1. Who we are
OS Insights provides website evaluations, user research, usability testing, customer insights and survey design services. For information collected through our own website and business communications, OS Insights is the data controller.
Legal operator: OS Insights
Contact email: contact@osinsights.co.uk
2. What information we collect
Depending on your interaction with us, we may collect:
- Your name, business name, email address, website address and any phone number you provide.
- Details you submit in an enquiry, proposal request or other correspondence.
- Appointment details and information you voluntarily share during discovery calls.
- Project communications, contractual and billing records.
- Technical and security information necessary to deliver and protect the website, subject to the services actually enabled.
Please do not send sensitive personal information through the general enquiry form.
3. Why we use it and our lawful bases
- Responding to enquiries and preparing proposals: our legitimate interests in responding to business requests, or taking steps at your request before entering a contract.
- Delivering agreed services and managing client relationships: performance of a contract or legitimate interests, depending on the individual and circumstances.
- Accounting, tax and compliance: compliance with legal obligations.
- Website security and prevention of abuse: legitimate interests in maintaining a secure service.
We do not automatically subscribe enquirers to marketing emails. If we introduce marketing, we will assess and comply with the applicable UK marketing rules.
4. Enquiries and discovery calls
If you contact us through our website, we use the information to respond and, where appropriate, arrange a free discovery call. Our website is hosted by Netlify. Enquiries submitted through our website are processed by Netlify Forms and stored in our Netlify project. Our enquiry form also uses Google reCAPTCHA, provided through Netlify, to help detect automated submissions. Google may process technical information about your device and interaction with the CAPTCHA under its own privacy terms. We receive form notifications and respond using Google Workspace. Netlify may process submission information under its applicable service and data-processing terms. Booking and video calls may be managed through Google Workspace, Google Calendar and Google Meet. The precise form provider should be confirmed before publishing this policy.
5. Client research and survey data
For survey design services, clients normally select and control their own survey platform, distribute invitations and collect responses. The client is responsible for providing suitable privacy information and identifying an appropriate lawful basis for its data collection.
Where clients commission results analysis, we request anonymous datasets where reasonably possible. Removing names alone may not make a dataset anonymous, especially where free-text answers or combinations of characteristics could identify individuals.
If we process identifiable research participant data for a client, our respective roles, instructions, retention, security and any required data processing agreement will be agreed separately. For some research activities OS Insights may act as a processor; for others, roles may differ and will be assessed per project.
6. Providers and sharing
We may share relevant information with service providers used to operate our business, such as Netlify for hosting and Google Workspace for email, documents and appointments, and with project-specific tools where agreed. We do not sell personal data. We may also disclose information when legally required. Form submissions are processed by Netlify Forms. We use Google Workspace to manage business correspondence and appointments.
7. International transfers
Some suppliers may process personal information outside the UK. Where restricted transfers occur, we will identify and rely on an applicable UK adequacy regulation or another valid transfer mechanism, such as the UK International Data Transfer Agreement or UK Addendum, and complete any required assessment. The actual supplier locations and safeguards should be verified before publication.
8. Retention
We keep personal information only for as long as necessary for the relevant purpose. Our proposed retention schedule is:
- Unconverted enquiries: normally up to 12 months after the last meaningful contact.
- Client project communications and deliverables: normally up to 3 years after completion, unless a longer period is needed for a legitimate legal purpose.
- Financial and tax records: for the applicable legal retention period.
- Identifiable research data: for the project-specific period agreed with the client, then deleted or returned as agreed.
These are intended periods and must match our actual operating practices.
9. Security
We use reasonable technical and organisational safeguards, including restricted access, account protection, secure transfer methods and reputable service providers. No internet service can guarantee absolute security.
10. Cookies and similar technologies
The website may use technologies necessary to deliver and secure the site. We do not intend to deploy non-essential analytics or advertising cookies without providing the information and consent controls required by UK law. Embedded services or third-party integrations may change what technologies are used; we will review this section when those services are enabled.
11. Your rights
Depending on the circumstances and applicable exemptions, you may have rights to access, correct, erase, restrict or port your personal data, object to certain processing, and withdraw consent where consent is relied on. You may object to direct marketing at any time. Contact us using the details above. We will respond within the applicable legal timeframe.
12. Complaints
If you have concerns, please contact us first. You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk or 0303 123 1113.
13. Changes to this notice
We may update this notice to reflect changes in our services, providers or legal requirements. The updated date at the top indicates the latest revision.