Privacy Policy

Version:2.0 | Last reviewed:17/08/26 | Next review due: August 2027

Purpose of this Policy

More in Common (“we” or “us”) takes the protection of your personal data seriously. This Privacy Policy explains how we use any personal information that you supply to us, or that might be collected from a third party, and sets out your rights in respect of our processing of your personal information.

In particular, this Policy explains:

the means by which we obtain your personal information;
the kinds of personal information we collect about you;
the ways in which we use your personal information;
the basis on which we use your personal information;
who we share your personal information with;
how we protect your personal information; and
where and why we transfer your personal information outside of the UK;
the length of time that we keep your personal information.

We may collect your personal data in your capacity as a partner, donor, applicant, supplier, participant in a research project or training session, subscriber to our marketing lists, or as a visitor to our website (www.moreincommon.org.uk) (the “Site”).

The data controller for personal data processed under this Privacy Policy is More in Common UK, a company registered in England and Wales (Companies House number: 10900540]) with its registered office at 320 City Road, London, EC1V 2NZ. Where we refer to “we”, “us” or “More in Common” in this policy in the context of UK data subjects, we mean More in Common UK. More in Common UK is registered as a data controller with the Information Commissioner’s Office (ICO) under registration number ZB562061.

This Privacy Policy is intended to assist you in making informed decisions about your personal data. Please take a moment to read and understand it.

About Us

More in Common’s mission is to understand the forces driving us apart, to find common ground and help to bring people back together. We are a full-service research agency, with experts in qualitative and quantitative research. We apply our unique segmentation lens of the public to help partners understand the big challenges facing British society — and how to respond to them.

More in Common’s seven offices across the United States, the United Kingdom, France, Poland, Brazil, Spain and Germany work closely together and share a commitment to advancing the common good. While we believe that a similar set of forces are threatening our societies, we also believe that our sense of identity and belonging has unique national and regional characteristics. We believe that every country can benefit from others’ experiences in building a sense of the ‘bigger us’ against the ‘us-versus-them’ forces of tribalism and division.

How to Contact Us

If you have any questions about this Policy or want to exercise your privacy rights, please contact us by email at privacy@moreincommon.com.

1. The Means by Which We Obtain Your Personal Information

We may collect your personal information in the following ways:

(1) When you give it to us directly

You may give us your personal data directly in various ways, for example when you interact with us on social media or visit our website, when you apply for employment with us or are employed by us, when you take part in a research poll or focus group, and when you contact us by email or sign up to our newsletter online.

(2) When we receive your information indirectly

Your information may be provided to us when you follow us or otherwise interact with us on or via X (formerly Twitter), when you like and/or join our LinkedIn or interact with us on other social media platforms.

(3) When you give permission to other organisations to share it with us, or it is available publicly

We may combine information you provide to us with information available from external publicly available sources. We use this information to gain a better understanding of you and to improve our communications.

(4) When you visit our website

We use cookies when you visit our website, which may record personal information about you. Please refer to our Cookies Policy for details on the way we use cookies: [LINK TO COOKIES POLICY].

2. The Kinds of Personal Information We Collect About You

We may process the following kinds of personal data:

Your name and contact details, including physical address, telephone number, e-mail address, and social media identity.
Financial information, such as payment-related information, including bank details or debit/credit card details.
Personal information we receive in the course of providing services to you, including details of why you have decided to contact us, details of trainings you have attended, and details of topics or areas of interest to you.
Information collected during qualitative research sessions, including audio and video recordings of focus groups and interviews, written notes, and transcripts.
Recruitment and employment application data, including CVs, covering letters, interview notes, and assessment records.
Special category personal data, as described in the section below.

Special Category Personal Data

The nature of our research means we sometimes process special category personal data, as defined under Article 9 of UK GDPR. This may include information about your political opinions, ethnicity, religion or beliefs, and social attitudes. We process this data only where we have a lawful basis under both Article 6 and Article 9 of UK GDPR. In most research contexts, we rely on your explicit consent (Article 9(2)(a)) and, where the data has been made manifestly public by you, Article 9(2)(e). We will always make it clear when we are collecting special category data and what it will be used for. You may withdraw your consent to our processing of special category data at any time by contacting us using the contact details given in this policy.

Research Data

Quantitative data from polling

Quantitative polling data is supplied to us by our fieldwork partners. All data we receive from partnersis fully anonymised before it reaches us – we do not receive any personally identifiable information through this channel.

Focus group participants

Participant data from focus groups does contain personal data and, depending on the nature of the research, may include special category data. We collect and process this data on the basis of the legitimate interest of understanding the big challenges facing society – the core purpose of More in Common’s work – supported by explicit consent from participants where special category data is involved.

Focus group participant data is shared with us in the form of a password-protected document and is saved directly to our third party secure cloud-based document storage system which is Google Workspace. This process is designed to avoid the transmission of personal data by email. Once the focus groups have taken place, the files are deleted from that secure folder within two months of the focus group taking place.

Focus group recordings

Focus group sessions are recorded via Zoom. Recordings are downloaded from Zoom promptly after the session and deleted from the Zoom platform. They are then uploaded to Rev, a secure third-party transcription platform. For information about how Rev handles personal data, please see Rev’s Privacy Policy.

Consent to record sessions and to retain recordings is obtained from each participant prior to the focus group via our Focus Group Consent Form. Recordings are retained in Rev for up to six years from the date of the session after which we delete them. Our lawful basis for this processing is our legitimate interest in understanding Briton’s attitudes (UK GDPR Article 6(1)(f)). We obtain consent from all focus group participants and we justify this retention period on the basis of legitimate interest: the UK election cycle is every five years and we may need refer back to recordings from previous elections to compare results.

Recruitment and Employment Applications

When you apply for a role with More in Common UK, we collect and process personal data including your name and contact details, CV and covering letter, references, and information shared during the interview and assessment process using a secure third party HR platform Personio. For information about how Personio handles your personal data, please see their Privacy Policy. Our lawful basis for this processing is our legitimate interest in identifying and appointing suitable candidates (UK GDPR Article 6(1)(f)). We do not rely on consent as the basis for recruitment processing.

We retain unsuccessful candidate records for up to three years from the date of notification of the outcome. We justify this retention period on the basis of our legitimate interest: the same individual may subsequently apply for another role with More in Common UK, and in those circumstances it is useful to be aware of any prior application and its outcome. There are also occasions where we may wish to reach out to a previously unsuccessful candidate to offer them a different role that we consider more appropriate for them. After the three-year period, all identifiable application data is securely deleted. Successful candidates’ records transfer into their employment file and are subject to a longer retention period consistent with our employment data obligations.

3. The Ways in Which We Use Your Personal Data

We may use your personal information to:

Manage and administer our relationship with you, including providing you with services and information you have requested.
Market our services, including sending you information about our work, training events, and other activities.
Administer our Site, including monitoring its use.
Administer payments.
Administer your employment application and employment with us once you are hired
Conduct research and data analysis into public attitudes and the impact of our work.
Deal with enquiries and complaints made by or about you.
Audit and/or administer our accounts.
Manage individuals’ preferences, including administering suppression files.
Administer security requirements, including data and systems security.
Conduct financial management and control.
Meet any of our legal, regulatory, and risk management obligations.

Supporter and research profiling

We may use your personal information to undertake research to gather further information about you from publicly accessible sources. This helps us gain a better understanding of your background, interests, and preferences, in order to improve our communications and interactions with you and to provide information about our work and activities which we consider may be of interest to you.

Marketing

We will contact you by email with targeted marketing communications to let you know about our work and activities that we consider may be of particular interest to you, and to ask for donations or other support.

Website analytics

We use cookies on our Site, which may collect your personal information. We use Google Analytics to analyse how visitors use our website — including which pages are visited, how long visitors spend on the site, and how they arrived. We also use HubSpot to assess the performance of our email communications. For more information on how we use cookies, please see our Cookies Policy: [LINK TO COOKIES POLICY].

4. The Basis on Which We Use Your Personal Information

We are required to have one or more lawful grounds to process your personal information. We use your personal information on the following bases:

(1) Consent

We will ask for your consent to use your information to send you electronic communications such as newsletters updating you about our work. Where we rely on your consent, you are entitled to withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal.

(2) Contractual relationships

Sometimes it will be necessary to process personal information so that we can enter into or perform a contract with you. For example, if you apply for employment with us.

(3) Legal obligations

Sometimes we will be required to process your personal information to comply with legal obligations that are binding on us. We will only do so when strictly necessary.

(4) Legitimate interests

Applicable law allows personal information to be collected and used if it is reasonably necessary for our legitimate activities, as long as its use is fair, balanced, and does not unduly impact individuals’ rights. We rely on consent for processing the data of applicants and attendees of our training events, processing data from our research, managing our fundraising activities, promoting our work to relevant organisations where their information is publicly accessible, and retaining unsuccessful recruitment candidate records as described above.

Where we rely on legitimate interests, you are entitled to object to our processing on this ground. If you wish to do so, please contact us using the details above.

5. Children and Young People’s Data

The majority of our work does not involve children or young people. Where our research does include participants under the age of 18, this is currently limited to specific polling and focus group projects, and we handle this data differently depending on the participant’s age, as set out below.

We do not knowingly collect personal information from anyone under the age of 18 unless collected as part of an exceptional research project that has sought specific consent. If we discover we hold personal information about someone below that age, we will delete it within a reasonable period.

Research Involving Children Aged 15 or Younger

Where our research involves participants aged 15 or younger, we only proceed with the consent of a parent, or another responsible adult acting in place of a parent, such as a teacher for a school-based project.Before this research takes place:

We record the name, relationship to the child, and role of the responsible adult giving consent.
We give the responsible adult enough information about the project, in plain language, for them to make an informed decision on the child’s behalf.
Where the subject matter is sensitive, we take additional safeguarding steps, which may include a responsible adult being present during the research itself.
Researchers present will have had DBS checks ahead of any contact with children.

Where this research involves special category data, such as political opinions, we rely on Article 9(2)(j) of the UK GDPR (the research condition) together with the associated condition in the Data Protection Act 2018. Our approach to safeguarding this data, including our retention and deletion policy for it, is set out in our Appropriate Policy Document, available on request.

Research Involving Young People Aged 16 and 17

Where our research involves participants aged 16 or 17, we may rely on their own informed consent, provided they have been given enough information to understand what taking part involves. For research on more sensitive subject matter, we may still involve a parent or other responsible adult, even where this is not strictly required at this age.

Before this research takes place:

Where a responsible adult is involved, we record their name, relationship, and role in the same way as for younger participants.
We take the same additional safeguarding steps as above where the subject matter warrants it.
Researchers present will have had DBS checks ahead of any contact with children.

Where this research involves special category data, we rely on the same Article 9(2)(j) condition described above, and the same Appropriate Policy Document applies.

6. Who We Share Your Personal Information With

The More in Common network

More in Common UK is part of the wider More in Common network, which includes organisations in the United States, Brazil, France, Spain, Poland, and Germany. We may share certain personal data across the network where this is necessary to carry out our work, such as sharing research findings or coordinating joint projects. Where we do this, we take all steps to ensure your personal data is protected to the same standard required by UK GDPR.

Third-party service providers

We share personal data with third-party service providers who process data on our behalf, including our cloud storage provider (Google Workspace), transcription services (Rev), email marketing platform (HubSpot), and website analytics (Google Analytics), recruitment and employee data (Personio). These providers are required to process personal data only in accordance with our instructions and are subject to appropriate data processing agreements.

Commissioned research clients

Where research is commissioned by a client organisation, anonymised or aggregated research outputs may be shared with that client. Identifiable research data is not shared with commissioning clients without your explicit consent. Where a client organisation is involved, this will be disclosed to you at the point of recruitment into the research.

Legal and regulatory disclosure

We may disclose personal data to regulatory authorities, law enforcement bodies, or courts where we are required to do so by law or where we determine it is necessary to protect our legal rights.

7. How We Protect Your Personal Information

We have put in place appropriate and proportionate technical and organisational measures to prevent the loss, destruction, misuse, alteration, unauthorised disclosure of, or access to your personal information.

Focus group participant data is shared with us via password-protected documents and stored directly in our secure cloud-based document management system, specifically to avoid the transmission of personal data by email. Focus group recordings are downloaded from Zoom and deleted from that platform before being uploaded to Rev for secure storage.

Your information is accessible only by appropriately trained employees of More in Common UK, and we provide regular training on data protection obligations to all relevant staff.

What Happens If There Is a Data Breach

If we become aware of a personal data breach affecting your personal information, we investigate promptly in line with our internal data security procedures. Where a breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office (ICO) without undue delay, and in any event within 72 hours of becoming aware of it, as required by UK GDPR. Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly and without undue delay, explaining what has happened, what personal information is affected, and the steps we are taking in response.

8. Where and Why We Transfer Your Personal Information Outside of the UK

More in Common UK very rarely needs to transfer personal information outside the UK.

On the limited occasions where a transfer is necessary, transfers to More in Common France, Germany, Spain, and Poland are covered by the UK’s adequacy decision for the European Economic Area (EEA), which means these transfers can take place without additional safeguards.

On the rare occasions where we need to transfer personal information to More in Common US or More in Common Brazil, the parties involved carry out a Transfer Risk Assessment and complete an International Data Transfer Agreement (IDTA) for that specific transfer, to ensure your personal information continues to receive an equivalent standard of protection.

If you would like further information about the safeguards we use for international transfers, please contact us using the details above.

Third-party links

We link from our Site to other websites. This Privacy Policy does not cover third-party websites and we are not responsible for the privacy practices or content of those sites. We encourage you to read the privacy policies of any external websites you visit via the links shared.

9. The Length of Time We Keep Your Personal Information

We keep your personal information only for as long as is necessary for our purposes, taking into account its relevance to our business and our legal and regulatory obligations. The retention periods below may be extended where we are required to retain data to comply with a legal obligation or to defend a legal claim.

Research participant contact details and screening data: 12 months from the date of the research session, unless the participant has consented to being contacted for future research, in which case until consent is withdrawn.
Focus group and interview recordings: up to six years from the date of the session, in line with the consent obtained via our Focus Group Consent Form.
Focus group participant files (password-protected documents): deleted within two months of the focus group taking place.
Unsuccessful recruitment candidate records: up to three years from notification of the outcome of the selection process.
Donor and supporter records: seven years from the date of the last donation or interaction, in line with financial record-keeping obligations.
Marketing and newsletter subscribers: until consent is withdrawn or, where we rely on legitimate interest, until an objection is raised and upheld.

Your Rights

You have the following rights in respect of your personal data, though please note they apply only in certain circumstances:

Right to be informed: you have the right to be told how your personal information will be used. This Policy is intended to provide that information.
Right of access: you can ask us for confirmation of what information we hold on you and request a copy. We have 30 days to respond.
Right of erasure: you may ask us to delete your personal information from our records in certain circumstances.
Right of rectification: if you believe our records are inaccurate, you have the right to ask for them to be updated.
Right to restrict processing: you have the right to ask for processing to be restricted in limited circumstances, including if you dispute accuracy or while an objection is under investigation.
Right to data portability: in certain circumstances, you have the right to ask us to provide data you have sent us to another service provider in a machine-readable format.
Right to object: you have an absolute right to object to processing for direct marketing purposes, and a qualified right to object in other circumstances, including on the ground of legitimate interests.

To exercise any of the above rights, please contact us at privacy@moreincommon.com. For further information on your rights as a data subject, please consult the ICO’s guidance: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/.

You are also entitled to make a complaint to the ICO about the way we have processed your personal data. Please see the ICO’s guidance at ico.org.uk/for-the-public/personal-information and contact details at ico.org.uk/global/contact-us.

Policy Amendments

We keep this Privacy Policy under regular review and reserve the right to amend it from time to time by posting an updated version on our Site, including where required by changes in applicable law. We will notify you of any material changes to this Policy by email where we hold your contact details.