Privacy
Privacy notice
How personal data is handled by ConsumerResearchHub365 and by RKC Consultancy Limited, the company that provides it, under the UK General Data Protection Regulation and the Data Protection Act 2018. Last updated 8 November 2026.
1. Who is responsible for your data
It depends on how you meet the product.
- If you applied for a study, joined a panel, booked a slot or sent details through a recruiter's pages, the recruiter or agency running that study is the controller of your data. They decide why and how it is used. ConsumerResearchHub365 stores and processes it on their behalf as their processor. Each recruiter's own public page names them, gives their company details and says how to reach them.
- If you are a member of staff at a recruiter or agency who signs in to the product, your employer is the controller of your workspace's data, and RKC is the controller of the minimum it needs to run your login (section 3).
- If you visit this website or send an enquiry, RKC Consultancy Limited is the controller (section 4).
RKC Consultancy Limited is registered in England and Wales under company number 06617083, 167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom, and with the Information Commissioner's Office under registration number ZB171202. Contact: hello@crh365.co.uk.
2. Participants
This section describes what the product does with participant data on a recruiter's behalf. The recruiter's own notice, on their public page and in their messages, is the one that governs; this is how the product carries it out.
What is collected
| Data | When | Why |
|---|---|---|
| Name, mobile number, email address, postcode | When you apply or join a panel | To contact you about the study you applied for, or studies that fit, and to tell people apart |
| Your answers to the screening questions | When you apply | To decide whether you fit the study's criteria; shared with the agency or client who commissioned it |
| Photos, videos or documents you upload | Only when a study asks | Proof of something the study needs (that you own a car, for example), or a task after the session. Viewed in the product, not forwarded |
| Identity document image | Only when asked, for a random spot check | To confirm you are in the UK and who you say you are. The image is deleted once checked; only the date, the checker and the document type are kept |
| Bank or PayPal details | Only when a study pays you and asks | So the thank-you payment can be made. Encrypted at rest, exported only to whoever pays you, deleted after the project on the recruiter's schedule |
| Bookings, attendance, messages sent to you and your replies | During the study | To run the study and to report attendance to the client so you can be paid |
| Past projects, agencies and brands | Over time | To apply the cooldown rule, which stops you being invited to a project for the same agency or brand too soon |
| Notes the recruiter writes | Over time | The recruiter's own record of working with you |
Lawful basis
Your consent, given when you apply or join a panel, for contacting you about studies; the recruiter's legitimate interest in running the studies you applied for and reporting attendance so you are paid; and, where a study asks for proof documents or identity, your explicit consent given on the upload page. Special category data (health, ethnicity and the like) is not asked for unless a client's brief needs it, and then only with a stated reason and your explicit consent.
Messages
You are texted or emailed only about studies you applied for, or a panel you joined. Reply STOP to any text and no further texts are sent to that number; anything that still needs to reach you goes by email. You can ask the recruiter to remove you from their panel at any time.
3. Recruiters, agency staff and clients
- Signing in. Staff sign in with a work email address (a one-time code is sent to it) or a Google account. The product keeps the address, the sign-in method, when the login was created and used, and the workspace and role it belongs to. There are no passwords.
- Working in the product. What a member does is recorded against their login where the product needs it: who approved an applicant, who checked an ID, who issued an invoice. Members of the same workspace can see this.
- Project managers and clients. A project manager at an agency is named on a project and receives a link to its page and a digest when it changes. A client receives an expiring share link to a project's screened list. The product keeps their name, email address and what they did on the sheet (approve or reject). The recruiter is the controller of this data.
- Product analytics. On signed-in pages the product measures which pages are used and which actions are taken, identified by the login's internal id only, never by name or email, through Mixpanel's EU servers. Participants' names, contact details, answers and any free text are never sent.
4. Visitors to this website and enquiries
- Browsing. The web host (Google's Firebase Hosting) records requests in its logs, including IP address, for security and to serve the pages. RKC does not use these logs to identify visitors.
- The contact form. Your name, email address, organisation, role and message are emailed to the product's inbox and kept in the product's database so your enquiry can be answered and followed up. A hashed form of your IP address is kept briefly to stop abuse of the form. Lawful basis: RKC's legitimate interest in answering you. Enquiries are deleted two years after the last contact unless a customer relationship follows.
- Demos and pilots. If you take a demo or join a pilot, RKC keeps the correspondence and the agreement for as long as the relationship lasts and for six years afterwards for legal and accounting reasons.
5. Cookies and analytics
The banner on this site offers "Accept all" or "Essential only". The essential part is small: the site keeps your choice in your browser so it is not asked again. Analytics is the only optional part, and it is switched on only by "Accept all". The site stores these values in your browser's local storage (a cookie-like store):
| Value | What it holds | How long |
|---|---|---|
| crh365.analytics | Your choice on the banner: "Accept all" or "Essential only" | Until you clear your browser data or change it through "Cookie choices" in the footer |
| crh365.analytics.id | A random identifier, created only if you accept all, so repeat visits count as one visitor | Until you clear your browser data or choose "Essential only" |
| crh365.theme | Light or dark, if you chose one with the toggle at the top of the page | Until you clear your browser data |
If you accept all, the pages send to Mixpanel's EU servers (api-eu.mixpanel.com) which page was opened and whether the contact form was sent, with the random identifier and no IP address (the request asks Mixpanel not to record one). Nothing you type into a form is ever sent. If you choose "Essential only", or if your browser sends a Do Not Track or Global Privacy Control signal, nothing is sent and the banner does not appear. The same rules apply to the product's own public pages (current studies, apply, book, upload), which show the same banner.
The product's signed-in pages measure use as described in section 3 without a banner; the staff member's employer is told in the workspace agreement.
6. RKC as processor
Where a recruiter or agency is the controller, RKC processes personal data only on their documented instructions, under a written data processing agreement that forms part of every customer agreement. In summary RKC:
- processes the data only to provide the product and as the customer instructs;
- keeps the data in the United Kingdom (section 8) and uses the sub-processors listed in section 7, telling customers before any change;
- keeps the data confidential and secure (section 11);
- helps the customer answer participants' requests about their rights and meet their own obligations;
- deletes or returns the data at the end of the agreement, keeping only what the law requires;
- tells the customer without undue delay of any personal data breach.
7. Who else sees data
Personal data is shared only as needed to run the product and the studies:
| With | What | Where |
|---|---|---|
| The agency or client who commissioned a study | Screening answers, stage, attendance, proof documents (viewed, not sent), and payment details only to whoever pays | Through the product's share link and exports, under the recruiter's control |
| Google Cloud (Firebase) | Hosting, database, file storage, functions and sign-in | London region (europe-west2), United Kingdom |
| Twilio | Mobile number and the text sent, to deliver texts and receive replies | Ireland region, European Union |
| Microsoft 365 | Email address and the email sent, to deliver emails | United Kingdom and European Union data centres |
| Xero | The agency's business name and the invoice (no participant data) | Xero's hosting, as agreed between the customer and Xero |
| Mixpanel | Usage events with an internal or random identifier, never a name or contact detail | European Union |
Where a provider handles data outside the United Kingdom, it does so under the UK's adequacy regulations or the International Data Transfer Agreement. Personal data is not sold and is not used for advertising.
8. Where data is kept
In Google Cloud's London region. Texts leave through Twilio's Irish region and email through Microsoft 365. No copy of the database is held outside the United Kingdom.
9. How long data is kept
| Data | Kept for |
|---|---|
| Panel records (name, contact details, past projects) | While you are on the recruiter's panel, and until you ask to be removed or the recruiter removes you |
| Applications, answers, bookings, attendance, messages | For the project and then as the recruiter's record of it; the recruiter sets the period and tells participants in their own notice |
| Payment details | Deleted a set time after the project, as the recruiter configures; never longer than the project needs |
| Identity document images | Deleted as soon as checked; the check itself (date, checker, document type) is kept |
| Uploads | For the project, then deleted on the recruiter's schedule |
| Staff logins | While the person is a member of the workspace, then removed |
| Share links and project pages | Links expire on the date set when they were made |
| Website enquiries | Two years after the last contact |
| Invoices and accounting records | Six years, as UK law requires |
10. Your rights
Under UK GDPR you can ask for a copy of your personal data, have it corrected or deleted, object to or restrict its use, take it with you in a usable format, and withdraw consent at any time where consent is the basis. For data a recruiter holds about you, ask the recruiter: their contact details are on their public page and in every message. If you write to hello@crh365.co.uk instead, RKC passes your request to the recruiter the same day and helps them answer it. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
11. Security
Data is encrypted in transit and at rest. Payment details are encrypted a second time with a key held in a separate secret store, so they cannot be read from a database export. Public pages write through server functions that check who is asking and how often, and are protected against automated abuse. Staff sign in without passwords, by a code sent to their work email or a Google account. Access to the production system is limited to RKC staff who need it, and every message the product sends is recorded in a ledger with its delivery result.
12. Changes and contact
This notice is updated as the product changes; the date at the top says when. Material changes are announced in the product and to customers. Questions about this notice: hello@crh365.co.uk, or RKC Consultancy Limited, 167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom.