Market Research Data Protection

Market Research Data Protection & Data Security

Our Market Research Surveys are conducted under Professional Codes Of Conduct

Jonathan Cook, Director of Insight-ful NFP Ltd (The Company) is a member of the Chartered Institute of Fundraising. We strictly observe the Professional Codes of Conduct of the Chartered Institute of Fundraising and the Fundraising Regulator.

We are registered with the Information Commissioner – ZA152716.

Our company insurance covers with Markel International Insurance Company Limited includes PLI (Public & Liability Insurance £1m) and Professional Liability/Indemnity Cover (£1,000,000).

Core Principles of our Professional Codes of Conduct

We must obtain informed consent from Market Research respondents, willingly given, to collect and use their data, ensuring they clearly understand why we’re collecting the data and how it will be used.
We must observe the rights of respondents, including confidentiality, anonymity, and the right to withdraw at any stage.
We must keep Market Research separate from any form of promotion. We must never use Market Research as a vehicle for disguised promotion.
We must forward any adverse events raised during a study to fulfil our responsibility to e.g. drug safety – without compromising respondents’ rights to anonymity and confidentiality.

Additional Principles of our Professional Codes of Conduct:

We must behave ethically.
We must ensure data collection is adequate, relevant and not excessive.
We must treat respondents with respect.
We must make sure respondents are never harmed or disadvantaged in any way.
We must ensure that data is processed fairly and legitimately – and only used for the specific, original purpose.
We must not process data unlawfully or without permission, or allow anyone else to do so.
We must also take reasonable steps to prevent personal data being accidentally lost, destroyed or damaged.
We must only transfer data once it has been adequately protected.
We mustn’t keep data longer than needed to fulfill the purpose of any study.
We mustn’t undermine or damage the reputation of Market Research.
We must conduct our Market Research accurately, transparently and objectively.

Data Protection & Data Security Policy (Sept 2020)

Introduction

The UK General Data Protection Regulation (UKGDPR) is UK legislation that replaces the European wide UKGDPR data protection legislation that requires organisations working with individuals based in the European Economic Area to meet certain requirements regarding the collection, processing, security and destruction of personal information.

As we undertake research that collects or evaluates personal information about a living person who can be identified from the information they have provided we aim to ensure compliance with the UK General Data Protection Regulation.

Purpose

This policy sets out how Insight-ful NFP Ltd and its supplier partners/Associates will seek to ensure compliance with the legislation.

Application

This policy applies to Insight-ful NFP Ltd’s dealings with respondents, clients and third parties that may be involved in processing personal information. It covers the way personal information will be obtained, used, shared, physically stored and destroyed.

UK General Data Protection Regulation (UKGDPR)

The UK General Data Protection Regulation (UKGDPR) governs the processing (i.e. obtaining, holding, organising, recording, retrieval, use, disclosure, transmission, combination and destruction) of personal and sensitive data (i.e. information relating to a living individual – the data subject) and sets out the rights of individuals whose information is processed in manual or electronic form or held in a structured filing system. There are six principles that describe the legal obligations of organisations that handle personal information about individuals. These Principles are:

1: Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the individual.

The information we gather about an individual will be collected in a way where they are fully informed how we intend to use that information, for what purposes and how we will share it.

2:Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes.

We will explain why we need the information we are collecting and not use it other than for those purposes.

3: Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

We will only collect the information we need to provide the services required.

4: Personal data shall be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay.

The information we collect will be accurate and where necessary kept up to date. Inaccurate information will be removed or rectified as we become aware of the changes.

5: Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the UKGDPR in order to safeguard the rights and freedoms of individuals.

We will not hold information for longer than is necessary.

6: Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

We will make sure that the personal information we hold is held securely to ensure that it does not become inadvertently available to other organisations or individuals.

Insight-ful NFP Ltd fully supports these principles.

Rights of Individuals

The UK General Data Protection Regulation creates specific rights of individuals. These include:

The right to be informed
The right of access
The right to rectification
The right to erasure
The right to restrict processing
The right to data portability
The right to object
Rights in relation to automated decision making and profiling.

Handling personal information, lawfully, fairly and transparently

The first and second principles require Insight-ful NFP Ltd to acquire and process personal information lawfully, fairly and in a transparent way. Insight-ful NFP Ltd therefore is clear at the outset about the purpose for which information is obtained and processed. Insight-ful NFP Ltd aims to ensure that:

respondents and potential respondents are aware of the purpose or purposes for which the information is to be used and they have a choice as to whether to provide the information;
a respondent is able to ask for confirmation of the source of their personal information;
personal information is not used in ways that would have adverse effects on individuals;
respondents are provided with easy to read and understand privacy notices when information is collected;
personal information will only be handled in ways that individuals would reasonably expect;
the third-party providers we work with to provide potential respondents must comply with the requirements of the UK General Data Protection Regulation as well;
marketing undertaken by us will be undertaken in a manner that complies with the UK General Data Protection Regulation;
we seek to uphold the individual’s rights with regard to their personal information.

Appropriate records will be maintained to demonstrate compliance with the above-mentioned requirements.

Consent for respondents

Consent will be required for certain types of information usage.

When consent is required, it must be freely given, specific, informed and unambiguous. Requests for consent will be separate from other terms, and be in clear and plain language. The individuals consent will be “explicit” where it relates to sensitive data. Insight-ful NFP Ltd is required to be able to demonstrate that consent was given. We therefore maintain records of clients consent to meet the accountability requirements for both the profession and the requirements of the UK General Data Protection Regulation.

Consent for Marketing and Prospecting Purposes

Under the Privacy and Electronic Communication Regulations (PECR) there are specific requirements relating to unsolicited direct marketing communications. A solicited communication is one that is actively invited, either directly by the customer or via a third party. An unsolicited communication is one that the customer has not invited but they have indicated that they do not, for the time being, object to receiving it. If challenged, businesses would need to demonstrate that an individual has positively opted in to receiving further information from us.

Insight-ful NFP Ltd understands that it is unlawful to contact customers or organisations that have informed us that they do not wish to receive unsolicited marketing material. Therefore, Insight-ful NFP Ltd are aware of and comply with the following:

Market Research C.A.T.I Centre calls – Insight-ful NFP Ltd ensure that individuals and organisations they wish to contact are not registered on the Telephone Preference Service (TPS) or the Corporate Telephone Preference Service (CTPS) respectively. If they are registered or have directly notified Insight-ful NFP Ltd or one of our MRS Company Partners, supplier partners, Associates not to call, then unsolicited direct market research calls will not be made to them.

Emails and text message – Insight-ful NFP Ltd will not contact individuals by email or via text message without obtaining prior consent unless the individual’s details have been obtained in the course of previous contact, in-bound and out-bound. Individuals will be given the opportunity to opt out of receiving further marketing emails or texts each time that such contact is made.

The Mailing Preference Service (MPS) is managed by the Direct Marketing Association and supported by Royal Mail to enable individuals to register their names and addresses to limit the amount of direct mail they receive. Unsolicited marketing material will not be sent by post to individuals that have informed Insight-ful NFP Ltd they do not wish to receive such information or they have registered with the MPS.

Insight-ful NFP Ltd will maintain internal logs of individuals and organisations that have indicated that they do not wish to receive unsolicited marketing information from May 2018 and conduct checks against the TPS, CTPS, FPS, eMPS and MPS databases as appropriate.

When data is purchased from third parties for market research or prospecting purposes, Insight-ful NFP Ltd ensures that the data has been acquired by the third party through fair and lawful means, the data can be used for the purposes of unsolicited marketing activities and that the data has been cross-checked by the third party against the appropriate preference service databases.

Fair treatment

Fairness generally requires us to be transparent, i.e. clear at outset and open with individuals about why the information is being collected and how it will be used. Assessing whether information is being processed fairly depends partly on how it is obtained. In particular, if anyone is deceived or misled when the information is obtained, then this is unlikely to be fair.

Insight-ful NFP Ltd aim to ensure that, in all cases, consent and privacy statements will:

be clear, fair and not misleading;
explain the consequences of providing the required information;
explain how long the information will be kept for;
explain if the replies to questions are mandatory or voluntary;
explain if the information is to be anonymised and how;
explain if the information will be transferred overseas;
explain that if the information will be shared, who with and how they will use it;
explain how individuals may be contacted e.g. telephone, email, SMS, post;
explain the individual’s rights – e.g. they can obtain a copy of their personal information;
explain who to contact if they wish to know more information about how their information is held or to opt-out of receiving further information or if they need to complain; and
explain the individuals’ right to complain to the Information Commissioner’s Office.

Insight-ful NFP Ltd is responsible for ensuring that the following details are communicated to respondents:

the identity of the business or if appropriate, its nominated representative;
the purpose(s) for which we intend to process the respondent’s personal information and if the information is to be shared or disclosed to other organisations. (so that the individual concerned can choose whether or not to enter into a relationship with the company sharing it);
the process for anonymising the information prior to it being shared with the commissioning organisation and
how customers can access the information held about them (as this may help them to spot inaccuracies or omissions in their records – see section below on Rights of Data Subjects).

Minimum amount of personal data

Under the principles of UKGDPR, and our Professional Trade Association Codes of Conduct, Insight-ful NFP Ltd identify the minimum amount of personal data we need to properly fulfil our purpose. We ensure that we hold that much information, but nothing further. If we need to hold particular information about certain individuals, we only collect the information for those individuals and nothing more. Insight-ful NFP Ltd does not hold personal data on the off-chance that it might be useful in the future. Typically we also work with end clients and partner suppliers to protect individual level data by allocating unique survey links and exchange when necessary is under encrypted FTP transmission, private storage spaces, and password protected files.

Accurate and kept up-to-date

Insight-ful NFP Ltd will:

take reasonable steps to ensure the accuracy of any personal information they obtain;
ensure that the source of any personal information is clear;
Establish if the individual has challenged the accuracy of the information, this is evaluated and recorded carefully; and
consider whether it is necessary to update the information, particularly if the purpose relies on the information being current.

Requests for information from law enforcement agencies

The UK General Data Protection Regulation includes exemptions, which allow personal information to be disclosed to law enforcement agencies without the consent of the individual who is the subject of the information, and regardless of the purpose for which the information was originally gathered. Insight-ful NFP Ltd will release personal information to law enforcement agencies if required to do so.

Data security

Insight-ful NFP Ltd has appropriate security measures to prevent personal information held being accidentally or deliberately compromised. In particular, Insight-ful NFP Ltd:

have designed and organised security to fit the nature of the personal information held and the harm that may result from a security breach;
are clear about everyone’s responsibility for ensuring information security;
make sure that the correct physical and technical security is in place, backed up by robust processes and procedures and reliable, well-trained staff; and
are ready to respond to any breach of security swiftly and effectively.

Insight-ful NFP Ltd recognise that information security breaches may cause real harm and distress to the individuals if their personal information is lost or abused (this is sometimes linked to identity fraud).

Outsourcing

Insight-ful NFP Ltd have procedures in place if we use third parties to process information to ensure that we:

only choose a data processor that provides sufficient guarantees about its security measures to protect the information and the processing it will carry out;
take reasonable steps to check that those security measures are working effectively in practice; and
put in place a written contract setting out what the data processor is allowed to do with the personal information or business information.
Notify any data controllers with whom we are working, who the proposed data processor will be.

Insight-ful NFP Ltd requires third parties that it works with to ensure that there are adequate security measures in place to secure the information that is being held.

Restrictions on transferring information to non EEA countries

There are no restrictions on moving personal information within EEA countries. We are open and transparent with our clients and potential clients about where their information is processed and accessed.

Insight-ful NFP Ltd considers the following factors when deciding whether or not to transfer information overseas:

the nature of the personal information being transferred;
how the information will be used and for how long; and
the laws and practices of the country where information is being transferred to.

We also consider additional factors such as:

the extent to which the country has adopted data protection standards in its law;
whether there is a way to make sure the standards are achieved in practice; and
whether there is an effective procedure for individuals to enforce their rights or get compensation if things go wrong.

Data loss

If personal information is accidentally lost, altered or destroyed, attempts to recover it will be made promptly to prevent any damage or distress to the individuals concerned. In this regard Insight-ful NFP Ltd consider the following:

containment and recovery – the response to the incident includes a recovery plan and, where necessary, procedures for damage limitation.
assessing the risks – assess any risks and adverse consequences associated with the breach, as these are likely to affect how the breach needs to be contained.
notification of breaches – informing the Information Commissioner’s Office or other relevant Supervising Authority as necessary (within 72 hours), law enforcement agencies, data controllers on whose behalf we are working and individuals (whose personal information is affected) about the security breach is an important part of managing the incident.
evaluation and response – it is important to investigate the causes of the breach, as well as, the effectiveness of controls to prevent future occurrence of similar incidents.
Additionally, Insight-ful NFP Ltd would also look to ensure that any weaknesses highlighted by the information breach are rectified as soon as possible to prevent a recurrence of the incident.

Data retention

To comply with information retention best practice, Insight-ful NFP Ltd establish standard retention periods for different categories of information, keeping in mind any professional rules or regulatory requirements that apply and ensuring that those retention periods are being applied in practice. Any personal information that is no longer required will either be archived or deleted in a secure manner.

Insight-ful NFP Ltd’s retention periods for different categories of personal information are based on individual business needs and contractual obligations.

Insight-ful NFP Ltd understands the difference between permanently deleting a record and archiving it. If a record is archived or stored offline, it will reduce its availability and the risk of misuse or mistake. If it is appropriate to delete a record from a live system, Insight-ful NFP Ltd will also delete the record from any back-up of the information on that system, unless there are business reasons to retain back-ups or compensating controls in place.

Destruction of Electronic Records

All electronic files are destroyed by deletion and then the use of an electronic file shredder. This ensures that all electronic information is deleted permanently and cannot be recovered.

Secure disposal of records and computer equipment

Once the retention period expires or, if appropriate, the customer or business information is no longer required; paper records are disposed of in a secure manner. All paper records containing customer or business information are disposed of by a confidential shredding service. This includes all archived records.

All used computers, printers and any other electronic equipment that may contain or that will have stored customer or corporate information in electronic format must be disposed of in an appropriate manner after the information has been completely wiped off. An external provider will be used to ensure that the memory on the devices is completely clean of information before the item is disposed of.

Training

Insight-ful NFP Ltd takes its responsibilities with regards to ensuring training is undertaken seriously. We know that having policies and procedures in place provides a solid base for our training program and we aim to undertake training in accordance with the role and seek specialist advice as and when required. All training is documented and reviewed regularly.

Data Protection Officer

Insight-ful NFP Ltd does not at this time meet the requirements for a dedicated Data Protection Officer but this is kept under review as the type of work and range of clients/respondent’s changes. We are committed to meeting the needs of the UK General Data Protection Regulation and if our business requires a DPO, we will seek to appoint one.

Review

This policy will be reviewed periodically considering changing business priorities and practices and to consider any changes in legislation
Date of this policy update: 01.03.2023 (Annual Renewal date).