PULSAR SS LTD

Privacy Policy

Data Protection & Research Participant Privacy

Version 1.0 | February 2026
Data Controller: Pulsar SS Ltd
ICO Registration: ZC093476
Registered Address:
60 CHIMES AVENUE
LONDON
GREATER LONDON
N13 5HR

This policy is reviewed annually and updated to reflect changes in law, operational practice, or client requirements. Last reviewed: February 2026.

1. Introduction
Pulsar SS Ltd (“Pulsar,” “we,” “our”) is a design and research company registered in England and Wales. We are registered with the UK Information Commissioner’s Office (ICO) as a data controller.

This Privacy Policy explains how we collect, use, store, and protect personal data across two distinct areas of our operations:

• Pulsar Space: Our physical creative space in Shoreditch, London, where we host community events and sessions.

• Pulsar Studio: Our qualitative research practice, through which we recruit and manage research participants across multiple markets on behalf of brand clients.

We take data protection seriously. Our approach is built on the principles of data minimisation, purpose limitation, transparency, and respect for the rights of every individual whose data we handle — with particular care for children and young people.

2. Data Controller & Contact
Pulsar SS Ltd is the data controller for all personal data described in this policy.

Data Protection Lead: Selim Selim

Email: selim@pul-sar.co

Address:
60 CHIMES AVENUE
LONDON
GREATER LONDON
N13 5HR

ICO Registration Number: ZC093476

For any questions about this policy or to exercise your data rights, contact the Data Protection Lead using the details above.

3. Pulsar Space: Events & Community Sessions
3.1 What We Collect

For community events and sessions hosted at our Shoreditch studio, we collect the following data at the point of registration:

• Full name

• Age (date of birth or age confirmation)

This data is collected solely to verify the identity of attendees on arrival and to ensure that no individuals under the age of 18 are admitted to events that are designated for adults only.

3.2 How We Collect It

All event registration data is collected and managed through Luma, our third-party event management platform. Pulsar does not store, export, or replicate this data outside of the Luma platform.

3.3 Lawful Basis

Legitimate interest (Article 6(1)(f) UK GDPR): ensuring the safety and security of our space, verifying attendee identity, and enforcing age restrictions.

3.4 Retention

Event registration data remains within Luma and is subject to Luma’s own data retention policies. Pulsar does not independently store or archive this data. We do not use event attendance data for marketing, profiling, research recruitment, or any purpose beyond event admission.

3.5 What We Do Not Collect

We do not collect email addresses, phone numbers, dietary requirements, accessibility needs, or any other personal data from Space event attendees beyond name and age. If attendees voluntarily provide additional information (for example, in conversation), this data is not recorded or stored.

4. Pulsar Studio: Research Participant Data
This section covers all personal data collected in connection with our qualitative research practice, including recruitment, screening, fieldwork, and ongoing panel management.

4.1 Who We Recruit

Pulsar recruits research participants across a broad age range, typically between 9 and 55 years old, with a primary focus on 18–25-year-olds. We also recruit outside this core range depending on project requirements, including children (9–12), teenagers (13–17), and adults up to 55.

Recruitment takes place across multiple international markets. Our current operational markets include but are not limited to: the United Kingdom, United States, Germany, Mexico, South Korea, Japan, China, and India.

4.2 What We Collect

The personal data we collect from research participants varies by project but may include:

Standard Data (All Participants)

• Full name

• Age and date of birth

• Gender

• Location (city/region and country)

• Email address

• Phone number

• Ethnicity (where relevant to research objectives and where local law permits)

• Household and family composition

• Socioeconomic indicators

• Cultural interests, passions, and media consumption habits

• Brand awareness and affinity

Research Outputs (Project-Specific)

• Written responses to research briefs

• Video and audio recordings (interviews, diary studies, vox pops)

• Photographs and visual materials submitted by participants

• Creative outputs (mood boards, collages, drawings)

Special Category Data

In some instances, we may collect special category data as defined under Article 9 of UK GDPR, including:

• Racial or ethnic origin

• Physical or mental health conditions (including disability and neurodivergence)

Where special category data is collected, we obtain explicit consent (Article 9(2)(a) UK GDPR) through a separate, dedicated consent mechanism. This consent is never bundled with general research participation consent.

5. Age-Specific Data Protections
Given that Pulsar recruits participants as young as 9 years old, we apply tiered protections based on age. These protections reflect both UK GDPR requirements and the data protection laws of each market in which we operate.

5.1 Children (Ages 9–12)

• Verified parental or guardian consent is required before any data collection begins. Consent forms are provided in the local language of the participant’s market.

• Consent covers: participation in research, collection of personal data, use of likeness (photo/video), and any special category data collected.

• All research materials (briefs, tasks, communications) are reviewed by Pulsar’s safeguarding lead to ensure age-appropriateness.

• Children may withdraw or skip any task at any time without consequence.

• No direct marketing communications are sent to children.

• Data is pseudonymised in all client-facing reporting. Real names are never shared with clients without explicit parental consent.

5.2 Teenagers (Ages 13–17)

• Parental or guardian consent is required in all markets where the participant is below the age of digital consent (varies by jurisdiction: 13 in the UK and US, 14 in Spain, 16 in Germany and the Netherlands, etc.).

• Where local law permits teens to consent independently (e.g., UK participants aged 13+ for certain processing), we still seek parental awareness as a matter of best practice.

• Teenagers are informed of their own data rights in clear, accessible language.

• All protections from Section 5.1 apply equally to teenagers.

5.3 Young Adults (Ages 18–25)

• Participants provide their own informed consent.

• Consent is obtained via a clear, written consent form (digital or physical) that explains: what data is collected, why, how it will be used, who it will be shared with, how long it will be retained, and how to withdraw.

• Consent is granular: separate opt-ins for research participation, marketing communications, and any special category data.

5.4 Adults (Ages 26–55)

• Same consent and data handling procedures as Section 5.3.

• Adults recruited for parent or guardian cohorts (e.g., parents of tweens/teens) are informed that their data is processed separately from their child’s data and for distinct purposes.

5.5 Jurisdiction-Specific Requirements

In addition to UK GDPR, we comply with the following data protection frameworks where applicable:

• United States: COPPA (Children’s Online Privacy Protection Act) for participants under 13. State-level privacy laws (CCPA/CPRA) where applicable.

• European Union: EU GDPR, with attention to member state variations on the age of digital consent.

• Japan: APPI (Act on the Protection of Personal Information).

• South Korea: PIPA (Personal Information Protection Act).

• China: PIPL (Personal Information Protection Law), with particular requirements around consent for processing minors’ data and cross-border transfers.

• India: DPDPA (Digital Personal Data Protection Act) where applicable.

Where local requirements exceed UK GDPR standards, we apply the higher standard.

6. Lawful Bases for Processing
We rely on the following lawful bases under Article 6 of UK GDPR:

Consent (Article 6(1)(a))

For all research participation, collection of audio/visual materials, and any special category data. Consent is freely given, specific, informed, and unambiguous. Consent can be withdrawn at any time.

Legitimate Interest (Article 6(1)(f))

For event registration data (Pulsar Space) and internal administration of our research panel (e.g., de-duplication, quality assurance). We conduct a Legitimate Interest Assessment (LIA) for each processing activity relying on this basis.

Legal Obligation (Article 6(1)(c))

Where we are required to retain data for tax, financial, or regulatory purposes (e.g., incentive payment records).

7. Consent Architecture
Pulsar operates a granular consent model. We never bundle consent. Each processing purpose requires its own explicit opt-in:

• Research participation consent: permission to take part in a specific project or ongoing panel.

• Audio/visual consent: permission to record, photograph, or film the participant and to use these materials in client reporting.

• Special category data consent: separate, explicit consent for processing any data falling under Article 9 of UK GDPR.

• Panel retention consent: permission to retain contact details for future research opportunities.

• Marketing consent: permission to send communications about Pulsar events or opportunities (never bundled with research consent).

All consent is timestamped and recorded. Consent forms are localised per market and translated into the participant’s first language.

For participants under the age of digital consent in their jurisdiction, parental or guardian consent is obtained for all of the above.

8. How We Use Participant Data
Personal data collected through our research practice is used for the following purposes:

• Screening and recruitment: assessing suitability for research projects based on demographic and attitudinal criteria.

• Research fieldwork: issuing briefs, collecting responses, conducting interviews, and managing participant relationships.

• Analysis and reporting: coding responses against analytical frameworks, producing insight reports, and creating multimedia outputs (short films, artefact collections) for clients.

• Incentive payments: administering compensation for research participation.

• Panel management: maintaining our research panel for future recruitment opportunities (with consent).

We do not use research participant data for advertising, profiling for commercial purposes, automated decision-making, or any purpose beyond those specified at the point of consent.

9. Data Sharing with Clients
When Pulsar conducts research on behalf of a client (e.g., the LEGO Group), data is shared with the client under the following conditions:

• All participant data is pseudonymised in client-facing reports. Participants are identified by first name only or by an assigned alias, never by full name, contact details, or identifying information unless explicit additional consent has been obtained.

• Audio/visual materials (video clips, photographs) are shared with clients only where the participant has provided specific audio/visual consent.

• For participants under 18, parental or guardian consent explicitly covers the sharing of pseudonymised data and audio/visual materials with the named client.

• Clients do not receive raw recruitment data, contact details, or panel management data. Pulsar remains the sole data controller for participant personal data at all times.

• Where a client acts as a joint controller or processor, this is documented in a formal data sharing agreement or Data Processing Agreement (DPA) prior to any data exchange.

10. Sub-Contractors & Recruitment Partners
For international research projects, Pulsar works with local recruitment and moderation partners in markets where we do not have a direct operational presence. These partners act as data processors under Pulsar’s instruction.

Our Requirements for Sub-Contractors

• Each sub-contractor is named and their scope of responsibility is fully documented.

• Each sub-contractor signs a Data Processing Agreement (DPA) with Pulsar as the data controller.

• Sub-contractors may only process data for the purposes specified by Pulsar and may not retain, share, or repurpose participant data.

• Sub-contractors must demonstrate compliance with the data protection laws of their operating jurisdiction.

• Where sub-contractors operate outside the UK/EEA, appropriate safeguards are in place (see Section 12: International Transfers).

• The sub-processor chain is fully documented and available for client review upon request.

11. Data Storage & Security
11.1 Where Data is Stored

Research participant data is stored on secure, access-controlled systems. Pulsar uses the following categories of storage:

• Recruitment and panel data: stored in our secure CRM/research management platform with role-based access controls.

• Research outputs (video, audio, written responses): stored on encrypted cloud storage with access limited to the assigned project team.

• Event registration data (Pulsar Space): stored exclusively within Luma. Pulsar does not export or replicate this data.

11.2 Security Measures

We implement the following technical and organisational measures:

Technical: Encryption at rest and in transit. Role-based access controls. Multi-factor authentication on all systems containing personal data. Regular security updates and patching.

Organisational: Data protection training for all staff. Confidentiality agreements for all team members and sub-contractors. Regular review of access permissions. Incident response procedures documented and tested.

11.3 Breach Notification

In the event of a personal data breach, Pulsar will notify the ICO within 72 hours where the breach is likely to result in a risk to individuals’ rights and freedoms. Affected individuals will be notified without undue delay where the breach is likely to result in a high risk. Clients will be notified in accordance with the terms of any applicable DPA.

12. International Data Transfers
Given that Pulsar conducts research across multiple international markets, personal data may be transferred outside the United Kingdom. We ensure that all international transfers are subject to appropriate safeguards:

UK to EEA

Transfers to the EEA are permitted under the UK’s adequacy regulations.

UK to Non-Adequate Countries

For transfers to countries without an adequacy decision (including the US, South Korea, Japan, China, India, and Mexico), we rely on:

Standard Contractual Clauses (SCCs) approved by the ICO, incorporated into our DPAs with all sub-contractors in these markets.

Where SCCs are supplemented by additional measures (e.g., encryption, pseudonymisation before transfer), these are documented in a Transfer Impact Assessment (TIA).

China (PIPL-Specific)

For research involving participants in China, we comply with PIPL requirements including: obtaining separate consent for cross-border transfers, conducting a Personal Information Protection Impact Assessment (PIPIA), and ensuring data localisation requirements are met where applicable.

Pseudonymisation in Reporting

All participant data is pseudonymised before inclusion in any client-facing report or deliverable that may be accessed across international borders. Raw personal data (full names, contact details) is never included in cross-border reporting.

13. Data Retention
We retain personal data only for as long as necessary for the purpose for which it was collected:

Project-Specific Data

Personal data collected for a specific research project is retained for the duration of the project plus 90 days to allow for quality assurance, query resolution, and final reporting. After this period, project-specific data is securely deleted unless the participant has provided separate panel retention consent.

Panel Data

Where a participant has consented to join our research panel, their contact details and demographic profile are retained for up to 24 months from their last active participation. Panel members are contacted at least annually to confirm their continued consent. Panel members may withdraw at any time.

Event Registration Data (Pulsar Space)

Retained within Luma in accordance with Luma’s retention policies. Pulsar does not independently retain this data.

Financial Records

Incentive payment records are retained for 7 years in accordance with UK tax and accounting obligations.

14. Use of Technology & AI
Pulsar’s default position is to operate without AI-powered tools in our research practice unless explicitly agreed with the client. Where any AI-assisted tools are proposed (for example, transcription or translation), these will be:

Fully disclosed to the client before use, with the specific tool named and its data handling practices documented.

Subject to client approval. If a client’s policy prohibits AI usage, Pulsar will comply fully and use manual alternatives.

Never used for participant-facing interactions (e.g., no AI chatbots, no automated moderation).

Never used for automated decision-making or profiling.

We do not use machine learning models trained on participant data. No participant data is used to train, fine-tune, or improve any AI system.

15. Your Rights
Under UK GDPR, all individuals whose data we process have the following rights:

Right of Access (Article 15)

You may request a copy of the personal data we hold about you.

Right to Rectification (Article 16)

You may request correction of inaccurate or incomplete data.

Right to Erasure (Article 17)

You may request deletion of your data where there is no compelling reason for its continued processing.

Right to Restrict Processing (Article 18)

You may request that we limit how we use your data.

Right to Data Portability (Article 20)

You may request your data in a structured, commonly used format.

Right to Object (Article 21)

You may object to processing based on legitimate interest.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact our Data Protection Lead at selim@pul-sar.co. We will respond within one calendar month.

Right to Complain

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

For participants in other jurisdictions, you may also have the right to lodge a complaint with your local data protection authority.

16. Additional Protections for Children & Young People
In addition to the rights outlined above, Pulsar applies the following additional protections for all participants under 18:

Parents or guardians may exercise data rights on behalf of their child at any time.

Children and young people are informed of their rights in clear, age-appropriate language.

Pulsar’s safeguarding lead reviews all research materials involving participants under 18 before they are issued.

No child or young person is ever penalised for withdrawing from research or declining to complete a task.

We comply with the ICO’s Age Appropriate Design Code (Children’s Code) in the design of our research processes.

17. Changes to This Policy
This policy is reviewed annually by Pulsar’s Data Protection Lead. Where material changes are made, we will notify affected individuals and clients. The current version of this policy is always available on request.

Document Control
Version: 1.0
Date: February 2026
Author: Pulsar SS Ltd
Next Review: February 2027
Approved by: Selim Selim, Data Protection Lead