are protected by the safeguards in our data processing agreement with Anthropic.
You can contact us using the details below if you would like further information about the countries to which your data may be transferred or the safeguards we use.
Who we disclose personal data to
Your personal data may be shared with third parties for the following purposes:
| Type of Recipient | Reason |
|---|---|
| Within Brandspeak | Depending on our Client’s requirements, it may be necessary to share your personal data with Brandspeak’s team of freelance market research specialists. |
| External market research agencies | Depending on our Client’s requirements, it may be necessary to share your personal data with market research agencies, so they can carry out research we have assigned to them. |
| Research service providers | Survey platforms, fieldwork and data processing suppliers, transcription services, viewing facilities and video conferencing providers, so they can provide services we use to run the research. |
| Incentive providers | To pay your thank-you payment. |
| Our Client | Only with your prior agreement, for example if you agree to a Client observing a session, to clips of a recording being shared with them, or to your comments, quotes or feedback being attributed to you. |
| Third-party contractors | Your data (in particular, the consent forms you sign when agreeing to take part in market research) is retained by our external auditors, to confirm participant expenses in our financial records. |
| AI technology providers | We use Claude, an AI tool provided by Anthropic, to help with tasks such as transcription, analysis and report writing. Anthropic processes this data on our behalf under a data processing agreement, only on our instructions, and does not use it to train its AI models. |
These companies are required to have appropriate security measures in place, to maintain the confidentiality of your personal data, and to use it only in the course of providing such services and in accordance with our instructions.
How long is your personal data retained?
Brandspeak retains your personal data for up to 1 year following completion of our contractual relationship with our Client. Recordings and transcripts are kept for up to 12 months from completion of the project. Our external auditors retain your consent forms for up to 7 years from the date of the audit to which they relate. Anonymised results, which do not identify you, may be kept for longer. We delete data from the AI tools we use when it is no longer needed for the research, in line with the retention periods above.
After the relevant retention period, if there is no ongoing need to hold your data for an active Client relationship, your personal data will be securely deleted.
Your legal rights
Under UK data protection law, you have the right to:
request access to your personal data
request correction of your personal data
request erasure of your personal data
object to our processing of your personal data
request restriction of our processing of your personal data
request transfer of your personal data (data portability), where this applies
withdraw your consent at any time, where we are relying on consent as our lawful basis
We will respond to a request within one month, or tell you within that month if we need longer because the request is complex. If your request concerns data held by an online panel, we will pass it to the panel company or tell you how to contact it. Where we are acting as our Client’s processor, we will pass your request to our Client.
Questions and complaints
If you have any questions or concerns about how we use your personal data, or wish to exercise any of your rights, please contact us at enquiries@brandspeak.co.uk, marked for the attention of our Data Protection Officer.
You do not need to use a special form or address to complain: we will treat any communication that expresses dissatisfaction with how we have handled your personal data as a complaint under this process, however it reaches us (for example by phone, email, post or social media). We will acknowledge it within 30 days, investigate it promptly, keep you updated on progress, and confirm the outcome to you without undue delay.
If you remain unhappy with our response, you have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk.