Athagora Privacy Notice

Our approach to privacy

Athagora studies human behaviour.

Respect for people's information is therefore part of the standard of our research, not simply an administrative obligation.

We aim to collect personal information because it serves a defined purpose, not simply because it may become useful later.

Who is responsible for your information?

For data protection purposes, the controller is:

Information we may process

Depending on how a person interacts with Athagora, information may include:

Enquiries

• name
• email address
• organisation
• professional role
• enquiry details
• correspondence

Research subscriptions

• email address
• subscription preferences
• consent records
• communication engagement where enabled

Client relationships

• professional contact information
• organisation
• role
• correspondence
• contractual information
• billing information

Research

Depending on the project:

• survey responses
• interview responses
• professional information
• opinions
• experiences
• demographic information where necessary
• publicly available professional information

Website information

Where applicable:

• IP address
• device information
• browser information
• website activity
• cookie preferences

Why we use information

Athagora may use information to:

• respond to enquiries
• conduct legitimate research
• manage research participation
• deliver commissioned work
• administer client relationships
• send requested Athagora research updates
• operate and secure the website
• maintain appropriate business records
• meet legal obligations

Lawful bases

Depending on the activity, Athagora may rely on:

Contract

Where processing is necessary to provide or prepare requested services.

Legitimate interests

Where processing is reasonably necessary for Athagora's research, security, professional operations or appropriate business activity and those interests are not overridden by an individual's rights.

Where appropriate, Athagora documents a legitimate interests assessment.

Consent

Where a person has actively chosen to participate or receive communications for which consent is appropriate or legally required.

Consent can be withdrawn.

Legal obligation

Where information must be processed or retained to comply with the law.

Public information

Athagora may analyse legitimately available public information as part of research.

Public availability does not mean privacy considerations disappear.

Where identifiable personal information is relevant, Athagora considers:

• context
• necessity
• proportionality
• reasonable expectations
• potential impact
• the sensitivity of the information

Sensitive information

Athagora does not intentionally collect sensitive information simply because it could make research more interesting.

Where special category personal information is genuinely necessary, Athagora establishes the appropriate legal basis, additional condition and safeguards before processing it.

We avoid collection where the research question can reasonably be answered without it.

Children

Children require additional protection.

Projects involving identifiable information about children or direct participation by children receive additional privacy, ethical and safeguarding review before data collection begins.

Marketing and research updates

Someone subscribing to Athagora research should know clearly what they are agreeing to receive.

Athagora uses active opt-in consent where required.

Every marketing or research update email includes an easy unsubscribe method.

We do not use pre-ticked consent boxes.

Selling personal information

Athagora does not sell personal information.

Sharing information

Athagora may use service providers required to operate the organisation, including:

• website hosting providers
• database providers
• email platforms
• survey platforms
• analytics providers
• professional advisers
• authorised research contractors

Only information reasonably required for the provider's role is shared.

Appropriate contractual and security protections are used where required.

International processing

Some technology providers may process information outside the United Kingdom.

Where legally required, Athagora uses an appropriate international transfer mechanism and considers the safeguards available.

Retention

General enquiries

Normally up to 24 months after the last meaningful interaction.

Research mailing list

Until the person unsubscribes or the service ends.

Limited suppression information may be retained where necessary to ensure someone who opted out is not accidentally added back.

Client and contractual records

Normally up to six years after the end of the relevant relationship where required for contractual, accounting, tax or legal purposes.

Research participants

According to the retention period stated for the individual research project.

Anonymised research

May be retained for longer where individuals can no longer reasonably be identified.

A different period may apply where law or the specific nature of a project requires it.

Individual rights

Depending on the circumstances, individuals may have rights concerning:

• access
• correction
• deletion
• restriction
• objection
• data portability
• withdrawal of consent

To make a request, use the Athagora contact form. Individuals in the UK may also contact the Information Commissioner's Office. Whether a particular right applies depends on the circumstances and the lawful basis involved.

Security

Athagora uses reasonable technical and organisational safeguards appropriate to the information being processed.

No internet-based system can be guaranteed to be completely secure.

Security risk is considered when choosing research tools, service providers and methods.

Updates

This Privacy Notice may change as Athagora develops.

Material changes are reflected through the updated date shown on this page.