Research Respondent Privacy Notice

Basis Research Limited, and its affiliates, (together “Basis”) are committed to protecting your personal information and being open about how and why we use it. This notice explains why we collect personal data, how we use it, who we share it with, how long we keep it, and your rights under the UK GDPR and the Data Protection Act 2018 (DPA 2018).

This notice applies when you take part in research carried out by Basis on behalf of our clients.

Who is responsible for your personal information

For most research projects:

• Our client is the data controller. They decide why and how your personal data is collected and used.
• Basis is the data processor. We carry out the research on the client’s instructions.

You will receive the controller and processor details as part of the information provided when you decide whether to take part.

Data protection officer contact (if applicable):
DPO@Basisresearch.co.uk

Some projects may involve more than one data controller. If so, the project-specific notice will explain these roles and responsibilities.

What personal data we collect

We may collect:

• contact details (name, email, phone number)
• demographic details (age, gender, region)
• your views, comments and responses in interviews, groups, workshops or surveys
• audio or video recordings (where relevant and where you have been informed)
• data provided by trusted suppliers such as panel providers, recruiters or survey hosts

If we need to collect special category personal data (for example health, ethnicity, sexual orientation, gender identity, religious beliefs or past criminal conviction information), we will explain this clearly in the project-specific notice.

Where we get your personal data

We may obtain data:

• directly from you, and
• indirectly from trusted third-party suppliers such as panel providers or recruitment partners who have obtained consent or another lawful Basis to share your details.

Where data is received from third parties, we will tell you the categories of data provided, the source, and whether it came from publicly available sources.

Why we use your personal information and our lawful Basis

We use your personal information to carry out research on behalf of our clients. This may include testing new product ideas, understanding consumer behaviour, measuring brand awareness and similar research activities.

Our lawful bases may include:

• Consent – for participation in research activities and, where required, for processing special category data
• Legitimate interests of our client – to understand opinions, behaviours and experiences
• Public task – where the client is a public authority commissioning research

For special category personal data, we may rely on:

• Your explicit consent, or
• Research conditions under Article 9(2)(j) and Schedule 1 DPA 2018, with safeguards in place

The project-specific notice will confirm which lawful bases apply.

We do not use your personal data to make decisions about you as an individual.

Who we share your personal information with

We may share your personal data with:

• employees of Basis who are conducting the research
• clients commissioning the research (usually in anonymised form unless you have agreed otherwise)
• trusted suppliers supporting fieldwork and analysis, such as:
  • panel providers
  • recruitment agencies
  • survey platforms
  • transcription services
  • viewing facility hosts

We only share what is necessary, and all third parties must follow data protection law and protect your information.

International transfers

If personal data is transferred outside the UK, we will ensure appropriate safeguards are in place, such as:

• a UK adequacy regulation
• the UK International Data Transfer Agreement (IDTA)
• the UK Addendum to the EU Standard Contractual Clauses

Project-specific information will confirm whether international transfers occur.

---

How long we keep your personal information

We keep identifiable personal data only for as long as needed to complete the research.

Typical retention periods include:

• identifiable data during fieldwork – up to [insert period] after the project ends
• audio or video recordings – kept for [insert period] if they cannot be anonymised
• anonymised data – may be kept longer as it no longer identifies you

Project-specific notices will explain any variations.

How we protect your personal information

To comply with the UK GDPR and DPA 2018, we have:

• policies and procedures guiding safe handling of data
• mandatory staff training
• technical and organisational security measures
• contracts with suppliers requiring appropriate safeguards

We also comply with the DPA 2018 research safeguards to ensure research does not cause damage or distress and is not used to make decisions about individuals.

Your rights

Depending on the project, you may have the right to:

• access your personal data
• correct inaccurate information
• erase your data
• object to or restrict processing
• move your data (portability)
• withdraw consent at any time (where consent is the lawful Basis)

Some rights may be limited where applying them would seriously impair research outcomes or where data has already been anonymised. If a right cannot be met, we will explain why within one month.

You can complain to the Information Commissioner’s Office (ICO):

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
ico.org.uk

Contact us

If you have questions or want to exercise your rights, please contact:

Name: Data Protection Officer
Email: DPO@Basisresearch.co.uk
Address: Basis Research Limited, Hanway House , 24 Hanway Street, London W1T 1UH