- Organisation: Sole Trader Courses Ltd, trading as GROW Formula®
- Company number: 16406138
- Registered in: England and Wales
- Document version: 1.0
- Date: 3 November 2026
- Responsible person: GROW Data Protection Lead
1. Purpose of this statement
GROW conducts research to improve understanding of business education, professional preparation and business support across the health, wellness and beauty sectors.
Some research activities involve processing personal information, including the professional contact details of people invited to participate and information provided by research participants.
Under Article 6(1)(f) of the UK General Data Protection Regulation (UK GDPR), an organisation may process personal data where this is necessary for legitimate interests, provided those interests are not overridden by the rights and freedoms of the individuals concerned.
This document explains how GROW has assessed the use of legitimate interests for its research activities, the safeguards required and the rights of people whose information is processed.
It follows the Information Commissioner’s Office (ICO) three-part assessment: purpose, necessity and balancing.
2. Research covered by this assessment
This assessment covers three studies developed and coordinated by GROW.
Graduate Support Survey
Part of the Graduate Success Benchmark.
This study examines how training providers prepare and support health and wellness practitioners for professional life.
Participating organisations complete a structured assessment of their provision across five stages, receiving a self-reported score and, when sufficient responses are available, comparative information.
The study involves processing professional contact details, institutional registration information, questionnaire responses and benchmarking results.
Practitioner Success Survey
Also part of the Graduate Success Benchmark.
This study examines graduates’ experiences of business preparation and support alongside their subsequent professional circumstances, including employment, self-employment, income bands and career goals.
Participation is voluntary. The questionnaire does not require a name or email address, although combinations of responses may sometimes permit identification.
Recruitment primarily involves professional bodies, training providers, alumni networks and participant sharing.
Business Skills Transfer Study
A separate study at skillstransfer.growformula.org.
This study examines how experienced health and wellness practitioners address business questions when mentoring, tutoring, supervising or coaching other qualified practitioners.
It investigates the questions encountered, support provided, resources used, professional boundaries and additional support needs.
Recruitment may include direct professional invitations. The questionnaire does not require identifying contact details, although combinations of answers or optional written comments may permit identification.
The three studies have separate research questions and datasets. Individual questionnaire responses are not linked between studies.
3. Lawful basis for processing
GROW relies on legitimate interests under Article 6(1)(f) UK GDPR where appropriate for:
- Identifying relevant organisations and professional representatives and inviting them to participate in genuine research.
- Administering voluntary research participation.
- Collecting, storing and analysing research responses.
- Providing participant feedback, institutional benchmarking and appropriately protected comparisons.
- Producing aggregated research findings and publications.
- Maintaining data quality, security and appropriate research records.
Other lawful bases apply where appropriate. In particular, optional email subscriptions rely on consent, while certain statutory compliance activities rely on legal obligation.
Where identifiable information is shared through optional named benchmarking arrangements, the applicable consent requirements are addressed separately.
Agreement to participate in a study is an ethical requirement of the research. It is distinct from the lawful basis for processing personal data.
This assessment does not authorise processing special-category information without meeting any additional requirements under Article 9 UK GDPR.
4. The legitimate interests assessment
Part 1: Purpose test
What legitimate interests are being pursued?
GROW has a legitimate interest in conducting proportionate research that improves understanding of how practitioners develop the business capabilities needed for sustainable professional careers.
The studies aim to identify existing practices, experiences, challenges and opportunities for improvement.
Potential beneficiaries include:
- Training providers, through a better understanding of graduate preparation and support.
- Practitioners and graduates, through evidence that may inform more relevant education and professional development.
- Mentors, tutors, supervisors and coaches, through a better understanding of business support needs and professional boundaries.
- Professional and educational organisations, through evidence that can inform policy, standards and provision.
- The wider sector, through access to research findings that may contribute to informed decisions.
GROW also benefits by developing its understanding of the sectors it serves and contributing to professional discussion.
Commercial interests and research independence: GROW provides commercial business education and support. Its research therefore relates to areas in which it has a commercial interest.
This potential conflict of interest is explicitly acknowledged.
The research is not intended to identify individuals as prospective customers or use questionnaire answers to qualify sales leads.
Participation does not imply endorsement of GROW, and research findings must be reported fairly, including findings that do not support GROW’s assumptions or commercial interests.
The legitimate interest relied upon in this assessment is the conduct and administration of genuine research, not the use of research participation as a disguised sales activity.
Assessment: The purposes are legitimate, provided research and commercial marketing remain appropriately separated.
Part 2: Necessity test
Is processing personal information necessary to achieve these purposes?
Some processing is reasonably necessary to conduct the studies effectively.
For research recruitment, GROW needs to identify people and organisations whose professional roles or experience make them relevant to a particular study.
Public announcements alone may not reach the full range of eligible participants, especially smaller training providers, practitioners who have left professional practice, and people working in specialist mentoring or supervisory roles.
Targeted professional invitations can therefore be a proportionate means of improving access to relevant participants.
GROW limits recruitment information to what is reasonably necessary, such as:
- Name, where relevant.
- Organisation and professional role.
- Business email address or other publicly provided professional contact information.
- Source of contact information.
- Limited correspondence and communication preferences.
For research participation, the Graduate Support Survey requires institutional account information to administer assessments and provide confidential results.
The Practitioner Success Survey and Business Skills Transfer Study do not require participants to register or provide names or email addresses.
Research responses are used to produce descriptive findings and, where appropriate, comparisons. Personal information is not collected merely because it might be commercially useful.
Could less intrusive methods achieve the same result? GROW uses or facilitates general recruitment through professional bodies, training providers, practitioner networks, social media and participant sharing.
These approaches reduce reliance on direct invitations but may not adequately reach all relevant groups.
Direct professional contact is therefore considered a proportionate supplementary recruitment method where contacts are carefully selected and the information collected is limited.
Individual-level information is not published where aggregated or effectively anonymised results can achieve the research purpose.
Assessment: The processing described is reasonably necessary and proportionate to the research objectives, subject to data minimisation and appropriate alternatives being considered.
Part 3: Balancing test
Do individuals’ interests, rights or freedoms override GROW’s legitimate interests?
GROW recognises that publicly accessible professional information remains personal data where it identifies an individual.
A person who publishes business contact details may reasonably expect relevant professional correspondence. However, they may not expect unsolicited research invitations from an organisation with which they have no existing relationship.
Similarly, providing information voluntarily for research does not mean that a participant expects it to be used for unrelated purposes.
The main potential privacy impacts are:
- Unwanted or repeated professional contact.
- Unexpected use of publicly available contact details.
- Uncertainty about how GROW obtained those details.
- Inadvertent identification through combinations of research responses.
- Disclosure of confidential institutional or personal information.
- Use of research participation or responses for subsequent commercial targeting.
The studies also require different levels of protection.
Institutional benchmarking may involve identifiable representatives and commercially sensitive information. Practitioner surveys may contain personal information about income, professional circumstances or reasons for leaving practice.
GROW addresses these risks through the safeguards set out below.
Safeguards for research recruitment
- Direct invitations are limited to people or organisations with a reasonably identifiable connection to the study.
- Professional contact details are obtained and used lawfully, with attention to the context in which they were made available.
- Where details are obtained indirectly, GROW provides appropriate privacy information, including the source of the details, within the applicable legal timeframe.
- Invitations clearly identify GROW, explain the research purpose and make participation voluntary.
- Recipients can decline further invitations easily and without explanation.
- Objections to further research recruitment are respected, with minimal suppression information retained where necessary.
- Previous objections, unsubscribe requests and relevant communication preferences are considered before contact.
- Direct recruitment is proportionate and does not involve excessive follow-up or unnecessary profiling.
Safeguards for research participation
- Participants receive information about each study before participating.
- Questionnaire responses are restricted to authorised research personnel and appropriately authorised collaborators.
- The Practitioner Success Survey and Business Skills Transfer Study do not require identifying contact details.
- Confidential institutional scores and rankings are not publicly disclosed without the applicable permission.
- Research findings are reported in grouped form, with safeguards against identifying individuals or confidential institutions through small numbers or combinations of responses.
- Optional written responses are reviewed for potentially identifying or unnecessary sensitive information.
- Data is held securely and retained only for the periods justified in the relevant study privacy notice.
- Participant withdrawal arrangements are explained and respected within the technical and legal limits of the study.
Separation from marketing
Research participation is not treated as consent to receive commercial marketing.
GROW does not use individual research answers to identify prospective customers, generate sales scores or determine who should receive commercial approaches.
Optional subscriptions to research findings, free GROW resources and commercial communications are presented as separate choices, with the relevant permissions recorded.
Providing information for research, registering an institution or completing a questionnaire does not automatically add anyone to a marketing mailing list.
Assessment: The principal risks are limited and manageable where these safeguards operate effectively. In that context, GROW considers that the legitimate interests identified are not overridden by the rights and freedoms of the individuals concerned.
5. Direct research invitations and electronic communications
GROW may contact relevant training providers, professional organisations and individual practitioners to invite participation in its research.
The ICO distinguishes genuine research from direct marketing.
An invitation made solely for legitimate research purposes will not ordinarily constitute direct marketing under the Privacy and Electronic Communications Regulations 2003 (PECR).
However, an invitation containing promotional material, or a research activity conducted for the purpose of identifying people for subsequent sales approaches, may constitute direct marketing and must comply with the applicable rules.
GROW therefore maintains the following distinction:
- Research invitations explain the study, eligibility, voluntary participation and access to relevant information.
- Commercial communications promote GROW products, services or commercial opportunities and are subject to separate legal and communication requirements.
The lawful basis for processing research recruitment details does not provide blanket permission for unsolicited promotional communications.
Where GROW proposes to reuse contact details previously collected for another purpose, it assesses whether the new research use is compatible with the original purpose and reasonable expectations of the individuals concerned.
6. Data sources, retention and access
Professional contact information may be obtained from publicly accessible organisational websites, professional directories, networking platforms or previous professional correspondence.
Where information is collected directly from participants, the relevant study privacy notice explains the information requested and its intended use.
The studies apply different retention arrangements, reflecting their processing needs:
- Direct research recruitment records: normally no more than 12 months after the last contact.
- Graduate Support Survey institutional accounts, assessments and identifiable score history: while participating, plus 24 months after account closure.
- Practitioner Success Survey responses: up to five years from submission.
- Business Skills Transfer Study responses: up to five years from submission.
- Communication objections and suppression records: minimum information necessary for as long as needed to respect preferences.
- Effectively anonymised research findings: may be retained indefinitely.
Data is deleted or effectively anonymised when no longer required, subject to applicable legal obligations and documented exceptions.
Access is restricted to authorised personnel, appropriate service providers and collaborators operating under relevant confidentiality and data protection arrangements.
Further details, including international data transfers and technical safeguards, are provided in the individual study privacy notices.
7. Individual rights
Individuals whose personal information is processed may have rights to access, correction, erasure, restriction and objection, depending on the circumstances and applicable lawful basis.
Where GROW relies on legitimate interests, individuals have the right to object to the processing of their personal information.
Any recipient of a research invitation can ask not to receive further invitations. GROW will respect that request.
Where an objection concerns other processing based on legitimate interests, GROW will assess it in accordance with applicable data protection law.
The right to object to processing for direct marketing is absolute.
Individuals can also withdraw consent to optional email subscriptions at any time.
Participation in research is voluntary, and the relevant study information explains how withdrawal requests are handled, including any limitations where information has already been effectively anonymised.
For questions, requests or concerns, contact support@growformula.org.
Individuals also have the right to raise a concern with the Information Commissioner’s Office.
8. Assessment conclusion and review
Having considered the purposes of the research, the necessity of the processing and the potential impact on individuals, GROW considers legitimate interests an appropriate lawful basis for the research activities described in this document.
This conclusion depends on the safeguards being implemented and maintained. It does not authorise unrelated processing, indiscriminate contact collection or the use of research participation as a disguised commercial prospecting activity.
The assessment will be reviewed when a material change is proposed to the research purposes, recruitment methods, personal information collected, use of responses or arrangements for sharing information.
Where a proposed change introduces additional privacy risks, GROW will undertake further assessment before proceeding.
9. Related information and guidance
This statement should be read alongside:
- GROW Data Protection Policy
- Graduate Success Benchmark Privacy Notice
- Business Skills Transfer Study Privacy Notice
The assessment has been informed by the ICO’s guidance on legitimate interests, research-related processing and direct marketing.
Data controller: Sole Trader Courses Ltd, trading as GROW Formula®. Registered office: 12 Charmind Walk, Swindon, SN25 1QA. Contact: support@growformula.org.