Craft & Scale Ltd. Privacy Policy

Last Updated: 8th October 2025

Your privacy is important to Craft & Scale Ltd (hereafter ‘Craft & Scale’).

If you have any concerns or queries about how we use your data, we encourage you to contact us promptly and directly.

Craft & Scale will always take great care in protecting the data you provide.

We will respond promptly and proactively to all data-related queries and concerns.

This policy explains how we collect, use, share and protect your personal data. By participating in market research we conduct, using our websites, or when supplying any data to Craft & Scale through other platforms, products or services, you consent to our use of your personal data under this Privacy Policy.

Only individuals aged 16 years of age or older should submit their data to Craft & Scale. By submitting your data to Craft & Scale through any platforms, products, services or portals (including those operated by third-parties), you confirm that you are 16 years of age or older.

The security of your personal data is important to us, but remember that no method of transmission over the Internet, or method of electronic storage, is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.

We reserve the right, at our discretion, to modify our privacy practices and update and make changes to this Privacy Policy at any time. If we make any changes, we will update our policy on this website.

Organisational Contact Details

Company: Craft & Scale Ltd

Registered Address: Units 4 & 5 Rockfield Business Park, Old Station Drive, Cheltenham, Gloucestershire, United Kingdom, GL53 0AN

Contact: contact @craftandscale.com

Information Commissioner’s Office (ICO) Registration number: ZA791508

Data Protection representative:  Joseph Morrison, Director

Data Protection contact: joe@craftandscale.com

The Purposes Of Our Data Processing

Craft & Scale collects personal data for the following purposes:

  • To undertake market research on behalf of our clients or for our own purposes
  • To effectively promote our products and services to potential and current clients
  • The ensure our websites, products and services are relevant and continuously improving to meet the needs of our clients
  • To enable efficiency in order processing, order administration and fulfilment, and in the management of client relationships.

Craft & Scale Privacy Policy Relating to Market Research Participants

Market Research Purposes - Types of Data Collected

As part of our market research work, we collect the following types of data:

  • Identifying data e.g. name, contact details (e.g. email address, phone number, address)
  • Demographic data e.g. age, gender, geographic location, family composition
  • Survey/interview data e.g. opinions, attitudes, behaviours and responses to research questions
  • Technical data: e.g. IP address, device type, cookie identifiers, audio/video recordings

Market Research Purposes - Collection of Special Category Data (Sensitive Data)

As part of our market research work, we sometimes also collect:

  • ‘Special Category Data’(as defined by UK GDPR) g. health information, race/ethnic origin, political opinions, religious beliefs
  • Sensitive data related to personal life history and circumstances e.g. experience of economic hardship, abuse or trauma

This data is only collected when strictly necessary for the research purpose and only with the participant’s explicit consent.

We commit to always processing and storing such data sensitively and securely.

Market Research Purposes - How and Why We Use Your Data

Core Purpose: We collect data to conduct market, social or opinion research and provide aggregated, non-identifiable insights to our clients.

Administration: To manage panel membership, contact participants for follow-up research, screen for eligibility and administer incentive payments/prize draws.

Quality Control: To validate responses (e.g. re-contacting a small percentage of participants).

Market Research Purposes – Our Lawful Basis for Processing

Consent (Article 6(1)(a) UK GDPR): For most market research participation we rely on informed, specific and freely given consent.

Your consent can be withdrawn at any time by contacting our Data Protection contact at the top of this Privacy Policy.

Legitimate Interests (Article 6(1)(f) UK GDPR): For administration and quality control purposes of our market research work. This is to ensure the work we deliver is accurate and high quality, and reduce the likelihood,  or impact, of fraud, deception, security risks and data breaches.

Explicit consent (Article 9(2)(a) UK GDPR): We collect and store data necessary for consent for Special Category Data collection.

Market Research Purposes – Data Ownership and Client Identity

For client market research work, Craft & Scale is the Data Processor and our clients are the Data Controllers. For market research completed for Craft & Scale’s own purposes, Craft & Scale is the Data Controller.

For most market research projects, the client receives aggregated and anonymised data. Clients may observe focus groups or focus group recordings but will not receive personal contact data of participants. Participants will be made aware and consent sought if such observations or access is to take place.

Market research clients will not receive personal, identifiable participant data unless the participant has given explicit permission.

Sometimes the client’s identity is not disclosed before market research participation. If the client is to receive personal data from the project, their identity will be disclosed and consent sought before any personal data is shared.

Market Research Purposes – Commitment on Data Collected in Market Research

Commitment against ‘Sugging' and ‘Fugging’: Craft & Scale assures that market research it conducts is purely for research purposes and data collected will never be used for direct marketing or selling (known as ‘Sugging’ – Selling Under the Guise of Research, or ‘Fugging’ – Fundraising Under the Guise of Research).

Market Research Purposes – How We Share and Disclose Market Research Participant Data

Sharing with market research clients: Our standard practice in market research is that personal data shared is anonymised and pseudonymised before being shared with the client. Unless agreed otherwise with research participants, market research reports and analysis are either reported in aggregate data, or individual responses are stripped of identifying data.

As an example, if you provide your opinion in market research, we may share what you said with our client, alongside demographic or profiling details (e.g. approximate age, customer type) but not in a way that personally identifies you (or enables them to identify you) or enables them to contact you).

Occasionally, permission is sought to share your identity with the client to enable further insight, to enable the client to access a research recording, or to enable a further phase of research. In such circumstances your personal data or identity will only be shared with your explicit permission.

Sharing with third party providers: We may use the following categories of third parties to deliver market research projects:

  • IT and hosting providers (e.g. cloud storage, survey platforms)
  • Market research recruiters, panel providers
  • Market research agencies, consultants and freelancers
  • Incentive/payment providers (e.g. voucher agencies)
  • Quality control providers
  • Data analysis, reporting and transcription services (including the potential use of Artificaial Intelligence (AI) services and products)

All third party providers are subject to strict contractual agreements in accordance with Article 28 UK GDPR.

International transfers: Personally identifiable data generated from market research is stored and processed by Craft & Scale in the UK or the EEA only.

Non-identifiable data may be transferred outside the UK or EAA and processed by third parties e.g. for the purposes of analysis or transcription. Directly identifiable data (e.g. full names, email addresses) are removed before such data transfers are undertaken. Participants should be aware that data they share in research (e.g. during an interview or in a survey) could indirectly make them identifiable if there were to be a data breach. Craft & Scale takes care to select credible partners, takes steps to limit access and protect such data, and ensures relevant data is deleted within 30 days after the project purpose is completed.

Market Research Purposes – Storage, Security and Retention

Data retention periods: We will only keep data for as long as necessary for the purpose it was collected. Raw data is anonymised and personally identifiable data (e.g. contact data) is deleted six months after a project closes, unless participants are explicitly informed that data will be retained or deleted within a different time period.

Data security measures: All market research data, including personally identifiable (e.g. contact data) and Special Category Data is stored and processed securely by Craft & Scale at all times. Access is restricted only to those required to deliver the project that data is collected for. Secure servers, password protection, two-factor authentication and robust contracting are used to minimise the risk of data breach or accidental disclosure.

Market Research Purposes – Your Data Protection Rights as Research Participants

If you participate in market research conducted by Craft & Scale you have the following rights under GDPR UK:

  • Right to be informed: This is covered by this policy (craftandscale.com/privacy-policy).
  • Right of access: You have the right to request a copy of the personal data we hold about you.
  • Right to rectification: You have the right to have inaccurate data we hold about you corrected.
  • Right to erasure (‘right to be forgotten’): You have the right to request deletion of personal data (note that we may retain anonymised data you have submitted for research purposes only)
  • Right to restrict processing: You have the right to limit how we use the data you submit to us.
  • Right to data portability: You have the right to receive personal data in a usable format.
  • Right to object: You have the right to object to processing based on legitimate interests.
  • Rights related to automated decision making and profiling: You have the right to confirmation on whether we use your data for solely automated decision-making.

Market Research Purposes – Contact and Complaints

How to contact us: Contact our Data Protection contact at the top of this Privacy Policy via email for any rights requests, questions or concerns. We will endeavour to respond to you promptly, with a guaranteed response within 30 working days.

Standards we abide by: All research projects undertaken by Craft & Scale are conducted in accordance with the Code of Conduct of the Market Research Society (MRS). Details of the Code can be found at mrs.org.uk/standards/code-of-conduct.

Complaining to the regulator: You have the right to lodge a complaint with the supervisory authority, which in the UK is the Information Commissioner’s Office (ICO).  They can be contacted at ico.org.uk/make-a-complaint.

Market Research Purposes – Updates to our policy

This policy is regularly updated and the most recent version is published on craftandscale.com/privacy-policy.

Craft & Scale Commercial Privacy Policy

The following applies to Craft & Scale’s commercial work for purposes other than market research.

When engaging with Craft & Scale’s websites, products, services and third-party portals (such as Calendly, Stripe, Mailchimp or Zoom), we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you. Personally identifiable information may include, but is not limited to:

  • Email address
  • First name and last name
  • Phone number
  • Address, State, Province, ZIP/Postal code, City
  • Details about your businesses, for example your objectives, performance, challenges and risks
  • Details about your personality, for example your personal ambitions, communication style, your working practices and personality traits
  • Usage data collected automatically when using our products, services or websites.

Usage data may include information such as your device's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our websites or services that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers, whether you open and engage with our emails and other diagnostic data. We may also collect information that your browser or device sends whenever you visit our products, services or websites.

There is additional Information about how we use Cookies and similar technologies, and how you can control their use, at the end of this Privacy Policy.

When you provide your personal data to Craft & Scale, you grant us permission to store that data and communicate with you for the purposes specified above.

You can opt-out of communications, or specify the communications you wish to receive, either by using links or tools Craft & Scale provides for such purposes, or by contacting us directly via: contact@craftandscale.com. Changing or withdrawing consent may prevent Craft & Scale from fulfilling its contractual obligations to you.

Consent To Record And Publish Your Engagement With Craft & Scale

When you provide your personal data in exchange for access to Craft & Scale marketing, content, events, products and services, your subsequent engagement in that marketing, content, events, products and services may be recorded. Such recording may be published publicly. You will be informed at the start of such engagements if it is to be recorded; this provides you with the opportunity to withdraw your participation. By continuing your participation, you permit Craft & Scale to use, share and publish such recordings to promote Craft & Scale, and to provide value for other customers and potential customers. You should be aware that published recordings could include the following:

  • Your personal image
  • Your presence, participation or use of an event, product or service
  • Your name and/or business
  • Any content you generate during participation
  • Any views or opinions you express during participation
  • Any data or information you share during participation

 

The Lawful Basis For Our Data Processing

Craft & Scale will only process your personal data if we have a lawful basis for doing so. Lawful bases for processing include consent, contractual necessity and our “legitimate interests” or the legitimate interest of others, as further described below.

Contractual Necessity: We process the following categories of personal data as a matter of “contractual necessity,” meaning that we need to process the data to perform under our Terms of Business with you, which enables us to provide you with services and products. When we process data due to contractual necessity, failure to provide such personal data will result in your inability to use some or all portions of the products and services that require such data.

  • First and last name
  • Email address
  • User Content about yourself and/or your business (which can include personal data if you include personal data in such content)
  • IP address
  • Billing address, postcode/zip code and/or country of residence

Legitimate Interest: We process the following categories of personal data when we believe it furthers the legitimate interest of us or third parties.

  • First and last name
  • Email address
  • User Content about yourself and/or your business (which can include personal data if you include personal data in such content)
  • IP address
  • Billing address, postcode/zip code and/or country of residence

 

Examples of these legitimate interests include:

  • Protection from fraud or security threats
  • Operation and improvement of our business, products and services
  • Marketing of our products and services, directly to you and to others
  • Provision of customer support
  • Compliance with legal obligations
  • Completion of corporate transactions

Consent: In some cases, we process personal data based on the consent you expressly grant to us at the time we collect such data. When we process personal data based on your consent, it will be expressly indicated to you at the point and time of collection.

Other Processing Grounds: From time to time we may also need to process personal data to comply with a legal obligation, if it is necessary to protect the vital interests of you or other data subjects, or if it is necessary for a task carried out in the public interest.

Potential Third-Party Access And Processing Of Your Personal Data

Craft & Scale uses your personal data to provide high value, relevant products and services.

Through accessing our websites, marketing, content, products and services, some of your data may be tracked or recorded by third parties; see sections on usage data and Cookies elsewhere in this Privacy Policy.

To enable Craft & Scale to deliver high quality products, services and functional websites, your data may be stored and/or processed by third-party providers e.g. payment providers, webinar hosting services, calendar scheduling services, email and cloud storage providers.

Craft & Scale uses Mailchimp as its marketing platform. By subscribing to Craft & Scale’s marketing communications you acknowledge that your information will be transferred to Mailchimp for processing. Learn more about Mailchimp's privacy practices here: https://mailchimp.com/legal/terms/

Craft & Scale treats the data it collects with great care and while we take steps to secure and protect the data we hold, we cannot be held accountable for third-party vulnerabilities and data breaches. By engaging with Craft & Scale and supplying data through its website, products and services, you accept this risk.

Potential Access And Processing Of Your Personal Data Outside The EEA

Although Craft & Scale’s offices are based within the United Kingdom, we (or a third party acting on our behalf) may transfer your personal data outside the European Economic Area (EEA). By providing us with your data, you consent to us (or third parties acting on our behalf) transferring your information outside the EEA.

Your rights concerning your personal data are listed below.

To exercise any of these rights, please submit your request. We will carry out any request to the extent required by applicable law.

  • The right of access: you can ask to see the personal data and information we hold about you (along with certain other details) and we will show you free of charge (restrictions apply). We’ll need you to verify who you say you are.
  • The right to rectification: if the data we hold about you is inaccurate or incomplete, you’re entitled to have it rectified. If we’ve shared your information with others, we’ll let them know about the rectification where possible. If you ask us, we’ll also tell you who we’ve shared your data with.
  • The right to erasure: you can ask us to delete or remove your data in some circumstances, such as where we no longer need it or you withdraw your consent (where applicable). If we’ve shared your data with others, we’ll let them know about the erasure where possible.
  • The right to restrict processing: you can ask us to ‘block’ or suppress the processing of your data in certain circumstances, such as where you contest the accuracy of that information or object to us processing it. It won’t stop us from storing your data but we’ll tell you before we lift any restriction. If we’ve shared your information with others, we’ll let them know about the restriction where possible.
  • The right to data portability: you have the right, in certain circumstances, to obtain data you’ve provided us with (in a structured, commonly used and machine readable format) and to reuse it elsewhere.
  • The right to object: you can ask us to stop processing your data if we are: relying on our own or someone else’s legitimate interests to process your data; processing your data for direct marketing; or processing your data for research.
  • The right to withdraw consent: if we rely on your consent (or explicit consent) as our legal basis for processing your data, you have the right to withdraw that consent at any time.
  • The right to complain: if you have a concern about the way we’ve handled your personal data, you can report it to the UK regulator, Information Commissioner’s Office (ICO). You can find details about how to do this on the ICO website at: https://ico.org.uk/concerns/ or by calling the helpline on 0303 123 1113.

Retention Periods For Your Personal Data

Craft & Scale will retain your personal data only for as long as is necessary for the purposes set out in this Privacy Policy. Craft & Scale periodically reviews and deletes personal data it holds, that it considers unfit for the purposes set out in this Privacy Policy.

Craft & Scale will retain and use your personal data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

Craft & Scale will also retain usage data for internal analysis purposes. Usage data is generally retained for a shorter period of time, except when this data is used to improve the security or performance of our websites, products and services, or we are legally obligated to retain this data for longer time periods.

Additional Information About Cookies And Similar Technologies

Craft & Scale uses cookies and similar technologies such as pixel tags, web beacons, clear GIFs, and JavaScript (collectively, “Cookies”) to enable our servers to recognise your web browser and tell us how and when you visit and use our websites, products and services, to analyse trends, learn about our user base and operate and improve our products and services.

 

Cookies are small files – usually consisting of letters and numbers – placed on your computer, tablet, phone, or similar device when you use that device to visit our websites or online products, services and portals. We sometimes combine information collected through Cookies that is not personal data with personal data that we have about you, for example, to tell us who you are or whether you have an account with us. We may also supplement the information we collect from you with information received from third parties.

Cookies can either be “session Cookies” or “persistent Cookies”. Session Cookies are temporary Cookies that are stored on your device while you are visiting our websites or using our online products, services or portals, whereas “persistent Cookies” are stored on your device for a period of time after you leave our websites or online products, services or portals. The length of time a persistent Cookie stays on your device varies from Cookie to Cookie. We use persistent Cookies to store your preferences so that they are available for the next visit, and to keep a more accurate account of how often you visit our website, products or services, how often you return, how your use varies over time. We also use persistent Cookies to measure the effectiveness of advertising efforts.

 

Through these Cookies, we may collect information about your online activity after you leave our website, products or services. Your browser may offer you a “Do Not Track” or “DNT” option, which allows you to signal to operators of websites, and web applications, and services that you do not wish such operators to track certain of your online activities over time and across different websites. Because we collect browsing and persistent identifier data, our website, products and services may not support Do Not Track requests, which means that we may collect information about your online activity both while you are using our websites or online products, services or portals, and after you leave our properties.

Some Cookies are placed by a third party on your device and may provide information to us and third parties about your browsing habits (such as your visits to our websites or online products, services or portals, the pages you have visited and the links and advertisements you have clicked). These Cookies can be used to determine whether certain third party services are being used, to identify your interests, to retarget advertisements to you and to serve advertisements to you that we or others believe are relevant to you. We do not control third party Cookies.

We use the following types of Cookies:

  • Essential Cookies. Essential Cookies that are required for providing you with features or services that you have requested. For example, certain Cookies enable you to log into secure areas of our websites or online products, services or portals. Disabling these Cookies may make certain features and services unavailable.
  • Functionality Cookies. Functional Cookies are used to record your choices and settings regarding our websites or online products, services or portals, maintain your preferences over time and recognise you when you return to our properties. These Cookies help us to personalise our content for you, greet you by name, and remember your preferences (for example, your choice of language or region).
  • Performance/Analytical Cookies. Performance/Analytical Cookies allow us to understand how visitors use our websites and online products, services and portals such as by collecting information about the number of visitors to a website, what pages visitors view on our website, and how long visitors are viewing pages on the website. Performance/Analytical Cookies also help us measure the performance of our advertising campaigns in order to help us improve our campaigns and the content for those who engage with our advertising. For example, Alphabet Inc. (“Google”) uses cookies in connection with its Google Analytics services. Google’s ability to use and share information collected by Google Analytics about your visits to the Services is subject to the Google Analytics Terms of Use and the Google Privacy Policy. You have the option to opt out of Google’s use of cookies by visiting the Google advertising opt-out page at https://www.google.com/privacy_ads.html or the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout/ .
  • Retargeting/Advertising Cookies. Retargeting/Advertising Cookies collect data about your online activity and identify your interests so that we can provide advertising that we believe is relevant to you.

 

You can decide whether or not to accept Cookies. One way you can do this is through your internet browser’s settings. Most browsers have an option for turning off the Cookie feature, which will prevent your browser from accepting new Cookies, as well as (depending on the sophistication of your browser software) allow you to decide on acceptance of each new Cookie in a variety of ways. You can also delete all Cookies that are already on your computer. If you do this, however, you may have to manually adjust some preferences every time you visit a website and some products, services and functionalities may not work (including Craft & Scale’s).

To explore what Cookie settings are available to you, look in the “preferences” or “options” section of your browser’s menu. To find our more information about Cookies, including information about how to manage and delete Cookies, please visit https://ico.org.uk/for-the-public/online/cookies/ or https://www.allaboutcookies.org/.

If you click on or otherwise interact with an advertisement there is a possibility that the advertiser may place a Cookie in your browser and note that it meets the criteria they selected.