Last updated: 30 September 2026

1. About this Privacy Policy

Hypothesis Research Ltd ("Hypothesis Research", "HRL", "we", "us" or "our") provides independent investment, market and industry research.

This Privacy Policy explains how we collect, use, store and disclose personal information when you:

• visit our websites or online store;

• purchase or download a research report or other digital research product;

• purchase or manage a research subscription;

• create or use an online account;

• subscribe to our research, newsletters or other communications;

• communicate with us; or

• otherwise use our websites, digital products and services.

Our online store is powered by Shopify, which provides the ecommerce technology that enables us to offer and sell digital research products and subscriptions.

For the purposes of applicable data protection legislation, including the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018, Hypothesis Research Ltd is the data controller of personal information processed for our own purposes.

Hypothesis Research Ltd
124 City Road
London EC1V 2NX
United Kingdom

Email: ma@hypothesisresearch.co.uk

This Privacy Policy should be read together with our Terms and Conditions and Cookie Policy, where applicable.

If there is a conflict between our Terms and Conditions and this Privacy Policy concerning the collection, use or disclosure of personal information, this Privacy Policy will apply to that processing.

2. Personal Information We Collect

"Personal information" means information that identifies you or can reasonably be linked to you. It does not include information that has been anonymised so that an individual can no longer reasonably be identified.

Depending on how you interact with us, we may collect or process the following categories of information.

Contact information

This may include:

• your name;

• email address;

• telephone number;

• billing address;

• country of residence; and

• company or organisation details where relevant.

Account information

If you create an account with us, we may process information including:

• username or account identifier;

• login credentials;

• account preferences and settings;

• subscription status; and

• account activity.

Passwords and authentication credentials may be processed through Shopify or other service providers rather than being directly accessible to Hypothesis Research.

Purchase and subscription information

We may process information concerning:

• research reports you view or purchase;

• subscriptions you purchase;

• products placed in your shopping cart;

• transaction dates and amounts;

• order history;

• subscription renewals, cancellations and changes;

• download or digital-access information; and

• other information necessary to provide purchased research to you.

Payment information

Payments may be processed by Shopify, Shopify Payments and/or other payment service providers.

Payment-related information may include:

• payment method;

• transaction details;

• payment status;

• billing information; and

• payment confirmation.

Complete payment-card information is generally processed directly by our payment service providers and may not be accessible to Hypothesis Research.

Communications

We may collect information that you provide when you communicate with us, including when you:

• make an enquiry;

• contact customer support;

• make a complaint;

• exercise a data-protection right; or

• otherwise correspond with us.

Device and technical information

When you use our websites or online store, we and our service providers may automatically collect information such as:

• IP address;

• browser type;

• device type;

• operating system;

• network information;

• device identifiers; and

• information concerning how you access our websites.

Website and usage information

We may collect information about how you interact with our websites and digital services, including:

• pages visited;

• products viewed;

• links selected;

• shopping-cart activity;

• time and date of visits;

• referring websites;

• research products purchased or accessed; and

• other website and store interactions.

We may use cookies and similar technologies for these purposes. Further information may be provided in our Cookie Policy and through the cookie-management tools available on our website.

3. How We Collect Personal Information

We may collect personal information:

Directly from you, for example when you:

• purchase a research report;

• purchase or manage a subscription;

• create an account;

• subscribe to research or marketing communications;

• contact us; or

• otherwise provide information to us.

Automatically, when you visit or interact with our websites or online store, including through cookies and similar technologies.

From service providers, including Shopify, payment processors, analytics providers and other suppliers that provide services to us.

From third parties, where permitted by law, including business partners and fraud-prevention or security providers.

4. How and Why We Use Your Personal Information

We only process personal information where we have an appropriate lawful basis.

Providing digital research products and subscriptions

We use personal information to:

• process orders;

• process payments;

• deliver purchased research reports;

• provide access to subscription content;

• administer subscriptions;

• create and maintain customer accounts;

• provide order and subscription confirmations;

• maintain records of purchases;

• provide customer support; and

• communicate with you concerning products or subscriptions you have purchased.

The principal lawful basis for this processing is that it is necessary for the performance of a contract with you or to take steps at your request before entering into a contract.

Operating and improving our websites and store

We may process information to:

• operate our websites and online store;

• understand how customers use our services;

• improve website functionality;

• analyse demand for our research;

• diagnose technical problems; and

• improve our products and customer experience.

Where appropriate, we rely on our legitimate interests in operating, maintaining, understanding and improving our business and digital services, provided those interests are not overridden by your rights and interests.

Where applicable law requires consent for particular cookies or similar technologies, we rely on your consent.

Security and fraud prevention

We may process personal information to:

• authenticate accounts;

• prevent unauthorised access;

• detect and prevent fraudulent transactions;

• investigate suspicious activity;

• protect our intellectual property and digital research products; and

• maintain the security of our websites, store and systems.

We generally rely on our legitimate interests in protecting our customers, our business, our intellectual property and our systems and, where applicable, on compliance with our legal obligations.

Legal and regulatory requirements

We may process and retain personal information where necessary to:

• comply with applicable laws and regulations;

• meet accounting and tax requirements;

• comply with regulatory requirements applicable to Hypothesis Research;

• respond to lawful requests from courts, regulators, law-enforcement authorities or other competent authorities;

• establish, exercise or defend legal claims; and

• enforce our contractual rights and policies.

Where applicable, the lawful basis is compliance with a legal obligation or our legitimate interests in protecting and enforcing our legal rights.

Communications and customer support

We use personal information to respond to questions, requests and complaints and to communicate with you concerning your account, purchases or subscriptions.

Depending on the circumstances, we rely on performance of our contract, legal obligations or our legitimate interests in providing effective customer service and maintaining our business relationships.

Research updates and marketing

Where permitted by law, we may use your contact details to provide information about:

• newly published research;

• research subscriptions;

• market or industry research;

• related Hypothesis Research products and services; and

• other information that may be relevant to our subscribers or customers.

We may rely on consent where consent is required.

Where legally permitted, we may rely on our legitimate interests in informing existing customers about relevant products or services, subject to applicable electronic-marketing rules.

You can unsubscribe from marketing emails at any time by using the unsubscribe link included in the communication or by contacting us.

Unsubscribing from marketing does not prevent us from sending necessary service communications concerning your orders, account or subscriptions.

5. Shopify

Our online store is powered by Shopify.

Shopify processes information about your access to and use of our store to provide ecommerce functionality and related services.

Information submitted through our store may therefore be transmitted to and processed by Shopify and its service providers.

Shopify may also process certain information for its own purposes in accordance with its applicable privacy notices and contractual arrangements.

Depending on the Shopify services and features enabled on our store, Shopify may process information concerning your interactions with our store and, where applicable, interactions with other Shopify merchants.

You should review Shopify's applicable consumer privacy information for further information about Shopify's processing activities and the privacy rights available in relation to information processed by Shopify.

6. How We Share Personal Information

We do not disclose personal information except where reasonably necessary for legitimate business purposes, to provide our services, where you have requested or consented to disclosure, or where required or permitted by law.

We may share personal information with:

• Shopify, which hosts and provides technology supporting our online store;

• payment processors and payment providers, for processing and securing payments;

• IT, hosting and cloud-service providers;

• analytics and website-service providers;

• email and communications providers;

• subscription and digital-content delivery providers, where applicable;

• professional advisers, such as accountants, auditors and legal advisers;

• regulators, courts, law-enforcement bodies and public authorities, where required or permitted by law; and

• other service providers acting on our behalf.

We may also disclose personal information in connection with a corporate transaction such as a merger, acquisition, restructuring, financing or sale of all or part of our business, subject to applicable law.

We require service providers processing personal information on our behalf to handle that information appropriately and in accordance with applicable data-protection requirements.

7. Cookies and Similar Technologies

We and our service providers, including Shopify, may use cookies, pixels and similar technologies to operate the website and store, remember preferences, understand website usage, provide analytics, maintain security and, where enabled and permitted, support advertising or marketing.

Where consent is required by law for non-essential cookies or similar technologies, we will request consent through the appropriate cookie-management mechanism.

You can manage applicable cookie choices through the privacy or cookie controls provided on our website.

8. Third-Party Websites and Services

Our websites may contain links to websites or services operated by third parties.

Third-party websites and services have their own privacy practices and policies. We are not responsible for the privacy, security, content or practices of websites and services that we do not control.

We recommend reviewing the relevant privacy information before providing personal information to a third party.

9. International Transfers

Hypothesis Research is based in the United Kingdom, but some of our service providers, including providers supporting our ecommerce, cloud, payment or technology infrastructure, may process personal information outside the United Kingdom.

Where personal information is transferred outside the United Kingdom, we take appropriate measures as required by applicable data-protection law.

Depending on the destination and circumstances, these measures may include:

• transferring information to a country recognised by the UK as providing an adequate level of protection;

• using approved contractual safeguards, including applicable UK data-transfer agreements or addenda; or

• relying on another lawful transfer mechanism available under UK data-protection legislation.

You may contact us if you would like further information concerning the safeguards applicable to relevant international transfers.

10. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to:

• provide your account, reports and subscriptions;

• maintain appropriate transaction and accounting records;

• comply with legal, tax and regulatory obligations;

• resolve disputes;

• prevent fraud and abuse;

• protect our intellectual property; and

• establish, exercise or defend legal claims.

Retention periods may vary according to the type of information and the purpose for which it is processed.

When determining an appropriate retention period, we consider the nature and sensitivity of the information, the purposes for which it is processed, applicable contractual requirements, potential legal claims and applicable legal and regulatory retention requirements.

When information is no longer required, we will delete or anonymise it where appropriate, subject to applicable legal and technical requirements.

11. Security

We use appropriate organisational and technical measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

However, no internet transmission, website, electronic storage system or security measure can be guaranteed to be completely secure.

You are responsible for keeping any account credentials confidential and should not disclose your password or other access credentials to other persons.

If you believe your account or personal information has been compromised, please contact us.

12. Your Data-Protection Rights

Depending on applicable law and the circumstances of our processing, you may have rights including:

• the right to be informed about how your personal information is used;

• the right of access to personal information we hold about you;

• the right to rectification of inaccurate or incomplete information;

• the right to erasure in certain circumstances;

• the right to restrict processing in certain circumstances;

• the right to data portability in certain circumstances;

• the right to object to certain processing; and

• rights relating to certain forms of automated decision-making where applicable.

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing undertaken before consent was withdrawn.

These rights are not absolute and may be subject to exemptions or limitations under applicable law.

We may need to verify your identity before responding to a request.

Your right to object

Where we process your personal information on the basis of legitimate interests, you have the right to object to that processing in certain circumstances.

You also have the right to object at any time to the use of your personal information for direct marketing.

You can exercise your rights by contacting us at:

ma@hypothesisresearch.co.uk

13. Complaints

If you have concerns about the way we collect or use your personal information, please contact us in the first instance:

Data Protection Contact
Hypothesis Research Ltd
124 City Road
London EC1V 2NX
United Kingdom

Email: ma@hypothesisresearch.co.uk

You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's data-protection supervisory authority.

14. Children's Privacy

Our research products and services are intended for adults and professional users and are not directed at children.

We do not knowingly collect personal information from children through our online store.

If you believe that a child has provided personal information to us, please contact us so that we can consider the appropriate action in accordance with applicable law.

15. Automated Decision-Making

We do not currently use customer personal information to make solely automated decisions that produce legal effects or similarly significant effects concerning customers in connection with the purchase of our research reports or subscriptions.

Our technology, ecommerce, security and payment providers may use automated systems for purposes such as fraud detection, transaction security or risk assessment in accordance with their own applicable terms and privacy policies.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to:

• our products and services;

• our use of Shopify or other technology;

• our data-processing practices;

• applicable laws or regulations; or

• other operational, legal or regulatory requirements.

When we update this Privacy Policy, we will publish the revised version on our website and update the "Last updated" date.

Where required by law, we will provide additional notice of material changes.

17. Contact Us

For questions concerning this Privacy Policy, our privacy practices or your data-protection rights, please contact:

Hypothesis Research Ltd
124 City Road
London EC1V 2NX
United Kingdom

Email: ma@hypothesisresearch.co.uk

For the purposes of applicable UK data-protection legislation, Hypothesis Research Ltd is the data controller for personal information processed for its own purposes.