TFSurvey's GDPR Compliance Framework
TFSurvey operates under GDPR as a Data Controller for panelist data and as a Data Processor for research data collected on behalf of clients. Our compliance framework covers all processing activities related to our B2B and healthcare professional panel, with particular attention to the cross-border data transfers inherent in global research projects.
Lawful Basis for Processing
TFSurvey processes panelist personal data under two primary lawful bases:
- Consent — All panelists provide explicit, freely-given consent to participate in research and to have their professional profile maintained for panel management purposes. Consent is specific, informed, and granular — panelists can consent to B2B research while declining healthcare research, for example.
- Legitimate interests — Limited processing for panel security, fraud prevention, and quality assurance is conducted under legitimate interests, with a documented balancing test on file.
Data Minimisation and Purpose Limitation
TFSurvey collects only the professional profile data necessary for panel management and research qualification. We do not collect unnecessary personal information, and data collected for one research purpose is not repurposed without fresh consent. Panel profiles are reviewed and minimised annually.
International Data Transfers
TFSurvey facilitates research across global markets, which involves transferring personal data outside the European Economic Area. All such transfers are governed by Standard Contractual Clauses (SCCs) under GDPR Article 46. Our Data Processing Agreements with sub-processors — including CalibraSync and cloud infrastructure providers — incorporate appropriate SCC documentation.
Data Subject Rights
TFSurvey supports all GDPR data subject rights for panelists:
- Right of access — Panelists can request a copy of their personal data at any time
- Right to rectification — Panelists can correct inaccurate profile data
- Right to erasure — Panelists can request deletion and withdrawal from the panel
- Right to restrict processing — Panelists can limit how their data is used
- Right to data portability — Panelists can request their data in machine-readable format
- Right to object — Panelists can object to processing under legitimate interests
Data Retention
Active panelist data is retained while panel membership is current. Panelists who withdraw, become inactive, or request erasure have their data deleted within 30 days of the request. Research response data is retained for the period specified in the client Data Processing Agreement, typically 2–3 years, after which it is securely destroyed.
Data Processing Agreements
Clients commissioning research through TFSurvey that involves EU/EEA panelist data are provided with a Data Processing Agreement (DPA) consistent with GDPR Article 28 requirements. Our standard DPA covers processing purposes, data categories, sub-processor obligations, technical and organizational security measures, and data breach notification procedures.