How we handle your data

You are about to start a market research survey. This page explains exactly what we collect on the way in, why, and how to get it removed.

Who is responsible

DreamlockMR is the controller for the checks described here. Write to privacy@dreamlockmr.com about anything on this page.

The company that commissioned the survey is a separate controller for the answers you give inside it, and the panel that invited you is responsible for your membership with them. This notice covers our part: getting you to the survey and checking the response is genuine.

What we collect

• The id your panel gave us. A code such as a7f3…. We are not told your name or email.
• Your IP address, and the approximate location it maps to — country, region, town and postal district, and your internet provider.
• The country you tell us you live in, so we can send you to the right version of the survey.
• Any answers you give on the page before the survey. Some studies ask a few questions first — your age group, your job, your household — to check the study is a fit before it takes up your time. You can decline any of them. Where a study asks about your health or your ethnic background, we ask for your explicit permission first and you can answer “prefer not to say”.
• Technical characteristics of your device and browser: screen size, time zone, language, processor and memory class, graphics hardware, and the results of small drawing and timing tests. Combined, these form a fingerprint — a code that is likely to be unique to your device.
• How the page behaves under your hands: whether the mouse moves and keys are pressed the way a person's are.
• What happened: when you started, when you finished, and the outcome the survey reported.

Why

Research only works if each response comes from a different real person in the market being studied. Fake and duplicated responses are a live, industrial problem, and the checks above are how we find them. Concretely we use this data to route you to the correct survey, to detect one person entering twice or many times, to detect automated software, and to record what you are owed.

Our legal basis

• Consent for reading the device characteristics that make up the fingerprint. You give it on the previous page, and you can refuse — you will simply be returned to your panel, which costs you nothing.
• Explicit consent (Art 9(2)(a)) for anything we ask about your health or your ethnic background. A study only asks these where the research needs them, and answering is always optional.
• Legitimate interests (Art 6(1)(f)) for the fraud and quality checks themselves, and for keeping a record of the outcome. Our interest is delivering research that is not corrupted by fraud; we have weighed that against your privacy and limited what we keep accordingly.
• Contract for the record of your participation, where your panel pays you on the strength of it.

You can object to processing based on legitimate interests at any time using the address above.

Who else sees it

• TrustedMR, our fraud-screening provider, receives your IP address, browser identification, device characteristics and approximate location, and returns a verdict. It acts on our instructions only.
• An IP geolocation service receives your IP address in order to return an approximate location.
• The panel that invited you is told the outcome, so it can pay you.
• The research client receives your responses to the survey and the id your panel gave us — not your IP address, and not your device fingerprint.
• Our hosting provider stores the data on our behalf.

Some of these are outside the UK and the EEA. Where they are, transfers rely on the European Commission's standard contractual clauses.

Decisions made automatically

The screening decision is automated: if the checks fail, you are returned to your panel without entering the survey. It does not affect your panel membership or any payment you have already earned, and no profile about you is built for any other purpose. If you believe a decision was wrong, write to us and a person will review it.

How long we keep it

• Your IP address, town, postal district and internet provider are erased after 30 days.
• Your panel id and device fingerprint are erased after about 13 months, which is the window in which a client can still query a delivered response.
• What remains after that — a count, a country, an outcome, a date — no longer identifies anyone and is kept as research statistics.

Your rights

You can ask us for a copy of what we hold about you, to correct it, to erase it, to restrict or object to how we use it, or to receive it in a portable form. You can withdraw consent for the device checks at any time, which does not affect what was lawful before you withdrew it. We answer within one month.

To make any of these work we need the id your panel gave you, or the date and approximate time you took the survey — those are the only handles we have on your record, because we were never given your name. Your panel can supply the id.

Write to privacy@dreamlockmr.com. If you are unhappy with our answer you can complain to your national data protection authority — in the UK, the Information Commissioner's Office at ico.org.uk.

Cookies

We set one cookie, for up to 12 hours, so that when the survey sends you back we know which entry you were. It is strictly necessary for the service and is not used for advertising or tracking across other sites.

Version 2026-08

Your responses are confidential. How we handle your data.