Guidance

Customer Insight privacy notice

Published 24 June 2025

This notice tells you about personal data collection and processing by the Customer Insight team at the Rural Payments Agency (RPA).

1. Purpose for Processing

We will use the information you provide to inform and improve the services and schemes delivered by RPA and the wider Department for Environment, Food and Rural Affairs (Defra) group.

2. Why we are able to process your personal data

The lawful basis for the processing is consent. The law allows us to process your personal data under Article 4(11) and Article 7 of the United Kingdom General Data Protection Regulation (UK GDPR). We are allowed to process your personal data when you freely give us consent to do so.

3. What personal data we process

The information that we will be collecting and processing is:

• customer registration information
• county parish holding (CPH) number
• your choices on which research topics you would like to take part in

We may also collect and process:

• gender
• age group
• any health conditions that could make it difficult for you to access information about our services

We will only use this information to:

• identify appropriate research opportunities for you
• make reasonable adjustments during research
• generate reports to better understand and improve your experience of RPA

We will handle any feedback you give us anonymously. Unless you expressly ask for, and consent to, your personal details being shared.

We may use details already stored in our systems, together with your feedback, to understand more about your experiences as a customer. We may also use it to identify which research opportunities may be most relevant to you and your business.

If you are communicating with us online, we also collect your internet protocol (IP) address and details of which web browser you use.

In the future, Defra may like to contact you with a follow-up survey or interview. They would use the main contact details held by RPA and welcome your assistance.

4. Your responsibility with other people’s personal data

If you’ve included personal data about other people in your records, you must tell them. You must provide them with a copy of this privacy notice so that they know how their personal data will be used.

5. Where your personal data is stored

We store, transfer and process your personal data on our servers in the United Kingdom (UK) and the European Union (EU).

6. How long we keep your personal data

We will keep your survey data for 2 years for individual responses and analysis and 10 years for final reports.

Please refer to our Personal Information Charter and the section ‘How long we will keep data’ for information on any potential exceptions.

We delete your IP address from our records after 90 days.

7. Who we share your personal data with

We may share your personal data with Defra and the wider Defra group. This is for research purposes and to inform and improve the services and schemes delivered.

Defra group organisations:

• Animal and Plant Health Agency
• Agriculture & Horticulture Development Board
• Centre for Environment, Fisheries and Aquaculture Science
• Royal Botanic Gardens Kew
• Joint Nature Conservation Committee
• Environment Agency
• Veterinary Medical Directorate
• Forestry Commission
• Marine Management Organisation

8. Your rights

Read our Personal Information Charter to find out your rights under the General Data Protection Regulation, the Data Protection Act 2018 (DPA 2018).

9. How to make a complaint

If you have concerns about how RPA uses your personal data, please read how to get in touch or make a complaint.