Research privacy notice
Your rights, and how we will process and store your data
Effective Date: 9th October 2026
This privacy notice is for participants in our research projects. We describe here the data we collect from you when you agree to participate, our reasons for collecting it, what we do with it and what your rights are.
Who are we?
We are Culture People, a Community Interest Company with registration number 17438030, registered office 44 Little Lane, Kimberley, Nottingham NG16 2PE.
Our contact details are hello@culturepeople.org.uk
We are the data controller for the processing described in this privacy notice, and we are registered as a data controller with the Information Commissioner’s Office (ICO) registration number ZC239219.
We also provide data analysis services to clients where we act as a Data Processor and our client is the Data Controller; those activities are not covered within this privacy notice but will be described within privacy notices supplied by our clients.
Purpose of processing
We process your personal data for a variety of purposes as set out below, which also shows our lawful basis under UK data protection legislation (UK GDPR) for doing so.
Purpose: Conducting the research project
Lawful basis under UK GDPR: Your consent
Purpose: Communicating with you regarding a prize draw or future research projects
Lawful basis under UK GDPR: Your consent
Purpose: Sharing your personal data with our commissioning client organisation
Lawful basis under UK GDPR: Your consent
You are free to withdraw your consent at any time, in which case we will delete your personal data. See contact us link above about how to get in touch.
What data do we collect?
The list below gives information on the categories of personal data we process for each of the purposes shown above.
Purpose: Conducting the research project
Categories of data processed: Name, contact details, record of consent
Purpose: Communicating with you regarding a prize draw or future research projects
Categories of data processed: Name, contact details, record of consent
Purpose: Sharing your personal data with our commissioning client organisation
Categories of data processed: Your record of consent
Special category data
There are additional rules we must follow if we collect certain types of more sensitive data, known as Special Category Data. These include, for example, details of your ethnicity, beliefs, health and sexuality and in each case, we must let you know what our additional lawful basis is for processing such data.
We will occasionally include these special category data in research projects and will obtain your explicit consent for their processing.
How long do we keep your data for?
Where we are relying on your consent or our legitimate interests to process your data then we will keep your personal data until you withdraw your consent for us to use it, or object to our legitimate interests and we agree with your objection.
We will retain your personal data by default for the following periods:
Purpose: Conducting the research project
Retention period: 2 years
Purpose: Communicating with you regarding a prize draw or future research projects
Retention period: 2 years
Purpose: Sharing your personal data with our commissioning client organisation
Retention period: 2 years
Do we ever share personal data?
Where we have been commissioned to conduct the research project on behalf of another organisation we will share your personal data with them, and we will tell you who that organisation is and will obtain your consent for sharing your personal data with them.
We may also utilise external suppliers to provide a number of support services to enable the research project. We always ensure that we have appropriate contracts in place to protect your rights when personal data are processed on our behalf by these third parties. There is further information regarding these suppliers in the “Where do we process data?” section.
Surveys are administered using online survey software Snap Surveys. Their privacy policy can be found here.
How do we keep your data secure?
We take sensible steps to keep your data secure and ensure we can uphold your rights and meet our obligations under UK GDPR:
All data sent between your browser and our website is encrypted in transit, and the data are encrypted at rest on our website servers.
Access to personal data is role based: only those members of staff or contracted freelance associates with a legitimate need will have access.
Systems are password protected and multi-factor authentication is enabled where available.
We maintain appropriate records of processing activities which record any data processors we use and we ensure that appropriate contracts are in place to protect your rights, that the processors take appropriate security measures to safeguard your data, and that any international transfers are done correctly under UK GDPR.
Our employees and freelance associates are all subject to an obligation of confidentiality and receive training on data protection matters.
We utilise appropriate technical and organisational measures to optimise the security of your personal data.
Survey data will be collected and stored with Culture People’s Snap Surveys account. Snap Surveys is ISO27001 certified, meaning they have an information management system that ensures they follow best practice with regards to preventing cyber-attacks and keeping their clients’ data safe. More information can be found here.
Your rights
You have a number of rights relating to the processing of your data. If you would like to use them or have any questions then please contact us at hello@culturepeople.org.uk
This privacy document fulfils the need to inform about how and why we process your information.
You have the right to a copy of the data we hold about you and if you think some of the data we hold is wrong then you have the right to ask us to correct it.
You have the right to ask us to delete the data we hold about you. Where we are holding the data to fulfil a contract with you or your organisation then we will need to retain the data in accordance with the data retention requirements shown above.
You have the right to ask us to restrict the processing of personal data in certain circumstances.
You have the right to object to the processing of your data where we are doing so based on legitimate interests.
You can request a copy of your data in a digital format.
You have the right, in certain circumstances, not to be subject to decisions based on automated processing (including profiling) if it has a significant or legal impact on you. We do not currently use any technology to make automated decisions about you.
We won’t charge you for making any data requests, unless they are frequent repeat or unfounded requests.
Where do we process data?
We primarily process data in the UK however we use partners to help us deliver our services, some of these services will mean that your personal data are transferred outside of the UK.
Partner: Microsoft – business software
Where do they process data?: UK primarily, some USA transfers
What additional protections are in place to safeguard your rights if processing is based overseas: Standard Contractual Clauses in place as part of the Microsoft licencing terms.
Partner: Snap Surveys Ltd
Where do they process data?: Our surveys are hosted on UK servers
Making a complaint
Please contact us using the details provided earlier. You can also contact the Information Commissioner’s Office (ICO) on their helpline 0303 123 1113 or online at www.ico.org.uk If you should contact the ICO they will normally ask you to contact us first.
