Privacy Notice for Customers and Suppliers

1. Who we are and what we do

Quadrangle is an independent research and strategy business which helps clients create, use, and communicate insight to drive and inspire change. This often involves us conducting studies on our clients' behalf with their customers, prospective customers and the wider general public to improve their understanding of what people like, dislike, are satisfied with or want in the future.

We also undertake research to help our clients communicate better and more effectively with their customers. We conduct surveys using a variety of methodologies including by telephone, face to face, online, by email and by SMS.

Quadrangle is a trading name of Quadrangle Research Group Limited, a company incorporated in England with Company Number 8064640.

2. About this Privacy Notice

Your privacy is important to us, and we ask that you read this Privacy Notice carefully as it contains important information on who we are, how and why we collect, store, use and share your personal data, your rights in relation to your personal information and on how to contact us and supervisory authorities in the event you have a complaint.

This privacy notice relates to personal data of:

• Visitors to Quadrangle controlled websites, and if you are visiting one of our websites, please also refer to our Cookie Notice;
• Quadrangle clients;
• Quadrangle suppliers;
• Quadrangle potential clients;
• Quadrangle potential suppliers; and
• Employees of the entities identified above.

3. What is personal data?

Under Data Protection laws of the United Kingdom, the term "personal data" means any information relating to a person who can be directly or indirectly identified, in particular, by reference to an identifier. In this Privacy Notice, data protection laws means all applicable UK data protection legislation, including the EU General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA), the UK General Data Protection Regulation (UK GDPR), and the Data (Use and Access) Act 2025 (DUAA).

3.1 Why did you contact me in the first place?

As a business we may have your personal data because you are an employee of a client, a potential client, a supplier or a potential supplier in order to pursue our normal business operations which could include:

• Providing customer consultancy and research services to clients;
• Informing clients and potential clients of our services and specialisms to help them solve business problems;
• Working with you as a supplier so you can fulfil your contract to supply goods or services to us;
• To communicate with you, to evaluate if you could supply us with goods or services in the future.

3.2 Information we collect

We collect personal information in order to work with you. We also collect personal information of employees of potential clients and potential suppliers to enable us to respond to your requests and to evaluate if we could work with you in the future. In these situations, we may collect information that can identify you such as your name, job title, company name, your work address, your work email address and your telephone number.

When using our websites, we may also collect technical data including internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform.

3.3 How we use your information

We will only use your personal data for the reasons specified in this Privacy Notice, unless you have specifically consented to any other use. Purposes may include:

• to respond to requests you may make of us, including the provision of services that you have requested;
• to send you future reports and newsletters written by Quadrangle;
• to manage and improve our websites and services;
• to manage research surveys and other market research activities;
• to contact you and/or provide you with general information as well as information about our products and services;
• to share with agents, contractors or partners of Quadrangle in connection with services they perform for us;
• to respond to duly authorised information requests of governmental authorities or where required by law;
• to investigate suspected fraudulent activity;
• to comply with our obligations under any contracts with you; or
• in connection with the sale, assignment, or other transfer of our business.

3.4 Who we share the information with

From time to time we may employ other companies and individuals to perform functions on our behalf. We may use third-party AI tools or applications to carry out tasks such as analysing data, drafting, summarising and transcribing information, identifying trends or themes, generating ideas. Third-party AI tools or applications are vetted prior to use and the outputs are not used for automated decision-making.

We will not sell your personal data to third parties.

4. Quadrangle as a Data Controller

4.1 Our role as a Data Controller

You may choose to provide us with your personal data in a variety of situations. You may at any time invoke rights in relation to the personal data provided to us in accordance with applicable laws.

4.2 Information we must provide you

The purposes of the processing are: to fulfil your transaction request; to provide you with support and consulting services; to verify your identity; to provide or request information on products, services, or call-back requests; to send you specific marketing materials; and to undertake the processing activities identified in section 3.3.

If you no longer wish to receive communications from us, you may opt-out by following the unsubscribe instructions located at the bottom of any email communication, or by emailing us at dataprotectionofficer@quadrangle.com.

4.3 Information for employees of Quadrangle clients and suppliers

If you work for a Quadrangle client or supplier, we may collect and process your personal data as necessary for the performance of the contract in place between the Quadrangle client and Quadrangle in accordance with data protection laws.

4.4 Cross-border flows of personal data

Quadrangle conducts research and has partners globally. We will not transfer personal data of citizens of EU countries outside of the EU unless this has been notified to you and any transfer is under a contract which includes the use of EU approved standard contractual clauses (Model Clauses) or otherwise in accordance with data protection laws.

4.5 Data storage, data access and data retention

Quadrangle will retain personal information of customers and suppliers (including secure encrypted off-site back-up retention) only as necessary to comply with our legal and contractual obligations, resolve disputes, and to provide our clients with the services they have contracted with us. In order to enable us to resolve any disputes and to comply with our clients' rights of audit we will retain this information for up to 6 years following the end of a contract.

4.6 Sharing with Service Providers

We may share your information with third parties who provide services on our behalf to help with our business activities under contractual terms providing adequate protection to your information.

4.7 Tracking technologies

Quadrangle and its partners may use cookies or similar technologies to analyse trends, administer their websites, track users' movements around the website, and to keep track of the domains from which people visit.

4.8 Disclosures required by law or to fulfil a business transition

We may also disclose your personal data as required by law. If Quadrangle is involved in a merger, acquisition, or sale of all or a portion of its assets, you will be notified.

4.9 Notification of changes

We may update this Privacy Notice to reflect changes to our information practices.

4.10 User data supplementation

We may receive information about you from other sources including from our clients, publicly available databases or third parties from whom we have purchased data and combine this data with information we already have about you.

5. Security measures

Quadrangle operates under a strong security and privacy regime. We have successfully undergone third party auditing in relation to our Information Security Management System, and we are accredited by the British Standards Institution that we have met the requirements of ISO 27001 in relation to information security.

Quadrangle conducts all research in accordance with the Market Research Society (MRS) code of conduct.

6. Privacy questions, access rights, incident reporting

If you have any questions about how we use your personal data or about this Privacy Notice, you can contact Quadrangle's Data Protection Officer using the contact details in section 1.

If you are unhappy with how we have handled your personal data, you have the right to raise a concern. Please see our Data Protection Complaints Policy for more details about this process.

If you have an unresolved privacy or personal data use concern, you can complain to the Information Commissioner's Office (ICO):

Phone: 030 3123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Online: https://ico.org.uk/concerns