Privacy Notice
Last updated: 06/08/2026
Folk Research Limited (“Folk Research”, “we”, “us”, “our”) is an independent market research agency. We carry out qualitative and quantitative research on behalf of organisations to understand people’s experiences, opinions, and behaviours.
This notice explains how we collect, use, and protect your personal data when you take part in our research, receive a survey invitation, or interact with us in connection with a research project. Information about our website and cookies is in Section 15.
Folk Research processes personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where we conduct research involving participants in the European Economic Area (EEA), we also comply with the EU General Data Protection Regulation (EU GDPR).
1. Who we are
| Data Controller | Folk Research Limited (company number 11267127) |
| Address | Cookham House, 29 The Green, Winchmore Hill, London N21 1HS |
| Data protection contact | dataprotection@folkresearch.com |
| ICO registration | ZA354791 |
We are registered with the UK Information Commissioner’s Office (ICO).
We are responsible for deciding how your personal data is used in our research projects. In many projects we act as joint controller alongside the organisation that commissioned the research. Section 12 explains what this means and sets out the essence of that arrangement.
2. Why we collect your information
We collect and use personal data so we can:
Invite suitable people to take part in research studies
Screen and recruit participants against agreed criteria
Organise and run interviews, focus groups, surveys, or online communities
Collect your responses and feedback as part of the research
Analyse research materials and produce findings, including with the support of AI-assisted tools (see Section 7)
Arrange incentive payments for participation
Deliver research findings and, where you have consented, research materials such as recordings and transcripts to the organisation that commissioned the research (see Section 6)
Meet our legal and regulatory obligations, including quality and audit requirements
We only collect information that is relevant and necessary for the research.
3. What information we may collect
Depending on the project, we may collect:
Invitation and recruitment data
Name, email address, phone number
General location (e.g. city or region)
Background information (such as age range, job role, professional specialism, or household details) to assess suitability and ensure a good mix of participants
Survey and research data
Your responses to questionnaire or screener questions
Your opinions, experiences, and feedback shared in interviews, focus groups, diaries, or online communities
Audio or video recordings (where you have been informed in advance and consented)
Written responses, chat messages, community posts, and any photographs or video you choose to upload
Research notes and transcripts
Together, the material generated through your participation (recordings, transcripts, written responses, photographs, video uploads, chat logs, and related research outputs) is referred to in this notice as the Materials.
Special category data (health and other sensitive information)
Where a project requires it, we may ask questions about your health, medical conditions, disability status, or other special category data. We will always make this clear before asking, explain why it is needed, and ask for your explicit consent before collecting it. You can decline to answer any such questions without affecting your ability to take part in the rest of the research. See Section 5 for more detail.
Incentive information
If we pay you for taking part, limited information needed to arrange payment may be processed via our incentive payment provider (typically Ayda). We do not collect or store bank or card details directly.
We try to minimise the personal data we collect. Where possible, we separate your contact details from your research responses and use participant reference numbers rather than names.
Age restriction: Our research is intended for adults aged 18 and over unless a project is specifically designed to include younger participants, in which case appropriate safeguards and parental or guardian consent will be obtained.
4. Lawful basis for using your data
Under UK and EU data protection law, we rely on the following lawful bases. References are to the UK GDPR; equivalent provisions apply under the EU GDPR where EEA participants are involved.
| Processing activity | Lawful basis |
|---|---|
| Taking part in research (surveys, interviews, groups) | Consent (Article 6(1)(a)) |
| Audio/video recordings | Consent (Article 6(1)(a)) |
| Sharing Materials with the commissioning organisation, and where applicable its appointed agency or research partner | Consent (Article 6(1)(a)) |
| Special category data (e.g. health information), including where it appears in Materials shared with the commissioning organisation | Explicit consent (Article 9(2)(a)) |
| Analysis of research Materials, including with AI-assisted tools | Legitimate interests (Article 6(1)(f)) |
| Arranging recruitment, scheduling, and project management | Legitimate interests (Article 6(1)(f)) |
| Fraud prevention and quality assurance | Legitimate interests (Article 6(1)(f)) |
| Financial records and incentive payment reconciliation | Legal obligation (Article 6(1)(c)) |
Where we rely on legitimate interests, we have assessed that our interests do not override your rights and freedoms as a research participant.
5. Special category data
Some of our research involves questions about health conditions, disability status, clinical experience, or other sensitive topics. This type of data is given additional protection under data protection law.
Special category data may also arise even where a project is not about a sensitive subject, because participants sometimes choose to share personal health or other sensitive experiences during a discussion. Where that happens, we treat that information as special category data regardless of the research topic.
Where a project involves special category data:
We will always tell you clearly before any such questions are asked
We will ask for your explicit consent before collecting any health-related information
The consent request will identify the specific categories of data collected and explain why they are needed
You can withdraw consent for health-related questions at any time without affecting your broader participation
Access is restricted to the smallest number of people who need it, and everyone with access is bound by confidentiality obligations
Health-related screener data is deleted more quickly than general research data (see Section 9)
Where recordings or transcripts containing special category data are shared with the organisation that commissioned the research, we will have obtained your explicit consent to that sharing, and the recipient is contractually restricted to using the Materials only to review the research findings. It may not use them for any other purpose, and may not attempt to identify you.
6. What our clients receive
Written outputs. Research reports, presentations, and other written deliverables are designed so that:
Participants are not named
Quotes are anonymised or use pseudonyms
Information that could directly identify you is removed wherever possible
Materials. In many qualitative projects, the organisation that commissioned the research also needs to see the underlying Materials, for example to observe a session live, to review recordings, or to read transcripts and community posts in full. Where this applies:
We will tell you before you take part, and obtain your consent
Access is limited to named individuals at the commissioning organisation and, where applicable, its appointed agency or research partner
Everyone with access is bound by written confidentiality and data protection obligations owed to Folk Research
The Materials may be used only to review and evaluate the research findings, and for no other purpose
Recipients are prohibited from attempting to identify or contact participants, and from sharing the Materials onward without our written agreement
Recipients must delete the Materials within the period set out in Section 9
Use of findings. The findings of the research may be used by the commissioning organisation to inform its products, services, or communications. That is the purpose of the research. Your personal recordings, words, photographs, and video will not appear in any advertising, marketing, or external publication without your specific further consent.
Identity of the commissioning organisation. We do not usually tell you who commissioned the research while fieldwork is under way, because knowing the client can influence the answers people give and undermine the impartiality of the research. Where we withhold it, we will tell you that the research is being conducted for a client under a joint controller arrangement, and we will provide the client’s identity at the end of your participation, or on request at any time afterwards. Your rights are unaffected either way, because Folk Research remains your single point of contact for all data protection matters (see Section 12).
7. AI and technology tools
We use AI-assisted tools to help deliver and analyse research, for example for automated transcription of recordings and to support thematic analysis of research Materials.
Where we do so:
We use reputable services operating under appropriate data protection agreements
Your Materials are not used to train AI models. We contractually prohibit our technology partners and AI service providers from using Folk data to train, fine-tune, or otherwise develop their models
Some of these services process data outside the UK. Where they do, the transfer is protected by safeguards approved under UK GDPR (see Section 10), and the same no-training rule applies
AI tools support our researchers; they do not replace them. All findings are reviewed and interpreted by Folk researchers
We do not use AI, or any other automated process, to make decisions about you that have legal or similarly significant effects
We also engage specialist technology partners to build and maintain the analysis tools we use. Where those partners handle research Materials, they do so under a written data processing agreement that restricts what they may do with the data, requires deletion within defined periods, and prohibits any use for their own purposes.
8. Who we share your data with
We share personal data only where necessary to deliver the research, with the following categories of trusted supplier:
| Supplier type | Purpose | Examples |
|---|---|---|
| Panel and recruitment providers | Sourcing and screening research participants | M3 Global Research |
| Survey hosting platforms | Scripting and hosting online surveys | Included within panel provider services |
| Qualitative research partners, international | Conducting or supporting qualitative research in markets outside the UK, including moderating sessions, recruiting participants, and handling local logistics | Local research agencies and partners engaged per project |
| Qualitative research partners, UK freelancers | Conducting or supporting qualitative research in the UK where Folk engages an independent moderator, researcher, analyst, or specialist consultant | Independent moderators, researchers, analysts, and consultants contracted by Folk |
| Transcription services | Transcribing recorded interviews and focus groups | Third-party transcription suppliers, including AI-assisted transcription |
| Research platforms | Online communities, diary tools, video interview platforms, and other qualitative tools | Recollective and other qualitative platforms as applicable per project |
| Technology and AI partners | Building, maintaining, and operating the analysis tools we use, and providing AI services that support transcription and analysis | Specialist technology consultancies and AI service providers engaged under written agreements |
| Incentive payment providers | Processing participation payments | Ayda |
| Secure business systems | Storing and managing project data | Microsoft 365 (SharePoint / OneDrive / Teams) |
Where Folk engages a local research partner or independent moderator to conduct qualitative interviews or focus groups, for example in international markets or where a specialist moderator is required, that partner will have access to the personal data necessary to conduct and record the session, such as your name, scheduling details, and research responses. All such partners are contractually bound by data protection obligations equivalent to those applied by Folk and may only use your data to deliver the research.
Most of these suppliers act as our processors, meaning they handle your data only on our instructions. Panel and recruitment providers are different: where a provider recruits from its own panel, it is responsible as a controller in its own right for the panel relationship and for the information you gave it when you joined, governed by its own privacy notice. Our agreement with that provider covers the data used for our research project.
All suppliers are contractually required to keep your data secure, to use it only for the purposes we have agreed, and to delete it when it is no longer needed. We do not sell your personal data.
9. How long we keep your data
We keep personal data only for as long as is necessary for the purposes for which it was collected. Different periods apply to different types of data, and separate periods apply to Materials held by the organisation that commissioned the research.
Data held by Folk Research
| Data type | Retention period |
|---|---|
| Health-related screener responses | Deleted within 30 days of fieldwork closing |
| Professional or occupational data collected for research eligibility purposes (e.g. clinical specialism, job role) where the research context is sensitive | Deleted within 30 days of fieldwork closing |
| Survey response data (where hosted by a third-party supplier) | Transferred to Folk on completion; supplier copy deleted within 7 days of confirmed receipt |
| Recruitment contact details and screener data | Deleted within 90 days of fieldwork closing |
| Participant scheduling and logistics data | Deleted within 90 days of fieldwork closing |
| Audio/video recordings | Deleted within 6 months of the final research deliverable |
| Transcripts and research notes (pseudonymised) | Deleted within 12 months of the final research deliverable |
| Incentive payment records | Deleted as soon as practical after payment reconciliation (subject to HMRC record-keeping requirements, up to 6 years) |
| Final anonymised research reports | Retained for our records; these do not identify individual participants |
Materials held by the commissioning organisation or its agency
| Data type | Retention period |
|---|---|
| Recordings, transcripts, and other Materials containing identifiable participant data | The recipient must delete these within 90 days of access ending or the project closing, whichever is sooner, unless we have agreed a different period in writing. We may require earlier deletion, and will do so if you ask us to delete your data |
Where applicable law requires us to retain certain data for longer, for example in connection with pharmacovigilance or adverse event reporting obligations in medical research, we will retain only the minimum data necessary and document the legal basis for doing so.
10. International data transfers
Folk Research is based in the United Kingdom. Some of our research projects are conducted across multiple countries, and some of the tools, suppliers, and AI services we use store or process data outside the UK or European Economic Area (EEA).
Where personal data is transferred outside the UK or EEA, we rely on one of the following:
An adequacy decision, where the receiving country has been recognised as providing an equivalent standard of protection. This covers transfers to the EEA, and to certain organisations in other countries recognised under UK adequacy regulations
UK-originating data without adequacy: UK International Data Transfer Agreement (IDTA) or UK Addendum to EU Standard Contractual Clauses
EEA-originating data without adequacy: EU Standard Contractual Clauses (Commission Decision 2021/914)
This applies to our research platforms, transcription suppliers, and AI service providers as well as to international research partners. We will not transfer your data to any country without appropriate protections in place. If you would like more detail about the specific safeguards applicable to your data, or about where a particular project’s data is processed, please contact us using the details in Section 17.
Where Folk Research processes personal data of EEA residents and the EU GDPR applies, EEA-based participants may also have the right to lodge a complaint with the supervisory authority in their country of residence.
11. How we keep your data secure
We use a combination of technical and organisational security measures, including:
Restricted access to project data on a need-to-know basis
Multi-factor authentication on all systems used to access personal data
Full disk encryption on devices
Secure cloud storage and file sharing
TLS-encrypted channels for data transmission
No unencrypted transmission of personal data by email
Written data protection agreements with every supplier, partner, and platform that handles research data
Procedures for reporting, investigating, and resolving data security incidents
If we become aware of a personal data breach that is likely to affect your rights or freedoms, we will notify the Information Commissioner’s Office (ICO) within 72 hours and, where required, notify you directly.
12. Joint controller arrangements
In many research projects, Folk Research acts as joint controller alongside the organisation that commissioned the research. This happens because the commissioning organisation shapes what the research sets out to achieve, and because it receives Materials containing personal data.
The essence of that arrangement is set out below, in line with Article 26(2) UK GDPR.
Folk Research and the commissioning organisation are joint controllers of the personal data contained in the Materials that are shared with the commissioning organisation for research review
The commissioning organisation determines the research objectives, the audiences to be researched, and the markets covered
Folk Research determines how the research is conducted: recruitment, consent, discussion and questionnaire design, data security, and retention. Folk Research is solely responsible for recruiting participants and for holding participant contact details
The commissioning organisation receives Materials only to review and evaluate the research findings. It may not use them for any other purpose, including marketing, and may not attempt to identify or contact participants
Folk Research is your single point of contact for all data protection matters. You can exercise your rights, including access, correction, and deletion, by contacting us at dataprotection@folkresearch.com, and we will coordinate any action needed from the commissioning organisation
The commissioning organisation’s identity is withheld while fieldwork is under way to protect the impartiality of the research, and is provided at the end of your participation or on request afterwards
Materials are deleted in line with the retention periods in Section 9
Nothing in a joint controller arrangement affects your rights under UK GDPR, which may be exercised in full against either controller. Where such an arrangement applies to a project you are taking part in, we will say so in the consent information you receive. You can also ask us at any time for details of the arrangement applying to a specific project.
13. Adverse event reporting
In research involving medical devices or pharmaceutical products, participants sometimes share information that may constitute a reportable adverse event (AE) under applicable pharmacovigilance regulations.
Where this applies, Folk Research has procedures in place to ensure that potential AEs are identified and reported promptly to the commissioning organisation, which holds the relevant regulatory reporting obligations as the manufacturer or authorisation holder. Only the minimum information necessary for reporting purposes will be shared. Folk Research will retain a record that the report was made.
If you disclose information during research participation that may constitute an adverse event, our research team will handle it sensitively and in accordance with our AE reporting procedure.
14. Your rights
Under applicable data protection law (UK GDPR and, where relevant, EU GDPR), you have the right to:
Access the personal data we hold about you
Correct inaccurate or incomplete information
Delete your data (in certain circumstances)
Restrict how we use your data (in certain circumstances)
Object to processing based on legitimate interests
Withdraw consent at any time. This will not affect the lawfulness of processing already carried out, but we will stop using your data for that purpose going forward
Data portability, where processing is based on your consent and carried out automatically, meaning you may request a copy of your data in a structured, commonly used, machine-readable format
Not be subject to solely automated decisions that produce significant legal or similar effects. Folk Research does not make decisions of this kind about individuals. Where we use AI-assisted tools, they support analysis carried out and reviewed by our researchers (see Section 7)
Complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we have handled your data
Requests affecting Materials held by others. If you ask us to delete your data and Materials containing your data have been shared with a commissioning organisation, agency, or supplier, we will notify them and require deletion. We will confirm to you once this is done.
Withdrawing from research: If you withdraw your consent to take part in research, we will stop processing your data for research purposes. Where your responses have already been included in anonymised analysis, it may not be possible to remove them from existing outputs, but your identifiable data will be deleted.
How to exercise your rights: Contact us at dataprotection@folkresearch.com. We will respond within one calendar month.
15. Cookies and our website
Our website (www.folkresearch.com) is an information website about Folk Research and our work, built on the Framer platform. This section explains what the website does and does not collect.
Analytics. We use Framer's built-in analytics to understand how our website is used, such as how many people visit and which pages are most popular. This analytics is privacy-first and works without cookies. It does not store information on your device or create any persistent identifier for you. Visitor numbers are calculated from anonymised, aggregated data (a daily-rotating and automatically deleted hash of IP address and browser type) that cannot be traced back to you as an individual.
Cookies. Our website may use a small number of strictly necessary cookies that are required for it to load and to stay secure. These are exempt from consent requirements under the Privacy and Electronic Communications Regulations (PECR). We do not use analytics, advertising, or tracking cookies, and we do not set any non-essential cookies. For this reason, our website does not display a cookie consent banner.
No third-party tracking. Our website does not use:
Google Analytics or any other third-party analytics tool
Advertising or tracking pixels, such as Meta or LinkedIn
Embedded third-party content such as video players, chat widgets, or external forms
Web fonts are served by the Framer platform rather than loaded from a third party such as Google Fonts.
Your choices. Because our analytics uses no cookies and collects no data that can identify you, there is nothing stored on your device to remove. If you would still prefer your visit not to be included in these anonymous statistics, you can use your browser settings or a privacy extension to block analytics scripts. You can also contact us using the details in Section 17.
If you visit our website without taking part in research, the only personal data we process is any information you choose to send us using the contact details in this notice.
16. Changes to this notice
We may update this notice from time to time. The date at the top of this page shows when it was last updated. We will notify you of any material changes where we have your contact details.
17. Contact us
| Folk Research Limited | Cookham House, 29 The Green, Winchmore Hill, London N21 1HS |
| dataprotection@folkresearch.com | |
| Website | www.folkresearch.com |
You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO):
Website: https://www.ico.org.uk Telephone: 0303 123 1113