This Privacy Policy sets out the types of personal data held by The Nest Research Ltd, how long we retain personal data for, and the method of deleting and disposing of personal data.
This policy applies to all personal data held by The Nest Research (“we”, “our”, “us” or “the Company”), and by third-party data processors, including fieldwork recruitment agencies, who process personal data on our behalf.
For further information on other aspect of data protection and compliance with the Data Protection Act 2018, please refer to our Data Protection Policy.
Data retention
We shall not keep personal data for any longer than is necessary for the purposes which that personal data was originally collected, held and processed.
When establishing and reviewing retention periods, we take into account the type of personal data and the purpose(s) for which it is collected, held and processed. Different types of personal data, used for different purposes, will be retained for different periods, as set out below:
Types of personal data:
Client-provided customer records (typically including name, contact information and transaction details)
Purpose:
Provided by clients with the purpose of contacting relevant customers to take part in market research
Retention period:
4 weeks after completion of project
Types of personal data:
Respondent profile details (typically including name, contact information, demographics such as age and gender)
Purpose:
To ensure respondent profile fits purpose of the research, and to allow tailoring of questions to respondent
Retention period:
3 months after completion of project
Types of personal data:
Static, video and audio recordings that include personally identifiable information
Purpose:
To support analysis of the research
Retention period:
12 months after completion of project
Types of personal data:
Static, video and audio recordings that include personally identifiable information
Purpose:
Use as part of a presentation, report or edited video (e.g. to bring the findings to life, or share with client)
Retention period:
12 months after completion of project – unless otherwise agreed
Types of personal data:
Consumer-provided photos, videos and audio files that include personally identifiable information
Purpose:
To support analysis of the research
Retention period:
12 months after completion of project
Types of personal data:
Consumer provided photos, videos and audio files (anonymized)
Purpose:
Use as part of a presentation, report or edited video (e.g. to bring the findings to life, or share with client)
Retention period:
Indefinitely held by client
Any changes to the above will be clearly stated in our Notices, and are strictly opt-in. Data subjects will not be notified if data is deleted before the retention period ends.
In limited circumstances, it may also be necessary to retain personal data for longer periods, including for archiving purposes that are in the public interest, for scientific or historical research purposes, or for statistical purposes. All such retention is fully Data Protection Act 2018 compliant.
Your rights
Under the right to erasure (or “right to be forgotten”), data subjects have the right to have their personal data erased (and to prevent the processing of that personal data) when:
- Personal data is no longer required for the purpose for which it was originally collected and processed;
- They withdraw their consent;
- They object to the processing of their personal data, and we have no overriding legitimate interest;
- Personal data is processed unlawfully (i.e. in breach of the Data Protection Act 2018);
- Personal data must be erased to comply with a legal obligation.
Data disposal
Upon the expiry of the data retention periods set out below, or when a data subject exercises their right to have their personal data erased, personal data shall be deleted, destroyed or otherwise disposed of as follows:
- Personal data stored electronically shall be deleted, including all backups (both physical and held in the Cloud).
- Personal data stored in hard copy form shall be shredded and recycled.
All third-party data processors (such as fieldwork agencies), who process personal data on our behalf, or third-party data users (such as our end clients) will be prompted to delete all personal data and special category personal data as above. We will request written confirmation in all cases.
Implementation of policy
This policy is effect as of July 1st 2020. No part of this Policy shall have a retroactive effect and shall thus apply only to matters occurring on or after this date.