Privacy Policy
ABA Market Research Limited (Kokoro Global, Zest Fieldwork, Konfidant and White Rooms) is committed to respecting your privacy. This notice explains how ABA Market Research Ltd complies with data protection law, what your rights are, and how we may use the personal information we collect before, during, and after your relationship with us as a customer.
ABA Market Research Ltd is the data controller of any of your personal information as defined in Article 4(7) of the UK GDPR. This notice applies to our current and former customers. This notice does not form part of any contract and is for informational purposes only. References to “we,” “our”, or “us” in this privacy notice are to ABA Market Research Ltd.
ABA Market Research Limited’s Data Protection Officer (‘DPO’) oversees our compliance with data protection legislation. Our ICO registration number is Z9921698. Our contact details are the following:
Email: DPO@kokoro-global.com
Postal Address: Kokoro Global, Hart House, 6 London Road, St Albans AL1 1NG
When you interact with ABA Market Research Ltd in relation to your relationship with us as a customer, you may provide us with, or we may obtain, personal data about you. We typically collect personal data about our clients through market research projects and platform sign-ups. We may sometimes collect additional information from third parties, including online business directories.
The table below describes the main purposes for which we process your personal data, the categories of information involved, and our lawful bases for doing so. It also includes the types of organisations we share your personal data with and how long we keep it.
| Data Collected | Purpose | Lawful Basis | Data Sharing | Retention |
| · Contact name
· Job Title · Organisation name · Business email · Business address · Telephone number · Social media handle · IP address |
To deliver the relevant information about the products and services you requested. | · Legitimate Interest
· Contractual obligation |
· Hosting provider | 6-years |
| · Contact name
· Job Title · Organisation name · Business email · Business address · Telephone number · Payment information |
Handle transactions for products and services and address any transaction issues. Process purchase requests made with payment cards. | · Contractual obligation
· Legitimate Interest |
· Software providers
· Finance and Payment card provider |
6-years after end of contract |
| · Contact name
· Job Title · Organisation name · Business email · Business address · Telephone number |
The actual delivery of products or services you purchased from us, whether in physical or digital form. | · Contractual obligation | · Software providers | 6-years after end of contract |
| · Contact name
· Job Title · Organisation name · Business email · Business address · Telephone number |
To communicate with you about any issue you raise or arise from our interaction. | · Contractual obligation | · Hosting providers | 6-years after end of contract |
| · Contact name
· Job Title · Organisation name · Business email · Business address · Telephone number · Meeting transcripts · Meeting recordings |
To carry out market research activities. | · Contractual obligation
· Legitimate Interest |
· Software providers | 2-years |
| · Contact name
· Job Title · Organisation name · Business email · Business address · Telephone number |
Client marketing | · Consent
· Legitimate Interest |
· Software providers | 6-years |
| · Contact name
· Job Title · Organisation name · Business email · Business address · Telephone number |
To fulfil our obligations to you as one of our customers in relation to your contract with us | · Legitimate Interest | · Software providers | 6-years |
| · Contact name
· Job Title · Organisation name · Business email · Business address · Telephone number |
To develop existing and new products that meet our client’s expectations and requirements. | · Legitimate Interest | · Hosting providers
· Where necessary, with professional services |
12-months unless anonymised |
| · Visitor name
· Organisation name · Car registration |
Health, and safety measures for onsite visitor management | · Legitimate interests | · Service providers
· Where necessary, with government agencies |
30-days or longer if there is an incident |
| · Contact name
· Organisation name · CCTV imagery |
Crime prevention, health, and safety measures for onsite meetings and focus groups. | · Legitimate interests | · Service providers
· Where necessary, with government agencies |
30-days or longer if there is an incident |
When we rely on the lawful basis of legitimate interest to process your personal data, we will inform you of these legitimate interests. Sometimes, you may be legally, contractually, or otherwise required to provide us with your personal information. If you choose not to provide this information, we might not be able to fulfil our contractual obligations or meet legal requirements. Even if there is no obligation, withholding your data might still prevent us from properly executing our contract with you.
If you have given us your consent to process your data, you can withdraw it at any time. However, withdrawing your consent won’t affect how we used your data before your withdrawal, and we may still have the right to hold and process your personal information based on other legal reasons. Keep in mind, withdrawing consent might mean we cannot offer certain services to you, similar to if you hadn’t provided the information.
Appropriate safeguards for international transfers are:
- Adequacy decisions.
- International Data Transfer Agreements (IDTA).
- Data Privacy Framework (DPF).
The following are categories of recipients to whom service user information could be transferred:
| Processor | Nature of Sharing | Data Transferred | Location | Transfer Safeguard |
| Microsoft Azure | Hosting provider | Personal data including platform users and AI prompts. | UK | Adequacy |
| Microsoft O365 | Office productivity apps | Personal data is contained in office apps used to communicate with clients, such as emails, team meetings and surveys. In addition, personal data will be stored in any office tools, e.g., reports. | UK | Adequacy |
| HubSpot | Cloud customer relationship manager | Personal data is contained in profiles to help manage client relationships. | UK | Adequacy |
| Twilio SendGrid | Cloud email delivery platform | Personal data is contained in transitional and notification emails | EU | Adequacy |
| CMAP | Professional services and resource management software | Personal data is contained in customer profile and reports. | Europe | Adequacy |
| Forsta Decipher | Quantitative surveys and reporting | Personal data contained in respondent surveys and insights. | Europe | Adequacy |
| QPSMR Limited | Market research questionnaire design | Personal data contained in respondent surveys and insights. | UK | Adequacy |
| Xero Limited | Cloud accounting provider | Personal data is contained in customer and supplier payment transactions and profiles. | New Zealand | Adequacy |
In some circumstances, such as under a court order, we are legally obliged to share information. We may also share information about you with third parties including government agencies and external auditors. For example, we may share information about you with HMRC to collect VAT.
ABA Market Research Limited is ISO 27001 and Cyber Essentials certified, and all our payment card processing complies with PCI DSS. We have what we believe are appropriate security controls in place to protect personal data. We work closely with industry experts to ensure we meet cybersecurity best practices. Risk assessment, including assessing risks to the rights and freedoms of data subjects, is at the heart of our management systems.
Where we provide links to other organisations’ websites, this privacy notice does not cover how those organisations process personal information. We encourage you to read the privacy notices on the other websites you visit.
As an individual, you have certain rights regarding our processing of your personal data, including a right to lodge a complaint with the Information Commissioner as the relevant supervisory authority. If you wish to exercise any of your rights concerning your personal data, you should contact ABA Market Research Limited’s Data Protection Officer at the address shown above.
Some of these rights are ‘absolute rights’, meaning you can exercise these rights as and when you like. Others are ‘qualified rights’, meaning certain conditions must be met for you to exercise these rights, or we can apply specific exemptions to prevent you from exercising these rights.
Right of Access (absolute): You have the right to obtain confirmation from ABA Market Research Ltd as to whether personal data concerning you is being processed and, where that is the case, access to that data.
Right to Rectification (absolute): You have the right to oblige us to rectify inaccurate personal data concerning you. Considering the purposes of the processing, you have the right to have incomplete personal data completed by providing a supplementary statement.
Right to Erasure (Right to be Forgotten) (qualified): You have the right (under certain circumstances, but not all) to oblige us to erase personal data concerning you.
Right to Restriction of Processing (qualified): You have the right (under certain circumstances, but not all) to oblige us to restrict the processing of your personal data. For example, you may request this if you are contesting the accuracy of personal data held about you.
Right to Data Portability (qualified): You have the right (under certain circumstances, but not all) to oblige us to provide you with the personal data about you in a structured, commonly used, and machine-readable format.
You also have the right to oblige us to transmit data to another controller.
Right to Withdraw Consent (absolute): If the lawful basis for processing is consent, you have the right to withdraw that consent.
Right to Object to Direct Marketing (absolute): Where your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for marketing, which includes profiling to the extent that it is related to such direct marketing.
Rights in Relation to Automated Decision-Making and Profiling (qualified): ABA Market Research Ltd does not perform any automated decision-making based on personal data that produces legal effects or similarly affects you.
Upon receiving your complaint, we will acknowledge receipt within 30 days, investigate the matter and take appropriate steps to resolve your concerns. We will keep you informed of the progress of our investigation and provide a final response without undue delay. Data may be shared internally for investigation or with the Information Commissioner’s Office (ICO) if the complaint is escalated
If you remain dissatisfied with our response, or if you believe we are not processing your personal data in accordance with the law, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection.
| Information Commissioner’s Office |
| Telephone: 0303 123 1113
Email: casework@ico.org.uk Web: https://ico.org.uk/for-the-public/ Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF |
Version 4.1 // Publish Date: 22-06-2026
