Privacy Policy
How we collect, use and protect personal data under UK GDPR · Last updated 19 September 2026 · Version 2.0
1. Who we are
Epicurean Digital Consultants Ltd (“we”), trading as DiasporaPulse™, is the data controller for personal data processed through this platform. We are registered in England and Wales (Company No. 16622200).
For any question about this policy or your rights, contact hello@epicureandigitalconsultants.com.
2. What we collect
| Category | Examples | Why |
|---|---|---|
| Account data | Email address, authentication identifiers | To create and secure your account |
| Verification data | Postcode district; a mobile number only once payouts are introduced | To reduce fraudulent and duplicate participation |
| Research profile | Demographic and cultural profile answers you choose to give | To match you to relevant studies |
| Study responses | Answers you submit to a study | To produce research findings for clients |
| Reward records | Points ledger, redemption and payout records | To pay you and meet accounting obligations |
| Technical data | Session identifiers, security and audit logs | To keep the platform secure and diagnose faults |
3. Special category data
Some profile fields — for example ethnicity, national origin, language or religious observance where it affects consumer behaviour — are special category data under UK GDPR Article 9. We process these only where you have given explicit, separate, freely given consent, recorded against a versioned consent document. You may withdraw that consent at any time without affecting your account.
Sensitive profile values are never transmitted in email notifications.
4. Lawful bases
- Consent (Art. 6(1)(a) and Art. 9(2)(a))
- Panel participation, research profiling, and all special category data.
- Contract (Art. 6(1)(b))
- Operating your account and paying rewards you have earned.
- Legal obligation (Art. 6(1)(c))
- Financial and tax records relating to payouts.
- Legitimate interests (Art. 6(1)(f))
- Platform security, fraud and quality control. We balance these against your rights and do not use them for profiling that produces legal effects.
5. Who we share with
We do not sell personal data. We share it only with the processors needed to run the service, each under a written processing agreement and only on our instructions:
| Processor | What it does | Where data is held |
|---|---|---|
| Supabase | Database, accounts and sign-in | United Kingdom / European Economic Area |
| Resend | Sends our service and study emails | European Economic Area, with UK transfer safeguards |
| Hostinger | Hosts the website | European Economic Area |
| Twilio | Sends the one-time code that verifies your mobile number | United States, under the UK International Data Transfer Addendum |
Reward vouchers are currently bought by us directly from the retailer (Amazon or Tesco) and the code is sent to you by us. The retailer does not receive your name, email address or any other detail about you.
We will publish any change to this list here before it takes effect.
Clients never receive your identity. Research findings are delivered aggregated or with direct identifiers removed.
6. International transfers
Our primary data storage is in the United Kingdom or European Economic Area. Where a processor transfers data outside the UK, we rely on UK adequacy regulations or the International Data Transfer Addendum to the EU Standard Contractual Clauses.
7. How long we keep it
We keep personal data only as long as we need it, and no longer. These are the periods we work to. Where a period is set by law we say so; the others are our own defensible defaults, reviewed annually.
| What | How long | Then what |
|---|---|---|
| Your account and profile | While your account is open, then 30 days | Deleted. The 30 days allow recovery from an accidental deletion or an account takeover |
| Special category answers (community, faith, diet) | Deleted as soon as you withdraw that consent | Deleted immediately, not at 30 days |
| Study answers | 12 months linked to you | Separated from you and kept only in aggregate |
| Consent records | 6 years | Kept as proof of consent, then the link to you is removed. UK GDPR requires us to be able to demonstrate consent |
| Points ledger and payment records | 6 years (required by tax law) | Pseudonymised, then deleted |
| Quality review decisions | 6 years | Anonymised after 12 months |
| Study invitations | 24 months | Anonymised |
| Email delivery log | 12 months | Deleted. The log holds a one-way hash, not your address |
| Security and access logs | 2 years, or 6 years where they evidence a payment | Actor anonymised, then deleted |
| Deletion requests | 6 years | Kept as proof that we honoured your request, with your identity removed |
| Enquiries and panel-interest sign-ups | 24 months from last contact | Deleted |
If you delete your account we remove your personal data within one month. Financial and audit records in the table above are kept for the periods shown, with your identity removed. Research results already published to a client do not change, because they contain no identifiers.
8. Your rights
Under UK GDPR you have the right to access your data, correct it, erase it, restrict or object to processing, obtain portability, and withdraw consent at any time. You will never be penalised for exercising a right, and withdrawing consent does not affect rewards already earned.
To exercise a right, email hello@epicureandigitalconsultants.com. We respond within one month. You may also complain to the ICO at ico.org.uk, though we would prefer the chance to put things right first.
9. Security
Access to your data is enforced at the database level by row-level security, so one participant cannot read another’s records and one client cannot read another’s studies. Administrative access requires multi-factor authentication and is written to an append-only audit trail. Email notifications identify recipients by a one-way hash rather than storing the address in the log.
10. Decisions, and who can join
We make no decision about you by automated means alone that produces a legal or similarly significant effect. Quality checks flag a response for review; a person decides the outcome, and you can ask us to look again. The panel is for adults: you must be 18 or over to join, and we do not knowingly hold data about children.
11. Changes
If we change this policy materially we will tell you and, where the change affects a consent you have given, ask you to review it again.