Privacy Policy

The overriding principles are that the gathering, processing and storing of data has a legal basis and that it is fair. Part of the process of making it fair is to be open and honest about the data we collect. The nature of our work means that it is difficult to keep a document transparent whilst also covering every eventuality, so we have tried to balance these in this document. However, if at any time you are concerned or wish to know more about how we collect, process and store data then you can contact us via our website and we will do our best to help.

In all cases our policy is that any data we gather will be:

• used lawfully;
• collected only for valid purposes that are clearly explained;
• relevant to the purposes we have told you about and limited only to those purposes;
• accurate and kept up to date;
• kept only as long as necessary for the purposes we have told you about; and
• kept securely.

Before gathering, processing and storing any information, we have an internal test where all those gathering data, whether on staff or from a third party that we contract, can clearly articulate why we need to gather that personal data and what our legal basis for doing so is. We also determine in advance the length of time for which we will need to retain that data.

At the outset, prior to collecting data, we also consider any risks posed to the individual, for us and our clients and balance the need to gather data against risks. Our researchers are all highly experienced and trained in research ethics.

Once we have determined that we do need to gather, process and store personal data, then we will always be clear about:

• who we are and how we can be contacted (in using Our Site we work on the basis that this is already clear, in all other instances we will clearly identify ourselves and what we do in advance);
• who we are collecting the data for;
• who else we may share the data with (if anyone); and
• what data we are collecting (including whether it is anonymous) and how we will do it.

Sometimes we will be gathering data for ourselves, sometimes we will have been commissioned to gather it for a third party. On occasions where we gather data for a third party we will determine with the third party in advance whether they require access to ‘raw data’ sets – often, the third party will only require ‘aggregate data’, in which case they cannot access any personal data. In other instances, the client will require access to the raw data set and in these instances we are a data processor and they are a data controller. In any instances where we are collecting data for a third party to use we will make this clear.

Where a third party is a data controller and we are the data processor we will satisfy ourselves in advance that their privacy policy is acceptable and, where necessary, we may also draw attention of data subjects to the privacy policies of those third parties.