Privacy Policy
Last updated: 5 August 2026
ALL INNOVATION FIRM SL, trading as Office for Business Research and Development — OBRD, respects your privacy and is committed to protecting your personal data.This Privacy Policy explains how we collect, use, store, disclose and protect personal data when you:visit our website;contact us;become a client, supplier or professional collaborator;apply to participate in a research project;take part in interviews, surveys, digital diaries, online communities or other research activities;communicate with us through email, telephone, WhatsApp or other digital channels.This Privacy Policy applies principally to individuals located in Spain, France, Germany and the United Kingdom. It may also apply, where relevant, to individuals in other countries who interact with our services.1. Who we are
Legal entity: ALL INNOVATION FIRM SL
Trading name: Office for Business Research and Development — OBRD
Tax identification number: ESB88196431
Registered address: Carrer des Centre 1, 07650 Santanyí, Illes Balears, Spain
Country of establishment: Spain
Privacy contact email: research@ofbrd.comWebsite: https://ofbrd.comFor the purposes of applicable data protection legislation, ALL INNOVATION FIRM SL may act either as:a
data controller, when we determine why and how personal data is processed; ora
data processor, when we process personal data on behalf of a client and in accordance with that client’s documented instructions.The role of OBRD and the role of the organisation commissioning a research project will depend on the circumstances of each project. Where appropriate, this will be explained in the project-specific information provided to participants.
2.
Applicable data protection legislationDepending on where you are located, our processing of personal data may be governed by:the General Data Protection Regulation, or GDPR;applicable Spanish data protection legislation;applicable French data protection legislation;applicable German federal or state data protection legislation;the United Kingdom General Data Protection Regulation, or UK GDPR;the United Kingdom Data Protection Act 2018;applicable electronic communications, privacy and consumer-protection legislation.We seek to apply consistent standards of lawfulness, fairness, transparency, security, data minimisation, purpose limitation and accountability across all countries in which our research is conducted.Data protection law requires privacy information to identify the organisation, the purposes and legal bases of processing, recipients, retention arrangements, international transfers and the rights available to individuals.
3.
Personal data we may collectThe information we collect depends on your relationship with us and the nature of the relevant research project.
3.1.
Identification and contact details
We may collect:first name and surname;preferred name or alias;email address;telephone or WhatsApp number;country, city or general location;age or age range;preferred language.
3.2.
Professional informationWe may collect:employer or organisation;job title;professional sector;professional experience;business contact details;professional interests.
3.3.
Research participation information
During a research project, we may collect:answers to research questions;opinions, attitudes, experiences and preferences;purchasing, media, travel, clothing or lifestyle habits;experiences with products, services, brands or retailers;purchase journeys and decision-making processes;clothing preferences, wardrobe organisation and product use;information about holidays, work, social activities, leisure and everyday routines;reactions to concepts, products, designs, prototypes or communications;survey responses;diary entries;comments made during interviews, workshops or group discussions;information voluntarily provided during follow-up conversations.The specific research topics will be explained before or at the start of each project.A telephone number, email address, voice, image or combination of indirect details may constitute personal data when it identifies or could identify an individual.
3.4.
Messages and communications
We may collect and process:emails;WhatsApp messages;SMS messages;telephone or video-call communications;dates and times of communications;message-delivery and status information;technical identifiers associated with communications.
3.5.
Photographs, video, audio and documents
Where relevant to a research project, we may collect:photographs;screenshots;videos;voice notes;interview recordings;photographs of clothing, products, wardrobes, shops or environments;receipts or purchase confirmations;links to products or websites;documents voluntarily shared by participants.We will explain whether recordings or visual materials are required or optional. Where required by law, we will request separate permission before recording or using identifiable material.
3.6.
Payment and incentive informationWhere participants receive an incentive, we may collect:payment details;bank or payment-platform information;payment status;tax-related information where legally required.We only seek to collect the information necessary to arrange and document the payment.
3.7.
Client, supplier and business information
We may collect:professional contact information;contract information;billing details;invoices and payment records;project communications;proposals and statements of work;supplier or collaborator information.
3.8.
Website and technical information
When you use our website or digital services, we may collect:IP address;browser type;operating system;device information;approximate location;date and time of access;pages viewed;referral source;cookie identifiers;security and diagnostic information.Further information about cookies should be included in a separate Cookie Policy.
4.
Special category data
We do not generally seek to collect sensitive or special category data unless it is necessary for a specific research purpose.Special category data may include information concerning:health;racial or ethnic origin;political opinions;religious or philosophical beliefs;trade-union membership;genetic or biometric information;sex life or sexual orientation.Participants should avoid sharing sensitive information unless it is directly relevant to the research and they have been informed that it will be collected.Where a project requires special category data, we will identify an appropriate legal basis and additional legal condition, provide specific information and apply enhanced safeguards.
5.
How we collect personal data
We may obtain personal data:directly from you;through our website;through email, telephone or WhatsApp;through interviews, surveys, digital diaries, online communities, workshops or discussion groups;from the client commissioning a research project;from participant recruitment agencies;from research partners or subcontractors;from publicly available professional sources;through technology providers used to deliver our services.Where information is obtained from another source, we will provide information about the categories and source of the data where required by law.
6.
How we use personal data
6.1.
To answer enquiries
We may use personal data to:respond to questions;provide information about our services;arrange meetings;prepare proposals;manage requests submitted through our website, email or other channels.
6.2.
To manage business relationships
We may use personal data to:provide contracted services;communicate with clients, suppliers and collaborators;administer contracts;manage projects;process invoices and payments;maintain business records;resolve disputes.
6.3.
To recruit research participants
We may use personal data to:identify potential participants;assess eligibility;apply screening criteria;contact participants;schedule research activities;manage attendance;send instructions and reminders;arrange incentives;prevent duplicate participation where appropriate.
6.4.
To conduct research
We may use personal data to:conduct interviews, surveys and digital diaries;collect and organise participant responses;understand behaviours, experiences, attitudes and needs;analyse themes and patterns;examine customer journeys and decision-making processes;compare findings across markets or participant groups;prepare reports, presentations, workshops and other research outputs;support our clients’ product, service, design, communication and strategic decisions.Research findings will normally be reported in aggregated, anonymised or pseudonymised form wherever reasonably possible.We do not use research information to make legal or similarly significant decisions about individual participants.
6.5.
To communicate through WhatsApp
We may use the WhatsApp Business Platform to:invite or onboard participants;send research questions;deliver scheduled diary prompts;send reminders;receive responses;receive photographs, videos, voice notes, links and documents;respond to participant questions;manage project-related communications.Messages may be processed through Meta’s WhatsApp Business services and connected automation tools.Participants should only send information that they are comfortable sharing for the research purposes explained to them.
6.6.
To automate operational processesWe may use automation technology to:schedule and send approved communications;receive incoming messages;classify messages by participant or project;record the date and time of responses;store research materials;organise links, images and files;notify research team members;prepare information for review and analysis;send acknowledgements or operational confirmations.Automation is used to support the research team. Unless expressly stated otherwise, we do not use exclusively automated processing to make decisions that produce legal or similarly significant effects on individuals.
6.7.
To analyse and report research findingsWe may:code or categorise responses;identify themes;create transcripts or summaries;select illustrative quotations;compare findings between Spain, France, Germany and the United Kingdom;prepare reports, presentations and workshops for the commissioning client.Direct quotations may be edited to remove identifying information. Any intended use of identifiable photographs, recordings or attributed quotations will be explained separately where required.
6.8.
To improve and secure our servicesWe may process data to:maintain our website and systems;detect and correct errors;prevent fraud or misuse;protect accounts and credentials;investigate security incidents;improve research methods and operational processes;maintain audit and activity records.
6.9.
To comply with legal obligationsWe may process personal data to comply with:accounting and tax requirements;regulatory obligations;court orders;lawful requests from authorities;data-protection obligations;record-retention requirements;legal claims.
7.
Legal bases for processingDepending on the activity, we may rely on one or more of the following legal bases.
7.1.
ConsentWe may rely on consent where you have freely agreed to a particular use of your personal data, including, where appropriate:participation in a research activity;recording an interview;providing photographs, video or audio;receiving optional communications;using identifiable material;processing particular sensitive information.You may withdraw consent at any time. Withdrawal will not affect processing carried out lawfully before the consent was withdrawn.Consent to participate in research and consent as a data-protection legal basis are not necessarily the same thing. The appropriate legal basis must be determined separately for each processing activity.
7.2.
Performance of a contractWe may process data where necessary to:enter into or perform a contract with you;provide agreed services;administer a participant incentive;take requested steps before entering into a contract.
7.3.
Legitimate interestsWe may rely on our legitimate interests or those of a client where processing is necessary and those interests are not overridden by your rights.These interests may include:conducting commercial and consumer research;understanding markets and customer experiences;improving products, services and communications;managing business relationships;maintaining security;preventing misuse;administering research projects;keeping appropriate business and research records.Where we rely on legitimate interests, we will consider the necessity and proportionality of the processing, individuals’ reasonable expectations and the potential effect on their rights. The GDPR permits legitimate-interest processing only where those interests are not overridden by the individual’s fundamental rights and freedoms.
7.4.
Compliance with a legal obligationWe may process data where necessary to comply with applicable laws relating to:taxation;accounting;employment;data protection;fraud prevention;regulatory reporting;legal proceedings.
7.5.
Other legal bases or conditionsWhere relevant, a client may rely on another lawful basis, such as the performance of a task carried out in the public interest.Where special category data is processed, we will also identify an additional condition permitted by applicable law.
8.
Voluntary participation
Participation in research is voluntary unless you have separately agreed otherwise as part of a contractual professional engagement.Participants may:decline an invitation;choose not to answer a particular question;refuse an optional task;ask the researcher for clarification;stop participating.Withdrawal from a study does not automatically require deletion of all information already collected where another lawful basis or legal obligation applies. The consequences of withdrawal will be explained in the project-specific information.Withdrawal may affect eligibility for an incentive where the applicable conditions were clearly explained before participation.
9.
Children and young peopleOur general services are not directed at children.Where a research project involves participants who are not legally able to provide their own valid consent, we will implement appropriate age-verification, parental or guardian authorisation and child-friendly information procedures.We will not knowingly conduct research involving minors without the safeguards required for the relevant project and jurisdiction.
10.
Who we share personal data with
10.1.
ClientsThe organisation commissioning the research may receive:aggregated findings;anonymised or pseudonymised participant information;quotations;photographs, recordings or other materials where disclosure has been explained and lawfully authorised;operational information necessary to manage the project.The client’s identity and expected access to personal information should be explained in the project-specific participant information where appropriate.
10.2.
Research and recruitment partners
We may work with:recruitment agencies;moderators;interviewers;translators;transcription providers;local research partners;fieldwork providers;incentive-payment providers;analysts and consultants.They may only use personal data for the authorised purpose and will be subject to appropriate contractual, confidentiality and data-protection obligations.
10.3.
Technology providers
We may use providers including:Meta Platforms and WhatsApp Business;n8n;Webflow;Google Workspace;cloud-hosting and database providers;videoconferencing platforms;survey platforms;transcription or analysis services;document-storage services;payment providers;cybersecurity and IT-support providers.The specific provider list may change as our systems develop. We select providers based on operational, security and compliance considerations and put appropriate contractual arrangements in place where required.
10.4.
Professional advisers and authoritiesWe may disclose information to:accountants;auditors;legal advisers;insurers;courts;regulators;law-enforcement bodies;tax authorities;other public authorities where legally required.We do not sell personal data to data brokers or advertisers.
11. International transfers
Our research may involve participants, clients, researchers and service providers located in Spain, France, Germany, the United Kingdom and other countries.Personal data may therefore be transferred:within the European Economic Area;between the European Economic Area and the United Kingdom;to service providers operating in other countries.Where personal data is transferred internationally, we will use an appropriate legal mechanism where required, such as:an adequacy decision;approved Standard Contractual Clauses;the UK International Data Transfer Agreement;the UK Addendum to the EU Standard Contractual Clauses;another permitted safeguard or derogation.We may also implement additional technical and organisational safeguards where appropriate.You may contact us for further information about the safeguards relevant to a particular transfer.
12.
Data minimisation, anonymisation and pseudonymisationWe seek to collect only the information that is reasonably necessary for the relevant purpose.Where reasonably possible, research will be conducted or reported using:anonymous information;aggregated findings;participant codes;pseudonyms;redacted quotations;removal of direct identifiers;restricted access to identification keys.Anonymous information is no longer personal data where individuals cannot reasonably be reidentified.Pseudonymised information remains personal data and will continue to be protected accordingly.Research should use anonymous information where possible and consider pseudonymisation where complete anonymisation is not possible.
13.
How long we retain personal dataWe retain personal data only for as long as reasonably necessary for the relevant purpose, including legal, regulatory, accounting and dispute-resolution requirements.Unless a different period is stated for a specific project, we generally apply the following retention periods.
13.1.
Research recruitment records
Eligibility, scheduling and recruitment information will normally be retained for the duration of the research project and for up to
12 months after the project is completed.
13.2.
Research responses
Interview responses, diary submissions, survey answers and related research information will normally be retained for the duration of the project and for up to
24 months after delivery of the final research output.
13.3.
Audio and video recordings
Recordings will normally be retained until transcription, analysis and quality review are complete, and for no longer than
12 months after delivery of the final research output, unless participants are informed of a different period.
13.4.
Photographs and visual material
Photographs, videos and screenshots will normally be retained for the duration of the project and for up to
24 months after delivery of the final research output, subject to the information provided for the relevant project.
13.5.
WhatsApp communications
WhatsApp messages and attachments will normally be retained during the project and for up to
24 months following completion of the project, unless they must be kept longer for legal, contractual or research-integrity reasons
13.6.
Financial and contractual records
Invoices, payments, contracts and tax records will be retained for the periods required by applicable law.
13.7.
Enquiries and business communications
General enquiries and professional correspondence may be retained for up to
24 months after the enquiry or professional relationship ends, unless longer retention is justified.At the end of the applicable period, personal data will be deleted, anonymised or securely archived where continued retention is lawfully required.Data protection principles require personal data to be limited to what is necessary, kept for no longer than needed and protected through appropriate security measures.
14.
Security
We use appropriate technical and organisational measures designed to protect personal data against:unauthorised access;accidental loss;alteration;improper disclosure;misuse;destruction.Measures may include:access controls;authentication;restricted permissions;encrypted communications or storage where appropriate;secure credential management;confidentiality obligations;supplier reviews;backups;activity logging;incident-response procedures;staff training;separation of identifying and research information;deletion and retention controls.No internet-based service can guarantee absolute security. We review our measures in light of the nature of the information and the risks involved.
15.
Your data protection rightsSubject to applicable law and any lawful restrictions, you may have the following rights.
15.1.
AccessYou may ask whether we process your personal data and request a copy of it.
15.2.
RectificationYou may ask us to correct inaccurate or incomplete personal data.
15.3.
ErasureYou may ask us to delete personal data where there is no lawful reason to continue processing it.
15.4.
RestrictionYou may ask us to limit the way we process your data in certain circumstances.
15.5.
ObjectionYou may object to processing based on legitimate interests or, where relevant, a public-interest basis.15.6. PortabilityYou may request certain data in a structured, commonly used and machine-readable format where the relevant legal conditions apply.
15.7.
Withdrawal of consentYou may withdraw consent at any time where processing is based on consent.
15.8.
Automated decisionsYou may request safeguards relating to decisions based solely on automated processing where those decisions produce legal or similarly significant effects.
15.9.
ComplaintsYou may raise a concern with us or submit a complaint to the relevant supervisory authority.Some rights may not apply in every situation. Certain research-related exemptions or restrictions may apply where permitted by law and where the required safeguards are in place. We will explain any refusal or restriction where legally required.
16.
How to exercise your rights
To exercise a data-protection right, contact:
Email: research@ofbrd.comRecommended subject line: Data protection requestPlease include:your name;your email address or telephone number;the research project or service concerned;the right you wish to exercise;enough information to help us locate the relevant data.We may ask for additional information to verify your identity. This is intended to prevent unauthorised access to or deletion of personal data.We will respond within the period required by applicable law
17.
Data deletion instructions
You may request deletion of personal data associated with your website enquiry, research participation, WhatsApp conversation or other interaction with OBRD.
17.1.
How to submit a deletion request
Send an email to:
finance@ofbrd.com
Use the subject line:
Data deletion request
Include:your full name;the email address or telephone number used to contact us;the relevant research project, where known;a description of the information you would like deleted.
17.2.
What happens after a request
We will:acknowledge the request;verify the requester’s identity where necessary;identify the relevant data;determine whether deletion is legally required;delete or anonymise the data where appropriate;confirm the outcome.
17.3.
Information we may need to retain
We may retain limited information where necessary to:comply with a legal obligation;maintain tax or accounting records;establish, exercise or defend legal claims;document consent or withdrawal;prevent fraud or repeated unauthorised participation;maintain a record that a deletion request was fulfilled;meet contractual or regulatory requirements.Where information must be retained, its use will be restricted to the relevant purpose.
17.4.
WhatsApp data
For deletion requests concerning WhatsApp, please provide the telephone number used in the conversation.We will delete or anonymise WhatsApp-derived data stored in systems under our control where legally required.Deleting information from our systems does not necessarily remove information independently retained by Meta, WhatsApp, a telecommunications provider, the participant’s device or another third-party service in accordance with its own legal responsibilities and retention practices.
18.
Supervisory authorities
You may lodge a complaint with the data-protection authority in the country where you live, work or believe an infringement occurred.Relevant authorities include:
Spain: Agencia Española de Protección de Datos;
France: Commission Nationale de l’Informatique et des Libertés;
Germany: the competent federal or state data-protection supervisory authority;
United Kingdom: Information Commissioner’s Office.We encourage you to contact us first at
research@ofbrd.com so that we can try to address your concern.
19.
United Kingdom representative
ALL INNOVATION FIRM SL is established in Spain.If applicable law requires us to appoint a representative in the United Kingdom, the representative’s contact details will be made available in this section and in the relevant project-specific privacy information.
20.
Data Protection Officer
ALL INNOVATION FIRM SL has not appointed a Data Protection Officer unless otherwise communicated.Questions concerning privacy or data protection should be sent to:
research@ofbrd.com
21.
Cookies and similar technologies
Our website may use cookies and similar technologies.Strictly necessary cookies may be used to:operate the website;maintain security;remember privacy choices;support core functionality.Optional analytics, advertising or third-party cookies will only be used where permitted and, where required, after the user has made a valid choice through our cookie banner.Further information should be provided in a separate Cookie Policy.
22.
Third-party websites and services
Our website, research messages or reports may contain links to third-party websites, applications or services.We are not responsible for the independent privacy practices of those third parties. We recommend reviewing their privacy information before submitting personal data.
23.
Changes to this Privacy Policy
We may update this Privacy Policy to reflect:changes in our services;new research methods;changes to technology providers;legal or regulatory developments;improvements to our privacy practices.The current version will remain available on this page. The date at the top indicates when it was last updated.Where a change materially affects an ongoing research project, we will provide additional information where legally required
24.
Contact usFor questions about this Privacy Policy or our use of personal data, contact:
ALL INNOVATION FIRM SLTrading as: Office for Business Research and Development — OBRD
Tax identification number: B88196431
Address: Carrer des Centre 1, 07650 Santanyí, Illes Balears, Spain
Email: research@ofbrd.comWebsite: https://ofbrd.com *