1. Introduction

This privacy policy explains how Nerds Collective Ltd (“Nerds”, “we”, “us” or “our”) collects, uses, shares and protects your personal data, and sets out your rights in relation to that data. We respect your privacy and are committed to protecting your personal data. Please read this policy carefully so that you understand how and why we use your information.

We are a research, strategy and cultural marketing agency. Much of the personal data we handle belongs to people who take part in our research. This policy explains that in detail, and also covers everyone else whose data we hold.

Who we are

Nerds Collective Ltd is a limited company registered in England and Wales under company number 16188521. Our registered office and trading address is Unit B03 Mainyard Studios, 102 Rookery Court, London, E10 5FA. Our VAT number is 484087659.

We trade as “Nerds” and “Nerds Collective”. We are registered with the Information Commissioner’s Office (ICO) as a data controller under registration reference ZB874480. We are a Company Partner of the Market Research Society (MRS) and conduct our research in accordance with the MRS Code of Conduct.

Who is responsible for your data

Nerds Collective Ltd is the controller of, and responsible for, the personal data described in this policy, except where we state otherwise.

We have not appointed a Data Protection Officer, as we are not required to do so. Responsibility for data protection sits with our senior management team, who can be contacted using the details below.

How to contact us

If you have any questions about this policy or about how we handle your personal data, or if you wish to exercise any of your rights, please contact us by emailing info@nerdscollective.com

2. Who this policy covers

This policy applies to personal data we hold about:

• people who take part in our research, including focus groups, interviews, surveys, online communities and other consumer research activities (we refer to these together as “Research Activities”);
• parents and legal guardians who give consent for a child or young person to take part in Research Activities;
• people who join our research panel or database of potential participants;
•  visitors to our website at nerdscollective.com;
• people who contact us through our website contact form or by email;
• people who subscribe to our mailing list;
• contacts at our clients, prospective clients, suppliers and partners; and
• people who apply to work with us.

This policy does not cover personal data we hold about our employees and contractors in their capacity as such. That is covered by a separate internal privacy notice provided to them directly.

3. The personal data we collect

Personal data means any information about a living individual from which that person can be identified, either directly or indirectly. It does not include data where the identity has been permanently removed.

We may collect, use, store and transfer the following kinds of personal data:

Category	What it includes
Identity Data	First name, last name, username or similar identifier, title, age, date of birth and gender.
Contact Data	Postal address, email address and telephone number.
Profile Data	Your interests, preferences, opinions, feedback, survey and screener responses, and the views you express during Research Activities.
Recording Data	Audio and video recordings, photographs, transcripts, clips and screen recordings captured during Research Activities.
Guardian Data	For participants under 18: the name, contact details and signature of the parent or legal guardian who provides consent.
Payment Data	Bank account details or PayPal address used to pay research incentives, and records of payments made.
Usage Data	Information about how you use our website, including IP address, browser type, device type, pages viewed and time spent.
Marketing and Communications Data	Your marketing preferences, subscription status and your communications with us.
Special Category Data	Information about your racial or ethnic origin. We collect this only on specific projects, only where there is a genuine research need, and only with your explicit consent. See section 6.

 

We also use Aggregated Data, such as statistical or demographic data, for research and business purposes. Aggregated Data may be derived from personal data but is not personal data in law, because it does not directly or indirectly identify anyone. If we combine Aggregated Data with personal data so that it can identify you, we treat the combined data as personal data.

Data we do not collect

• We do not collect information about criminal convictions or offences. Our screeners and discussion guides do not ask about them.
• We do not collect information about your religious or philosophical beliefs, political opinions, trade union membership, health, sex life or sexual orientation, or genetic or biometric data.

4. How we collect your personal data

Directly from you

Most of the personal data we hold comes from you, when you:

• register or apply to take part in a Research Activity;
• complete a screener, survey or consent form;
• take part in a focus group, interview or other research session;
• give consent for us to add you to our research panel;
• subscribe to our mailing list;
• contact us by email or through our website; or
• apply to work with us.

From recruitment partners

We work with external recruitment and panel providers, currently Norstat and Discuss.io, who recruit participants for some of our projects. Where they recruit from their own panels, they act as independent data controllers and pass us the personal data needed to run the research. Their own privacy policies apply to the data they hold about you as a member of their panel.

Automatically, when you use our website

When you visit nerdscollective.com we collect Usage Data automatically through cookies and similar technologies. We only set non-essential cookies, including analytics cookies, where you have given consent. Full details are set out in the cookie section of our Terms and Conditions.

5. Children and young people

A significant part of our work involves research with young people. We take particular care with their personal data and follow the MRS Code of Conduct as well as data protection law.

Minimum age

We do not conduct research with anyone under the age of 13, and we do not knowingly collect personal data from anyone under 13 through our website or any other channel.

Consent for participants aged 13 to 15

A person aged 13 to 15 may take part in our research only where their parent or legal guardian has given explicit written consent, and only where that parent or legal guardian is present throughout the research session.

Consent for participants aged 16 and 17

A person aged 16 or 17 may take part in our research only where their parent or legal guardian has given explicit written consent. The parent or legal guardian must be the primary signatory to the consent form.

How guardian consent works

Before any research involving a participant under 18 takes place, we provide the parent or legal guardian with a clear explanation of the research, including its subject matter, methodology, format, timings, the incentive offered, and how the resulting data will be used. The parent or legal guardian must sign a consent form or research waiver before the participant takes part. We keep a record of that consent.

A parent or legal guardian may withdraw consent at any time, and the young person may choose to stop taking part at any time, without giving a reason and without affecting any incentive already agreed.

Age verification

We verify the age of participants through identity checks, carried out either by us directly or by our external recruitment partners.

Our website

Our website, mailing list and podcast are aimed at brands and industry professionals, not at children. They are not designed for or directed at anyone under 18.

6. How we use your personal data and our lawful bases

We only use your personal data where the law allows us to. In most cases we rely on one of the following lawful bases:

• Consent – where you have given us clear permission to use your personal data for a specific purpose. You can withdraw your consent at any time.
• Legitimate interests – where using your data is necessary for our legitimate business interests, and those interests are not overridden by your rights and freedoms.
• Performance of a contract – where using your data is necessary to perform a contract with you, or to take steps at your request before entering into one.
• Legal obligation -where we need to use your data to comply with the law.

The table below sets out how we use personal data and the lawful basis we rely on in each case. We may rely on more than one basis for a given purpose. If you would like more detail about the basis we rely on for a particular activity, please contact us.

Purpose	Data used	Lawful basis
To register you for, and enable you to take part in, a Research Activity	Identity, Contact, Profile, Guardian	Consent. For participants under 18, the consent of a parent or legal guardian.
To record research sessions and produce transcripts and analysis	Recording, Profile, Identity	Consent
To collect and analyse data about racial or ethnic origin where relevant to a project	Special Category	Article 6: consent. Article 9(2)(a): explicit consent.
To produce anonymised research findings and deliver them to our clients	Profile, Identity (anonymised)	Consent for the underlying collection. Legitimate interests in operating our business.
To pay research incentives	Identity, Contact, Payment	Performance of a contract with you, and legal obligation to keep accounting records.
To hold your details on our research panel and invite you to future projects	Identity, Contact, Profile	Consent
To manage our relationship with you, including responding to enquiries and notifying you of changes to our policies	Identity, Contact	Legitimate interests in running our business and keeping our records accurate.
To send you marketing emails about our work	Identity, Contact, Marketing and Communications	Consent
To manage our relationships with clients, prospective clients, suppliers and partners	Identity, Contact	Legitimate interests in developing and running our business. Performance of a contract where applicable.
To operate, secure and improve our website	Usage	Legitimate interests in keeping our site secure and understanding how it is used. Consent for non-essential cookies.
To consider applications to work with us	Identity, Contact, and the content of your application	Legitimate interests in recruiting staff and contractors. Steps taken at your request before entering into a contract.
To comply with our legal, accounting and regulatory obligations	Any relevant data	Legal obligation

 

Withdrawing your consent

Where we rely on your consent, you may withdraw it at any time by emailing info@nerdscollective.com. Withdrawing consent does not affect the lawfulness of anything we did before you withdrew it.

Please note that once research findings have been anonymised so that you can no longer be identified from them, that anonymised material is no longer personal data and we may continue to use it. Where anonymised findings have already been delivered to a client, we will not be able to recall them. We will always delete your identifiable personal data on request.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another compatible reason. If we need to use your personal data for an unrelated purpose, we will tell you and explain the lawful basis that allows us to do so.

7. Special category data

On some projects we collect information about racial or ethnic origin. This is what data protection law calls “special category data” and it receives additional protection.

We collect it only where there is a genuine and justifiable research need for the specific project, and only where you have given your explicit consent. Our lawful basis under Article 6 of the UK GDPR is consent, and our condition under Article 9 is Article 9(2)(a), explicit consent.

Before you give explicit consent, we will tell you what data we are asking for, why we need it for that project, and how it will be used. You are never required to provide it, and declining will not prevent you from taking part unless the project is specifically about that characteristic, in which case we will make that clear at the outset.

We handle all special category data in accordance with the MRS Code of Conduct.

8. Research recordings

Where a project requires it, we record research sessions. Whether a session is recorded varies by project, and we will always tell you before recording begins and obtain your consent, or that of your parent or legal guardian where you are under 18.

Recordings are made using encrypted platforms. We do not retain recordings in the cloud storage of the platform used to host the session; recordings are downloaded and stored securely in our Google Workspace environment with restricted access. We do not store recordings on local hardware.

We do not share raw recordings with our clients. Clients receive edited or anonymised outputs only, unless the exception in section 9 applies.

We do not use participant footage, images or attributed quotes in our own marketing, case studies, showreels, social media or podcast.

9. Who we share your personal data with

Our clients

We carry out research on behalf of client organisations. In the great majority of cases, our clients receive aggregated or anonymised findings only, and no personal data about you is shared with them.

We will only share personal data that identifies you with a client where a written data protection agreement is in place with that client and you have given your specific consent to that sharing. Where that applies, we will tell you who the client is and provide you with their privacy information before you consent.

Some projects are run on a blind or semi-blind basis, meaning the client is not disclosed to participants. We only do this where no personal data about you will be shared with the client.

Except where a written joint controller arrangement is in place for a specific project, we act as the sole data controller for the personal data we collect through our research.

Our service providers

We use third party service providers who process personal data on our behalf, under contract and on our instructions. The categories are:

Provider	Purpose	Location of processing
WP Engine	Website hosting	United States
Cloudflare	DNS, content delivery and website security	United States
Google (Google Workspace and Google Forms)	Email, document and file storage, screeners	United States
Zoom	Hosting remote research sessions	United States
Discuss.io	Hosting research sessions where we have recruited the participants	United States
PayPal	Payment of research incentives	United States
Brevo	Email marketing	European Economic Area (France)
Typeform	Screeners and surveys	European Economic Area (Spain)
Norstat	Participant recruitment (acts as an independent controller)	European Economic Area (Norway)

 

Where these providers act as our processors, they are bound by the data processing terms that form part of their standard contracts with us. They may only process your personal data on our documented instructions and for the purposes we specify, and they are subject to duties of confidentiality and security.

Discuss.io acts in two different capacities. Where Discuss.io recruits participants from its own panel, it acts as an independent data controller for that recruitment. Where we have recruited the participants ourselves and use the Discuss.io platform to host the research, Discuss.io acts as our processor.

Others

• Our professional advisers, including lawyers, accountants, auditors and insurers, where necessary.
• HM Revenue & Customs, regulators and other authorities where we are required to report or disclose.
• A purchaser or successor, if we sell, transfer or merge parts of our business. Any new owner would be required to use your personal data in accordance with this policy.

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.

10. International transfers

Some of the service providers listed above are based in the United States, which means your personal data may be transferred outside the United Kingdom.

Where we transfer personal data outside the UK, we rely on the safeguards required by UK data protection law. In practice this means the International Data Transfer Agreement or the UK Addendum to the European Commission’s standard contractual clauses, which are incorporated into the standard contractual terms of each of the providers concerned.

Transfers to providers in the European Economic Area, including Brevo, Typeform and Norstat, are covered by the UK’s adequacy regulations for the EEA and do not require additional safeguards.

If you would like more information about the safeguards that apply to a particular transfer, please contact us.

11. How long we keep your personal data

We keep personal data only for as long as we need it. Our standard retention periods are:

Type of data	Retention period	Reason
Participant personal data collected for a project, including names, contact details, screener responses and unanonymised transcripts	6 months from the end of the project	The period we need to complete analysis, respond to client queries and resolve any issues arising from the research.
Research recordings, clips and highlight reels	6 months from the end of the project	As above. Recordings are identifying data and are not retained beyond this period.
Anonymised research data (pseudonym, age and general location only)	Indefinitely	Once anonymised, this material is no longer personal data and has ongoing research and analytical value.
Consent forms and research waivers, including guardian consent	6 years. For participants under 18, until the participant reaches the age of 24.	To evidence that valid consent was obtained. The longer period for minors reflects that a limitation period does not begin to run until a person turns 18.
Research panel contact details	6 months from last contact	So that we can invite you to relevant future projects, unless you ask us to remove you sooner.
Incentive payment records	6 years from the end of the relevant financial year	Required by the Companies Act 2006 and HMRC.
Client contracts, invoices, project deliverables and business correspondence	6 years	The limitation period for bringing a contractual claim.
Mailing list subscriber data	Until you unsubscribe	You can unsubscribe at any time using the link in any marketing email.
Website enquiry correspondence	2 years from last contact	To maintain a record of business enquiries and our responses.
Unsuccessful job applications	6 months from the outcome	To respond to any query about the recruitment process.

 

We may keep personal data for longer where we are required to by law, or where we reasonably believe there is a prospect of a dispute or legal claim.

What we mean by anonymised

When we anonymise research data, we remove all directly identifying information and retain only a pseudonym, an age and a general location. We do not retain any key or index that would allow anonymised data to be matched back to a named individual. Once anonymised in this way, the data is no longer personal data and falls outside data protection law.

12. Data security

We have put in place appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, alteration or disclosure. These include:

• multi-factor authentication enforced across our Google Workspace environment, where research data is stored;
• access to research data restricted to employees only, granted on the basis of a demonstrated need to access it;
• access permissions reviewed regularly on a folder-by-folder and file-by-file basis, and revoked where no longer required;
• use of encrypted platforms to conduct and record research sessions; and
• a policy of not storing research recordings on local hardware or in third party platform cloud storage.

We limit access to your personal data to those employees and service providers who have a business need to know. Our service providers process personal data only on our instructions and are subject to duties of confidentiality.

We have procedures in place to deal with any suspected personal data breach, and we maintain a record of breaches. We will notify you and the ICO where we are legally required to do so.

13. Marketing

We send marketing emails about our work through Brevo.

We will only send you marketing emails where you have given us your consent, either by subscribing through our website or by opting in when you contact us.

You can unsubscribe at any time using the link at the bottom of any marketing email, or by emailing info@nerdscollective.com. Unsubscribing from marketing does not affect any other communications we send you, such as those relating to a research project you are taking part in.

We do not share your details with third parties for their marketing purposes, and we do not buy marketing lists.

14. Cookies

Our website uses cookies. Essential cookies are required for the site to function and are always set. Non-essential cookies, including Google Analytics, are only set where you have given your consent through our cookie banner.

You can change or withdraw your cookie preferences at any time using the cookie settings link on our website.

Full details of the cookies we use, what they do and how long they last are set out in the cookie section of our Terms and Conditions at nerdscollective.com/terms-and-conditions/#cookies.

15. Your legal rights

Under data protection law you have the following rights in relation to your personal data. These rights do not apply in all circumstances, and we will tell you if an exemption applies to your request.

• Access. You can ask for a copy of the personal data we hold about you, and information about how we use it.
• Correction. You can ask us to correct personal data that is inaccurate or incomplete. We may need to verify the accuracy of any new data you provide.
• Erasure. You can ask us to delete personal data where there is no good reason for us to continue holding it, where you have withdrawn your consent, or where we have processed it unlawfully.
• Objection. You can object to our use of your personal data where we rely on legitimate interests, if you believe it affects your rights and freedoms. You can always object to direct marketing.
• Restriction. You can ask us to suspend our use of your personal data, for example while we verify its accuracy or consider an objection you have raised.
• Portability. You can ask us to transfer your personal data to you or to another organisation in a structured, commonly used, machine-readable format. This applies to data you provided to us where we rely on consent or on a contract with you.
• Withdrawal of consent. Where we rely on your consent, you can withdraw it at any time. This does not affect the lawfulness of anything we did beforehand.

To exercise any of these rights, please email info@nerdscollective.com.

No fee usually required

You will not have to pay a fee to exercise your rights. We may charge a reasonable fee, or refuse to comply, if a request is clearly unfounded, repetitive or excessive, and we will explain our reasons if we do.

What we may need from you

We may ask you for information to confirm your identity before we act on a request. This is a security measure to ensure personal data is not disclosed to anyone who has no right to receive it. We may also ask you to clarify your request so that we can respond more quickly.

How long we take

We aim to respond to all legitimate requests within one month. If your request is complex, or if you have made a number of requests, it may take us longer. We will let you know and keep you updated.

Rights of children and young people

These rights belong to the young person, not to their parent or guardian. Where a participant is under 18, a parent or legal guardian may exercise these rights on their behalf, and we will consider the young person’s own views according to their age and understanding.

16. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at info@nerdscollective.com so that we have the opportunity to put things right.

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection:

•  Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

 

As an MRS Company Partner, we are also subject to the MRS Code of Conduct, and you may raise a concern about our research conduct with the MRS at mrs.org.uk.

17. Changes to this policy

We keep this privacy policy under regular review. Any changes we make will be published on this page, and the date at the top of the page will be updated. Where changes are significant, we will notify you directly if we hold your contact details.

It is important that the personal data we hold about you is accurate and current. Please let us know if your details change.

Last updated Monday 17th August 2026