1. What this Policy covers
ADMAKER LTD publishes this Privacy Policy so that every individual whose personal data we process can see who the controller is, which purposes we pursue, which Article 6 UK GDPR lawful bases support those purposes, which categories of data we hold, how long we keep them, who receives them, how international transfers are handled, and how statutory rights may be exercised. The notice is written for clients and their staff, commercial prospects, users of https://admaker.digital, market research respondents, journalists and other media contacts, and suppliers. Personal data means information relating to an identified or identifiable natural person, including client-roster names, harvest-request emails, linkable survey answers, journalist contact records, freelance invoices, and technical identifiers created when a browser loads our site.
We process personal data only where a lawful basis exists: contract, legitimate interests, consent, or legal obligation. We do not sell personal data. We do not treat a research panel as an advertising list, or a journalist’s private number as a media-buying key. This Policy should be read with the Cookie Policy, the Terms of Service, and the Terms and Conditions. Where a client contract, participant information sheet, media protocol or supplier agreement sets more specific processing terms, those terms apply to that engagement if they remain consistent with UK GDPR and the Data Protection Act 2018. If a conflict cannot be resolved by interpretation, the statutory rights of the data subject prevail.
2. Controller identity and roles
The controller for the processing described here is ADMAKER LTD, a market research, public relations and advertising agency. The address for data-protection correspondence is 60 Tottenham Court Road, London, W1T 2EW, United Kingdom. Privacy emails should be sent as ordinary text to tech.team@admaker.digital. The telephone number is +44 7811 456789 during United Kingdom business hours. The public website is https://admaker.digital. ADMAKER LTD determines the purposes and means of processing for client administration, business development, website operations, research design (except where a client is independently controller of a particular study), public-relations contact management, advertising campaign administration, supplier management, and statutory record keeping.
In some engagements we act as processor for a client who remains controller, for example where we host a survey, manage a media list supplied by the client, or operate advertising accounts on documented instructions. We will say so in the statement of work or data-processing schedule, and we will process only on documented instructions unless United Kingdom law requires otherwise. Joint controllership may arise where ADMAKER LTD and a client jointly determine purposes and means, for example a co-branded study. The allocation of UK GDPR duties will then be set out in writing. A data subject may still exercise rights against either party.
At the date of this Policy ADMAKER LTD has not appointed a statutory data protection officer under Article 37 UK GDPR, because our core activities do not consist of large-scale regular systematic monitoring of individuals, nor of large-scale processing of special category or criminal-offence data as a principal business. An internal privacy lead can be reached at tech.team@admaker.digital. If Article 37 later applies, we will appoint a data protection officer and notify the Information Commissioner’s Office.
3. Law, jurisdiction and the ICO
This Policy is governed by the law of England and Wales. ADMAKER LTD is established in the United Kingdom. UK GDPR and the Data Protection Act 2018 apply to processing in the context of that establishment. The lead supervisory authority is the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. The ICO website is https://ico.org.uk. A person who considers that our processing infringes data-protection law may lodge a complaint with the ICO. We ask, without limiting that right, that concerns first be sent to tech.team@admaker.digital. A complaint to the ICO does not affect other remedies in the courts of England and Wales.
Professional standards that are not statutes still shape handling of data in this industry. Market research is conducted with regard to the Market Research Society Code of Conduct and the ICC/ESOMAR International Code. Advertising is prepared with regard to the UK Code of Non-broadcast Advertising and Direct & Promotional Marketing (CAP Code) and, where relevant, the UK Code of Broadcast Advertising (BCAP Code). Public relations work is conducted with regard to accuracy, fair dealing with journalists, and the prohibition on disguising advertising as independent editorial. Those codes do not replace UK GDPR. They add duties of honesty, consent quality, and separation between research, editorial contact and paid media.
4. People whose data we process
We process personal data of six principal groups. First, clients and their personnel: directors, marketing leads, research sponsors, legal and procurement contacts, and other staff who instruct, review or pay for work. Second, prospects: individuals at organisations that have enquired, attended a professional conversation, or been identified as a relevant business contact. Third, website users: persons who visit https://admaker.digital, submit a harvest request through contact.html, or read about.html, services.html or portfolio.html. Fourth, research respondents who take part in interviews, groups, surveys, diaries or observational work. Fifth, journalists, editors, producers and other media or public-affairs contacts. Sixth, suppliers, freelancers, field agencies, panel providers, media owners, production houses and professional advisers, together with their staff.
We may also process limited personal data of people who appear incidentally in client materials, such as employees named in a public annual report used for desk research. Incidental processing is minimised. Where a campaign or study would require systematic processing of a new population, we treat that as a fresh purpose and apply a fresh lawful-basis assessment before collection begins.
5. Categories of personal data
5.1 Clients and client personnel
For clients we typically process identity and contact data (name, job title, employer, business email, business telephone, postal address for notices), contractual and commercial data (briefs, statements of work, fee arrangements, billing entity), professional correspondence, meeting notes, comments on research instruments and creative work, access credentials for shared workspaces we administer, and records required for accounting, tax and professional indemnity. We may process dietary or access requirements when we host a workshop, only for that event. If someone discloses health information to request a reasonable adjustment, we process it only for that adjustment. Where client work product contains personal data of the client’s own customers, the client is usually controller of that underlying data. We will not use a client’s customer file to seed our own prospect list.
5.2 Prospects
For prospects we process name, role, organisation, business contact details, the source of the enquiry, notes of professional conversations, and a limited record of materials sent. We may record that a person asked not to be contacted, which is itself personal data kept to honour that request. Prospect data is business-to-business. We do not scrape private social profiles for sensitive inferences or buy consumer marketing lists and relabel them as professional outreach. Where a contact comes from a public professional directory, a conference list that permitted follow-up, a referral, or a form on our site, we record the source so that the lawful basis can be explained if asked.
5.3 Website users
When a person uses https://admaker.digital we process technical data that the server and, where enabled, analytics tools generate: internet protocol address, coarse location derived from that address, browser and device type, referring URL, pages viewed, timestamps, and cookie identifiers as described in the Cookie Policy. If the person submits the harvest request form we process the name, email address and message they provide. We do not require an account to read public pages. Free-text fields should not be used to send special category or criminal-offence data; if such data is sent unsolicited we will delete it unless we must retain a copy to handle a legal claim or a safeguarding issue.
5.4 Market research respondents
Respondent data depends on the method. It may include screening answers, demographic classifications at the level the study requires, attitudes, claimed or observed behaviour, recordings where the participant has been told that recording will occur, transcripts, open-ended comments, incentive payment details, and quality-control flags. Direct identifiers are separated from analytical files as soon as the design allows. Where a study is commissioned as anonymous or confidential, we design collection so that ADMAKER LTD and the client cannot reasonably re-identify a participant from delivered tables, except where a participant has agreed to a named case study. Special category data is not collected in ordinary brand, communications or advertising research. If a client commissions a study that cannot be performed without it, we will not proceed unless an Article 9 UK GDPR condition is identified, research ethics tests are met, and, where required, a data protection impact assessment is completed before fieldwork. Criminal-offence data is not a research product we offer.
5.5 Journalists and public-relations contacts
For media contacts we process professional identity and outlet, beats or specialisms, business contact details, records of previous correspondence, embargo preferences, and notes necessary to brief accurately. We may keep copies of published articles or broadcasts that are already public. We do not covertly monitor a journalist’s private life or append consumer purchase data to a reporter’s record. A journalist may ask to be removed from a distribution list or from all ADMAKER LTD lists; we will honour that request except where we must retain a minimal suppression record or a record of a legal dispute.
5.6 Suppliers
Supplier data includes identity and contact details of account managers, contractual terms, due-diligence materials proportionate to the service, invoices, bank details of the contracting entity, and performance notes. Where a freelance individual is the contracting party, some of that data is personal data of that individual. Bank details are limited to those who pay invoices. We do not use supplier lists for unrelated advertising of ADMAKER LTD services except where the person has a reasonable expectation of professional updates and can object.
6. Purposes of processing
We process personal data to receive and qualify enquiries; to negotiate and perform contracts for market research, public relations and advertising; to design, field, analyse and report research; to plan and execute public-relations programmes including media relations, issues preparation and thought leadership; to plan, traffic, buy, quality-check and evaluate advertising; to operate, secure and improve https://admaker.digital; to manage suppliers; to keep accounting, tax and company records; to obtain professional advice and insurance; to establish, exercise or defend legal claims; and to comply with court orders and ICO or other competent-authority requests. We do not process personal data to decide an individual’s eligibility for employment by a third party, creditworthiness, or access to essential public services.
7. Lawful bases under UK GDPR
Article 6 UK GDPR requires a lawful basis for each purpose. ADMAKER LTD does not treat convenience as a basis. The bases we rely on are contract, legitimate interests, consent, and legal obligation. We record the basis against processing activities in an internal register. If we cannot identify a basis, we do not start. If a basis falls away, we stop or anonymise.
7.1 Contract: Article 6(1)(b)
We process personal data where necessary for the performance of a contract to which the data subject is party, or to take steps at the request of the data subject before entering a contract. This covers, for a client who is a natural person including a sole trader, administration of the engagement, billing, delivery of research, public-relations and advertising services, and related correspondence. It covers administration of a freelance supplier who contracts in their own name, and handling of a harvest request to the extent necessary to decide whether we can offer terms. Article 6(1)(b) does not authorise us to add a contracting individual’s email to an unrelated newsletter, to reuse a research participant’s identity in advertising without a model or testimonial agreement, or to retain prospect data indefinitely on the theory that a contract might one day exist. Where the contracting party is a company, staff we deal with are usually processed under legitimate interests or, for optional communications, consent.
7.2 Legitimate interests: Article 6(1)(f)
For journalist contacts, the legitimate interest is professional media relations, including offering comment, correcting the record, and distributing material that is clearly labelled as to its source. That interest does not extend to harassment, repeated contact after a clear refusal, or processing of a journalist’s family data. For website security logs, the interest is prevention of abuse, fraud and unauthorised access. A data subject may object to processing based on legitimate interests. We will then stop unless we demonstrate compelling legitimate grounds that override the objection, or the processing is for legal claims. Objection to direct marketing is absolute.
7.3 Consent: Article 6(1)(a)
We rely on consent where the law requires it or where it is the most honest basis. Consent is used for non-essential cookies and similar technologies as set out in the Cookie Policy; for optional newsletters or event invitations where PECR or good practice requires a clear opt-in; for research participation where the person is not under a contractual duty to take part; for use of a person’s identifiable image, voice or testimonial in advertising or public-facing case material; and for any processing of special category data that rests on explicit consent under Article 9(2)(a). Consent is presented in plain language, separated from contract terms that are not optional, and capable of being withdrawn as easily as it was given, using tech.team@admaker.digital or the unsubscribe or cookie controls for that channel. Withdrawal does not affect lawfulness of processing before withdrawal. We do not bundle research consent with a requirement to accept advertising follow-up, and we do not treat silence, pre-ticked boxes, or continued scrolling as consent.
7.4 Legal obligation: Article 6(1)(c)
We process personal data where necessary to comply with a legal obligation to which ADMAKER LTD is subject under United Kingdom law. This includes retaining accounting records for the periods required by companies and tax legislation; responding to binding requests from the ICO, the courts, or other authorities with power to compel; and complying with advertising and consumer-protection duties that require us to keep substantiation. Legal obligation is not used as a residual excuse to keep marketing files. If a statute does not require the processing, we do not cite Article 6(1)(c).
8. Market research ethics
Market research at ADMAKER LTD produces evidence that can support positioning, communications and media decisions. It is not a disguised sales channel. We distinguish research from direct marketing in participant information, interviewer scripts, sample sources, and files we keep after analysis. A person who agrees to an interview about category behaviour is not thereby agreeing to receive the client’s product offers. If a client wishes to convert a research sample into a marketing list, we refuse unless each person has given a separate, informed permission that meets UK GDPR and PECR. Participants are told who is conducting the work (ADMAKER LTD, and the client identity unless a genuine and lawful reason for withholding the client name exists), what the topic is, whether the session is recorded, whether observers are present, how long it will take, whether an incentive is offered, and how to withdraw.
Confidentiality in research means comments are not attributed in client reports in a form that identifies the speaker, unless the speaker has agreed to attribution. Anonymity means we do not hold identifying links. Many studies are confidential rather than anonymous because incentives, recontact quality checks, or longitudinal design require a code that can be linked under restricted access. Access is limited to staff and processors who need it for fieldwork, quality, incentive fulfilment or compliance. When the purpose of the link ends, we delete or irreversibly anonymise it. International fieldwork commissioned through our London office remains subject to this Policy for ADMAKER LTD’s own processing, and to local research and privacy law for agencies we appoint.
9. Public relations data
Public relations processing exists to place accurate, attributable information in the public domain, to prepare clients for scrutiny, and to maintain professional relationships with media and stakeholders. We prepare briefing notes and issues maps that may include personal data of client spokespeople. We process journalist data to match a story to a beat, to honour embargoes, and to avoid sending irrelevant material. We keep a record of what was sent and when, because disputes about accuracy and timing are a normal risk in reputational work. We do not impersonate third parties, fabricate grassroots opinion, or harvest private email accounts of campaign opponents. Stakeholder mapping that lists an identifiable private individual who is not a public figure, and that scores that person’s supposed influence, is not a standard product and would often be declined. Crisis work may require rapid processing of incoming media queries. Speed does not cancel minimisation: we record what we need to respond, not a permanent dossier of every caller’s private opinions.
10. Advertising, media targeting and limited profiling
Advertising work processes personal data of client staff who approve copy and media plans, of suppliers who produce and traffic creative, of talent or models where a licence exists, and of end-audiences only to the extent that campaign platforms and publishers process identifiers for targeting, frequency capping, measurement and fraud prevention. ADMAKER LTD does not operate a proprietary consumer data-management platform that independently holds millions of UK consumer profiles. When we recommend or operate targeting on third-party platforms, we do so as a professional adviser and, depending on the contract, as processor or joint controller with the client and, in some models, with the platform. We require that audience definitions are consistent with the CAP Code, PECR where electronic mail or cookies are used, and UK GDPR principles of fairness and minimisation. We do not design targeting intended to exploit a person’s inferred vulnerability in a way the codes prohibit. We do not use special category data to target ads unless an Article 9 condition exists and the platform terms allow it. We do not upload a research respondent file to an ad platform.
UK GDPR gives additional protection where a decision based solely on automated processing, including profiling, produces legal effects concerning a person or similarly significantly affects them. ADMAKER LTD does not use solely automated decision-making to decide whether a named individual will be offered a job by us, granted a consumer contract, or denied a statutory benefit. Limited profiling occurs in media targeting when platforms group users into interest, demographic or lookalike segments and decide which impression to serve, with ADMAKER LTD and the client setting campaign parameters. Ordinary display or paid-social targeting, without a decision by ADMAKER LTD that significantly affects a specific identified person’s legal rights, is not Article 22 automated decision-making by ADMAKER LTD. If a future product involved solely automated significant effects on individuals, we would not deploy it without an Article 22(2) exception, required information, and a route to human intervention. Research analysis may use statistical models or machine-assisted coding; a researcher remains responsible for the published interpretation. Prospect scoring, if used, is a coarse internal ranking of organisational fit, is not sold, and is subject to objection.
11. Cookies
Storage of, or access to, information on a user’s terminal equipment is regulated by PECR in addition to UK GDPR. ADMAKER LTD uses cookies and similar technologies on https://admaker.digital only as described in the Cookie Policy. That document is the controlling notice for cookie categories, durations, third parties, and how to change choices. Non-essential cookies are not set until the appropriate consent is obtained. Essential cookies are limited to what is necessary to provide a service the user requests, for example security. Withdrawing cookie consent is as straightforward as giving it.
12. Recipients and processors
We disclose personal data only to recipients who need it for a purpose in this Policy. Internal access is limited to partners, employees and contractors of ADMAKER LTD who are bound by confidentiality and who work on the relevant engagement or on systems administration. Processors act on our documented instructions. They include, as the engagement requires, cloud hosting and email providers; survey and qualitative-research platforms; transcription services; panel and fieldwork agencies; production houses; media-planning and buying platforms; project-management tools; accountants and, where engaged, solicitors or insurers. We impose written terms that meet Article 28 UK GDPR, including confidentiality, security, sub-processor controls, deletion or return at the end of the service, and assistance with rights requests and incident notification.
Independent controllers who may receive data include the client; media owners and platforms that provide advertising inventory under their own terms; professional regulators and the ICO when we are obliged to disclose; courts and legal advisers in a dispute; and, with consent or another basis, a journalist who receives a spokesperson’s authorised biography. We do not disclose personal data to brokers for their independent marketing. We do not publish respondent-level files. The portfolio describes work at a level that does not identify private research participants. If we sell or reorganise the business, data may be disclosed to the extent necessary for due diligence and transfer of contracts, under confidentiality, and with notice where required.
13. International transfers
ADMAKER LTD is established in the United Kingdom. Some processors and platforms we use are located in, or remotely access data from, countries outside the United Kingdom. UK GDPR Chapter V applies to those transfers. We do not transfer personal data to a third country unless a UK adequacy regulation covers the destination, or appropriate safeguards are in place (typically the UK International Data Transfer Agreement or the UK Addendum to the EU Commission Standard Contractual Clauses, together with a transfer risk assessment), or a specific Article 49 derogation applies to a limited transfer. Where a United States or other non-adequate vendor is used for email, hosting, survey software or advertising infrastructure, we review whether the vendor offers a UK-approved transfer mechanism and whether public-authority access laws create a risk that cannot be mitigated. If the risk cannot be mitigated for the category of data, we choose a United Kingdom or adequate-country alternative or we change the method. Clients who require that no personal data leave the United Kingdom must state that in the statement of work. Research partners outside the United Kingdom receive only the data necessary for their fieldwork and are contractually prohibited from secondary use.
14. Retention
We keep personal data only for as long as needed for the purposes stated, including the need to resolve disputes and meet legal retention duties. The periods below are our standard operating calendar as of August 2026. A particular contract, legal hold or investigation may freeze deletion until the hold ends. Anonymised research datasets that can no longer identify a person may be kept for methodological reference. Harvest requests and unsuccessful prospect correspondence are reviewed within twenty-four months of the last meaningful contact; if no engagement has formed and no legal issue remains, we delete or restrict to a suppression note. Client correspondence, deliverables and contracts are retained for the life of the engagement and for six years after it ends, aligning with ordinary limitation periods for contract claims in England and Wales, unless a longer period is required for tax or a deed. Accounting records are kept for the statutory minimum applicable to the company, commonly six years from the end of the relevant financial year.
Research identifiable files (sample, recordings, incentive registers) are kept for the shortest of the period stated in the participant notice, the period needed for quality audit of that study (not ordinarily more than twelve months after delivery unless the design is longitudinal), or the period the client contract requires us to hold as processor. After that, identifiers are deleted and analytical files are anonymised if they are to be retained. Journalist lists are reviewed at least annually. Supplier files follow the contract and ordinary financial practice. Website security logs are kept for a short operational window, typically up to ninety days unless an incident requires a longer forensic hold. Cookie durations are stated in the Cookie Policy. When a retention period ends we delete or irreversibly anonymise.
15. Security
We implement technical and organisational measures appropriate to the risk, taking account of the state of the art, cost of implementation, and the nature of the personal data. Measures include access control on a need-to-know basis, authentication for systems that hold client and research files, encryption in transit for our website and for standard file-transfer methods we recommend, device protections for staff who handle client work, confidentiality terms, and least-privilege administration. Research recordings and identifiable sample are treated as higher-risk than a business card and are not stored in shared marketing folders. Staff are instructed not to use personal email for client or respondent files. If a personal-data breach likely to result in a risk to individuals occurs, we will notify the ICO without undue delay and, where feasible, within seventy-two hours of becoming aware, unless the breach is unlikely to result in a risk. Where the breach is likely to result in a high risk to individuals, we will communicate to those individuals as UK GDPR requires, unless a statutory exception applies.
16. Your rights
Data subjects have rights under UK GDPR and the Data Protection Act 2018. ADMAKER LTD will respond without undue delay and in any event within one month of receipt of a valid request, extendable by two further months for complex or numerous requests, in which case we will explain the delay within the first month. We may need to verify identity. We will not charge a fee except where a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse, as the legislation allows.
You may obtain confirmation as to whether we process your personal data, access to that data, and information about purposes, categories, recipients, retention, rights and sources. We will not disclose data that would adversely affect the rights of others, including other respondents in a group recording, or that is subject to legal privilege. You may have inaccurate personal data corrected and incomplete data completed. In research, if you are still identifiable in a live quality window we can correct factual identity errors and, where the method allows, withdraw your record. You may request erasure where the data are no longer necessary, where you withdraw consent and no other basis exists, where you object and we have no overriding grounds, where the processing was unlawful, or where erasure is required for a legal obligation. Erasure does not apply to the same extent where we must keep data for legal claims or for a legal obligation. Research anonymisation may be the practical equivalent of erasure for analytical files.
You may request restriction while accuracy is contested, while we assess an objection, if processing is unlawful and you prefer restriction to erasure, or if you need data for a legal claim that we no longer require for our original purpose. Where processing is based on consent or contract and is carried out by automated means, you may receive the personal data you provided to us in a structured, commonly used and machine-readable format, and you may ask us to transmit it to another controller where technically feasible. Portability does not cover inferences we create, paper-only notes, or data we process solely on legitimate interests. You may object at any time to processing based on legitimate interests, including profiling based on those interests, and at any time to processing for direct marketing. Direct-marketing objections are honoured in full. Other objections are assessed as described in section 7.2. Given the limited automated decision-making described in section 10, Article 22 rights will not ordinarily be engaged by ADMAKER LTD’s own systems. If that changes, you will have the right to obtain human intervention, to express your point of view, and to contest the decision, unless a valid Article 22 exception applies.
Send requests to tech.team@admaker.digital or write to ADMAKER LTD, 60 Tottenham Court Road, London, W1T 2EW, United Kingdom, marked for the privacy lead. You may also telephone +44 7811 456789. If you are dissatisfied with our response you may lodge a complaint with the Information Commissioner’s Office at https://ico.org.uk or at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
17. Children
https://admaker.digital and the professional services of ADMAKER LTD are directed at organisations and at adults acting in a professional capacity. We do not knowingly offer agency services to children or collect personal data from children through the public website. If we become aware that a child has submitted a harvest request, we will close the request and delete the data unless we must keep a trace to protect the child or to deal with a related legal issue. Advertising we design for clients must comply with CAP and BCAP rules on children. Research with children is exceptional, commissioned expressly, and run with appropriate adult authority. We will not use a child’s research data for advertising targeting.
18. Sources, special category data and third-party sites
Most personal data comes from the data subject: forms on this site, emails, calls to +44 7811 456789, meetings at 60 Tottenham Court Road, research instruments, and professional messages. We also receive data from the client who engages us, from processors who collect on our behalf, and from public professional sources such as mastheads, company websites, Companies House filings and industry events. Our default position is not to process special category data or criminal-offence data. Exceptions are narrow: explicit health or access information for an event; a research study that cannot otherwise answer its question and that has an Article 9 condition and ethics clearance; or information a person sends unsolicited that we must handle lawfully. Criminal-offence data would be processed only in the context of legal claims, regulatory defence, or a specific obligation, and in accordance with Schedule 1 of the Data Protection Act 2018. Our pages may link to client work, industry bodies, or maps on contact.html. Those third parties have their own privacy notices. ADMAKER LTD is not the controller of a third-party site merely because we link to it.
19. Changes to this Policy
We will revise this Privacy Policy when our processing, the law, or our services change in a way that the current text does not accurately describe. The date at the head of the notice will change. Material changes will be shown by updating this page on https://admaker.digital. Where a change affects processing that was based on consent, we will obtain new consent if the original consent does not cover the new purpose. Where a change concerns a client contract, the variation rules in the Terms of Service and Terms and Conditions may also apply. Continued use of the public website after an update constitutes notice of the new text for website-user processing; it is not a forced consent for optional cookies, which remain governed by the Cookie Policy controls.
20. Contact
Questions, rights requests and notices about this Privacy Policy should be sent to ADMAKER LTD, 60 Tottenham Court Road, London, W1T 2EW, United Kingdom. Email should be sent as ordinary correspondence to tech.team@admaker.digital. Telephone: +44 7811 456789. The website is https://admaker.digital. For service enquiries that are not privacy requests, use contact.html. For the company’s method and services, see about.html and services.html. This Privacy Policy was issued in August 2026 and applies to personal-data processing by ADMAKER LTD in connection with its market research, public relations and advertising agency operations from London, under the jurisdiction of England and Wales, UK GDPR, the Data Protection Act 2018, and the Information Commissioner’s Office.