How personal data is handled

1. Data protection

The UK General Data Protection Regulation and the Data Protection Act 2018 apply to everything the product does.

Who is the controller and who is the processor

Each agency or recruiter that uses the product is the controller of the participant, client and agency data it puts in: it decides who is recruited, what is asked and how long records are kept. ConsumerResearchHub365 is provided by RKC Consultancy Limited (company number 06617083), which is the processor: it holds and moves that data only on the customer's documented instructions and for no purpose of its own. RKC is the controller only for this website, enquiries and staff sign-in records, as the privacy notice sets out.

Data processing agreement Available

A written data processing agreement with the clauses UK GDPR Article 28 requires (documented instructions, confidentiality, security measures, sub-processor conditions, help with participants' rights, breach notification, deletion or return at the end, audit information) forms part of every customer agreement and is available on request before any data is loaded. Ask for a copy.

Participants' rights

Participants can ask for a copy of their data, have it corrected or deleted, object to or restrict its use, take it with them and withdraw consent. The Your data page Available lets a participant do that without a login: they enter the email address or mobile number they gave, receive a one-time code, and see everything held about them in every workspace that holds them, in plain words. From there they download a copy, ask for a correction, withdraw consent across every channel at once, or ask for deletion, which runs straight away unless a legal reason (an invoiced attendance inside the six-year finance retention, a payment still inside its retention days) blocks it, in which case the request is queued with the reasons shown. Every request is logged with the statutory one-month deadline and handled by the controller from the app; the owners are emailed when one arrives. Requests that reach RKC are passed to the controller the same day. What a participant can expect is also in the privacy notice.

Retention

Retention periods are set per customer and recorded in the data processing agreement and in the record of processing the app generates for each workspace. Today the product deletes payment details a set number of days after a project's last date, on the schedule the customer sets, deletes identity document images as soon as they are checked, keeps invoices for the six years UK law requires, and deletes a participant's records on request through the Your data page or the member's own Erase. Automatic deletion of the remaining records at the end of the customer's retention period is In progress; until then the customer deletes them from the product.

2. Where data lives

The database, file storage, server functions and hosting run in Google Cloud's London region (europe-west2). No copy of the database is held outside the United Kingdom. Three things leave the region to be delivered: texts go through Twilio's Ireland region, email through Microsoft 365, and, only after a visitor or staff member has consented, usage events go to Mixpanel's servers in the European Union, never with a name, contact detail or anything typed into a form.

Sub-processors

Every company that handles personal data on RKC's behalf, what for, and where. The same list appears in the record of processing (UK GDPR Article 30) that each workspace generates in the app, and a test fails whenever the two differ. Last checked 8 November 2026.

Sub-processor	Purpose	Where
Google Cloud / Firebase Google Ireland Limited	Hosting, the database, file storage and server functions (every record the product holds), staff sign-in records, and the bot check on public pages (reCAPTCHA Enterprise)	London region (europe-west2), United Kingdom; the sign-in service is Google's global service and holds staff email addresses only
Twilio Twilio Ireland Limited	Text messages: the mobile number and the text sent, and replies received	Ireland region (IE1), European Union
Microsoft 365 Microsoft Ireland Operations Limited	Email: the address and the email sent, and the product's mailboxes	United Kingdom and European Union data centres
Xero Xero (UK) Limited	Invoicing, when the customer connects its own Xero account: the agency's business name and the invoice lines, no participant data	Xero's hosting, under the customer's own agreement with Xero
Mixpanel Mixpanel, Inc. (EU data residency)	Product analytics after consent: usage counts with a random or internal identifier, never a name, contact detail, answer or free text	European Union

Staff who sign in with a Google or Microsoft work account do so through that provider, under the customer's own agreement with it. Where a provider handles data outside the United Kingdom, it does so under the UK's adequacy regulations or the International Data Transfer Agreement. Changes to this list are notified to customers under the data processing agreement. Personal data is never sold and never used for advertising.

3. Security

• Encryption in transit and at rest Available Every connection to the product uses TLS, and Google Cloud encrypts the database and file storage at rest.
• Payment details under a separate key Available Bank and payment details a participant gives are encrypted a second time with a key held in a separate secret store, so a database export cannot reveal them. Staff and exports see the last four digits only, and the details themselves go only to whoever pays.
• Identity document images Available An image a participant uploads for an identity check is stored in London and deleted the moment the recruiter completes the check; the record of the check (date, checker, document type) is kept without the image. Anything nobody checks is deleted automatically after 14 days.
• App Check on every public endpoint Available The participant pages (apply, book, upload, payment details, identity check, call times) and the agency share pages reach the database only through server functions that require a verified Firebase App Check token and apply a rate limit per caller, so scripts and bots cannot read or write through them.
• Role-based access Available Each workspace's data is separated from every other's by security rules, and access within it is by role: owner, admin, member and project manager. Owners manage everyone, admins manage members and project managers, and removing a person revokes their sign-in at once. Staff sign in without passwords, by a code sent to their work email or through a work Google account. Access to the production system itself is limited to the RKC staff who need it.
• Audit logging Available Every data request, export, erasure and consent withdrawal is logged with who did it and when, including a participant's own views and downloads on the Your data page. Every text and email the product sends is recorded in a ledger with who it went to, what triggered it and its delivery result, and every change the platform operator makes to a workspace is logged with who made it and when.
• Error alerting Available Cloud Monitoring raises an alert to RKC within minutes on any server error and on any refused or failed text, email or accounting call, so a delivery problem is seen rather than found later.
• Backups and point-in-time recovery In progress Daily backups and point-in-time recovery of the production database are being switched on; until they are, no claim is made about recovery.

4. Standards

• MRS Code of Conduct Available The participant consent flow is built to the Market Research Society's Code of Conduct: each recruiter publishes a consent page in its own words, every participant is told who is collecting their data, why and how to withdraw before they apply, consent can be withdrawn at any time from the Your data page or by replying to a text, and nothing a participant gives is used for anything but the research they agreed to.
• ICO registration Available RKC Consultancy Limited is registered with the Information Commissioner's Office, registration number ZB171202. Each recruiter or agency, as controller, holds its own registration and shows it on its consent page.
• Cyber Essentials In progress Certification under the National Cyber Security Centre's Cyber Essentials scheme is in progress. No certificate is claimed until it is issued.

5. Contact

Data protection questions, requests for the data processing agreement and security questionnaires: hello@crh365.co.uk, or RKC Consultancy Limited, 167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom.