Privacy

WHO WE ARE

Bluegrass Research Limited is a market and social research consultancy. This means that we are commissioned by businesses and public bodies to obtain information which helps them understand people who might use, buy or benefit from their goods / services / activities.

We are registered in England and Wales as a company under number: 6428361. Our registered office address is: Generator Studios, Trafalgar Street, Newcastle upon Tyne, NE1 2LA.

We are registered Data Controllers [ICO registration number: Z1158782].

OUR DATA PROCESSING PRINCIPLES

We are committed to complying with the principles and safeguards set out in the General Data Protection Regulation (EU) 2016/679) (“GDPR”). As such, we have procedures in place to ensure that any personal data is:

• Processed lawfully, fairly and in a transparent manner
• Collected only for specified, explicit and legitimate purposes
• Adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed
• Accurate and where necessary kept up to date
• Not kept in a form which permits identification of data subjects for longer than is necessary for the purposes for which the data is processed
• Processed in a manner that ensures its security using appropriate technical and organisational measures to protect against unauthorised or unlawful processing and against accidental loss, destruction or damage
• Not transferred to another country without appropriate safeguards being in place
• Made available to individuals such us to allow them to exercise certain rights in relation to their personal data

We also work to the principles of the Market Research Society Code of Conduct.

If you have any questions about this policy, including any requests to exercise your legal rights, please contact the data privacy manager using the details below:

• Email address: info@bluegrassresearch.co.uk
• Postal address: Bluegrass Research, Design Works, William Street, Gateshead, NE10 0JP

If you are not happy with any aspect of how we collect and use your data, you have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would be grateful if you would contact us first if you do have a complaint so that we can try to resolve it for you.

TYPE AND PURPOSE OF DATA COLLECTION

The nature of the personal data we hold and how it is used varies by a person’s relationship with our business:

Research Participant

All information you share as a research participant is confidential and will only be used for the purpose of that specific research project, unless you have been asked and explicitly given permission for it to be used for another purpose.

Participation in a research project is completely voluntary and you have the right to end a research interview at any point, not to provide your name or contact details and to withdraw your details after the interview.

We may ask for a range of personal information as part of a research interview, primarily:

• Personal profiling information, such as age, gender and occupation
• Sensitive personal information such as ethnic origin or political views
• Personal opinions on topics linked to the topic under study

This is to obtain the information our client requires and also to ensure that we engage a cross-section of the population in our research.

We may ask for your name, address and contact details (such as telephone number or email address) at the end of an interview to enable us to:

• conduct quality control checks on the data we collect
• enter you into a prize draw [specific prize draw terms and conditions are always supplied] or provide an incentive
• provide further details connected to the research project [such as invite you to a focus group]

We have processes in place to anonymise (ie remove personal identifiers and hold separately to ensure data cannot be attributed) research data gathered as soon as possible. This means that we only work with aggregated data-sets, which do not directly or indirectly reveal the identity of research participants.

We do not disclose personally identifiable data or individual survey responses to the client that commissioned the project unless you request or consent to sharing your identifying information and individual responses.

We may employ other UK based companies and individuals to conduct quality control checks. They will have access to the personal information needed to perform this function, but will not use it for other purposes. They will also adhere to GDPR principles when processing the personal information.

Processing of prizes/incentives for a research project may result in your contact details being passed onto a voucher supplier e.g. Amazon etc. This would purely be in order for the prize/incentive to be sent out to you electronically / by post and would not result in any marketing or follow up.

Client

To deliver a contract on your behalf, we will store the following information about you and / or your company:

• name, job title, telephone number and email address
• company address, including financial contacts

Your contact information will be used to provide project specific correspondence and to manage our relationship with you.

Suppliers / Fieldworker

To enable you to supply goods or services to Bluegrass Research, we will store the following information about you and /or your company:

• name, job title, telephone number and email address
• company address
• bank account details

All contracts involving the supply of personal details (respondents, employees etc) will be subject to a Data Processing Agreement.

DATA SECURITY

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know such data. They will only process your personal data on our instructions and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

DATA RETENTION

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

YOUR LEGAL RIGHTS

Under certain circumstances, you have rights under data protection laws in relation to your Personal Data. These include the right to:

• Request access to your personal data
• Request correction of your personal data
• Request erasure of your personal data
• Object to Processing of your personal data
• Request restriction of processing your personal data
• Request transfer of your personal data
• Right to withdraw consent

You can see more about these rights at:

• https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/

If you wish to exercise any of the rights set out above, please email us at info@bluegrassresearch.co.uk

You will not have to pay a fee to access your Personal Data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made several requests. In this case, we will notify you and keep you updated.

UPDATES TO THIS POLICY

This policy was last updated April 2021. We reserve the right, at our discretion, to modify our privacy practices and update and make changes to this Privacy Policy at any time. If we make any changes, we will update our policy on this website.