Introduction
nativve Research (operated by TSJP Ltd, “we”, “us”, “our”) provides social media and digital advertising services to research organisations to support the recruitment of participants into clinical trials, academic studies, and health surveys.
This Privacy Policy explains how we collect, use, and protect personal data in connection with:
our own website at nativveresearch.com;
the bespoke study landing pages we create and host on behalf of research clients; and
the digital advertising campaigns we run across platforms including Meta (Facebook and Instagram), Google, X (formerly Twitter), and others.
We are registered with the Information Commissioner’s Office (ICO) and process all personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where campaigns involve participants in the European Economic Area (EEA), we also comply with the EU GDPR.
Key Terms
Term
Meaning
Our Role as Data Controller
Understanding our role is important, particularly for research clients and ethics committees reviewing our service.
3.1 Our own website (nativveresearch.com)
nativve Research is the sole data controller for personal data collected through our own website, including enquiry forms, contact submissions, and analytics.
3.2 Study landing pages and advertising campaigns
When we run advertising campaigns on behalf of a research client, we typically act as a data processor for our client (the research organisation), who is the data controller in relation to their study participants. Our contractual arrangements with clients reflect this.
However, in line with EDPB Guidelines 8/2020 on the targeting of social media users, nativve Research may be a joint data controller with advertising platforms (such as Meta Platforms Ireland Ltd) in respect of the following specific processing activities:
The placement of advertising tracking pixels and/or Conversions API integrations on study landing pages, which — where a visitor has given cookie consent — transmit online identifiers and browser data to the advertising platform.
The configuration of conversion-based advertising campaigns, by which user actions are measured and reported back to us as aggregated campaign performance data.
This joint controller status arises only where a visitor accepts cookies on the landing page. Every study landing page we host presents a cookie consent banner on first visit. Advertising pixels and the Conversions API are classified as non-essential cookies and are blocked by default. They fire only if the visitor actively accepts cookies. If a visitor rejects cookies, no pixel data is transmitted to any advertising platform and no joint controller relationship arises for that visit.
We receive only aggregated, anonymised campaign statistics — we do not receive individual participants’ personal data directly from the platforms.
Our joint controller arrangement with Meta is governed by Meta’s Business Tools Terms, available at facebook.com/legal/terms/businesstools. Participants wishing to exercise rights in respect of Meta’s processing should contact Meta directly or refer to Meta’s Privacy Policy at facebook.com/privacy/policy.
3.3 Typeform — two types of use
Each study landing page includes an embedded Typeform. nativve Research uses Typeform in two ways depending on the requirements of the study:
Type 1 — Forwarding only (no screening questions)
The Typeform displays a message confirming the visitor will be forwarded to the research organisation’s own screener or data collection tool. No eligibility questions are asked. In this case, Typeform captures only: a unique response ID, a timestamp, and UTM campaign attribution parameters (source, medium, campaign ID, ad ID, creative variant) appended to the URL. No health data or special category data is collected. nativve Research processes this data on the basis of legitimate interests (Article 6(1)(f) UK GDPR) in measuring and optimising campaign performance, as documented in our Legitimate Interests Assessment.
Type 2 — Eligibility screener (with yes/no questions)
The Typeform asks a short series of yes/no eligibility questions before forwarding or declining the visitor. In this case, Typeform captures: the yes/no answers, a unique response ID, a timestamp, and UTM campaign attribution parameters. Because some studies relate to health conditions, screener answers may constitute health data or data relating to a third party’s health (for example, where a parent answers questions about a child). Such data is special category data under Article 9 UK GDPR. We process screener answers on the basis of explicit consent (Article 9(2)(a) UK GDPR), obtained via a consent checkbox on the Typeform before submission. UTM data associated with screener responses is processed on the basis of legitimate interests.
In both cases, Typeform acts as our data processor under a Data Processing Agreement. nativve Research does not share Typeform response data with research clients or any other third party. All Typeform responses are deleted within 12 months of a study closing.
3.4 Health and special category data — advertising targeting
Where advertising targeting uses health-related interest categories on social media platforms, this may involve special category data processed by the platform. We take additional care to ensure appropriate legal bases are in place for such processing, working with our clients and the platforms’ own policy frameworks.
Personal Data We Collect
4.1 Website visitors (nativveresearch.com)
Contact information submitted via enquiry or contact forms: name, email address, organisation, and the content of your message.
Usage data collected via analytics tools: pages visited, time on site, browser type, device type, and approximate location derived from IP address.
Cookie and tracking data, as described in our Cookie Policy.
4.2 Study landing page visitors — Typeform
Each study landing page contains an embedded Typeform. The data collected depends on which type of Typeform is used for that study:
Type 1 — Forwarding only:
A unique Typeform response ID.
The date and time of submission.
UTM campaign attribution parameters from the landing page URL (ad platform, campaign name, ad ID, creative variant).
No question answers, no health data, no personally identifying information.
Type 2 — Eligibility screener:
Your yes/no answers to the eligibility questions. Some questions may relate to health matters and may constitute special category data.
A unique Typeform response ID.
The date and time of submission.
UTM campaign attribution parameters from the landing page URL.
A score indicating whether your answers met the eligibility criteria.
In neither case do we collect your name, email address, phone number, or IP address through Typeform. For Type 2 forms, you will be asked to consent to the processing via a checkbox before submitting. You can withdraw consent and request deletion at any time by contacting hello@nativveresearch.com.
4.3 Study landing page visitors — advertising cookies
If you accepted cookies on the landing page, advertising pixels and/or the Conversions API transmit your online identifiers (e.g. the click ID assigned by the advertising platform) and browser data to the relevant ad platform when your Typeform screener is successfully completed. If you rejected cookies, these technologies are blocked. We do not store or access this data ourselves; it is processed by the platform as described in section 3.2.
We may log aggregate visitor statistics (page views, click-through rates, screener completion rates) for campaign reporting purposes. These are not linked to identifiable individuals.
4.4 Clients and prospective clients
Professional contact details: name, job title, organisation, email address, and phone number.
Information about your study or research project, shared in the course of scoping and delivering our services.
Billing and payment information (processed via our payment service provider; we do not store full payment card details).
4.5 Data we do not collect from study participants
We do not collect participant names, email addresses, phone numbers, medical records, or informed consent forms. If a screener respondent is eligible and clicks through to the research organisation’s own data collection system (REDCap, Qualtrics, or similar), any data submitted there is processed by the research organisation under their own privacy policy. nativve Research does not receive or store that data.
How We Use Personal Data
Advertising Platforms and Joint Controller Arrangements
nativve Research runs advertising campaigns across multiple platforms. The following table summarises our relationship with each platform and the applicable controller terms that govern the joint processing described in section 3.2.
How We Share Personal Data
We do not sell personal data. We share personal data only in the following circumstances:
7.1 Advertising platforms (joint controllers)
As described in sections 3.2 and 6, pixel and Conversions API integrations on study landing pages transmit online identifiers to advertising platforms. This is an inherent part of conversion-based campaign management.
7.2 Research clients (data controllers for their studies)
We provide research clients with campaign performance dashboards showing aggregated statistics (impressions, clicks, conversions). We do not transfer individual participants’ personal data to clients. Where clients provide us with assets or data as part of campaign setup, they remain the controller for that data and we act as their processor.
7.3 Service providers (data processors)
We use third-party service providers to support our operations. Key processors include:
Typeform S.L. (Barcelona, Spain) — our eligibility screener platform. Typeform processes screener response data on our behalf under a Data Processing Agreement. Data is stored on EU-based servers. Typeform’s privacy policy is available at typeform.com/privacy.
Hosting and infrastructure providers — for landing page hosting and our website.
Analytics providers — for website and campaign performance analytics (e.g. Google Analytics).
Email and communication tools.
Payment processing providers.
All third-party processors are subject to data processing agreements and are required to process personal data only on our instructions and not to retain it beyond what is necessary.
7.4 Legal requirements
We may disclose personal data where required by law, court order, or regulatory authority, or where necessary to protect the rights and safety of individuals.
7.5 Business transfers
In the event of a merger, acquisition, or sale of our business, personal data held by us may be transferred to the acquiring entity, subject to the same protections described in this Policy.
International Data Transfers
Some of our advertising platform partners process data outside the UK and EEA. Where this occurs, we rely on appropriate safeguards, including:
UK Adequacy Regulations (for transfers to countries with adequacy decisions);
Standard Contractual Clauses (SCCs) approved by the ICO or European Commission; or
The platforms’ own binding data transfer mechanisms as described in their applicable terms.
Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Our general retention periods are:
Data type
Retention period
Typeform eligibility screener responses
Deleted from Typeform within 12 months of the study closing. Where a study has no defined end date, responses are reviewed and deleted on an annual basis.
Client contract and project records
7 years from end of contract (UK statutory requirement)
Financial and invoicing records
7 years (HMRC requirement)
Website enquiry data
2 years from last contact, unless a client relationship develops
Campaign performance data (aggregated)
Duration of the study plus 2 years
Website analytics data
As per our analytics provider’s retention settings (typically 14 months)
Your rights
Under UK and EU GDPR, you have the following rights in respect of your personal data:
Right of access — to obtain a copy of the personal data we hold about you.
Right to rectification — to have inaccurate or incomplete data corrected.
Right to erasure (“right to be forgotten”) — to request deletion of your data where there is no lawful reason for us to continue processing it.
Right to restriction — to ask us to limit how we use your data in certain circumstances.
Right to data portability — to receive your data in a structured, machine-readable format.
Right to object — to object to processing based on legitimate interests, including direct marketing.
Right to withdraw consent — where processing is based on consent, to withdraw it at any time without affecting the lawfulness of prior processing.
Right to lodge a complaint — with the ICO (ico.org.uk) or, for EEA residents, your local supervisory authority.
To exercise any of these rights, please contact us at hello@nativveresearch.com. We will respond within one calendar month.
Where our processing is carried out jointly with an advertising platform, you may also exercise your rights directly with that platform. Please refer to the relevant platform’s privacy policy (see section 6).
Cookies and Tracking Technologies
Our website and the study landing pages we host use cookies and similar tracking technologies. These fall into two categories:
Essential cookies — required for the page to function (for example, to remember your cookie preference). These are always active and do not require consent.
Non-essential cookies — including analytics cookies (e.g. Google Analytics) and advertising pixels used to measure campaign conversions. These are blocked by default and are only set if you actively accept cookies.
Cookie consent on study landing pages
Every study landing page hosted by nativve Research presents a cookie consent banner on first visit. The banner requires an active choice:
Accept — non-essential cookies are enabled, including any advertising tracking pixel or Conversions API integration. This allows campaign performance to be measured and optimised (see section 3.2).
Reject — non-essential cookies remain blocked. No advertising pixel fires, no data is transmitted to advertising platforms, and no joint controller processing takes place for that visit.
You can change your cookie preference at any time by clearing your browser cookies and revisiting the page, which will re-present the consent banner.
Exercising data rights in respect of advertising platform data
Where you have accepted cookies and an advertising pixel has transmitted your online identifiers to an advertising platform (such as Meta), that data is processed by the platform directly and is associated with your account or profile on that platform. nativve Research does not receive, hold, or have access to this data.
As a consequence:
If you contact us requesting erasure of data transmitted via advertising pixels, we are unable to fulfil that request directly — we hold nothing to delete on our side.
We will always confirm this in writing so you have a clear response.
To request deletion of data held by the advertising platform, you will need to contact that platform directly. Links to each platform’s privacy controls are provided in section 6.
This limitation is an inherent feature of how conversion-based advertising technology works. It applies equally to all advertisers using these platforms and is acknowledged in EDPB Guidelines 8/2020. We disclose it here and in our cookie consent banner so that visitors can make a fully informed choice before accepting cookies.
For full details of the specific cookies used and how to manage your preferences, please see our Cookie Policy at nativveresearch.com/cookie-policy.
Information for Research Ethics Committees and Study Sponsors
This section is provided for the benefit of research ethics committees, data protection officers, and study sponsors reviewing Nativve Research’s involvement in clinical trial or study recruitment.
12.1 Summary of our data processing activities
Our involvement in a study creates the following data processing activities relevant to ethics review:
We host a study-specific landing page containing an embedded Typeform eligibility screener. We receive and hold screener responses (yes/no eligibility answers, timestamps, and UTM campaign parameters). These responses may constitute special category data where questions relate to health matters. We process this data on the basis of explicit consent obtained via a checkbox on the Typeform before submission. Responses are deleted within 12 months of the study closing.
The landing page presents a cookie consent banner on first visit. If a visitor accepts cookies and successfully completes the Typeform, advertising pixels / Conversions API integrations transmit online identifiers to the advertising platform(s) being used. nativve Research and the advertising platform (e.g. Meta) are joint data controllers for that specific processing. The research organisation is not party to that joint controller arrangement — it runs between nativve Research and the platform directly, and is governed by the platform’s Business Tools Terms. If a visitor rejects cookies, no pixel fires and no such processing occurs.
We run paid advertising campaigns on social media and search platforms. Targeting may use interest-based, demographic, or behavioural criteria configured within each platform’s ad manager. We are the targeter as defined in EDPB Guidelines 8/2020.
We do not collect, process, or store individual participant personal data. Participants’ consent and study data are handled entirely by the research organisation.
12.2 Documentation available on request
On request, nativve Research can provide research clients and ethics committees with:
Evidence of ICO registration;
A link to the applicable advertising platform Business Tools Terms or Controller-to-Controller terms;
Example protocol language for inclusion in ethics applications describing social media as a recruitment method;
Screenshots of campaign advertising materials and the study landing page.
Requests should be directed to hello@nativveresearch.com.
13. Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse. These include access controls, encrypted communications (HTTPS), and regular review of our data handling practices.
Our client reporting dashboards are password-protected and access is limited to authorised users.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this document and publish the new version at nativveresearch.com/privacy-policy. Where changes are material, we will take reasonable steps to notify affected parties.
15. Contact Us
If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us:
