Message House Privacy Notice
Effective 25th May 2018, last updated May 2024
This privacy notice explains how and why Message House Ltd (“Message House” or “we”), the data controller, collects and processes your personal data. This notice applies to all individuals.
In addition to this privacy notice, we may provide you with further, more specific, information about how we process your personal data. For example, staff of Message House may find further information in the staff handbook, and individual contractors of Message House may find further information in the material provided alongside your contract for services – the “Ways of Working” contract.
We may modify this policy at any time, and it is reviewed on a bi-annual basis.
We are committed to protecting your privacy. We will only use the personal information that we collect from you lawfully.
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). Identification can be by the information alone or in conjunction with any other information. The processing of personal data is governed by the Data Protection Act 2018, the "UK GDPR", as defined in the Data Protection Act 2018, and other legislation relating to personal data and rights.
This applies to information that is gathered automatically as you use the website (via cookies) as well as any information you submit to us voluntarily.
We will not sell or distribute your personal information to third parties unless we have your permission or are required by law to do so.
Information we collect about you
We may collect, use, store and transfer different kinds of personal data about you which we have grouped together follows:
- Identity Data includes first name, maiden name, last name, username or similar identifier, title, date of birth and gender.
- Contact Data includes billing address, delivery address, email address and telephone numbers.
- Financial Data includes bank account and payment card details.
- Transaction Data includes details about payments to and from you.
Our research activity
As our services include finding individuals who could be research panellists, we may collate information about you using publicly available sources. These may include online sources such as LinkedIn or the websites of the businesses or institutions with which you are affiliated. We do this when requested by a client to carry out research for a particular project and may also do so proactively. We may also be provided with your information by other people – for example, if it is suggested to us by a third party that you may be interested in being a research panellist. Information collated in this way may include your name, occupation, employer, email address, phone number, location, and area of professional expertise.
The legal basis (according to article 6 of the UK GDPR) for doing so is our Legitimate Interests – we require this information in order to identify potential research panellists.
When you contact us
If you contact us via email, phone, post or the contact form on our website, we collect relevant information you provide to us, which may include name, email address, phone number and postal address.
The legal basis (according to article 6 of the UK GDPR) for doing so is our Legitimate Interests – we require this information in order to respond to your enquiry and provide a service.
If you register for a research panel
When you register as a research panellist we require that you submit personally identifiable information, such as name, postal address, email address and phone number. We may also ask you to provide demographically relevant information, which may include special category data as set out in article 9 of the UK GDPR. We use this type of data to ensure that we have an appropriately representative panel. We hold this data in order to maintain a register of potential participants.
The legal basis (according to article 6 of the UK GDPR) for doing so is Consent – when you register as a research panellist you will explicitly give us permission to process your data for this purpose. You may withdraw this consent at any time in which case your data will be removed from the register of potential participants.
If you participate on a research panel
When you are on a research panel, personal data will be collected and processed. The questions put to you during a research panel will be dependent on the client and subject matter and a briefing will be provided to you beforehand. The answers you provide will be recorded or noted down. Audio or video recordings of your participation may also be taken.
Sessions may be monitored, or recordings viewed, by our client. Our client will not be provided with your identity or demographic information from our register.
The legal basis (according to article 6 of the UK GDPR) for doing so is our Legitimate Interests – we require this information in order to carry out an analysis for our client.
Once you have participated on a research panel
The information that has been collected during a research panel will be processed in accordance with the Market Research Society Code of Practice for the purpose of producing a research report for our client. As part of this process, we seek to remove personally identifiable data before sharing the report with our client. The raw data will be held securely by Message House in accordance with our retention policy.
When you apply for a role with Message House
In connection with your application for work with us, we will collect, store, and use the following categories of personal information about you:
- The information you have provided to us in your curriculum vitae and covering letter.
- Any information you provide to us during an interview.
We may also collect, store, and use the following types of more sensitive personal information:
- Information about your race or ethnicity, religious beliefs, sexual orientation, and political opinions.
- Information about your health, including any medical condition, health, and sickness records.
- Information about criminal convictions and offences
We may also receive information about you from any recruitment agency we may use, together with background check providers or credit reference agencies and your referees. Where we propose to use any of these sources, we will let you know. We may also gather data from publicly available sources, such as LinkedIn.
We will use the personal information we collect about you to:
- Comply with legal or regulatory requirements.
- Keep records related to our hiring processes.
- Communicate with you about the recruitment process.
- Carry out background and reference checks, where applicable.
- Assess your skills, qualifications, and suitability for the role.
The legal basis (according to article 6 of the UK GDPR) for doing so is our Legitimate Interests - to decide whether to appoint you to a role since it would be beneficial to our business to appoint someone to that role. We also need to process your personal information to decide whether to enter into a contract of employment with you.
If you fail to provide information when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to process your application successfully. For example, if we require a credit check or references for this role and you fail to provide us with relevant details, we will not be able to take your application further.
If we collect special category data, we will use this strictly for the purpose collected. We collect information about your disability status to consider whether we need to make appropriate adjustments during the recruitment process. We will use information relating to certain protected characteristics to ensure meaningful equal opportunity monitoring and reporting. We will also process your nationality status as part of the right to work checks that we are required to carry out by law.
When you use our website
The Message House website is hosted by Squarespace and uses cookies that are stored on your browser. These cookies collect information about how you use the site, for example which pages you visit, and all user data is anonymous. They only collect data related to your use of this website.
Please note that some of these cookies may be placed by third party service providers who perform a function for us. The third party services this site uses are Google Analytics. The data these services collect are anonymous.
You can find out more about controlling, opting-out and deleting cookies, here.
By continuing to use this website without adjusting your browser’s cookie settings you agree that we can place these cookies on your device. You can find out more about the cookies Squarespace uses while you use our site here.
Automated decision-making
Message House does not make use of automated decision-making in relation to personal data.
Where your data is stored
Some of the third party service providers (such as Microsoft) we use to manage data may be located overseas or make use of overseas data centres. Where this is the case we have undertaken an assessment to ensure they are compliant with appropriate UK GDPR-equivalent safeguarding measures. We also ensure that a recognised safeguard is in place such as adequacy regulations, participation in the US Privacy Framework or an International Data Transfer Agreement.
How long we keep your data We only keep your data for as long as necessary.
Records will be regularly reviewed to ensure that data is not held longer than necessary.
In general, and unless we consider it necessary to retain data for longer, our retention periods are:
- Personal data relating to general enquiries – 24 months after last contact.
- Personal data on the register of potential participants – until consent is withdrawn where an individual has opted into research.
- Personal data collected through participation on a research panel – 12 months after the conclusion of the project.
Where we are collating information about you using publicly available sources on the basis that you may be a potential research panellist, we will contact you up to three times to gauge your interest in being a research panellist. If we do not receive a response from you, we will not retain your data.
In the circumstances where you have either withdrawn your consent to being on the register of potential participants or you have indicated, through your lack of response, that you do not wish to be a potential participant after being contacted by us, we will retain some of your personal data (including name, occupation, employer, email address, phone number, location, area of professional expertise) solely for the purpose of ensuring we do not contact you again.
Data that is found to have passed the retention period will be destroyed in a secure manner.
Your Rights
Where you have given us consent to process your data, you have the right to withdraw your consent at any time. You can do this by contacting Message House directly using the contact details below.
You also have the following rights regarding your data:
i) The right to request to access your personal data that is held by Message House.
ii) The right to rectify any errors if your personal data is inaccurate or incomplete.
iii) The right to request the deletion or removal of personal data.
iv) The right to request that restrictions are placed on the processing of their personal data.
v) The right to object to the processing of your data.
Requests in regards to these rights should be made using the contact details below and we will respond within a month.
Security & sharing your data
We are committed to keeping your data secure and take all reasonable precautions to protect your data from loss, misuse or alteration.
We will not sell or distribute your personal information to third parties unless we have your permission or are required by law to do so.
We may on occasion need to share your personal data with professional advisors and service providers who support our own business, for example solicitors, accountants and auditors. They have limited access to your data, where there is a business need, and only access it using our software.
Our team are contracted to strict confidentiality, and may only process data in accordance with our instructions. Please contact us using the contact details below if you have any concerns about the way Message House has processed your data. If we are unable to resolve your concerns, you may lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk).
Contact details
If you have any questions about this privacy notice or our data protection practices, please contact us.
Message House Ltd
3 Churchgates
The Wilderness
Berkhamsted
Herts
HP4 2UB
United Kingdom
Company number 08597751
Tel: +44 (0)1442 862365
Email: info@message-house.co.uk
Overall responsibility for data protection is with Dr Matt Carter.
