Privacy Policy

1. Introduction

ABA Market Research Limited (Kokoro Global, Zest Fieldwork and Whiterooms) is committed to respecting your privacy. This notice explains how ABA Market Research Ltd complies with the law on data protection, what your rights are, and how we may use the personal information we collect before, during and after your relationship with us as a customer.

ABA Market Research Ltd is the data controller of any of your personal information as defined in Article 4(7) of the UK GDPR. This notice applies to our current and former customers. This notice does not form part of any contract and is for informational purposes only. References to “we,” “our”, or “us” in this privacy notice are to ABA Market Research Ltd.

ABA Market Research Limited’s Data Protection Officer (‘DPO’) oversees our compliance with data protection legislation. Our ICO registration number is Z9921698

Our contact details are the following:

Email: DPO@kokoro-global.com

Postal Address: Kokoro Global, Hart House, 6 London Road, St Albans AL1 1NG

When you interact with ABA Market Research Ltd in relation to your relationship with us as a customer, you may provide us with, or we may obtain, personal data about you.

We typically collect personal data about customers through market research, either directly from respondents, customers, or their employers. We may sometimes collect additional information from third parties, including online business directories.

If you are providing us with details of your employees, they have a right to know and to be aware of what personal information we hold about them, how we collect it, how we use it, and how we may share that information. Please share this notice with those of them who you feel have the capacity to understand it. They also have the same rights as set out in the “Your Rights In Relation To This Processing” section below.

The table below describes the main purposes for which we process your personal data, the categories of information involved, and our lawful bases for being able to do this. It also includes the types of organisations we share your personal data with and how long we keep your personal data.

Data Collected Purpose Lawful Basis Data Sharing Retention Period
Organisation name
Full name
Email address
Telephone number
Position
Office address
IP address		 To provide appropriate online or email information about products and services that you have requested.
  • Legitimate Interest
  • Contractual fulfilment
  • Hosting provider
 6-years
Organisation name
Full name
Email address
Telephone number
Position
Office address
IP address		 To process purchase transactions for products and services with customers, and to ensure any transaction issues can be dealt with. To fulfil purchase requests using payment cards
  • Consent
  • Legitimate Interest
  • Hosting provider
  • Finance and Payment card provider
 6-years
Full name
Email address
Telephone number
Billing address
Payment card details
IP address		 Actual delivery of products or services, in physical or digital form, that you may have purchased from us.
  • Contract (If you are a sole trader)
  • Legitimate Interest (If you are an employee of a company)
  • Hosting providers
  • Software providers
 6-years
Organisation name
Full name
Email address
Telephone number
Position
Office address
IP address		 To communicate with you about any issue that you raise with us or which follows from an interaction between us.
  • Contract (If you are a sole trader)
  • Legitimate Interest (If you are an employee of a company)
  • Hosting providers
 6-years
Full name
Email address
Telephone number
Office address
IP address
Images (Still and live)		 To conduct market research activities
  • Consent
  • Legitimate Interest
  • Hosting providers
  • Software providers
 2-years
Organisation name
Full name
Email address
Telephone number
Position
Office address
IP address		 To send you marketing communications
  • Consent
  • Legitimate Interest
  • Hosting providers
  • Software providers
 6-years
Organisation name
Full name
Email address
Telephone number
Position
Office address
IP address		 To fulfil our obligations to you as one of our customers in relation to your contract with us
  • Contract (If you are a sole trader)
  • Legitimate Interest (If you are an employee of a company)
  • Hosting providers
  • Software providers
 6-years
Organisation name
Full name
Email address
Telephone number
Position
Office address
IP address		 To develop existing and new products that meet the expectations and requirements of our customers.
  • [Contract (If you are a sole trader)
  • Legitimate Interest (If you are an employee of a company)
  • Hosting providers
  • Where necessary, with professional services
 Anonymised for statistical research, this data may be kept indefinitely.
Where not anonymised, it shall be retained for a maximum of 12-months

When we rely on the lawful basis of legitimate interest to process your personal data, we must tell you what these legitimate interests are. The legitimate interests we rely on are as follows:

  • In relation to our contract with your organisation.
  • In relation to sending marketing research messages to you.

Where you have given us your consent to use your personal information, you have the right to withdraw this consent at any time. You may do this by contacting us as described in the “Contact Details” section above.

Please note that the withdrawal of your consent will not affect any use of the data undertaken before consent is withdrawn, and we may still be entitled to hold and process relevant personal information on bases other than consent. Withdrawing consent may also have the same effects as not providing the information at all; for example, we may no longer be able to provide certain services to you.

In some cases, you will have a legal, contractual, or other requirement or obligation to provide us with your personal information. If you do not provide us with the requested personal information, we may not be able to properly perform our contract with you or comply with legal obligations. In cases where you are not under an obligation to provide such information, failing to provide it may still mean we are not able to properly perform our contract with you.

ABA Market Research Ltd is required to transfer the personal information provided by its service users to third parties to fulfil contractual obligations.

Where necessary, we may transfer personal information outside of the UK. When doing so, we comply with the UK GDPR and ensure appropriate safeguards are in place.

Where necessary, our data processors may share personal information outside of the UK. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place.

Appropriate safeguards for international transfers are:

  • Adequacy decisions
  • International Data Transfer Agreements (IDTA)
  • Standard Contractual Clauses (SCC)

Please get in touch with us using the details found in the “Contact Details” section for more information on our use of international transfers.

The following are categories of recipients to whom service user information could be transferred:

Data Processor Nature of Sharing Data Transferred Location Transfer Safeguard
Microsoft Corporation Cloud hosting provider and apps Personal data is contained in emails created by service user and stored in applicable cloud products. UK DPA
Xero Limited Cloud accounting provider Personal data is contained in customer and supplier payment transactions and profiles. New Zealand DPA
Forsta Quantitative surveys and reporting Personal data contained in respondent surveys and insights. Europe DPA
QPSMR Limited Market research questionnaire design Personal data contained in respondent surveys and insights. UK DPA
Catalys2 Hosting provider Personal data including opinion is contained in databases from respondent surveys. UK DPA
CMAP Professional services and resource management software Personal data is contained in customer profile and reports. Europe DPA

In some circumstances, such as under a court order, we are legally obliged to share information. We may also share information about you with third parties including government agencies and external auditors. For example, we may share information about you with HMRC to collect VAT.

ABA Market Research Limited is ISO 27001 and Cyber Essentials certified, and all our payment card processing complies with PCI DSS.

We have what we believe are appropriate security controls in place to protect personal data. We work closely with industry experts to ensure we meet cybersecurity best practices. Risk assessment, including assessing risks to the rights and freedoms of data subjects, is at the heart of our management systems.

As an individual, you have certain rights regarding our processing of your personal data, including a right to lodge a complaint with the Information Commissioner as the relevant supervisory authority.

Some of these rights are ‘absolute rights’, meaning you can exercise these rights as and when you like. Others are ‘qualified rights’, meaning certain conditions must be met for you to exercise these rights, or we can apply specific exemptions to prevent you from exercising these rights.

Right of Access (absolute): You have the right to obtain confirmation from ABA Market Research Ltd as to whether personal data concerning you is being processed and, where that is the case, access to that data.

Right to Rectification (absolute): You have the right to oblige us to rectify inaccurate personal data concerning you. Considering the purposes of the processing, you have the right to have incomplete personal data completed by providing a supplementary statement.

Right to Erasure (Right to be Forgotten) (qualified): You have the right (under certain circumstances, but not all) to oblige us to erase personal data concerning you.

Right to Restriction of Processing (qualified): You have the right (under certain circumstances, but not all) to oblige us to restrict the processing of your personal data. For example, you may request this if you are contesting the accuracy of personal data held about you.

Right to Data Portability (qualified): You have the right (under certain circumstances, but not all) to oblige us to provide you with the personal data about you in a structured, commonly used, and machine-readable format.

You also have the right to oblige us to transmit data to another controller.

Right to Withdraw Consent (absolute): If the lawful basis for processing is consent, you have the right to withdraw that consent.

Right to Object to Direct Marketing (absolute): Where your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for marketing, which includes profiling to the extent that it is related to such direct marketing.

Rights in Relation to Automated Decision-Making and Profiling (qualified): ABA Market Research Ltd does not perform any automated decision-making based on personal data that produces legal effects or similarly affects you.

If you wish to exercise any of your rights concerning your personal data, you should contact ABA Market Research Limited’s Data Protection Officer at the address shown above. If you are not satisfied with the response you receive, you have the right to lodge a complaint with the supervisory authority.

In the United Kingdom, this is the Information Commissioner’s Office:

Information Commissioner’s Office
Telephone: 0303 123 1113

Email: casework@ico.org.uk

Web: https://ico.org.uk/for-the-public/

Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Version 4.0  //  Publish Date: 31-10-2025