Privacy Policy
Research Participants

Version: 1.0

Last updated: 23 September 2026

1. Who is responsible for processing your
personal data?

Blauw Research B.V. (“Blauw”) is a Dutch market research agency, founded in 1993
and based in Rotterdam. We conduct research among clients and consumers for
various clients.

Address

Coolsingel 55

3012 AB Rotterdam

Netherlands

Email: privacy@blauw.com

Blauw has appointed a Data Protection Officer (DPO), who is registered
with the Dutch Data Protection Authority. You can reach the DPO via privacy@blauw.com.

This privacy policy applies to participants in Blauw’s research
(“respondents”), including participants in questionnaires, interviews, focus groups,
communities, and panels. For visitors to our website www.blauw.com and for our
business relations, a separate privacy policy applies, which you can find at www.blauw.com.

Blauw is a member of the Data & Insights Network, the industry association that represents the interests of
respondents, clients, and providers of market research. We adhere to
the Code of Conduct for Research and Statistics and operate according to the principles of
ISO 20252 (market research), ISO/IEC 27001 (information security), and ISO/IEC 27701
(privacy management).

2. Two roles: commissioned research and own research

Blauw processes personal data of respondents in two different roles. Which role
applies determines who is responsible for the processing and where you can turn
with questions or requests.

Research commissioned by our clients

In the majority of our research, we act as a data processor on behalf of our
clients and according to their instructions. Our client has provided us with your data
and, as the data controller, is responsible for the lawful
processing of your data. When we invite you to participate in research, we will inform
you about the purpose of the research and, upon your request, who our client is. This allows you
to verify with the client that they have shared your data with us.

Own research and platform recruitment

When we recruit respondents ourselves, for example for our own research platform or
panel, we are the data controller. When collecting your data,
we will inform you about how we use your data and how long we retain it. This
processing takes place based on your consent, which you can withdraw at any time.

3. What personal data do we process?

Depending on the research, we may process the following personal data:

● contact details, such as name, email address, and telephone number;
● your answers to research questions;
● background characteristics relevant to the research, such as age category,
region, or family situation;
● special categories of personal data, such as data concerning health, ethnic origin,
religion or belief, or political preference, exclusively when this is necessary for the
research and under the conditions described in paragraph 5;
● audio and video recordings for qualitative research, exclusively with your prior
consent;
● technical data required for conducting online research, such as
device and browser information;
● data required for paying compensation or incentives, if
applicable.

We do not process more data than necessary for the purpose of the research.

4. Why do we process your personal data?

We process your personal data exclusively for research purposes:
● inviting respondents to participate in research;
● conducting the research and processing your answers;
● analysing research results for statistical purposes, for example,
to determine whether young people have a different opinion than older people;
● recruiting and managing members of our own research platform;
● paying compensation or incentives, if applicable.
Your answers and personal data will be used exclusively for
research activities and therefore never to sell you anything or send you commercial
offers.

5. On what legal bases do we process personal data?

Because we use data for statistical research, additional
rules apply under the GDPR (Article 89 GDPR). We must then take extra measures to protect your
privacy. For example, we collect as little data as possible and de-link your
name from your answers as soon as possible. What measures we take can be found in
paragraph 6. What these extra rules mean for your rights can be found in paragraph 13.

When processing is based on consent, you can withdraw this consent at any time. The withdrawal of your consent does not affect the lawfulness of processing prior to the withdrawal.

Special categories of personal data

Sometimes it is necessary for research to ask for special categories of personal data,
such as your health. You are never obliged to answer these questions. We only
ask for this data if it is necessary for the research and process it with extra
safeguards, such as limited access and pseudonymising or
anonymising the data as early as possible.

6. Our safeguards for you as a respondent

Participation in our research is always entirely voluntary. You are not legally or
contractually obliged to provide us with data; if you do not, it will have no consequences for
you, except that you cannot participate in the research. You decide whether you
want to participate and you can stop at any time. If you do not wish to be invited
again for research, you can use the unsubscribe link in the e-
mail invitation. This link applies, unless otherwise stated, to the specific research. If you
do not wish to be contacted at all for research commissioned by a specific
organisation, you can indicate this to that organisation. As the data
controller, they are responsible for your data and can record your objection to
further contact. If you do not know who to contact, we will gladly help you via
privacy@blauw.com. If you are a member of our own research platform, you can
terminate your membership at any time.

In addition, we apply the following safeguards:

● we never report on you as an identifiable individual, unless you have given us
explicit consent to do so; when requesting that consent,
we will tell you to whom and for what purpose the data will be passed on;
● we do not process your data in identifiable form longer than necessary and
pseudonymise or anonymise data as early as possible in the
research process;
● we do not process more data than necessary for the purpose of the research;
● we never sell your data to third parties and never use it for sales or
marketing purposes;
● after the research is completed, your personal data will be deleted or
anonymised as soon as possible, in accordance with the agreements with our
client.

7. With whom do we share personal data?

We only share respondents’ personal data when this is necessary for
conducting the research:

● with our client, exclusively in the form agreed with you; typically
report anonymised and aggregated data;
● with our client for qualitative research, when they observe live or
receive recordings, only if we have informed you in advance and you
have given your consent;
● with suppliers of research software and data collection platforms working on our
behalf;
● with fieldwork and panel partners, when necessary for the research;
● with IT and hosting providers who maintain and
secure our systems;
● with competent authorities, if we are legally obliged to do so.
With parties that process personal data on behalf of Blauw, we conclude data
processing agreements, if legally required.

8. International transfer of personal data

We process respondents’ personal data exclusively within the European
Economic Area (EEA). This also applies to the suppliers and systems we use for
our research, such as research software, hosting, and any AI-
applications for the analysis of research data. Respondents’ personal data
will not be transferred to countries outside the EEA. More information
about this can be requested via privacy@blauw.com.

9. How long do we retain your personal data?

We do not retain personal data longer than necessary for the purpose for which it was
collected. The retention periods below are used as a starting point:

When personal data is no longer necessary, it will be deleted or
anonymised. Anonymised research results cannot be traced back to you and are not subject
to the GDPR.

10. How do we secure your personal data?

Blauw takes appropriate technical and organisational measures to prevent loss, misuse, unauthorised access, alteration, and unlawful disclosure of personal data. Our security measures include secure connections, access control based on authorisations, logging and monitoring, backup and recovery procedures, and periodic employee training. Blauw organises its information security and privacy management according to the principles of ISO/IEC 27001 and ISO/IEC 27701.

11. Minors

Young people under the age of 16 are not directly approached by Blauw to participate
in research. When research specifically targets children or young people under
the age of 16, we approach them through their parents or guardians and ask the parents or
guardians for consent.

12. Automated decision-making

We do not make decisions about you based solely on automated processing that
have legal consequences for you or significantly affect you otherwise.

13. Your rights

Under the GDPR, you have various rights regarding your
personal data. You can request:

● access to your personal data;
● rectification of inaccurate or incomplete data;
● erasure of your personal data;
● restriction of processing;
● transfer of your personal data (data portability);
● to object to certain processing activities;
● to withdraw previously given consent.

Right to object. Blauw does not base its own processing activities on legitimate
interest (see paragraph 5); if you wish to stop, you can withdraw your consent. For commissioned
research, the client may rely on legitimate interest. You can then
object to the client if you have a reason related to your
personal situation. The client must then cease processing,
unless they have compelling legitimate grounds that override your interests. Your data
will never be used for direct marketing.

Exceptions for statistical research. For research that we conduct ourselves, we may
refuse a request for access, rectification, or restriction in some cases. We only
do this if the research cannot otherwise be carried out properly. We are allowed to do this because
we ensure that your data is only used for statistical research (see
paragraph 6). For commissioned research, our client decides on this.

Your other rights always remain valid. You can therefore always ask us to delete your data, object, or withdraw your consent. We will only refuse a request for deletion if the research becomes impossible or seriously hindered as a result (Article 17(3)(d) GDPR).

If we can no longer identify you. Sometimes we have already de-linked your name and contact details
from your answers. We then no longer know which answers are yours.
If you still wish to exercise your rights, you can provide us with additional information that allows us
to retrieve your data.

You can submit your request via privacy@blauw.com. We will generally respond within one
month. Depending on the complexity and number of requests, this period may be extended by two
months; we will inform you of this within the first month.
Please note: when we act as a data processor on behalf of a client, that
client is responsible for handling your request. In that case, we will gladly help you and,
where possible, forward your request to the correct party.

To process your request, we may ask you to prove your identity.
If a request cannot be carried out or can only be partially carried out, we will inform you
of this with an explanation.

14. Complaints

Do you have questions about this privacy policy or about how we handle your
personal data? Please contact us via privacy@blauw.com. Our
Data Protection Officer will handle your query.

If you cannot resolve the issue with us, you have the right to lodge a complaint with the
Dutch Data Protection Authority. More information can be found on
www.autoriteitpersoonsgegevens.nl.

15. Changes

Blauw may amend this privacy policy from time to time, for example, when legislation
changes or when our services change. The most current version will always be

published on www.blauw.com. We advise you to consult this privacy policy regularly
.

16. Contact

For questions about this privacy policy or about the processing of personal data, please
contact:

Blauw Research B.V.

Coolsingel 55

3012 AB Rotterdam

Email: privacy@blauw.com

Version 1.0

Last updated: 23 September 2026