We’re committed to ensuring your privacy is protected

We promise to respect your privacy and treat any personal information you choose to share with us securely, fairly and lawfully. This policy explains how we handle personal information under the UK GDPR and the Data Protection Act 2018.

Who we are

Border Crossing UX is the trading name of Border Crossing Media Holdings Limited (SC308978). Our registered company name and registered office address are:

Border Crossing Media Holdings Limited
4 Waterside House
46 Shore
Edinburgh
Scotland
EH6 6QU

Our website address is: https://bordercrossingux.com.

How do we obtain personal data

Most of the personal information we process is provided to us directly by you for one of the following reasons:

  • You represent an organisation we work with or may work with.
  • You have contacted us.
  • You wish to leave a comment on an article we have published.
  • You wish to attend, or have attended a conference, seminar or event we are holding or talking at.
  • You wish to subscribe to our email newsletter.
  • You or your organisation have engaged our services.
  • You have voluntarily elected to provide feedback or participate in a primary research activity, e.g. complete a survey or interview.
  • You have applied for a job or internship.
  • You raise a complaint or concern, or provide feedback.
  • You report an information security, data security or cyber security concern.
  • You make a personal data request or contact us about your data protection rights.

We also receive personal information indirectly, in the following scenarios:

  • Referrals from third-party individuals.
  • Responding to public tenders.
  • Conducting secondary research.
  • Receiving or reviewing information provided by clients where we carry out work on their behalf.
  • Another person or organisation identifies you or provides information about you in connection with a complaint, concern, security report or personal data request.

What personal data do we collect and why

You use our website

Website analytics

We use Google Analytics to collect statistics about how visitors use our website so that we can identify and make improvements. Google Analytics uses first-party cookies and assigns a randomly generated identifier to a browser. We do not use this information to try to identify individual visitors, combine it with other information to identify them, or make decisions about them. Further information about the analytics cookies used and their duration is provided in the Cookies policy below.

Embedded content from other websites

Articles on this site may include embedded content (e.g. videos, images, articles, etc.). These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

Hosting, security and performance

We use a third-party service to host our website and maintain its security and performance. It processes visitors’ IP addresses to identify and block traffic that is not using the website as expected. Firewall and server logs are stored for a maximum of 12 months. The legal basis for processing this information is legitimate interests.

You leave a comment

We will keep your name and the contact details you have elected to share. In addition to this we will also log your IP address and browser user agent string to help spam detection. The legal basis for processing this information is consent.

You sign up to our email newsletter

We hold your name and supplied email address. We may also track how you use our emails – for example whether you open them or not and what links you click on. The legal basis for processing this information is consent.

You contact us online or offline

We will keep a record of your enquiry and any associated contact details, such as your email address or telephone number, so that we can respond and manage any necessary follow-up. The legal basis for processing this information is legitimate interests. Where your enquiry relates to an existing contract or steps you have asked us to take before entering into a contract, the legal basis may also be contract.

You raise a complaint or provide feedback

We may hold your name and contact details, the details of the complaint or feedback, information about the people, services or activities involved, supporting correspondence or evidence, any communication or accessibility needs you tell us about, and records of our investigation and response.

We use this information to understand, assess and respond to the matter, maintain appropriate records, identify learning or corrective action, and meet relevant client, contractual, professional, legal or regulatory requirements.

Where the complaint concerns work carried out for or on behalf of a client, we may receive relevant information from the client or share relevant and necessary information with them.

The legal basis for this processing is normally legitimate interests. Contract may also apply where the complaint concerns services delivered under a contract, and legal obligation may apply where we are required to retain, disclose or act on information by law.

If the information includes special category personal data, we will only process it where an additional condition under data protection law applies.

You report a security concern

We may hold your name and contact details, information about the concern, the systems, accounts, communications or services affected, relevant dates, supporting evidence and technical information needed to assess the report.

We use this information to assess, investigate and respond to the concern, protect our information, systems and services, maintain appropriate security records, and meet any applicable contractual, legal or regulatory requirements.

The legal basis for this processing is normally legitimate interests. Legal obligation may also apply where we are required to investigate, retain, report or disclose information by law.

You make a personal data request

We may hold your name and contact details, information that helps us locate the relevant personal data, correspondence about your request and, where reasonably necessary, information used to confirm your identity or authority to act for another person.

We use this information to verify, process and respond to your request, maintain a record of how it was handled and demonstrate compliance with data protection law.

The legal basis for this processing is legal obligation.

You or your organisation participate in research activities

We collect and use personal information for research recruitment, screening and participation. The information, lawful basis, recipients and retention arrangements vary between studies. See the Research participants section below and the project-specific information provided before you take part.

You or your company ask us to submit a proposal, estimate or response to a tender

We will keep a record of the contact information necessary to deliver this. This is likely to include your name, job title, office address, email address and telephone number. The legal basis for processing this information is contract.

You or your organisation are a prospective client or supplier

We may hold business contact information you provide, such as your name, job title, organisation, business address, email address and telephone number.

We use this information to respond to your enquiry or expression of interest, discuss a possible business relationship and take any relevant follow-up steps.

The legal basis for processing this information is normally legitimate interests. Where you have asked us to take specific steps before entering into a contract with you, the legal basis may also be contract.

You are applying for a job or internship

We will use the contact details you provide us to contact you and progress your application. We will use the other information you provide to assess your suitability for the role you have applied for. We do not collect more information than we need to fulfil this purpose and will not retain this information for longer than 2 years. The legal basis for processing this information is normally taking steps at your request before entering into a contract and our legitimate interests in managing recruitment. Legal obligation and an additional special-category condition may apply to particular information where relevant.

You visit our office and connect to the WiFi

We will record the device address and allocate you an IP address. The purpose of processing this information is to provide you with access to the internet while visiting our office. The legal basis for processing this information is legitimate interests.

You or your company engage our services, or you are a former client

We will keep the information necessary to fulfil the services we are/were engaged to provide. This usually includes the name, job title, email address and telephone numbers of all key individuals directly involved in a project. We also maintain a record of the contact details required for all relevant account administration purposes, e.g. invoicing and project logistics. The legal basis for processing this information is contract.

We reach out directly to you

In addition to this, we may also collect personal data in the process of contacting prospective clients, suppliers and research participants we believe are likely to have an interest in the services we provide or the domain we are researching. In these instances, we will always consider the interests of individuals and ensure permission for ongoing communications is obtained. The legal basis for processing this information is legitimate interests.

Whether you have to provide information

You are not normally under a statutory obligation to provide personal information to us.

We may need certain information to provide services, manage a contract, respond to a request, assess an application or determine whether a research study is relevant. We will explain what information is required and what may happen if it is not provided.

Taking part in research is voluntary. You may choose not to answer a question unless the information is needed to determine whether a study is relevant to you or to conduct it safely and lawfully.

Automated decision-making

We do not use automated decision-making or profiling to make decisions about you that have legal or similarly significant effects.

We do not use automated scoring to decide whether someone can take part in research, be offered work or receive our services.

We process the information described above for one of four reasons:

  1. Contractual obligations

The processing is necessary for a contract you have with us, or because you have asked us to take specific steps before entering into a contract, for example, submit a proposal, estimate or response to a tender.

  1. Legitimate interests

The processing is necessary for our legitimate interests or those of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests, for example maintaining records of prospective, current and former clients and suppliers, responding to enquiries, handling complaints and feedback, investigating security concerns, protecting our systems and maintaining appropriate business records.

  1. Consent

You have given us clear consent for us to process your personal data for a specific purpose, such as signing up to receive our email newsletter or taking part in research where consent is the appropriate lawful basis.

  1. Legal obligation

The processing is necessary to comply with a legal obligation, such as keeping copies of invoices and information relating to payments received, responding to personal data rights requests, or meeting applicable reporting, record-keeping and regulatory requirements.

How do we use this information

All personal data covered by this policy is controlled by Border Crossing Media Holdings Limited, unless we process it on behalf of a client or another organisation. Where we process personal data on a client’s behalf, the client may be the data controller and we will act in accordance with its documented instructions. Relevant project or participant information will explain the respective responsibilities where appropriate.

We use personal data only for the purposes explained in this policy, in relevant project-specific information, or for another compatible purpose permitted by law. We seek to collect only the information reasonably needed for those purposes.

We will never sell or rent your information, or share it with third parties for their own direct marketing purposes.

We may share relevant personal data with:

  • clients where this is necessary to deliver work, respond to a complaint or concern, or meet agreed contractual or regulatory requirements
  • service providers and data processors that support our systems, communications, administration and service delivery
  • professional advisers, auditors and insurers where reasonably necessary
  • the Market Research Society, the Information Commissioner’s Office, another regulator, ombudsman or professional body where relevant
  • courts, law enforcement bodies, public authorities or other organisations where disclosure is required or permitted by law
  • an appropriate organisation where information indicates a serious risk of harm to a person

We will only share information that is relevant and necessary, subject to applicable confidentiality, contractual and data protection requirements.

We use third-party data processors and have appropriate data protection contracts in place with them. They may process personal data only in accordance with our documented instructions and the terms of their contract, including requirements relating to security, retention, confidentiality and the use of any approved sub-processors.

How long do we keep your data

We will only retain your personal data for as long as:

  • It is needed for the purposes set out in this document.
  • The law requires us to.

The period for which we retain personal data depends on why we hold it and any relevant contractual, legal, regulatory or professional requirements.

In particular:

  • complaint records are normally kept for three years from the date the complaint is closed, unless the matter remains unresolved or a longer period is required
  • personal data request records are kept for as long as reasonably necessary to demonstrate that the request was handled appropriately and to resolve any related issue
  • information used only to confirm identity will be securely deleted when it is no longer required for that purpose, unless we have another lawful reason to retain it
  • security reports and associated records are kept for as long as necessary to investigate and resolve the concern and meet applicable legal, contractual or regulatory requirements
  • research information is retained in accordance with the relevant project, consent and data retention arrangements
  • some commercial, contractual, financial and legal records may be retained for up to seven years

We securely delete or anonymise personal data when it is no longer required.

How do we store your data

We are committed to doing all that we can to keep your data secure. We have set up systems, processes and tools to prevent unauthorised access or disclosure and make sure your data is as safe as possible, for example, we protect your data using varying levels of encryption.

We store your information in secure environments. We also make sure that any third-party services, tools and servers keep all personal data they process on our behalf secure. Some of our service providers may process or make personal data accessible outside the UK. Where this involves a restricted international transfer, we use an appropriate transfer mechanism, such as UK adequacy regulations or approved contractual safeguards, and take steps to ensure that the information remains appropriately protected.

Research participants

Much of our work involves research with members of the public, service users, professionals and staff. The arrangements differ between projects.

Before you take part, we will provide project-specific information explaining who is responsible for your personal information, why it is being used, the relevant lawful basis, who may receive it, whether a session will be recorded or observed, how long information will be kept and how to exercise your rights.

Who is responsible for your information

Where we conduct research for a client, the client may be the data controller and we may process personal information on its instructions.

In other cases, Border Crossing Media Holdings Limited may be the controller, for example where we conduct our own research or manage our research panel.

The information provided for each study will explain the position. Where we hold information on behalf of a client, we will help direct any data protection request or concern to the organisation responsible.

What we may collect

Depending on the study, we may collect:

  • your name and contact details
  • screening and demographic information
  • information about your experiences, circumstances or views relevant to the research
  • accessibility or communication needs
  • research notes and transcripts
  • audio or video recordings
  • information needed to arrange or record an incentive payment.

Recordings and observers

We will tell you before a session if it will be recorded or observed, who is likely to have access and how recordings will be used. We will obtain any agreement required before recording begins.

How research contributions are used

Research findings are normally reported in an anonymised or pseudonymised form. Reports may include quotations or extracts, but we will not identify you unless this has been explained and agreed or disclosure is otherwise required or permitted by law.

How long research information is kept

Retention depends on the project, client requirements and the type of record. The information provided for each study will explain the relevant period or the criteria used to determine it.

We delete or anonymise research information when it is no longer needed. Financial records relating to incentive payments may be retained separately for accounting and tax purposes.

Sensitive information

Some studies involve information about health, disability, ethnicity, religious or philosophical beliefs, sexual orientation or other matters treated as special category data.

We only collect and use this information where it is relevant to the research and where an additional legal condition applies. The project-specific information will explain the position.

Voluntary participation and withdrawal

Taking part in research is voluntary. You may decline to answer a question or stop taking part.

The project information will explain how and until when identifiable information can be withdrawn. Once information has been irreversibly anonymised or combined into aggregate findings, it may no longer be possible to identify and remove an individual contribution.

Rights and complaints

You can contact us about your rights or a concern relating to research. Where a client is the data controller, we will explain this and help route your request.

Border Crossing UX is an MRS Company Partner and works to the MRS Code of Conduct. Research-related complaints may also fall within the MRS complaints process.

Your rights

Depending on the circumstances and the lawful basis for processing, you may have the right to:

  • ask us for information about how we use your personal data
  • ask for access to the personal data we hold about you
  • ask us to correct inaccurate or incomplete personal data
  • ask us to delete personal data where there is no longer a lawful reason to retain it
  • ask us to restrict how personal data is used in certain circumstances
  • object to certain uses of your personal data
  • receive certain personal data in a portable format or ask us to transfer it where the right to data portability applies
  • withdraw consent at any time where we rely on consent
  • complain to the Information Commissioner’s Office

These rights are not absolute and may not apply in every circumstance. For example, we may need to retain information where it remains necessary to fulfil a contract, meet a legal obligation, establish or defend a legal claim, or for another lawful reason.

Withdrawing consent

Where we rely on your consent, you can withdraw it at any time.

  • For our newsletter, use the unsubscribe link in the email.
  • For a research study, use the contact details provided in the project information.
  • For another use of your information, contact our data protection contact or use our Personal data request form.

Withdrawing consent does not affect processing carried out before it was withdrawn. It also does not affect information we lawfully hold or use on another basis, such as information we need to retain to meet a legal or contractual obligation.

Personal data requests or enquiries

You do not have to use our Personal data request form. You can make a request verbally or in writing using any of the contact details below.

We will respond without undue delay and normally within one calendar month. Where we reasonably need information to confirm your identity or your authority to act for another person, the response period begins when we receive that information.

If your request is complex or you have made several requests, we may extend the response period by up to a further two months. If this applies, we will tell you within the first month and explain why more time is needed.

Our data protection lead is François Roshdy. Please contact him with any personal data requests or enquiries about this policy or how we use your personal data using the contact options below.

You can also use our Personal data request form. The form is optional and is provided to help you give us information that may make it easier to locate and respond to your request.

Email: francois@bordercrossingux.com
Phone: 0131 467 9227
Post: Border Crossing UX, 4 Waterside House, 46 Shore, Edinburgh, Scotland, EH6 6QU.

If you are dissatisfied with how we have used or protected your personal data, you can use our Complaints and feedback process. You also have the right to complain to the Information Commissioner’s Office.

This privacy policy only applies to https://bordercrossingux.com/ and doesn’t cover the external websites that we link to. If you go to another website from this one, we encourage you to read the privacy policy on that website to find out how they will collect and use your personal data.

We use cookies and similar technologies to operate and protect this website, understand how it is used and provide content from third-party services.

Some cookies are strictly necessary for the website to work securely. Other cookies help us understand website use or support embedded content such as videos.

You can manage or remove cookies using your browser settings. Blocking some cookies may affect how parts of the website or embedded content work.

The cookies identified during our most recent review are listed below. Cookies set by embedded services may vary depending on the content viewed, how you interact with it and changes introduced by the service provider.

This list was last reviewed on 20 July 2026.

Strictly necessary cookies

These cookies support the security and operation of the website.

Name: __cf_bm
Domain: .bordercrossingux.com
Type: Necessary, first-party
Provider: Cloudflare
Purpose: Used by Cloudflare to distinguish between people and automated traffic and help protect the website from malicious activity.
When it is used: Website security and bot protection.
Duration: Approximately one hour.

Name: cf_clearance
Domain: .bordercrossingux.com
Type: Necessary, first-party
Provider: Cloudflare
Purpose: Records that a visitor has successfully completed a Cloudflare security check.
When it is used: Only set when a security challenge is triggered. It allows the visitor to avoid repeated checks for the duration of the cookie.
Duration: Approximately one year, based on our most recent review.

Analytics cookies

We use Google Analytics to understand how visitors use the website and identify potential improvements.

Name: _ga
Domain: .bordercrossingux.com
Type: Analytics, first-party
Provider: Google Analytics
Purpose: Used to distinguish browsers and compile information about how visitors use the website. It assigns a randomly generated identifier.
When it is used: Website visitor and usage analytics.
Duration: Approximately 400 days.

Name: _ga_X2ZME3854Z
Domain: .bordercrossingux.com
Type: Analytics, first-party
Provider: Google Analytics
Purpose: Used to maintain information associated with this website’s Google Analytics property and measure website use.
When it is used: Analytics reporting for this website.
Duration: Approximately 400 days.

Embedded-content cookies

Pages containing video or other content supplied by third parties may cause those services to set cookies when the content is loaded or used.

The cookies set may vary depending on the content viewed, whether you are signed in to the third-party service and changes made by the service provider.

YouTube

Name: __Secure-ROLLOUT_TOKEN
Domain: .youtube.com
Type: Embedded content, third-party
Provider: YouTube
Purpose: Used by YouTube to manage feature availability and embedded-player behaviour.
When it is used: Delivery and operation of embedded YouTube videos.
Duration: Approximately 180 days.

Name: VISITOR_INFO1_LIVE
Domain: .youtube.com
Type: Embedded content and measurement, third-party
Provider: YouTube
Purpose: Used by YouTube to maintain visitor and session information associated with embedded videos.
When it is used: Embedded-video delivery, performance and usage information.
Duration: Approximately 180 days.

Name: VISITOR_PRIVACY_METADATA
Domain: .youtube.com
Type: Embedded content, third-party
Provider: YouTube
Purpose: Stores information about privacy settings associated with embedded YouTube content.
When it is used: Applying privacy-related settings and behaviour to embedded videos.
Duration: Approximately 180 days.

Name: YSC
Domain: .youtube.com
Type: Embedded content and measurement, third-party
Provider: YouTube
Purpose: Maintains information about a visitor’s interaction with an embedded YouTube player during a browsing session.
When it is used: Embedded-video session and usage information.
Duration: Session.

Name: __Secure-YNID
Domain: .youtube.com
Type: Embedded content and tracking, third-party
Provider: YouTube
Purpose: An identifier cookie that may be set by YouTube in some circumstances.
When it is used: Embedded-video functionality, measurement or personalisation, depending on the service configuration.
Duration: Approximately 180 days, based on our most recent review.

Vimeo

Name: _cfuvid
Domain: .vimeo.com
Type: Security, third-party
Provider: Cloudflare, used by Vimeo
Purpose: Helps Cloudflare distinguish individual requests made to Vimeo and apply security and rate-limiting controls.
When it is used: Security and delivery of embedded Vimeo content.
Duration: Session.

How to manage or remove cookies

Most browsers allow you to view, block and delete cookies. Blocking all cookies may affect how some websites and embedded content work.

Guidance on managing cookies is available from:

Google Chrome

Microsoft Edge

Mozilla Firefox

Opera

Apple Safari

To manage cookies in another browser, visit the browser developer’s website.

Changing your browser settings will affect cookies used in future. It may not automatically remove cookies that are already stored on your device, so you may also need to delete existing cookies through your browser settings.

More information about cookies

You can find further information about cookies, including how to identify and manage them, on the About Cookies website.

Last updated

This document was last updated on 20/07/2026.