Last Updated: 9 September 2026

This GDPR & Data Protection Statement explains the principles iReach Insights Limited applies when protecting personal data relating to members of the iReach Conversations research community.

It is designed to provide a clear overview of our approach to data protection and should be read together with the iReach Conversations Privacy Policy, Member Terms & Conditions and Cookie Policy.

Where this Statement provides a summary, the Privacy Policy contains the more detailed information about individual processing activities.

1. Our Commitment to Data Protection

Trust is fundamental to market research. iReach aims to collect and use personal data fairly, lawfully, transparently and only for legitimate research, community administration and related purposes.

We design our data practices around the GDPR principles of lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.

We do not treat membership of iReach Conversations as permission to use personal data for any purpose. Personal data should be used for specified and legitimate purposes and supported by an appropriate lawful basis.

2. Who Is Responsible for Your Personal Data?

iReach Conversations is operated by iReach Insights Limited.

For the core activities involved in recruiting, profiling, communicating with and administering iReach Conversations members, selecting members for research, managing research participation and administering rewards, iReach generally acts as the Data Controller.

As Data Controller, iReach is responsible for determining the purposes and means of this processing and for meeting the applicable obligations imposed on controllers by data protection law.

iReach Insights Limited
Ireland
Privacy/Data Protection Contact: --
Email: info@ireachconversations.com
Website: ireachconversations.com
Registered Office: --
Company Registration Number: --

3. The Data Protection Principles We Apply

We seek to apply the following principles when handling member personal data:

Lawfulness, fairness and transparency - we should have a lawful reason for processing and explain our use of personal data clearly.

Purpose limitation - information should be collected for specified, explicit and legitimate purposes and not reused incompatibly.

Data minimisation - we should collect and use only the personal data reasonably necessary for the relevant purpose.

Accuracy - we take reasonable steps to keep information accurate and enable members to update relevant profile information.

Storage limitation - identifiable personal data should not be retained for longer than necessary.

Integrity and confidentiality - appropriate technical and organisational measures should protect personal data.

Accountability - iReach should be able to demonstrate how it meets its data protection responsibilities.

4. What Personal Data Does iReach Process?

Depending on your membership and research participation, iReach may process information such as:

identity and contact information;

age, gender, geographic and demographic information;

household, employment, education and socio-economic information;

interests, behaviours and preferences;

member profile information;

survey responses, opinions and research contributions;

survey participation, screening and completion information;

points, rewards and redemption records;

communications with iReach;

research-quality and fraud-prevention information; and

IP address, device, browser, cookie and other technical information.

Some research projects may involve Special Category Personal Data, which receives additional protection under GDPR.

5. Why We Process Personal Data

Personal data may be processed to:

create and manage iReach Conversations memberships;

maintain member research profiles;

identify members who may be suitable for particular research;

invite members to surveys and other research activities;

conduct market, social and opinion research;

manage samples, screening and research quotas;

analyse and report research findings;

manage points, rewards and redemptions;

maintain research quality and prevent fraud or duplicate participation;

provide member support;

operate and secure our research systems;

meet legal, accounting and regulatory obligations; and

protect the rights, security and integrity of iReach, our members, clients and research.

6. Lawful Bases Under GDPR

GDPR requires an appropriate lawful basis whenever personal data is processed.

Depending on the activity, iReach may rely on:

Contract - where processing is necessary to administer your membership or provide a service you have requested.

Consent - where you have freely given an appropriate consent for a particular use of your personal data.

Legitimate interests - where processing is reasonably necessary for a legitimate purpose, such as maintaining research quality, protecting systems, preventing fraud or operating and improving our research community, and those interests are not overridden by your rights and freedoms.

Legal obligation - where processing is necessary to comply with a legal requirement.

The applicable lawful basis depends on the processing activity. Where we rely on consent, you may withdraw it for future processing.

7. Special Category Personal Data

GDPR gives additional protection to certain sensitive information, including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic or certain biometric data, health data, and information concerning sex life or sexual orientation.

Market research may legitimately explore some of these topics. Membership of iReach Conversations does not constitute blanket consent to process Special Category Personal Data.

Where a study involves Special Category Personal Data, iReach will identify an appropriate Article 6 lawful basis and a valid Article 9 condition. Additional information and explicit consent will be provided or obtained where required.

Members remain free to decline a research invitation or stop participating in a study, subject to the practical limitations explained for the research.

8. Research Profiling and Selection

We may use information in a member's research profile to identify people who appear suitable for particular research projects and to manage research quotas.

This may involve automated filtering or profiling based on characteristics such as age group, location, household characteristics, product usage or interests.

Research selection is used to decide which research opportunities may be relevant to a member. It is not intended to make decisions producing legal or similarly significant effects on members.

9. How We Protect Member Identity in Client Research

Our normal approach is to provide research clients with findings in aggregated, anonymised or pseudonymised form rather than identifying individual iReach Conversations members.

Research outputs may include statistics, charts, tables, analysis, audience segments and anonymous or pseudonymised comments.

Pseudonymised information remains personal data where an individual could still be identified using additional information. Truly anonymised information, where individuals can no longer be identified, is no longer personal data under GDPR.

We will not normally provide a client with information that directly identifies a member simply because that member participated in research.

Where identifiable disclosure is necessary for a particular study, the purpose and intended disclosure will be explained and an appropriate lawful basis will be established before the information is shared.

10. Data Minimisation and Research Design

We aim to design research so that it collects only information reasonably necessary to answer the research question.

Where identifiable information is unnecessary, we should use aggregated, anonymised or appropriately pseudonymised data where practicable.

Research involving sensitive, unusual or higher-risk processing may require additional review, safeguards or a Data Protection Impact Assessment.

11. Research Quality and Fraud Prevention

iReach has a legitimate need to protect the reliability of research and the integrity of its member community.

We may therefore use profile, participation, response and technical information to identify duplicate participation, inconsistent or implausible responses, unusually rapid completion, automated activity, account misuse or other indicators of unreliable or fraudulent participation.

Quality controls may affect whether points are approved or whether an account is reviewed or restricted.

We aim to apply these controls fairly and proportionately.

12. Sharing Personal Data with Service Providers

iReach may use trusted service providers to operate the research community and supporting technology. These may include hosting, survey technology, email, analytics, security, fraud prevention, reward fulfilment, technical support and professional services.

Where another organisation processes personal data on behalf of iReach, we will use appropriate contractual and data protection arrangements and will require the provider to protect personal data in accordance with applicable law.

13. International Data Transfers

Where personal data is transferred outside the European Economic Area, iReach will ensure that an appropriate lawful transfer mechanism and safeguards are used where required.

These may include a European Commission adequacy decision or Standard Contractual Clauses together with supplementary safeguards where necessary.

14. Security and Confidentiality

iReach uses appropriate technical and organisational measures designed to protect personal data from accidental or unlawful loss, destruction, alteration, unauthorised access or disclosure.

Depending on the system and risk, measures may include access controls, authentication, encryption, monitoring, backups, security procedures, restricted staff access and confidentiality obligations.

Access to identifiable member data should be limited to people who reasonably need it for legitimate business or research purposes.

No internet-based service can provide an absolute guarantee of security.

15. How Long We Keep Personal Data

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and for applicable research-integrity, financial, legal, accounting and regulatory requirements.

Retention periods may differ between active member profiles, research responses, quality records, rewards, closed accounts, support records and backups.

Where information no longer needs to identify a member, anonymisation may allow research findings to be retained without continuing to process personal data.

16. Your GDPR Rights

Subject to applicable law and the circumstances of the processing, members may have rights including:

the right to be informed about the processing of personal data;

the right to access personal data held about them;

the right to have inaccurate information corrected;

the right to request erasure in certain circumstances;

the right to restrict processing in certain circumstances;

the right to data portability where applicable;

the right to object to certain processing;

the right to withdraw consent where consent is the lawful basis; and

rights relating to certain solely automated decisions and profiling.

These rights are not absolute and legal exemptions may apply.

17. Exercising Your Rights

You may contact iReach to exercise an applicable data protection right. We may need to take reasonable steps to verify your identity before disclosing or changing personal data.

Requests will be handled in accordance with the time limits and other requirements of applicable data protection law.

Where appropriate, we will provide information electronically and in an accessible form.

Privacy/Data Protection Contact: --
Email: info@ireachconversations.com

18. Your Right to Object

Where processing is based on legitimate interests, you may have the right to object based on your particular circumstances.

You may also object to direct marketing at any time. Where an applicable objection is made to direct marketing, personal data will no longer be processed for that purpose.

GDPR also provides a right to object to certain processing for research purposes, subject to the circumstances and legal basis of the processing.

19. Withdrawing Consent

Where iReach relies on your consent, you may withdraw it at any time.

Withdrawal applies to future processing and does not affect the lawfulness of processing carried out before consent was withdrawn.

Withdrawing consent for a particular study or processing activity does not necessarily require deletion of information that iReach must retain under another lawful basis or that has already been irreversibly anonymised.

20. Closing Your Membership

You may request closure of your iReach Conversations membership.

Following closure, your profile will no longer be used to invite you to new panel research, subject to processing necessary to complete closure and meet applicable legal or operational obligations.

Research findings that have already been irreversibly anonymised or aggregated may continue to be used because they no longer identify you.

The Privacy Policy explains retention after closure in more detail, while the Member Terms govern the treatment of outstanding points and rewards.

21. Children and Young People

The ordinary iReach Conversations membership programme is subject to a minimum age requirement.

Where iReach undertakes research involving children or young people outside ordinary panel membership, additional transparency, consent and safeguarding measures will be applied where required.

22. Personal Data Breaches

iReach maintains procedures for assessing and responding to suspected Personal Data Breaches.

Where a breach is likely to create a risk to individuals, iReach will assess and meet applicable notification obligations to the Data Protection Commission and, where required, affected individuals.

We will take reasonable steps to investigate, contain and mitigate relevant incidents.

23. Accountability and Data Protection by Design

We aim to consider data protection when designing and changing research processes, systems and services rather than only after processing has begun.

This may include data minimisation, access controls, appropriate defaults, risk assessments, processor due diligence, retention controls and Data Protection Impact Assessments where required.

iReach should maintain appropriate records and documentation to demonstrate compliance with its data protection obligations.

24. Complaints and the Data Protection Commission

If you have a concern about how iReach uses your personal data, we encourage you to contact us first so that we can investigate and respond.

You also have the right to lodge a complaint with the Data Protection Commission, Ireland's independent supervisory authority for data protection.

Data Protection Commission
6 Pembroke Row
Dublin 2
D02 X963
Ireland
Website: www.dataprotection.ie

25. Relationship with Our Privacy Policy

This Statement summarises iReach's GDPR and data protection approach for the iReach Conversations research community.

Our Privacy Policy provides more detailed transparency information about the personal data we collect, purposes of processing, lawful bases, recipients, retention, international transfers and member rights.

Where additional information is required for a particular research activity, we may provide a project-specific privacy notice or consent information.

26. Updates to this Statement

We will review this Statement as our research activities, systems, providers and legal obligations evolve.

The latest version will be published on ireachconversations.com with an updated date.

Material changes affecting members will be communicated where appropriate.

27. Contact Us

For questions about data protection or to exercise your rights, please contact:

iReach Insights Limited Ireland
Privacy/Data Protection Contact: --
Email: info@ireachconversations.com
Website: ireachconversations.com