Privacy Statement
for Research Participants
Version: 1.0
Last updated: 23 September 2026
1. Who is responsible for processing your personal data?
Blauw Research B.V. (‘Blauw’) is a Dutch market research agency, founded in 1993 and based in Rotterdam. We conduct research among customers and consumers on behalf of various clients.
Address
Coolsingel 55
3012 AB Rotterdam
The Netherlands
Email: privacy@blauw.com
Blauw has appointed a Data Protection Officer (DPO), who is registered with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). You can contact the DPO at privacy@blauw.com.
This privacy statement applies to participants in Blauw’s research (‘respondents’), including participants in surveys, interviews, focus groups, communities and panels. Visitors to our website www.blauw.com and our business contacts are covered by a separate privacy statement, which you can find at www.blauw.com.
Blauw is a member of the Data & Insights Network, the industry association that represents the interests of respondents, clients and providers of market research. We adhere to the Code of Conduct for Research and Statistics and work in line with the principles of ISO 20252 (market research), ISO/IEC 27001 (information security) and ISO/IEC 27701 (privacy management).
2. Two roles: commissioned research and our own research
Blauw processes respondents’ personal data in two different roles. The role that applies determines who is responsible for the processing and who you can contact with questions or requests.
Research commissioned by our clients
In most of our research, we act as a processor on behalf of our clients and on their instructions. Our client has provided us with your data and, as the controller, is responsible for the lawful processing of your data. When we invite you to take part in research, we will tell you the purpose of the research and, if you ask, who our client is. This allows you to check with the client that they have shared your data with us.
Our own research and platform recruitment
When we recruit respondents ourselves, for example for our own research platform or panel, we are the controller. When we collect your data, we will tell you how we use it and how long we keep it. This processing is based on your consent, which you can withdraw at any time.
3. What personal data do we process?
Depending on the research, we may process the following personal data:
● contact details, such as name, email address and telephone number;
● your answers to research questions;
● background characteristics relevant to the research, such as age group, region or household situation;
● special categories of personal data, such as data concerning health, ethnic origin, political opinions and religious or philosophical beliefs, only where this is necessary for the research and under the conditions described in section 5;
● audio and video recordings in qualitative research, only with your prior consent;
● technical data required to conduct online research, such as device and browser information;
● data required to pay compensation or incentives, where applicable.
We do not process more data than is necessary for the purpose of the research.
4. Why do we process your personal data?
We only process your personal data for research purposes:
● inviting respondents to take part in research;
● conducting the research and processing your answers;
● analysing research results for statistical purposes, for example to determine whether younger people hold different opinions from older people;
● recruiting and managing members of our own research platform;
● paying compensation or incentives, where applicable.
Your answers and personal data are only used for research activities. We will therefore never use them to sell you anything or send you commercial offers.
5. On what legal basis do we process personal data?
| Legal obligations (for example, the statutory tax retention obligation for incentives) | Legal obligation |
Because we use data for statistical research, the GDPR sets additional rules (Article 89 GDPR). These require us to take extra measures to protect your privacy. For example, we collect as little data as possible and separate your name from your answers as soon as possible. You can read which measures we take in section 6, and what these additional rules mean for your rights in section 13.
When processing is based on consent, you can withdraw this consent at any time. The withdrawal of your consent does not affect the lawfulness of processing prior to the withdrawal.
Special categories of personal data
Some research requires us to ask about special categories of personal data, such as your health. You are never obliged to answer these questions. We only ask for this data when it is necessary for the research, and we process it with extra safeguards, such as restricted access and pseudonymising or anonymising the data as early as possible.
6. Our safeguards for you as a respondent
Taking part in our research is always entirely voluntary. You are under no legal or contractual obligation to provide us with data. If you choose not to, there are no consequences for you, other than that you cannot take part in the research. You decide whether you take part, and you can stop at any time. If you no longer want to be invited to a particular study, you can use the unsubscribe link in the email invitation. Unless stated otherwise, this link applies to that study only. If you no longer want to be approached at all for research commissioned by a particular organisation, you can let that organisation know. As the controller of your data, it can record your objection to further contact. If you are not sure who to contact, we are happy to help at privacy@blauw.com. If you are a member of our own research platform, you can end your membership at any time.
In addition, we apply the following safeguards:
● we never report on you as an identifiable individual unless you have given us explicit consent; when we ask for that consent, we tell you who the data will be shared with and for what purpose;
● we do not keep your data in identifiable form for longer than necessary, and we pseudonymise or anonymise data as early as possible in the research process;
● we do not process more data than is necessary for the purpose of the research;
● we never sell your data to third parties and never use it for sales or marketing purposes;
● after the research has been completed, your personal data is deleted or anonymised as soon as possible, in line with the agreements made with our client.
7. Who do we share personal data with?
We only share respondents’ personal data when this is necessary to carry out the research:
● with our client, only in the form agreed with you; as standard, we report anonymised and aggregated data;
● with our client in qualitative research, when they observe sessions live or receive recordings, only if we have informed you in advance and you have given your consent;
● with suppliers of research software and data collection platforms that work on our behalf;
● with fieldwork and panel partners, when necessary for the research;
● with IT and hosting providers who keep our systems available and secure;
● with competent authorities, if we are legally required to do so.
Where legally required, we enter into data processing agreements with parties that process personal data on Blauw’s behalf.
8. International transfers of personal data
We only process respondents’ personal data within the European Economic Area (EEA). This also applies to the suppliers and systems we use for our research, such as research software, hosting and any AI applications used to analyse research data. Respondents’ personal data is not transferred to countries outside the EEA. You can request more information about this at privacy@blauw.com.
9. How long do we retain your personal data?
| Processing | Retention period |
|---|---|
| Research data from commissioned research | In line with the agreements made with the client; after the research has been completed, personal data is deleted or anonymised as soon as possible |
| Contact details for research invitations | Until the relevant study has been completed, or until you unsubscribe |
| Audio and video recordings | For the period stated when your consent was requested |
| Data of members of our own research platform | For as long as you are a member; your data is deleted when your membership ends |
| Data for paying incentives | 7 years, in line with the statutory tax retention period |
We do not keep personal data for longer than necessary for the purpose for which it was collected. We apply the retention periods below as a starting point:
Personal data that is no longer necessary is deleted or anonymised. Anonymised research results cannot be traced back to you and do not fall under the GDPR.
10. How do we secure your personal data?
Blauw takes appropriate technical and organisational measures to prevent loss, misuse, unauthorised access, alteration and unauthorised disclosure of personal data. Our security measures include secure connections, access management based on permissions, logging and monitoring, backup and recovery procedures and regular employee training. Blauw bases its information security and privacy management on the principles of ISO/IEC 27001 and ISO/IEC 27701.
11. Minors
Blauw does not directly approach young people under 16 to take part in research. When a study is specifically aimed at children or young people under 16, we approach them through their parents or guardians and ask the parents or guardians for consent.
12. Automated decision-making
We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
13. Your rights
Under the GDPR, you have a number of rights regarding your personal data. You can submit a request to:
● access your personal data;
● have inaccurate or incomplete data corrected;
● have your personal data deleted;
● have the processing of your personal data restricted;
● have your personal data transferred (data portability);
● object to certain processing;
● withdraw consent you have previously given.
Right to object. Blauw does not base its own processing on legitimate interest (see section 5); if you wish to stop, you can withdraw your consent. In commissioned research, the client may rely on legitimate interest. You can then object to the client on grounds relating to your particular situation. The client must then stop the processing, unless it has compelling legitimate grounds that override your interests. Your data is never used for direct marketing.
Exceptions for statistical research. For research we carry out ourselves, we may refuse a request for access, rectification or restriction in some cases. We only do this if the research could not otherwise be carried out properly. We are allowed to do this because we ensure that your data is only used for statistical research (see section 6). In commissioned research, our client decides on this.
Your other rights always apply. You can therefore always ask us to delete your data, object or withdraw your consent. We will only refuse a request for deletion if deletion would make the research impossible or seriously impair it (Article 17(3)(d) GDPR).
If we can no longer identify you. Sometimes we have already separated your name and contact details from your answers. In that case, we no longer know which answers are yours. If you still wish to exercise your rights, you can provide us with additional information that allows us to find your data.
You can submit your request to privacy@blauw.com. We will normally respond within one month. Depending on the complexity and number of requests, this period may be extended by two months. If so, we will let you know within the first month.
Please note: when we act as a processor on behalf of a client, that client is responsible for handling your request. In that case, we are happy to help you and, where possible, forward your request to the right party.
To process your request, we may ask you to verify your identity.
If we cannot fulfil a request, or can only partly fulfil it, we will let you know and explain why.
14. Complaints
If you have any questions about this privacy statement or how we handle your personal data, please contact us at privacy@blauw.com. Our Data Protection Officer will handle your query.
If we are unable to resolve the matter together, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). You can find more information at www.autoriteitpersoonsgegevens.nl.
15. Changes
Blauw may update this privacy statement from time to time, for example when legislation or our services change. The latest version is always
available at www.blauw.com. We recommend checking this privacy statement regularly.
16. Contact
If you have any questions about this privacy statement or the processing of personal data, please contact:
Blauw Research B.V.
Coolsingel 55
3012 AB Rotterdam
The Netherlands
Email: privacy@blauw.com
Version 1.0
Last updated: 23 September 2026
This privacy statement is a translation of the Dutch original. In the event of any discrepancy, the Dutch version prevails.
