Last updated: 22 July 2026

1. Introduction

Your privacy and personal information are important to us. We take care to protect the information provided to us when we conduct research and consultancy projects.

This privacy policy explains:

• what personal information OKO may collect;
• how and why we use it;
• when we may share it with our clients and appointed research partners;
• how long we retain it;
• the rights you have in relation to it; and
• how to contact us or make a complaint.

OKO conducts qualitative and quantitative research and consultancy for organisations including charities, membership organisations, social enterprises, standards bodies and purpose-led businesses.

We do not sell personal information. We do not use information collected for research to market or sell products or services to research participants.

2. Who we are

OKO Ltd is a market research and consultancy company registered in England and Wales.

Company number: 7776862
Registered address: 26 High Street, Haslemere, GU27 2HW
Office address: Capel Bancyfelin, Llangrannog, Llandysul, SA44 6SD

Our Data Protection Lead is:

Jeremy Rix
Email: jeremy@engageoko.com

General enquiries may also be sent to:

Email: hello@engageoko.com

3. The laws and professional standards we follow

We process personal information in accordance with applicable UK data-protection legislation, including:

• the UK General Data Protection Regulation;
• the Data Protection Act 2018;
• the Data (Use and Access) Act 2025; and
• other applicable data-protection and privacy legislation, as amended from time to time.

We also work in accordance with the Market Research Society’s Code of Conduct and relevant MRS guidance.

Participation in our research is voluntary. We aim to be clear about who is conducting the research, what taking part involves and how the information provided will be used.

4. When this policy applies

This policy applies when you:

• are invited to participate in research conducted by OKO;
• apply or agree to participate in an OKO research project;
• complete a survey conducted by or on behalf of OKO;
• take part in an interview, focus group, workshop, online community or other research activity;
• contact us about a research project;
• visit our website or communicate with us in another professional capacity; or
• exercise your data-protection rights or make a complaint.

For some projects, we will also provide a project-specific privacy notice or participant information sheet. This may explain particular arrangements relating to that project, such as recording, client observation, retention periods or the collection of sensitive information.

The project-specific information should be read alongside this policy. Where it provides more specific information about a project, that information will apply to that project.

5. Whether OKO is a controller or processor

Our role under data-protection law can vary depending on the project and the particular information being processed.

In some circumstances, OKO acts as a data controller, meaning that we determine why and how particular personal information is used.

In other circumstances, OKO acts as a data processor on behalf of the client commissioning the research. This may be the case where a client supplies a list of its customers, supporters, employees, members or service users and instructs OKO how that information may be used.

OKO may also act as a controller for some aspects of a project and as a processor for others. Where appropriate, the research invitation or project-specific privacy information will identify the organisation responsible for the particular processing.

6. How we obtain personal information

We may receive personal information:

• directly from you;
• from the organisation that commissioned the research;
• from an appointed qualitative recruitment partner;
• from a quantitative panel, sample or fieldwork provider;
• from another research partner working on the project;
• through a survey, interview, group discussion or other research activity; or
• from publicly available professional sources where this is appropriate and lawful.

You may be invited to participate because:

• you have previously agreed to be contacted about research;
• you have a relationship with the organisation commissioning the research;
• your experiences, circumstances or opinions are relevant to the project;
• you are a member of a research panel;
• you responded to an invitation or advertisement; or
• an appointed recruitment or fieldwork partner identified you as potentially meeting the research criteria.

If you believe you have been contacted without an appropriate reason, please contact us. We will investigate and, where appropriate, remove your details from the project contact list.

Where another organisation supplied your information, we may also inform that organisation that you do not wish to be contacted for the research.

We may retain a minimal suppression record where this is necessary to ensure that your request not to be contacted is respected.

7. Information we may collect

The information collected will depend on the nature of the research. It may include:

• your name and contact details;
• age or age group;
• address, postcode or region;
• employment, occupation or professional role;
• household or family circumstances;
• your relationship with the organisation commissioning the research;
• customer, supporter, donor, member or service-use information;
• purchasing, giving, media or service-use behaviour;
• attitudes, experiences, preferences and opinions;
• answers to research screening questions;
• survey responses;
• interview or group-discussion responses;
• audio, video or photographic recordings;
• written transcripts, notes and quotations;
• accessibility or communication requirements;
• payment details needed to administer a research incentive; and
• correspondence between you, OKO and our appointed partners.

When you take part in online research, the technology used may also collect limited technical information such as:

• IP address;
• browser or device information;
• survey completion time;
• date and time of participation; and
• quality-control or security information.

This technical information may be used to administer the research, prevent duplicate or fraudulent responses and check the quality of the data.

We will only seek information that is relevant and proportionate to the particular research project.

8. Special-category and sensitive information

Some research may involve sensitive subjects or special-category personal information. This can include information about:

• health or disability;
• racial or ethnic origin;
• religious or philosophical beliefs;
• political opinions;
• trade-union membership;
• genetic or biometric information used for identification;
• sex life; or
• sexual orientation.

We will only intentionally collect or use this information where it is necessary and appropriate for the research.

Where required, we will obtain your explicit consent or identify another applicable condition under data-protection law. We will explain the purpose of collecting the information and take additional steps to protect it.

You do not have to answer any research question you would prefer not to answer.

9. Why we use personal information

We may use personal information to:

• assess whether someone is eligible for a research project;
• recruit an appropriate and balanced range of participants;
• contact potential or confirmed participants;
• schedule interviews, groups or other research activities;
• administer online or telephone surveys;
• conduct interviews, groups, workshops, communities and observational research;
• understand participants’ experiences, attitudes, needs and behaviour;
• analyse qualitative and quantitative research findings;
• check the quality and integrity of research data;
• prepare anonymous or de-identified reports, presentations and recommendations;
• administer research incentives;
• manage requests to withdraw or not be contacted;
• respond to questions, rights requests or complaints;
• meet our contractual and professional obligations;
• protect participants, our clients, our partners and OKO from inappropriate or fraudulent activity; and
• comply with legal, regulatory, accounting and professional requirements.

We will not use research information to make sales approaches to you or for unrelated direct marketing.

10. Our lawful bases for processing

The lawful basis we rely upon will depend on the project and the information being processed.

The bases we may rely upon include:

Legitimate interests

We may process personal information where this is necessary for the legitimate interests of OKO or the organisation commissioning the research, provided those interests are not overridden by your rights and interests.

These interests may include conducting proportionate research, understanding audiences and stakeholders, improving services and communications, administering participation and maintaining research quality.

Consent

We may rely on your consent where appropriate, including for:

• optional participation in particular activities;
• audio or video recording;
• the use of identifiable video, audio, images or quotations;
• future recontact;
• particular uses of sensitive information; or
• another optional use explained to you in advance.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal will not make processing carried out before withdrawal unlawful.

Contract

We may process limited information where this is necessary to fulfil an agreement with you, such as administering an agreed research incentive.

Legal obligation

We may process or retain information where this is necessary to comply with legal, regulatory, taxation, accounting or data-protection obligations.

Where OKO is acting as a processor, the organisation commissioning the research is responsible for identifying the lawful basis for the processing it has instructed us to undertake.

11. Qualitative and quantitative research partners

OKO works with carefully selected and appointed partners to help us conduct qualitative and quantitative research.

These may include:

• qualitative research recruitment agencies and independent recruiters;
• quantitative fieldwork agencies;
• online panel and sample providers;
• telephone interviewing providers;
• survey-hosting and data-collection platforms;
• video-conferencing, online-community and research-viewing platforms;
• transcription, translation and accessibility providers;
• data-processing, coding and analysis specialists;
• secure data-storage and IT providers; and
• incentive administration or payment providers.

An appointed partner may help us to:

• identify and contact potential participants;
• ask screening or eligibility questions;
• recruit participants to a research specification;
• arrange interviews or group discussions;
• distribute and administer surveys;
• host research sessions;
• process responses;
• transcribe or translate discussions;
• conduct quality-control checks;
• analyse data; or
• make incentive payments.

Where these organisations act as processors for OKO or our client, they may only use personal information for the agreed research purposes and in accordance with documented instructions.

We require appointed processors to:

• protect the confidentiality and security of the information;
• limit access to people who need it for the project;
• use the information only for the agreed purpose;
• assist with data-protection requests where required;
• notify us of relevant security incidents;
• delete or return the information when it is no longer required; and
• apply equivalent requirements to any approved sub-processors they use.

We only provide partners with the information they reasonably need to perform their role.

Partners acting as independent controllers

Some research panel, sample or recruitment providers maintain their own databases and decide how they recruit and manage members of those databases. They may act as independent data controllers for those activities.

Where this applies, the provider is responsible for its own privacy notice, lawful basis and relationship with its panel members or contacts. You should be given access to that provider’s privacy information.

Once information is transferred to OKO for the particular research project, OKO’s role and this privacy policy will apply to the information we receive.

12. Sharing information with the organisation commissioning the research

Research responses are normally reported to our client in aggregate, anonymous or de-identified form.

We may use quotations or statements from interviews and group discussions to illustrate the findings. We will take reasonable steps to remove names and other directly identifying details.

We will not normally disclose your name or contact details to the client unless:

• this is necessary for the project and has been explained to you;
• you have explicitly agreed to be identified;
• you have agreed to the use of an identifiable recording, image or quotation; or
• disclosure is required by law.

In some qualitative research, representatives of the commissioning organisation may observe an interview or group discussion live or through a recording. Where this is planned, we will tell you before you take part.

Clients and other observers are expected to respect participants’ confidentiality and not attempt to identify or contact participants from the research unless this has been explicitly agreed.

13. Recordings, images and quotations

We may ask to audio-record or video-record interviews, groups, workshops or other research activities to support accurate analysis.

We will tell you:

• whether recording will take place;
• why the recording is needed;
• who may see or hear it;
• how it will be used; and
• how long it will be retained.

Recordings will not be used for promotional, advertising or public-facing purposes unless you have given separate, explicit permission.

We may include anonymous or de-identified quotations in reports and presentations. Where a quotation or case study may identify you, we will seek your explicit agreement before using it in that form.

14. Confidentiality and anonymity

We treat research participation and responses as confidential.

We take reasonable steps to remove or separate information that directly identifies participants from their research responses.

However, it may not always be possible to guarantee complete anonymity. For example:

• participants in a group discussion will hear what other participants say;
• someone may be recognisable from a distinctive experience or quotation;
• client observers may see or hear a participant;
• a video or audio recording may contain identifying information; or
• very small or specialised samples may increase the possibility of recognition.

We will explain any material limitations to confidentiality before you participate.

Participants in group research will be asked to respect the privacy of others and not repeat personal information outside the session. OKO cannot, however, guarantee the behaviour of other participants.

15. Children, young people and vulnerable participants

We do not knowingly involve children or young people in research without applying appropriate consent, safeguarding and age-appropriate information procedures.

Where required, we will obtain permission from a parent, guardian or other responsible adult as well as seeking the agreement of the child or young person.

Where research involves people who may be vulnerable or where sensitive subjects are being discussed, we will take proportionate steps to ensure that participation is informed, voluntary, accessible and appropriately supported.

16. Research incentives

Some projects offer an incentive as a thank you for the participant’s time.

Where an incentive is offered:

• the amount and form of payment will be explained in advance;
• payment will not affect your right to decline to answer a question or stop participating;
• we may need to share limited information with an appointed payment provider; and
• we may retain limited payment records where required for accounting, taxation, fraud-prevention or audit purposes.

Payment information will not be used for marketing.

17. International transfers

Most of our research is conducted within the UK. However, some appointed technology providers, research partners, clients or project team members may be located outside the UK, or may store or access information from outside the UK.

Where personal information is transferred outside the UK, we will ensure that an appropriate legal mechanism and safeguards are in place. These may include:

• UK adequacy regulations;
• approved contractual safeguards;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved standard contractual clauses; or
• another lawful transfer mechanism.

We will also consider the nature of the information, the purpose of the transfer and the security arrangements applied.

You may contact us for further information about the safeguards relevant to a particular project.

18. How we protect information

We use proportionate technical and organisational measures to protect personal information.

Depending on the nature of the project, these may include:

• password protection and encryption;
• secure transfer methods;
• access controls;
• multi-factor authentication;
• separation of contact details from research responses;
• confidentiality agreements;
• secure cloud-storage and research platforms;
• limited access based on project roles;
• data-processing agreements with appointed partners;
• staff and partner training; and
• secure deletion or anonymisation.

No system can be guaranteed to be completely secure, but we take reasonable steps to reduce the likelihood and impact of unauthorised access, loss, misuse or disclosure.

19. How long we retain information

We retain identifiable personal information only for as long as it is needed for the purpose for which it was collected.

Unless a project-specific notice specifies a different period, our usual approach is:

Recruitment and contact information

Names, contact details, screening responses and scheduling information will normally be deleted or anonymised once recruitment, fieldwork and necessary follow-up have been completed.

This will generally be no later than three months after the research project has been completed.

Audio and video recordings

Recordings will normally be deleted once transcription, analysis and quality checking are complete. They will not normally be retained for longer than 12 months after completion of the project unless you have agreed to a longer or different use.

Research responses and transcripts

Identifiable or pseudonymised responses, transcripts and research data will normally be deleted or fully anonymised within 12 months of completion of the project.

Incentive and financial records

Limited records relating to incentive payments may be retained for the period required by applicable accounting, taxation, legal or audit requirements.

Rights requests and complaints

Information relating to a data-protection request or complaint may be retained where necessary to demonstrate how the matter was handled and to meet our legal obligations.

Anonymous information

Once information has been effectively anonymised so that no individual is identifiable, it is no longer personal information. Anonymous reports, aggregated findings and fully anonymised datasets may be retained for research, business-record, learning and evidential purposes.

Where information remains in secure system backups after deletion from active systems, it will be placed beyond ordinary use and deleted or overwritten in accordance with the relevant backup cycle.

20. Your data-protection rights

Depending on the circumstances and the lawful basis being used, you may have the right to:

• be informed about how your personal information is used;
• ask for access to the personal information held about you;
• ask for inaccurate or incomplete information to be corrected;
• ask for personal information to be deleted;
• ask for the use of your information to be restricted;
• object to particular uses of your information;
• receive certain information in a portable format;
• withdraw consent where processing is based on consent; and
• complain about how your personal information has been handled.

These rights are not absolute and may not apply in every circumstance.

Where OKO acts as a processor, we may need to pass your request to the client that is responsible for the information. We will assist the responsible organisation as required.

We will normally respond to a valid rights request without undue delay and within one calendar month. In certain circumstances, the period may be extended by up to a further two months. If this is necessary, we will explain the reason for the extension.

We may need to request proportionate information to confirm your identity before disclosing or changing personal information.

To exercise a right, contact:

Jeremy Rix, Data Protection Lead
Email: jeremy@engageoko.com

21. Withdrawing from research

You may decline to participate or stop participating at any time.

You may also ask us to withdraw identifiable information you have provided. We will explain whether and to what extent this is possible.

It may not be possible to remove your information after it has:

• been fully anonymised;
• been combined into aggregated findings;
• been included in completed analysis that cannot reasonably be separated; or
• been used in a final report or other completed output.

Stopping participation will not affect any rights you have in relation to the information already collected.

22. Automated decision-making

OKO does not use research information to make solely automated decisions about participants that produce legal or similarly significant effects.

Automated tools may be used for limited administrative or research-quality purposes, such as checking survey eligibility, applying sample quotas, identifying duplicate responses or flagging potential quality issues. Where appropriate, these decisions are subject to human review.

23. Making a data-protection complaint

If you have concerns about the way OKO has collected, used, shared or protected your personal information, please contact us first so that we can investigate.

You can make a complaint electronically by emailing:

Jeremy Rix, Data Protection Lead
Email: jeremy@engageoko.com

Please include:

• your name and contact details;
• the research project concerned, if known;
• an explanation of your concern; and
• what you would like us to do.

You may also send a complaint by post to our office address.

We will:

• acknowledge your complaint within 30 days;
• investigate it appropriately;
• keep you informed where further information or time is required; and
• communicate the outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office, the UK’s independent data-protection regulator. Information about making a complaint is available on the Information Commissioner’s Office website.

You do not have to complain to OKO before contacting the Information Commissioner’s Office, although the regulator may ask whether you have first raised the matter with us.

24. Changes to this policy

We may update this privacy policy to reflect changes in our research methods, appointed partners, business practices or legal obligations.

The latest version will be published on the OKO website and will show the date on which it was last updated.

25. Contacting us

For questions about this policy, a particular research project or the personal information we hold, contact:

Jeremy Rix
Data Protection Lead
Email: jeremy@engageoko.com

OKO Ltd
Capel Bancyfelin
Llangrannog
Llandysul
SA44 6SD

General enquiries: hello@engageoko.com