Privacy notice for qualitative studies

As at 24 August 2026

1. Data controller

Unless otherwise stated in the study-specific information, the data controller for the processing of personal data in the context of qualitative studies is:

bemorrow GmbH
Lochhamer Str. 75
82166 Gräfelfing
Germany

2. Data Protection Contact

If you have any questions regarding data protection or wish to exercise your rights, please contact our Data Protection Officer:

Dr Georg Schröder
Maximilianstr. 27
80539 Munich
Germany
Email: datenschutz@legaldata.law

3. Scope and types of studies

This privacy notice applies to qualitative studies conducted by bemorrow itself or in which bemorrow is involved. These may include, in particular, individual interviews, group discussions and focus groups, observations and shadowing studies, usability and product tests, as well as diary studies and digital surveys.

Additional or different privacy notices may apply to individual studies. In such cases, the information you receive upon invitation, during recruitment or before the start of the respective study shall prevail.

4. Purposes of processing

We process personal data in particular in order to:

• plan, organise and conduct qualitative studies,
• recruit suitable study participants and communicate with them,
• to conduct interviews, focus groups, observations, tests and digital surveys,
• to analyse statements, experiences, needs and usage behaviour,
• prepare study results for our clients,
• to document the conduct and quality of the study,
• to manage consents, objections and deletions,
• to answer queries and to handle data protection enquiries.

The results are generally summarised and, where possible, analysed in an anonymised or pseudonymised form. The data is not used for advertising purposes or for automated decision-making regarding individual persons in the context of qualitative studies, unless otherwise expressly stated in the study-specific information.

5. What data may be processed?

Depending on the study, the following data in particular may be processed:

• contact details and communication data,
• sociodemographic details, insofar as they are required for selection or evaluation,
• information on experiences, attitudes, needs and behaviour,
• information on the use of products, services or digital applications,
• interview and discussion contributions,
• observation data,
• image and audio recordings,
• screen and interaction recordings,
• photographs,
• technical data, such as date, time, the device used or session data.

We will inform you of the specific data to be collected in a particular study before the data collection begins.

6. Video, audio and screen recordings

If a study is being recorded, we will inform you separately before it begins about:

• the nature and scope of the recording,
• the purpose of the recording,
• the retention period,
• access and recipients,
• any possible disclosure to clients,
• Anonymisation, pseudonymisation or deletion,
• Your rights and the option to withdraw consent.

Audio and video recordings in which individuals or their spoken words are recognisable will only be made if this is necessary for the specific study and the relevant consents or other legal bases are in place.

During observations in publicly accessible areas, it may happen that individuals who are not taking part in the study are recorded by chance. We organise the recordings and the procedure in such a way as to avoid this as far as possible. Individuals captured incidentally will not be analysed. Such material will be deleted immediately after review or permanently obscured, provided that no other legal basis requires further storage.

7. Legal bases

The specific legal basis depends on the study in question, the data subject and the role of bemorrow.

7.1 Consent

For participation in a qualitative study, as well as for recordings that cannot already be processed on another legal basis, your consent in accordance with Article 6(1)(a) of the GDPR is generally the legal basis. Consent is voluntary and may be withdrawn at any time with future effect. The lawfulness of the processing up to the point of withdrawal remains unaffected.

Consent is not valid unless it is given voluntarily, in an informed manner, specifically and unambiguously. We therefore obtain consent, where necessary, separately and on a study-by-study basis.

7.2 Legitimate interests

Where this is permissible in a specific case and justified following a documented balancing of interests, processing may be based on our legitimate interests or those of our client in accordance with Article 6(1)(f) of the GDPR. These may, in particular, relate to the organisation, conduct, quality assurance and evaluation of a qualitative study that is limited in time and scope.

In doing so, we take particular account of the reasonable expectations of the data subjects, the nature and scope of the processing, the degree of intrusion, and measures for data minimisation, short-term storage, erasure and anonymisation. Whether this legal basis is applied is assessed separately for each study and specified in the study-specific information.

7.3 Contractual or pre-contractual necessity

If you enter into an agreement with bemorrow or a client regarding your participation, Article 6(1)(b) of the GDPR may serve as the legal basis, insofar as the processing is necessary for the performance of that agreement.

7.4 Legal obligations

Where necessary, we process personal data to comply with legal obligations in accordance with Article 6(1)© of the GDPR, for example to fulfil statutory retention or record-keeping obligations.

7.5 Special categories of personal data

As a general rule, we do not collect special categories of personal data, in particular health data, biometric data, data relating to political opinions, religious or philosophical beliefs, or trade union membership.

Should a specific study, in exceptional circumstances, involve such data, we will inform you in advance and in no uncertain terms about the data in question and the additional safeguards in place. Processing will then only take place if a relevant exception under Article 9(2) of the GDPR is met, in particular where explicit consent is required.

8. Recruitment and source of data

Study participants may be recruited via bemorrow, our client, public calls for participants, the website, social media or external market research and recruitment agencies.

If we do not collect your personal data directly from you, we will inform you of the source of the data, insofar as this is required under Article 14 of the GDPR and no legal exception applies. Where recruitment is carried out by external partners, these partners may provide their own privacy notices.

9. Recipients and roles

Access to personal data is granted only to individuals who require it for the purposes of the respective study. This may include:

• bemorrow project teams,
• the respective client commissioning the study,
• external market research and recruitment agencies,
• interviewers, moderators, observers and transcription service providers,
• providers of secure storage, communication, video conferencing, transcription or analysis,
• other data processors whom we carefully select and bind by contract.

bemorrow’s role may vary depending on the project. bemorrow may act as the sole data controller, as a joint data controller with a client, or as a data processor on behalf of the client. The specific role, responsibilities and, where applicable, recipients are set out in the study-specific information.

Where bemorrow and a client jointly determine the purposes and essential means of processing, they shall transparently set out their respective obligations in an agreement on joint controllership in accordance with Article 26 of the GDPR. Where bemorrow processes data exclusively on the instructions of a client, the processing shall be governed by Article 28 of the GDPR.

10. Transfer to third countries

We generally store study and recording data within the European Union or the European Economic Area. Depending on the service providers or clients involved, a transfer to, or access from, a country outside the European Union or the European Economic Area cannot be ruled out.

Such a transfer shall only take place if the conditions set out in Articles 44 et seq. of the GDPR are met, in particular on the basis of an adequacy decision, appropriate safeguards such as standard data protection clauses, or a relevant statutory exception. Details are set out in the study-specific information, insofar as they are necessary for the specific processing.

11. Retention period and erasure

We retain personal data only for as long as is necessary for the respective purpose of the study or where statutory retention obligations apply.

The specific retention period depends on the nature of the study and the relevant processing and will be communicated to you before the study begins. Records will be deleted or anonymised as soon as they are no longer required for the stated purpose. Data that is no longer required and is not subject to any statutory retention obligations will be deleted.

12. Your rights

You have the following rights in accordance with the statutory requirements:

• Right of access to information regarding the processing of your personal data in accordance with Article 15 of the GDPR,
• Right to rectification of inaccurate data in accordance with Article 16 of the GDPR,
• Right to erasure in accordance with Article 17 of the GDPR,
• Right to restriction of processing in accordance with Article 18 of the GDPR,
• Right to data portability pursuant to Article 20 of the GDPR,
• Right to object to processing based on Article 6(1)(e) or (f) of the GDPR, in accordance with Article 21(1) of the GDPR,
• Right to withdraw consent with future effect.

To exercise your rights, simply send a message to datenschutz@legaldata.law. We may request appropriate additional information to verify your identity.

Where data is processed on behalf of a client, your enquiry may also be forwarded to the relevant data controller or coordinated with them. Your statutory rights remain unaffected.

13. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. In particular, the supervisory authority at our registered office may be competent:

Bavarian State Office for Data Protection Supervision
Promenade 18
91522 Ansbach
Germany
Website: https://www.lda.bayern.de/

Further contact details and online forms can be found on the authority’s website.

14. No automated decision-making

In the context of qualitative studies, no automated decision-making, including profiling, with legal effects or similarly significant effects takes place, unless otherwise expressly stated in the study-specific information.

15. Changes to this privacy notice

We may amend this privacy notice if there are changes to study types, processing activities, technical procedures or legal requirements. The version currently published on this website shall apply. For a specific study, the study-specific information shall prevail.