EFFECTIVE DATE: February 20, 2023

1.0 – PRIVACY POLICY STATEMENT

This Privacy Policy ("Privacy Policy") discloses Regina Corso Consulting’s (RCC) privacy practices for our survey respondents, market research study participants and market research consultants.

The purpose of this Privacy Policy is to inform you about the Personal Information ("Personal Information") we collect about you. It outlines how we collect, use and disclose that information when you participate in one of our surveys or research. This Privacy Policy will also explain how you can verify the accuracy of your information submitted to and how you may correct that information.

When you participate in our market research surveys, focus groups and in-depth interviews, your personal privacy will be protected. You can be assured of the following:

• We will not make your Personal Information available to anyone without your knowledge unless it is for research purposes only or if required by law (as described in this Privacy Policy). This includes the following but not limited to: your name, address, phone number and e-mail address.
• We will never try to sell you anything and we will never sell your name to anyone. That is not our business. We are not telemarketers or direct marketers. We are market researchers interested only in your opinions.
• Occasionally, we may re-contact you to validate your responses. We will never misrepresent ourselves or what we are doing.
• Your decisions about participating in a study, responding to specific questions, or discontinuing participation will be respected without question.

We have developed our Privacy Policy based on industry guidelines and standards, and local, national, and international laws, including the California Consumer Privacy Act of 2018 (CCPA), and requirements, and the privacy practices and methods described in this statement are designed to be compliant with the applicable standards, laws and requirements. RCC also follows the guidelines of the Insights Association (in the USA) and the Canadian Research Insights Council (CRIC), in Canada, the professional trade association of survey research companies that sets industry standards to which research companies must adhere, and which also protect your privacy.

We are also demonstrating our commitment to your privacy, by complying with the laws and regulations under applicable privacy laws in Canada, including the Personal Information Protection and Electronic Documents Act ("PIPEDA").

2.0 – SCOPE AND APPLICATION

The scope and application of the Privacy Policy are as follows:

• The Privacy Policy applies to all offices of Regina Corso Consulting.
• The Privacy Policy applies to Personal Information collected, used, or disclosed by RCC in the course of commercial activities.
• The Privacy Policy applies to the management of Personal Information in any form whether oral, electronic or written.
• The Privacy Policy does not impose any limits on the collection, use or disclosure of the following information by RCC:
• non-personally identifiable information;
• your name, business title, business address and telephone number and fax in your capacity as an employee of an organization;
• depending on the jurisdiction, publicly available information (e.g. specified by regulation pursuant to PIPEDA in Canada).
• The Privacy Policy does not apply to "Privileged Information". In the case of a situation where a government body or any other person requests Privileged Information, we will consult with our attorney before responding to any request for the said information.
• This Privacy Policy applies to the collecting and processing of Personal Information that RCC receives from individuals in Canada, the United States as well as individuals who reside in the European Union and Switzerland.

3.0 – PRIVACY POLICY

3.1 – The Personal Information We Collect

Personal Information means any information that can specifically identify you during a survey and/or enrollment process. This information may include but is not limited to, your first and last name, mailing address, phone number(s), e-mail address and in, certain circumstances, your opinions and individual preferences. This information is used to contact you regarding market research opportunities, as well as to send incentive rewards.

In most research surveys, we also collect demographic and professional information, some of which may be considered sensitive in nature, such as your age, gender, occupation, income range, racial or ethnic origin, household composition, language preference, employment status, etc. We ask these questions to help ensure that the demographic profiles of individuals who kindly participate in our surveys accurately reflect the target population that we are trying to approximate.

We may also collect sensitive information that may include but is not limited to health-related information (disease, conditions and treatment) or financial information. We will never ask you for sensitive Personal Information that could give rise to economic crimes if it were lost, misused or disclosed to an unauthorized party, such as credit card numbers, social insurance numbers, bank account information, passport numbers or driver’s license numbers.

Personal Information, however, does not include (i) your name, business title or business address and business telephone number and fax in your capacity as an employee of an organization; and (ii) depending on the jurisdiction, publicly available information. However, if in your capacity as an employee of an organization you participate in one of our surveys, your responses will be treated as Personal Information.
We may collect Personal Information about other members of your household. This information may include but is not limited to the age and gender of the other household members. We use this information to determine if certain surveys are relevant to you based on the composition of your household. Sometimes we use this information to invite other members of your household to participate in our surveys.

3.2 – How We Collect Personal Information

We will always collect your Personal Information by fair and lawful means. We collect your Personal Information where we have obtained your consent to do so or as otherwise permitted by law.

We may collect Personal Information directly from you or we may obtain Personal Information from clients or research firms who commission us to provide research services on their behalf. We may also obtain Personal Information from list providers who have assured us that their lists comprise only individuals who have consented to be listed ("opt-in" lists). Finally, we may collect and use Personal Information obtained from publicly-available sources, such as telephone directories.

We may use a third-party agent to host surveys or panel events to collect Personal Information, including email address. That information is delivered to RCC directly. Contractual agreements between RCC and third-party vendors ensure that your Personal Information will not be shared with anyone and will not be used for any other purpose without your consent.

RCC will give notice when Personal Information is collected or when any collected information is later to be provided to third parties. All notices will explain the need for the information and describe how the information will be used. Personal Information will not be used to directly market any products or services to identifiable persons unless that possibility has been disclosed in advance and the opportunity not to participate has been given.

3.3 – How We Use Personal Information

We identify the purposes for which we use your Personal Information at the time we collect such information from you and obtain your consent, in any case, prior to such use.

We collect your Personal Information for the following purposes:

1. To conduct quantitative or qualitative marketing and social research on behalf of our clients who include businesses, non-profit organizations and governmental institutions;
2. To understand respondent opinions to establish suitability for further quantitative and qualitative marketing and social research;
3. To meet legal and regulatory requirements.

In this context, we may use your Personal Information for any of the following reasons:

• To invite you to participate in survey research;
• To conduct a survey research interview with you;
• To validate answers, you provided in a recent survey we conducted;
• To update and to ensure that our records of your Personal Information are correct;
• To provide services and support that you have requested;
• To verify the integrity of submitted information;
• To detect and to prevent violation of our Terms & Conditions.
• As otherwise authorized by you.

Data collected from market and social research studies is shared with our clients in aggregate (or group) form, and responses are not attributed to individuals, in other words we combine your survey responses with the responses of all other survey participants and report aggregate responses. Individual level responses are occasionally used, but never associated with any personal identifying information without your explicit permission, except as otherwise stated herein.

3.4 – To whom Personal Information is Disclosed

We will not make your Personal Information available to any third party without your knowledge, unless it is for research purposes or required by law, as further specified below.

The only exceptions when we may disclose your Personal Information and/or survey responses to third parties are as follows:

• To a client of RCC who commissioned the survey you participated in, who is contractually bound to keep the Personal Information confidential and use it only for research or statistical purposes (in accordance with the guidelines of the Insights Association, ESOMAR and with CRIC Code of Conduct and Good Practice);
• You consent to sharing your identifying information and individual responses with a third party for a specified purpose;
• In the rare but possible circumstance that the information is subject to disclosure pursuant to judicial or other government subpoenas, warrants, orders or for similar legal or regulatory requirements, except for Privileged Information. In that specific case, we will consult with our attorney before responding to any request for the information.
• When we believe disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with suspected or actual illegal activity.
• RCC may be required to disclose an individual’s Personal Information in response to a lawful request by public authorities, including to meet national security or law enforcement requirements. RCC is liable for appropriate onward transfers of personal data to third parties.
• If RCC is involved in a merger, acquisition, or sale of all or a portion of its assets, you will be notified via email and/or a prominent notice on our website of any change in ownership or uses of this information, as well as any choices you may have regarding this information.

3.5 – Retention of Personal Information

We retain Personal Information for as long as necessary to fulfill the purpose for which it was collected or as otherwise permitted by law. Once this purpose has been fulfilled, subject to any legal exceptions, we destroy or irrevocably erase or de-identify the Personal Information in a secure manner that protects the privacy of the individual whom the information relates to. You may cancel your membership in a program or otherwise request deletion of your Personal Information. Note that, in some cases, we may retain some of your Personal Information for a reasonable period of time for legal, administrative or compliance purposes.

3.6 – How and When We Obtain Your Consent

We obtain your consent prior to collecting, and in any case, prior to using or disclosing your Personal Information. You may provide your consent to us either orally or in writing. For example, when you respond to a survey, you provide your consent to allow us to use your Personal Information for the purpose of conducting quantitative and qualitative market and social research and, in certain circumstances, to disclose your Personal Information to our clients.

When you agree to participate in survey research, and the method of data collection is by telephone or in-person, an interviewer then conducts an interview with you. When the method of data collection is by mail, via a web panel or email invitation, you complete a questionnaire yourself.

From time to time, we may collect, use or disclose your Personal Information based on your consent and as permitted by law. If you provide us with sensitive Personal Information such as health or financial information, we will obtain your express consent for the collection, use and disclosure of such sensitive Personal Information.

When you participate in market research telephone interviews and discussions with us, the interview may be recorded, or there may be others on the call for note taking, training, or research evaluation purposes. To protect your privacy, only your first name will be used during discussions. You may decline to participate in interviews that are monitored by others or recorded.

3.7 – Access to Personal Information

We will make available to you any specific Personal Information on you in our custody or control, that we have collected, used or disclosed, upon your written request, to the extent required and/or permitted by law. We will make such information available to you in a form that is generally understandable, including explaining any abbreviations or codes.

To request access to Personal Information that we hold about you, we require that you submit your request in writing at the e-mail address or postal address shown below in the Contact section. When we receive an access request from an individual, we will attempt to fulfill the requested information within 30 business days, including requests regarding the Personal Information we have in our possession or control about the individual, what it is being used for, and to whom it has been disclosed, if applicable. Note that, in an effort to prevent fraudulent or unauthorized requests for access, we may request identification for authentication purposes. You may also make a subsequent request to correct any Personal Information that you feel is inaccurate or incomplete. You may also request the deletion of your Personal Information, subject to legal and contractual restrictions; however, please note that deletion of some information may impact our ability to provide you with certain services.

In certain situations, however, we may not be able to give individual access to all of their Personal Information. This may occur when:

• Providing access to Personal Information would be likely to reveal Personal Information about a third party;
• Disclosing the information would reveal confidential commercial information;
• The information has been collected for the purposes of a legal investigation.

If we deny an individual’s request for access to their Personal Information, we will advise the individual of the reason for the refusal.

3.8 – Ensuring Third Party Confidentiality

We ensure that all our affiliates and other third parties which are engaged to perform services on our behalf and are provided with Personal Information are required by contract to observe the intent of this Privacy Policy and practices or are governed by the same Privacy Policy.

3.9 – Collecting Information from Children

Occasionally, we conduct surveys with children under 13 but only with parental or legal guardian consent. Depending on the sensitivity of the survey topic, we may seek parental or legal consent for interviewing children between 13 and 17 years of age. If we become aware that Personal Information from a child under 13 has been collected without the consent of such child’s parent or guardian, we will use all reasonable efforts to delete such information from our database.

3.10 – Safeguards

The security of your Personal Information is very important to us. We have put in place reasonable physical, administrative, electronic, contractual and technological security procedures to protect your Personal Information we collect so as to prevent any loss, misuse, copying, unauthorized access, disclosure or modification of Personal Information. Only those employees who need access to your Personal Information in order to perform their duties are authorized to have access to your Personal Information.

We prevent electronic intrusion by using firewall technology and we use SSL certificates to ensure the confidentiality of the information collected by our web applications. The employees who are granted access to your Personal Information, including email address, can only access it using secure connections and passwords from within our networks.

3.11 – Questions or Suggestions

If you are concerned or have any complaints or questions about our use of your Personal Information, please contact ReginaCorsoConsulting.com Customer Support with the subject line "Privacy":

3.12 – Changes to this Privacy Policy

We may update and make changes to this Privacy Policy from time to time, consistent with applicable data protection and privacy laws and principles. We encourage you to periodically review our Privacy Policy for the latest information on our privacy practices.