5. Protecting client information
Information gathered or developed on behalf of a client belongs to the client, unless specified by the research agreement or contract. Data files will be scrubbed for identifying information prior to transfer to the client unless explicit consent is received.
We use client information only for the services described in our agreement with them.
Access is limited to people who need it for the project, and we keep that group as small as practical.
We handle files according to their sensitivity and the terms of the client agreement.
6. How we keep information secure
We use physical, organizational, and technical safeguards appropriate to the sensitivity of the information.
Access control
Individual accounts with strong passwords and multi-factor authentication for email, file storage, and research platforms.
Access granted on a need-to-know basis and removed when a project ends or a person leaves.
Devices
Work is done on encrypted, password-protected]devices with current operating system and security updates, anti-malware protection, and a firewall enabled.
Data protection
Data is encrypted in transit and at rest via the Microsoft cloud storage network.
Paper records, if any, are kept in locked storage and shredded securely when no longer needed.
Secure file transfer
We exchange data and reports with clients through secure Microsoft file sharing or alternative channels requested by our clients. We do not send sensitive data as unprotected email attachments.
Vendors and subcontractors
We use third-party tools for survey hosting, interview recording and transcription, panel sourcing, cloud storage. We select providers with appropriate security practices and, where personal information is involved, require contractual confidentiality and security commitments.
7. Where data is stored
Data is hosted in the Microsoft 365 cloud environment. All data and back-up data is stored withing Canada.
8. Retention and destruction
We keep personal information only as long as needed for the research purpose and any contractual or legal requirement. Raw aw data and recordings are deleted 12 months after project completion; reports retained 3 years. When the retention period ends, we destroy information securely, using secure deletion for electronic files and shredding for paper.
9. Access requests, questions, and complaints
Individuals can contact us to learn what personal information we hold about them, how it is used and disclosed, and to request access or corrections. We will respond within ten business days. We investigate every complaint about our privacy practices and respond in writing. Contact: Erik Fraser, erik@fraserinsights.ca
If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.
10. If something goes wrong
We maintain a process for responding to security incidents. If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required, inform affected clients, and keep a record of the incident.
11. Changes to this statement
We review this statement annually and update it as our practices or legal requirements change. Last updated: September 2026.
1. Our commitment
Confidentiality is central to the work Fraser Insights does. Clients trust us with sensitive business information, and research participants trust us with their time, opinions, and sometimes personal details. We protect both.
We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and any provincial privacy laws that apply to our work, and we follow the CRIC Code of Conduct and Standards.
2. Accountability
Erik Fraser is Fraser Insights' designated Privacy Officer and is responsible for our compliance with this statement. Questions, access requests, and complaints can be sent to erik@fraserinsights.ca
Anyone who works with us, including employees, contractors, and interviewers, must sign a confidentiality agreement before accessing client or participant information.
3. What we collect and why
We collect only the personal information needed for the research purpose we have identified, and we explain that purpose at or before the point of collection. Depending on the project, this may include contact details for recruitment, demographic information, survey or interview responses, audio or video recordings.
We do not use personal information for any purpose other than the one for which it was collected, and we do not disclose it for unrelated purposes.
4. Protecting research participants
Informed consent: We obtain consent before collecting, using, or disclosing personal information, and we explain how responses and recordings will be used.
Voluntary participation: Participation is voluntary. People may skip questions or withdraw at any time. Withdrawal can occurring at any point during the research collection process or afterward by emailing Fraser Insights directly.
Confidentiality of identity: We do not release participants' names or contact details outside the bounds of a study. Any exceptions (e.g. client-observed sessions, use in marketing and promotional materials) are with explicit participant consent.
Reporting: Results are reported in aggregate or in a de-identified form unless a participant has explicitly agreed otherwise.
Children and youth: Fraser Insights will occasionally engage respondents under the age of 16. We use age-appropriate recruitment, consent, and research materials and collect only the information necessary for the study. For participants under 16, we obtain informed consent from a parent or legal guardian before participation and also seek the young person’s affirmative agreement to take part. We explain the study, privacy protections, any recording, and the voluntary nature of participation in language the participant can understand. A parent or guardian may withdraw consent, and the participant may decline to answer a question or stop participating at any time, without penalty. In most cases, parents or legal guardians are requested to join the research collection process, though in situations where this may present bias, the research will be conducted with the participant directly. We do not knowingly enroll a participant under 16 without the required guardian consent.
Recordings. Qualitative sessions are recorded and are only shared with clients with explicit informed consent from research participants. Recordings are stored on Fraser Insights’ secure Microsoft Cloud environment, with all data and backups residing on Canadian servers. Recordings are retained for a period of up to 12 months, after which they are deleted.