Participant Privacy Policy
This policy details how we collect, store, and process your personal data when you sign up with PFR, apply for paid research, or engage in any other interaction that involves sharing your personal data with us.
1. Introduction
1.1 People for Research Ltd., a company based in the UK, is registered with the Information Commissioner’s Office (ICO), the organisation that regulates data protection in the UK. View our proof of ICO registration.
1.2 People for Research works in a fully compliant manner, in line with the current data protection legislation. Find out more about the Data Protection Act 2018 and the GDPR.
1.3 Our main goal is to keep your data safe while working to get you involved in paid research. We'll never sell your personal data to a third party and will only share it with a client running paid research after you have specifically given consent.
2. Legal grounds, nature and purpose of the processing
2.1 We process your personal data based on your informed consent. This means that, when you decide to sign up to our database and apply to our studies, you're doing so because you've read this data privacy policy and consent to People for Research collecting, recording, organising, storing and generally using your data for the purpose of getting you involved in paid research studies.
2.2 If you're recruited for one of our paid research studies, the nature of the processing may also include disclosing some of your data to our clients during the recruitment process. For example, a client may need your email address so they can send you a link to the prototype you're testing. If this is required, we'll ask you to further confirm your consent specifically for this purpose during screening telephone calls.
3. Personal data and special category data
3.1 Personal data is any information that relates to an identified or identifiable individual.
3.2 Some types of data are considered special under the GDPR. The current legislation singles out certain types of personal data as likely to be more sensitive and gives them extra protection. This includes personal data concerning:
- Racial or ethnic origin;
- Political opinions;
- Religious or philosophical beliefs;
- Trade union membership;
- A person’s sex life;
- A person’s sexual orientation;
- Genetics;
- Biometrics (where used for identification purposes);
- Health.
3.3 We may ask you to share special category data at different stages, from signing up to our database to applying to paid research studies.
3.4 During the sign-up process, for example, we'll ask you to confirm your ethnicity and whether you live with accessibility needs, impairments or long-term conditions. By completing the sign-up form and joining our community, you're providing PFR with explicit and informed consent to collect, process, store and use this special category data.
3.5 The same applies to our online questionnaires, which we use to determine if you are suitable to take part in our studies. These questionnaires may include questions about special data. By completing and submitting these questionnaires, you're providing PFR with explicit and informed consent to collect, process, store and use this special data.
4. Sharing your data during the sign-up process
4.1 When you share your personal data during the sign-up process, you're sharing it directly and exclusively with People for Research (PFR).
4.2 PFR is the sole controller of the information shared during the sign-up process. This means no third parties, including our clients who run the paid research projects, have access to or control over this information.
5. Sharing your data during the application process
5.1 When you complete one of our questionnaires, we ask you to share information about yourself that goes beyond what we capture during the sign-up process or in the ‘My account’ area.
5.2 When you apply to take part in research or submit a questionnaire, we collect limited technical information about your device and connection, including your IP address, browser type, device type, and approximate location.
An IP address is a unique number assigned to your internet connection and can be used to distinguish users accessing our platform.
We use this information to:
- Prevent duplicate applications
- Detect and prevent fraudulent activity
- Ensure fair and reliable research recruitment
This processing is based on our legitimate interests in protecting our platform and maintaining the integrity of our research recruitment process.
5.3 If you're eligible to take part in one of our studies, we may go through a telephone screening with you - if you're applying to take part in qualitative research (e.g. a one-to-one session with a researcher). If you're applying to take part in quantitative research (e.g. a survey or an online task you can do by yourself), we don’t usually collect any extra data over the phone.
If the client running the research requests access to any of your personal data, we'll collect your informed consent during the application process and ask you to confirm you are happy for the client to receive specific data provided during the application and screening stages. We may request your consent in writing or verbally, over the phone. Additionally, the client may ask you to sign a consent form.
5.4 If you apply to take part in research by completing our questionnaires or surveys, you agree to be contacted by PFR.
5.5 If you confirm your consent during the screening stage and we pass some of your data to the client, both the client and People for Research will process this data as independent controllers, which means the client must also work in a GDPR compliant manner and follow the law when it comes to your personal data.
5.6 As part of our terms and conditions, our clients must always agree not to use any of your data to involve you in future research or studies without PFR’s involvement and/or get you involved in marketing-related activities or similar.
6. Sharing your data during a paid research study
6.1 The client is the sole controller of any data collected during a paid research study or task that you may have been recruited for. This means People for Research has no involvement in this part of the process. At this stage of the process, you enter into a personal agreement with the client.
6.2 If you're asked to sign a consent form before taking part in paid research, the client will use this document to detail how they will process, store and use your data. This also means you have the right to request the permanent destruction of your data at any point after the study ends. The client’s consent form should indicate how to contact them to request the destruction of your data. So, please ensure you make a note of this on signing - or keep a copy of the document.
6.3 If you're not asked to sign a consent form, you can get in touch with PFR and ask us how to request the deletion of data shared with a client during a paid research study.
6.4 The client is unlikely to ask you to share any contact details during the session, unless originally agreed with PFR (which we will make you aware of). They should not ask you to create accounts, purchase any products, or similar, using your real data.
6.5 If a client requests information that you don’t feel comfortable sharing during a paid research session, please make them and People for Research aware of this.
7. Technical Data and Website Usage
7.1 By using our website, you consent to our use of cookies in accordance with the terms of our Cookie Policy.
7.2 When you visit our website, we may collect, store and use information about your computer and use of our website, including your IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views and website navigation paths. This data is collected via Google Analytics and is anonymised to help us understand website performance.
7.3 When you use our platform to apply for research opportunities, we collect certain device and connection information (including your IP address and approximate location). This information is used to maintain platform security, prevent fraud and duplicate applications, and ensure fair and reliable research recruitment, as described in Section 5.2. We retain this information only for as long as necessary to carry out these checks, after which it is securely deleted or anonymised. We do not retain this data for longer-term profile management or marketing purposes
7.4 We use the Meta, LinkedIn, TikTok and Reddit Pixels on our website. These pixels allow us to track user behaviour after users have been redirected to our website by clicking on an advertisement from Facebook, Instagram, LinkedIn, TikTok or Reddit. This helps us increase the relevance of our social media advertising and measure its impact for statistical and market research purposes.
The data collected in this manner is anonymous to us, meaning we don't see individual users' personal data. However, this data is stored and processed by the third-party platform in question (e.g. Meta). The third-party platform in question may link this information to your Facebook / Instagram / LinkedIn (etc.) account and use it for their own promotional purposes, in accordance with the third-party platform’s Data Usage Policy.
Anonymised information collected through these technologies may include:
- IP address
- Device and browser type
- Operating system
- PFR website pages visited and time spent
- Links clicked
- Conversion events (e.g., signing up to our database or applying for a study)
We only enable tracking pixels, including advertising and analytics pixels, after receiving your explicit consent via our cookie banner.
You can opt out of interest-based advertising by visiting the Network Advertising Initiative Opt-Out Page or by adjusting your browser settings to block pixels and cookies. Note that disabling these technologies may limit functionality on our website.
8. How we store your data
8.1 We store your data across both our internal systems, like our own database, and external systems, such as Airtable or SharePoint.
8.2 All the systems or platforms we use to store and process personal data are encrypted both in transit and at rest.
8.3 Before we onboard any external platforms, we ensure they are fully compliant with the GDPR. We always implement a Data Protection Agreement with these organisations to ensure both People for Research and your personal data are fully protected.
9. How long we keep your data for
9.1 If you sign up to our database, we'll keep your data for as long as your account remains active. Your account is considered active if you apply to take part in paid research at least once a year.
9.2 If you don't apply to take part in research for a period of one year, your account will be marked as inactive. This means you will no longer receive marketing emails from us, but your account remains open, and you can still log in and apply to research opportunities as normal.
9.3 If your account remains inactive for another year (two years total), your account will be marked as obsolete and closed. To have your account reinstated, you'll need to contact our support team at support@peopleforresearch.co.uk.
9.4 We keep your closed account on our system for a further three years. After this period, we permanently delete your personal data from our systems.
9.5 We keep personal data related to your applications to paid research in compliant external systems such as SharePoint for five years and permanently delete it once this period has ended, even if your account remains active on our database. This does not affect the application data we keep in our internal database, which remains saved in the system as per the timeframes detailed in points 9.1 to 9.4 or until you request the deletion of your account.
9.6 When we delete your data, we permanently remove it from the system accessed by our team. If you've taken part in any paid research, we retain a minimal record of your participation after your account is deleted, specifically your email address, phone number, profile notes, and the project(s) you took part in. We keep this data to prevent fraudulent activity, such as re-registration to bypass our processes. This is permitted under our legitimate interests in line with Article 6(1)(f) of the UK GDPR. This information is held in a restricted area of our systems and is only accessed to screen new registrations or if you choose to rejoin our database. If you have never taken part in paid research, we will not retain any of your data following deletion.
10. Sharing your data and taking part in research if you’re not registered with us
10.1 If you share data with us while applying or taking part in research, but you don’t have an account on our system, you give us consent to collect, store and process your data for the purpose of getting you involved in the project you are applying for.
10.2 If you apply to one of our projects without having an account on our system, we'll keep your application data for five years or until you request its deletion. We won't use any of your personal data to contact you for future projects or for any marketing purposes, unless you have separately and explicitly consented to this, for example by completing our media consent form.
10.3 If you've taken part in any paid research without having a registered account, the same minimal record applies as described in 9.6.
11. Sharing your data and taking part in research if a client is running research with their customers via PFR
11.1 Companies and organisations will sometimes engage People for Research to organise research with their customers or subscribers. If this happens, we'll always ask for your consent before capturing any of your data.
11.2 If PFR or our client contact you for the purpose of getting you involved in a specific research project, we'll ask you to complete an application questionnaire. We only keep the data captured in this form for the length of the project and up to a maximum of one month.
11.3 If you're eligible to take part and one of our team members calls you for a screening interview and/or to book you in for research, we keep all data associated with this process for six months after the last research date. Once this period ends, we permanently delete all the data.
11.4 Any data that we keep under these circumstances is strictly kept to fulfil our obligations in relation to the specific research project you were referred for and never used for any other purposes other than involving you in research with the client that has referred you.
12. Disclosing your personal data
12.1 Our employees have access to your personal data for the purposes set out in this policy.
12.2 We may also be required to disclose your personal information under the following circumstances:
(a) to the extent that we are required to do so by law;
(b) in connection with any ongoing or prospective legal proceedings;
(c) to establish, exercise or defend our legal rights and prevent fraud;
(d) to the purchaser (or prospective purchaser) of any business or asset that we are (or are contemplating) selling; and
(e) to any person who we reasonably believe may apply to a court or other competent authority for disclosure of that personal information where, in our reasonable opinion, such court or authority would be reasonably likely to order disclosure of that personal information.
13. International data transfers
13.1 The personal data stored by PFR may be subject to an international data transfer for one or both of the following reasons:
(a) Because we use a digital tool to store or process your data whose headquarters and/or servers are based outside of the UK/European Economic Area. As previously stated in this policy, before we onboard any external platforms, we ensure they are fully compliant with the GDPR. We always put in place a Data Protection Agreement to ensure both our organisation and your data are fully protected.
(b) Personal data that we collect may be transferred, processed and stored by clients whose headquarters are based in other countries. Some of these countries may not have data protection laws equivalent to those in force in the UK / European Economic Area. In these cases, People for Research will set up a contract with these clients that safeguards any personal data, using standard data protection contract clauses.
14. Media content and marketing
14.1 From time to time, we may invite you to feature in media content for use in our marketing activities, such as video footage, photographs, audio recordings, written quotes or case studies. Taking part is entirely voluntary and separate from any research study you may be involved in. Saying no will never affect your participation in research or any payment you are due.
14.2 We will only ever capture and use this type of content with your explicit consent, which we collect through a dedicated media consent form. This form details how the content may be used, including on our social media channels, our website, email campaigns and other promotional materials.
14.3 Any media content featuring you is personal data and will be stored securely, with access limited to authorised PFR staff and the third-party platforms we use to publish and host our marketing content, such as social media platforms and our website provider.
14.4 You can withdraw your consent at any time by emailing gdpr@peopleforresearch.co.uk. Withdrawing your consent does not affect any use of the content before your withdrawal. Where content has already been published, immediate removal from all channels may not always be possible, but we will stop any further use and take reasonable steps to remove it. Once you withdraw your consent, we'll delete the original content from our systems unless we need to keep a limited record of your consent and withdrawal for compliance purposes.
14.5 We keep media content for as long as it remains in active use in our marketing. We review the content we hold at least every five years and permanently delete anything we no longer use or need. This means your content will not be stored indefinitely, even if you never withdraw your consent.
15. Incentive payments
15.1 If you take part in one of our paid research studies, we'll collect the information we need to pay your incentive, such as your bank account details or the email address needed to send a voucher.
15.2 We process this information to fulfil our agreement to pay you (Article 6(1)(b)) and to meet our legal record-keeping obligations for tax and accounting purposes (Article 6(1)(c)).
15.3 Your payment details (such as bank account numbers) are only accessible to staff who process payments and are used solely to fulfil your incentive. We permanently delete your full payment details from our active systems once all incentive payments for the project are complete and reconciled.
15.4. To comply with our legal tax and accounting obligations, we retain a basic transaction record for six years from the end of the financial year in which the payment was made. This record is strictly limited to your name, the payment amount, the date paid and the research project it relates to and will be securely deleted after this period.
15.5 Where your incentive is paid via GiftPay, your email address will be retained by GiftPay in line with their own retention policy, which is determined by the expiry dates of the relevant gift cards. This means GiftPay may hold your email address for as long as your gift card remains valid. PFR has no control over GiftPay's retention periods once a gift card has been issued. If you request deletion of your data before your gift card has been redeemed, you may lose access to it.
16. How to request the deletion of your data
16.1 The informed consent you provide during sign-up can be revoked at any time, meaning you can ask us to permanently close your account and delete your data whenever you choose. The easiest way to do this is to email us at gdpr@peopleforresearch.co.uk from your registered email address, as this helps us verify your identity quickly.
If you're unable to contact us this way, you can still reach out via any of our other contact channels, and we'll ask you to provide some additional details to confirm your identity before we process your request. If you've taken part in any of our media or marketing content, please see section 14 for how to withdraw consent and request deletion of that content.
16.2 When you ask PFR to permanently delete your account and any personal data you may have shared with us, this doesn't cover any personal data, as well as audio and video recordings, captured during paid research sessions with clients. As mentioned in these terms, PFR has no control over the data you share with our clients during research sessions, and you must contact the client directly to request the deletion of this data.
16.3 If you have any concerns about how we have handled your personal data, you can raise a complaint with us by emailing gdpr@peopleforresearch.co.uk or calling +44 (0)117 921 0008. We'll acknowledge your complaint within 30 days of receiving it, investigate it appropriately and communicate the outcome to you. You also have the right to complain directly to the ICO at ico.org.uk or by calling 0303 123 1113.