User Research Privacy Notice

Caution Your Blast Ltd. (CYB) carries out research to test and improve services for our clients. This research privacy notice explains who we are, how we collect, share and use your personal data, and how we protect your right to privacy.

Caution Your Blast Ltd., is registered in England under company number 07203051. Caution Your Blast Ltd. is registered as a data controller with the UK Information Commissioner's Office under registration number ZA444861. Our registered address is Office 7, 35-37 Ludgate Hill, EC4M 7JN, London, and you can contact us via email at info@cautionyourblast.com .

If we make material changes to this Privacy Policy we will email you or post a notification on our website or app. If you have any questions or concerns about our use of your data then please contact us at info@cautionyourblast.com .

Why we need your data

We need information about you when inviting you to take part in research to ensure that:

• you meet the criteria for this piece of research
• we are including a wide range of people

We need to collect data during the research session to ensure that we have an accurate record of what happened and what was said. This is important because we then analyse this information and use it to draw conclusions about what we should do next.

Our legal basis for using your data

We use your data specifically for our research and because you have consented for us to do so.

What data we collect from you

When inviting you to take part the personal data we collect from you could include information about your:

• name
• age
• gender
• ethnicity
• disabilities, such as details of any condition that can affect your ability to use a computer
• job title
• email address
• phone number

We will collect information based on the specific topic being researched. For example, if we’re conducting research on a specific government service, we might want to know whether you’ve used this service in the past.

During the research session in most cases, we’ll collect personal data during the research session. This could be in the form of:

• audio recordings
• video recordings
• screen recordings
• written notes
• photos

We sometimes work with other organisations to carry out research. This can include companies that help us recruit people to take part in research. If we do this we will not share your personal data with them. These companies may also collect your personal data to provide their service and as a data controller their privacy policy will apply.

What we do with your data

Collecting and analysing

We sometimes use external tools to conduct remote research sessions; this includes:

• survey tools
• online collaboration tools, including video conference and virtual whiteboard tools
• unmoderated research tools

Anonymisation of reports

When using your responses in reports or presentations, or sharing with our clients we will make sure you cannot be identified from your data. Each person taking part in a piece of research will be assigned a number, and any names or other personal and identifiable data will be removed.

Access to personal data

Only team members at CYB and team members within the client organisation will have access to the full original recordings. We may share short audio or video clips with other colleagues within the client's organisation if we have your express permission to do so.

We will monitor and limit the access that people outside CYB have to your data. The privacy policies of these external organisations will also apply.

Data retention

The data collected when we invite you to take part will be held for a maximum of 2 years. After this point, we will delete all personal data relating to you, but we will retain reports that contain your anonymised quotes.

How we share personal information

In order to provide our services, we work with trusted third parties to handle your data efficiently and to keep your data safe. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely within the EEA and will only retain it for the period we instruct.

When you send us an email, your email address and the email is stored by Google, our mailbox tool. Google’s privacy policy is here .

We will not:

• sell or rent any of your data to third parties
• share your data with third parties for marketing purposes

We will share your data if we’re required to do so by law - for example, by court order, or to prevent fraud or other crime. We will also share your data with appropriate authorities in the event of a serious safeguarding concern - for example, if we are concerned about the welfare of a child or vulnerable adult.

Data security

We are committed to doing all that we can to keep your data secure. We are externally certified to the ISO27001 Information Security standard and have set up systems and processes to prevent unauthorised access to or disclosure of the data we collect about you. All data and user details are encrypted at rest and in transit. This applies whether that data is held by Caution Your Blast Ltd. or by a trusted third party. Where data is held by Caution Your Blast Ltd., it is stored in the United Kingdom and EEA only. Where data is held by a trusted third party, their privacy policy applies. Links to all applicable third party privacy policies are set out in this information.

Your rights

You have the right to withdraw consent to the processing of your personal data - for example original recordings and notes where you can be identified. If a report with anonymised quotes has been published (internally or externally) we will not be able to remove this as it does not constitute personal data.

You also have the right to request:

• information about how your personal data is processed
• a copy of that personal data
• that this copy be provided in a structured, commonly used and machine-readable format
• that anything inaccurate in your personal data is corrected without delay
• that your personal data is erased if there is no longer a justification for holding it
• that the processing of your personal data is restricted in certain circumstances (for example, where accuracy is contested)

If you have any of these requests, please contact us at info@cautionyourblast.com .

Questions and complaints

If you have questions about research that you’ve been invited to participate in, you can contact the researcher named on the information sheet provided to you.

Contact CYB if you:

• have any questions about anything in this document
• think that your personal data has been misused or mishandled
• want to make a subject access request (SARS)