Privacy policy.

Who is responsible for your data?

In this policy “We”, “Us” and “Our” means Antedote Limited, incorporated and registered in England and Wales with company number 09175238. Our registered office is at c/o Alderwick James & Co, 4 The Sanctuary, 23 Oakhill Grove, Surbiton, Surrey, KT6 6DU.

antedote is a strategic research and innovation consultancy providing services including strategic consulting, market research and analysis, business intelligence and customer insight. Antedote Limited is certified to ISO/IEC 27001:2022 (see information security below) and registered with the ICO (registration number ZA718731).

We use personal data to provide these services and we are the Data Controller of the data we collect from you. If you have any questions regarding this policy please contact dpo@antedote.com.

Our commitment to your privacy

We will manage and treat your personal data with respect. We will collect, store and manage it in an unbiased and secure way, use it only for purposes that we have informed you about, and always be transparent about the personal data we collect and how we use it. We use a variety of security technologies, procedures and staff training to protect your personal data from unauthorized access, including encryption of personal data at rest and in transit.

Information security

Antedote Limited is certified to ISO/IEC 27001:2022 by the British Assessment Bureau, certificate number 219152. We were first certified in February 2020; the current certificate was issued in February 2026 after a recertification audit and runs to February 2029, subject to annual assessments. The certified scope covers our strategy and innovation consultancy: market research, marketing solutions, and strategy reports for commercial clients worldwide. Procurement and security teams can request the certificate and our current information security policies from dpo@antedote.com.

What kind of information do we collect?

The personal information that we collect will depend on your relationship with us. It may include: your name; demographic data (for example date of birth, gender identification, age, educational background, employment); contact data such as email address, postal address and phone number; image and/or voice captured through photography, video or audio recording, always with your explicit consent if you participate in research; your use and opinions of particular products or brands pertinent to a project you have consented to participate in; and, where the scope of a project specifically requires it and with your explicit consent, sensitive personal information.

How do we collect information about you?

We collect information about you if you: get in touch with antedote, request a proposal or purchase a service from us; contact us by email, including via the form on this website (which sends your message to us as an email through the site’s contact endpoint; the message is forwarded to our inbox and is not stored on this website); take part in a research project, online research community or panel, participation in which is always voluntary; or provide us with information in the course of our interactions with you.

Some information reaches us from others. Recruitment agencies and research panel companies pass us your contact details, your answers to the screening questions that made you eligible, and your availability, when you have agreed to be contacted about taking part in research. Our clients sometimes share their own customer information with us when a project uses it, for example customer or member records used to build a segmentation; we then usually process it on the client’s behalf and under its instructions.

How do we use this information?

We can only use your personal data where we have a proper reason: to fulfill a contract we have with you, to meet a legal duty, with your consent, or where it is in our legitimate interest, such as preparing proposals, providing our services, communicating with you about work in progress, fulfilling our accounting and administrative obligations, facilitating and paying for research participation, and helping our clients understand the needs of their current and future customers. We will not unfairly put our legitimate interests above what is best for you.

In practice: when you take part in research, we rely on your consent, which you can withdraw at any time; when you are a client or a supplier, on our contract with you; when you get in touch through this website or by email, on our legitimate interest in replying to you and following up; and for payments, tax and accounts, on our legal obligations. You don’t have to give us any information, but without contact details we can’t reply to you, and without the screening answers we can’t invite you to take part in research.

We don’t make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects on you.

How long do we keep your personal information?

If you have undertaken a research project for us your data will be deleted within 6 months of completion of the project unless you have been explicitly told otherwise at the time you participated. In line with the Market Research Society Code of Conduct: recordings of voice or face and any images that reveal personally identifiable information are held for a maximum of 2 years; information required to make payments for participation is held for 7 years (an HMRC requirement). Client information is held only as long as necessary to provide our services, comply with our legal obligations, resolve disputes and enforce our agreements. Inquiries you send us, through this website or by email, are kept for as long as we need them to reply to you and follow up, and then under the same rule as client information.

Your rights

You have the right to ask us to: confirm what personal information we hold about you and for what purposes; change the consent you have provided; correct any inaccurate or incomplete information; provide you with a complete copy of your personal data to move elsewhere; stop processing your personal information while an objection is resolved; and permanently erase all your personal information promptly. You may also withdraw consent at any time, by emailing dpo@antedote.com.

Your right to object. Where we rely on our legitimate interests, you have the right to object to us using your information, and we will stop unless we have compelling grounds to continue.

To make a request, or a complaint about how we have handled your information, email our Data Protection Officer at dpo@antedote.com or write to Antedote Limited at our registered office, c/o Alderwick James & Co, 4 The Sanctuary, 23 Oakhill Grove, Surbiton, Surrey, KT6 6DU. We will respond to requests within one month, acknowledge complaints within 30 days, and tell you the outcome without undue delay. You also have the right to complain to the supervisory authority responsible for data protection where you live or work; in the UK this is the Information Commissioner’s Office (ico.org.uk).

How is this information shared?

We may use selected suppliers to process your information on our behalf: research recruitment and panel companies; the platforms we use to run surveys, interviews and online research; transcription and translation services; local moderators and analysts where a project requires them; the providers of AI tools approved under our AI security policy; and the services that run our email, files and this website. They may use your information only to carry out their contracts with us, and we remain responsible for how they use it.

In line with the Market Research Society Code of Conduct, we don’t pass your identity to our clients unless you have agreed to it, for example when a client team watches a research session or receives a recording. We never sell personal information. In exceptional circumstances we may share your information when we are legally required to do so.

Artificial intelligence

We use AI tools, including our own AI agents, to help our researchers search, compare and cross-check research material, only on AI models that don’t train on client material. Client material is used only in AI tools approved under our AI security policy, part of our ISO/IEC 27001-certified information security management system, on enterprise terms and never in public AI services, and every AI output is reviewed by a person before it reaches a client. AI is never used to make decisions about you.

Where do we store and process your information?

We generally store and process your information in the United Kingdom and the European Economic Area (EEA). Some of the services we use, including our email and this website’s hosting, may process information in other countries, including the United States, and colleagues in our US offices may need to access it. When your information leaves the UK, we rely on an adequacy decision where one applies, or on the safeguards the law provides for, such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. You can ask dpo@antedote.com for details of the safeguards.

This website

This website sets no cookies. We use Plausible Analytics (Plausible Insights OÜ, Estonia, which keeps its data in the EU) to count visits, how far pages are read and which links are clicked, in aggregate. It sets no cookies and stores nothing that identifies you: your IP address and browser details are used only momentarily, to tell one visit from another that day, and are never stored. The counts pass through this website’s own address on their way to Plausible. Nothing is shared with advertising networks.

The contact form sends what you type to us as an email through the site’s contact endpoint; the message is forwarded to our inbox and is not stored on this website, and if sending fails the form keeps what you wrote and offers to open it in your own email app. To keep automated messages out, the form uses Cloudflare Turnstile once you start filling it in: it checks signals from your browser and connection, such as your IP address and browser type, only to tell people from automated software, as Cloudflare sets out in its Turnstile privacy addendum.

Two further services are involved in serving the site: Adobe Fonts, which delivers the site’s typeface and logs font requests under Adobe’s privacy policy, and Cloudflare, which hosts and secures the site and keeps short-lived request logs, including IP addresses, for up to seven days for security and troubleshooting. To stop abuse of the contact form, Cloudflare also counts messages from each connection for one minute; the count is not kept. The site also counts requests from automated AI crawlers and agents (the name the software gives itself, the page it asked for, and the country it came from); it records nothing about people.

We don’t track visitors across other websites, and no third party collects information about your activity here for that purpose, so the site behaves the same whether or not your browser sends Do Not Track or Global Privacy Control signals.

Contacting us

We may revise or update this policy from time to time. If we do so, we will post notice of the change on this website. This policy is governed by the laws of England and Wales. Questions: dpo@antedote.com, or write to Antedote Limited, c/o Alderwick James & Co, 4 The Sanctuary, 23 Oakhill Grove, Surbiton, Surrey, KT6 6DU, United Kingdom.