Marketing Research & Insight Privacy Notice

This privacy notice explains how the University of Warwick (“Warwick”, “UoW”, “us”, “we” and “our”) collects, uses and protects personal data when individuals participate in market research and insight activities conducted by the University’s Market Research and Insight (MRI) team.

The University of Warwick's Market Research and Insight (MRI) team is committed to undertaking market research to the highest standards of integrity, in line with the Market Research Society (MRS) Code of Conduct and in compliance with the relevant data protection legislation: the UK General Data Protection Regulation (UK GDPR) and the UK Data Protection Act 2018 (DPA).

Please note that this notice is for informational purposes only and does not form part of your contract of employment or any other contract to provide services.

What personal data do we collect and use?

As part of market research activities, the MRI team may collect, store and process a range of personal data. This may include, but is not limited to:

• Name
• Email address
• Institutional ID number (where applicable)
• Demographic information (e.g. age range, nationality, level of study, department or role)
• Survey responses and qualitative feedback
• Opinions, experiences and perceptions relating to University services
• Audio or video recordings from interviews, focus groups or research sessions
• Photographs or images (where participants consent to this)
• Technical data such as IP address or survey participation metadata
• Information relating to participation in Student Insight Panels or Staff Insight Panels

In most cases, responses are analysed and reported in aggregated or anonymised form, meaning individuals will not be identifiable in published outputs.

Special category personal data

In some research projects we may collect limited special category personal data, such as:

• Ethnicity
• Health or disability information
• Other diversity and inclusion characteristics

This information is collected only where necessary to understand the experiences of different stakeholder groups and to support equality, diversity and inclusion monitoring.

How do we obtain your personal data?

The University collects personal data relating to participants in market research activities through several methods.

This may include:

• Directly from you when you participate in surveys, focus groups, interviews or research panels
• When you register to join a student, staff, alumni or stakeholder insight panel
• Through personalised survey links sent to you by the University
• From University administrative systems where demographic information is used to ensure representative research samples

Participation in MRI activities is voluntary, and you may choose not to take part.

How do we use your personal data and which legal bases do we rely on?

The University processes personal data collected through MRI activities to support research and insight generation which helps inform University decision-making and improve services.

Purpose	Legal Basis
Conducting market research and insight activities to understand the experiences of staff, students, applicants and other stakeholders	Legitimate interests of the University
Analysing feedback to improve services, programmes, facilities and communications	Legitimate interests
Supporting institutional decision-making, planning and strategy	Legitimate interests
Conducting research relating to recruitment markets, competition and demand for University programmes	Legitimate interests
Managing research panels and inviting participants to take part in research activities	Legitimate interests
AI use to code survey responses	Legitimate interests
Recording interviews, focus groups or research sessions (where applicable)	Legitimate interests and/or consent
Using photographs, video recordings or identifiable media in research outputs	Legitimate interests and/or consent
Monitoring equality, diversity and inclusion within research samples	Substantial public interest and legitimate interests
To safeguard vulnerable individuals (e.g. children and vulnerable adults)	Recognised Legitimate Interests
To protect public/national security and defence (e.g. measures to help prevent harm and support safety)	Recognised Legitimate Interests
Emergency response (e.g. where there is a need to act in relation to events or situations that pose a threat or risk to human welfare and/or the environment)	Recognised Legitimate Interests
To detect, investigate or prevent crime, or apprehend or prosecute offenders	Recognised Legitimate Interests
To assist public bodies and bodies carrying out public tasks	Recognised Legitimate Interests

The University carefully considers whether its legitimate interests are balanced against the rights and freedoms of individuals before relying on this lawful basis.

In certain circumstances, the UoW may seek your written consent to process particularly sensitive data. If this occurs, UoW will provide you with comprehensive details regarding the information required and the reasons for its collection, allowing you to make an informed decision about whether or not to grant your consent.

Should you choose to provide consent for the collection, processing, and transfer of your personal data for a specific purpose, you retain the right to withdraw that consent at any time. To do so, simply contact us at infocompliance@warwick.ac.uk.

Once UoW is notified of your decision to withdraw consent, we will immediately cease processing your data for the purpose(s) you initially approved. However, if there is another lawful basis for continuing to process your data, we will notify you of this legitimate reason.

Which third parties may we share your personal data with and what legal bases do we rely on?

The University does not sell or rent personal data and will not share your information with third parties for marketing purposes.

In some cases, we may share personal data with trusted service providers who help us conduct research activities.

Third Parties	Legal Basis
Research software providers (e.g. survey platforms such as Qualtrics)	Legitimate interests / Performance of a contract
Qualitative research platforms (e.g. Qualzy)	Legitimate interests / Performance of a contract
External research agencies engaged to conduct research on behalf of the University	Legitimate interests / Performance of a contract
IT service providers supporting University systems	Legitimate interests
Professional advisers (e.g. auditors, legal advisers)	Legitimate interests
Regulatory or law enforcement authorities where required by law	Compliance with a legal obligation
In exceptional circumstances, where research responses indicate a safeguarding or wellbeing concern, the University may contact you to signpost relevant support services.	Legitimate interests/vital interests
Emergency services	Recognised Legitimate Interests
Law enforcement bodies/agencies	Recognised Legitimate Interests
Local authorities	Recognised Legitimate Interests
Healthcare providers	Recognised Legitimate Interests
Environmental protection and regulatory bodies	Recognised Legitimate Interests
Specialist safeguarding, welfare, security, or crisis management service providers	Recognised Legitimate Interests
Government departments, public bodies and other bodies carrying out legally authorised public tasks.	Recognised Legitimate Interests

We will only share your personal data with third parties where there is a lawful basis for doing so and appropriate safeguards are in place. We will never sell your personal data or share it with third parties for their own marketing purposes. Please note that, where we rely on your consent, you have the right to withdraw your consent at any time. If we need to transfer your personal data outside the UK, we will ensure that appropriate safeguards are put in place where required by data protection law. Further details of these safeguards can be provided upon request to Legal and Compliance Services.

How long do we keep your personal data?

The University retains personal data in accordance with its Records Retention Schedule.

Personal data will be kept only for as long as necessary for the purposes for which it was collected, including meeting legal, regulatory, accounting or reporting requirements.

Further information on retention periods can be found in the University Records Retention Schedule.

What rights do I have in relation to my personal data?

Data protection law gives you specific rights over your personal data, as follows:

• the right to access personal data held about you;
• the right to be informed about how and why your data is used;
• the right to have your data rectified, erased or restricted;
• the right to object to the processing of your data;
• the right to portability of your data; and
• the right not to be subject to a decision based solely on automated processing.

If you have concerns about how we use your personal data, you have the right to make a data protection complaint directly to us.

If you would like to make a data protection complaint directly to us, please complete and submit the form below providing as much information as possible:

https://warwick.ac.uk/services/legalandcomplianceservices/dataprotection/complaints/complaintform/

Once we have received your complaint, we will:

• acknowledge receipt of your complaint;
• review the matters raised and make appropriate enquiries; and
• keep you informed (where appropriate) and, without undue delay, report the outcome of your complaint to you.

If you are dissatisfied with the University’s response to your complaint, you have the right to escalate your complaint to the Information Commission's Office (the ICO). You can contact the ICO at www.ico.org.uk.

How can you obtain more information about this privacy notice?

If you have any questions about this privacy notice, please do not hesitate to contact our Data Protection team and/or Data Protection Officer at: infocompliance@warwick.ac.uk.

This privacy notice was last updated on 5 October 2026. We reserve the right to update or modify this notice at any time to reflect changes in legal requirements, operational needs, or best practices. Any significant changes will be communicated to relevant individuals through appropriate channels (e.g. on our website). The most recent version of the notice will always be available for your reference.