PrivacyPrivacy PolicyPolicy

1. Introduction

Amber & Bull (“Amber & Bull”, “A&B”, “we”, “us” or “our”) respects your privacy and is committed to protecting the personal information entrusted to us.

Amber & Bull is a luxury boutique research firm focused on understanding how affluent, high-net-worth and ultra-high-net-worth consumers think, choose and spend. Our services include custom research, proprietary research, syndicated intelligence and our members-only Experience Economy 2.0 Intelligence platform (together, the “Services”).

This Privacy Policy explains how we collect, use, disclose, store and protect Personal Data when you:

• visit or use the Amber & Bull website at amberandbull.com;
• contact us or submit an enquiry;
• subscribe to our publications, research updates or other communications;
• take part in research conducted by or on behalf of Amber & Bull;
• register for or use the Experience Economy 2.0 Intelligence platform;
• provide information in connection with a research project;
• provide services to us or work with us as a business partner or supplier; or
• otherwise interact with Amber & Bull online or offline.

“Personal Data” means any information relating to an identified or identifiable individual. It includes “personal information” and “personal data” as defined in the data protection laws that apply to you.

This Privacy Policy should be read together with our Cookie Policy and our Terms & Conditions (User Agreement).

By using our website or Services, you acknowledge that you have read this Privacy Policy. Where applicable law requires consent for a particular processing activity, we will ask for that consent separately.

2. Who we are

Amber & Bull is a luxury boutique research firm by Jasper Colin. We operate using established research, technology, security and operational infrastructure.

Unless a contract or notice says otherwise, the data controller for Personal Data processed through the Amber & Bull website and Services is Jasper Colin Private Limited, a company registered in New York.

For specific research engagements, platform agreements or fieldwork, an affiliated company may act as controller or processor. Where that is the case, the relevant contract or participant notice will identify it.

We operate globally, with client leadership in the United States, EMEA leadership in the United Kingdom, and research execution and analytics through the global operations centre in India.

• Privacy enquiries and data rights requests: privacy@amberandbull.com
• Commercial and general enquiries: sales@amberandbull.com

3. What Personal Data we collect

The Personal Data we collect depends on how you interact with Amber & Bull.

3.1 Information you provide directly

We may collect information you provide when you:

• complete a contact or enquiry form;
• request information about our Services or research;
• register for access to the Experience Economy 2.0 Intelligence platform;
• subscribe to newsletters, research updates or other communications;
• request an executive summary or research material;
• take part in a research study;
• submit questions through an omnibus or research programme;
• upload research, datasets, documents or other materials to the platform;
• communicate with our research, client service or business teams; or
• otherwise voluntarily provide information to us.

Depending on the interaction, this may include your first and last name, business email address, company name, job title or professional information, telephone number, country or region, account and login information, research preferences, correspondence, information in documents or materials you provide, and other information needed to provide the requested Service.

Our website contact form asks for your full name, company email, company name, an optional telephone number and your message.

3.2 Research participant information

Where you take part in research conducted by Amber & Bull or on our behalf, we may collect information needed to confirm that you meet the requirements of the study. Depending on the study design, this may include demographic, professional, behavioural, purchasing, lifestyle, wealth-tier or other research-relevant information, as well as your survey or interview responses.

Because we research affluent, HNWI and UHNWI audiences, some studies may ask about financial circumstances, wealth tier, investments, purchasing behaviour or lifestyle. Some of this information may be treated as sensitive or specially protected under the law that applies to you.

We collect such information only where there is a lawful basis and it is necessary for the research purpose. We minimise the Personal Data collected and do not ask for information the research does not need. We do not ask for special category data, such as information about health, racial or ethnic origin, religious beliefs or political opinions, unless a specific study requires it. In that case we explain why and ask for your explicit consent first.

Where participants are recruited and managed by a fieldwork partner or panel provider, that provider may also act as a controller of your Personal Data. It will give you its own privacy notice.

3.3 Information collected automatically

When you visit our website or use our online Services, we may automatically collect technical and usage information, including IP address, browser type and version, device type, operating system, pages visited, referring and exit pages, date and time of access, approximate location derived from technical information where permitted, interaction and usage information, authentication and security information, and other diagnostic information.

Some of this information is collected through cookies and similar technologies. Please see our Cookie Policy for details.

3.4 Information from other sources

We may receive information from research partners and sample providers, clients commissioning research, professional databases or publicly available sources, business partners and suppliers, event or webinar partners, technology and service providers, organisations that refer you to us, and other lawful sources. Where required by law, we will tell you about such processing within one month of obtaining the information, or at our first communication with you if sooner.

4. How we use Personal Data and our legal bases

Depending on the applicable law and circumstances, we rely on one or more of the following legal bases: consent, performance of a contract, legitimate interests, legal obligation, protection of vital interests, or another lawful basis permitted by applicable law. The table below shows the main purposes and the basis we normally rely on under the EU and UK GDPR.

Our research may use qualitative and quantitative methods, MaxDiff, conjoint, longitudinal measurement and other techniques. We may aggregate or anonymise information to identify trends, run repeat studies, improve research instruments and maintain research quality.

Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for more information about this assessment. Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before you withdrew.

5. Research confidentiality

Research confidentiality is fundamental to our work. We conduct research in line with the ICC/ESOMAR International Code on Market.

• Every participant is individually verified. We do not use synthetic or AI-generated respondents.
• Taking part is always voluntary. You may skip any question or withdraw from a study at any time.
• Research responses are pseudonymised. The key linking responses to your identity is held separately under restricted access.
• Research outputs report findings in aggregated, anonymised or otherwise protected form.
• We will not disclose your identity or identifiable responses to a client without your explicit, informed consent for a named purpose, such as a follow-up interview.
• We never use your participation in research to sell to you. Research is kept separate from marketing.
• Where an interview is audio or video recorded, we tell you in advance and ask for your consent.

6. Platform data and client materials

The Experience Economy 2.0 Intelligence platform lets authorised users keep their own research, datasets and findings alongside Amber & Bull’s intelligence. Where you upload materials to the platform:

• you remain responsible for having the rights and permissions needed to upload them;
• you should not upload Personal Data or confidential information unless you are authorised to do so;
• we process the materials only to provide the platform and Services you request, including authorised analytical and synthesis features;
• access is restricted according to your account permissions and our security controls; and
• additional contractual terms, including a data processing agreement where we act as your processor, may apply to client-specific data and confidential information.

Client-owned research and datasets are not treated as publicly available because they are uploaded to the platform.

7. Artificial intelligence and automated processing

Some Amber & Bull Services use artificial intelligence, machine learning or other automated technologies to help with research discovery, synthesis, analysis and presentation. Where AI-enabled features are used:

• outputs are based on authorised research, datasets or other information available to the relevant Service;
• outputs are analytical assistance, not a guarantee of factual accuracy;
• users should review and validate outputs before relying on them for material business decisions;
• we do not use participants’ identifiable data, or clients’ confidential uploads, to train third-party AI models; and
• we do not make decisions with legal or similarly significant effects on individuals based solely on automated processing.

8. Cookies and similar technologies

We use cookies and similar technologies for essential website functionality, security, remembering preferences, understanding website usage, measuring performance and improving our Services. Where you consent, we also use them for analytics and marketing. Please see our Cookie Policy for details.

9. Marketing communications

We do not add an enquiry to a marketing list just because you contacted us. Where required by law, we obtain your consent before sending marketing communications.

You may unsubscribe at any time using the link in any marketing email or by contacting us. Opting out does not stop essential service or transactional communications.

10. How we share Personal Data

We do not sell, rent or trade Personal Data, and we do not share it with third parties for their own marketing. We do not display client names, logos or engagements without the client’s written permission. We may share Personal Data with:

• Our affiliated companies, where needed to provide Services, maintain infrastructure, conduct research or administer the business.
• Service providers acting on our instructions, for hosting, cloud infrastructure, website and platform operations, fieldwork, participant recruitment, survey administration, identity verification, data processing, analytics, email delivery, customer support, security, incentive or payment processing and professional services. They may process Personal Data only as needed to provide their services, under written contracts with appropriate safeguards.
• Clients, who receive research findings. Participant-identifying information is not shared except as described in section 5.
• Legal and regulatory authorities, where required by law, regulation, court order or legitimate governmental request, or to protect our rights, users or the public.
• Parties to a corporate transaction, such as a merger, acquisition, restructuring, financing or sale of assets, subject to applicable law.

11. International data transfers

Amber & Bull operates across multiple markets, including the United States, the United Kingdom and India, and may use service providers or research partners in other countries. Where Personal Data is transferred internationally, we apply the safeguards required by applicable law. These may include adequacy decisions (including the EU-U.S. Data Privacy Framework where the recipient is certified), the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or another legally recognised transfer mechanism. You can ask us for a copy of the relevant safeguards by contacting privacy@amberandbull.com.

12. Data security

Our information security management system is ISO 27001 certified. We use administrative, technical and organisational safeguards designed to protect Personal Data against unauthorised access, alteration, disclosure, loss, misuse or destruction. These include access controls, authentication, encryption where appropriate, restricted system access and monitoring.

No method of transmission or storage is completely secure. While we work to protect Personal Data, we cannot guarantee absolute security. If a personal data breach is likely to result in a high risk to your rights, we will tell you without undue delay, as required by law.

13. Data retention

We keep Personal Data only as long as reasonably necessary for the purposes it was collected for. This includes providing Services, keeping business and research records, meeting contractual, legal and regulatory requirements, resolving disputes and enforcing agreements.

Retention periods depend on the type of information and its purpose. As a guide:

• client and business contact records are kept for the relationship and up to 6 years after;
• identifying research participant data is kept for up to 24 months after a study ends, unless you agree to stay in our participant community; pseudonymised research data may be kept longer for longitudinal studies;
• platform account data is kept while the account is active and deleted within 90 days of closure, unless we must keep it longer;
• newsletter data is kept until you unsubscribe; and
• job applicant data is kept for up to 12 months after the recruitment process ends.

When Personal Data is no longer needed, we delete, anonymise or securely dispose of it.

14. Your privacy rights

Depending on where you live, you may have the right to:

• know whether we process your Personal Data;
• access your Personal Data and receive a copy;
• correct inaccurate or incomplete information;
• request deletion;
• restrict processing;
• object to certain processing, including direct marketing, which you can do at any time;
• data portability;
• withdraw consent at any time;
• not be subject to decisions based solely on automated processing that significantly affect you; and
• other rights under applicable privacy law.

These rights are not absolute and may be subject to legal exceptions.

To exercise a privacy right, email privacy@amberandbull.com. You may also use an authorised agent where the law allows. We may ask for information to verify your identity before acting on a request. We respond within one month under the EU and UK GDPR, which we may extend by up to two further months for complex requests, and within the time limits set by other applicable laws. We will tell you if we need more time and why.

If you have a concern, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the data protection authority in your country, such as the UK Information Commissioner’s Office (ico.org.uk) or the supervisory authority in your EU member state.

15. Children’s privacy

Our Services are intended for business, professional and adult research audiences and are not directed at children. We do not knowingly collect Personal Data from anyone under 18. If you believe a child has given us Personal Data, please contact us so we can review it and delete it where appropriate.

16. Third-party websites

Our website and platform may link to websites or services run by third parties, including social media platforms. We are not responsible for their privacy practices, content or security, and we encourage you to read their privacy policies.

17. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our Services, technology, legal requirements or privacy practices. We review it at least once every 12 months. The updated version will be posted on this page with a revised “Last updated” date. Where required by law, we will give additional notice or obtain consent for material changes.

18. Contact us

If you have questions, concerns or requests about this Privacy Policy or your Personal Data, please contact:

Amber & Bull, a luxury boutique research firm

• Privacy: privacy@amberandbull.com
• General enquiries: sales@amberandbull.com