Privacy Policy

Room to Act, Inc. (“we,” “us,” or “our”) is committed to protecting the privacy and security of your Personal Information (“PI”). This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our survey platform (the “Services”).

This policy applies to all users of our Services and complies with the General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA).

We collect various types of information, including:

• Personal Information (“PI”):
  • Contact information (e.g., name, email address, phone number).
  • Account credentials (e.g., username, password).
  • Usage data (e.g., IP address, browser type, device information, activity logs).
  • Information collected through cookies and similar tracking technologies.
• California Specific Information: Any of the above information that is associated with a California resident.

We use your information for the following purposes:

• To provide and improve our Services: Administering surveys, generating reports, analyzing data, and providing technical support.
• To comply with legal obligations: Meeting GDPR and CCPA/CPRA requirements; responding to legal requests.
• To communicate with you: Sending updates, notifications, and administrative messages; responding to inquiries.
• For research and development: Anonymized and aggregated data may be used for research and development purposes.
• Security: To maintain the security of our systems and data.

For users in the European Economic Area (EEA), we process your PI based on the following legal grounds:

• Contractual Necessity: Processing is necessary to provide the Services you requested.
• Legal Obligation: Processing is necessary to comply with legal obligations.
• Legitimate Interests: Processing is necessary for our legitimate interests (e.g., improving our Services, ensuring security), provided your rights and interests are not overridden.
• Consent: In certain cases, we rely on your consent to process your PI.

We may disclose your information to:

• Service Providers: Third-party service providers that assist with data storage, processing, and other services. These providers are contractually obligated to protect your information.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.
• Legal Requirements: We may disclose your information when required by law or to protect our rights.

We implement appropriate technical and organizational measures to protect your information from unauthorized access, disclosure, alteration, and destruction. These measures include encryption of data in transit and at rest, access controls and authentication procedures, and regular security assessments and audits.

In the event of a data breach involving your PI, we will notify affected individuals and relevant authorities without undue delay, and in accordance with applicable law.

We retain PI for as long as reasonably necessary to provide our Services, fulfill the purposes described in this Privacy Policy, and comply with applicable legal, regulatory, tax, accounting, or reporting requirements.

• Usage Data: Retained for 12–24 months, depending on the nature and purpose of the data.
• Survey Response Data: Retained as long as needed to provide services to our clients, including analysis, follow-up studies, or re-engagement with participants. This data may be retained beyond the end of the active engagement, unless deletion is requested.
• Anonymized Data: May be retained and used indefinitely for research, analytics, benchmarking, and product development. Anonymized data is not considered Personal Information under GDPR or CCPA.

GDPR Rights

• Right to access your PI.
• Right to rectify inaccurate PI.
• Right to erase your PI (right to be forgotten).
• Right to restrict processing of your PI.
• Right to data portability.
• Right to object to processing of your PI.
• Right to withdraw consent.

CCPA/CPRA Rights

• Right to know what PI we collect, use, disclose, and sell.
• Right to delete your PI.
• Right to correct inaccurate PI.
• Right to opt-out of the sale or sharing of your PI.
• Right to limit the use and disclosure of sensitive PI.
• Right to non-discrimination.

To exercise your data rights, please contact us at dbh@gtmhawthorne.com. We will respond within the timeframes required by applicable law.

California residents have the right to request information about the categories of PI we collect, the purposes for which we use it, and the categories of third parties with whom we share it. We do not “sell” personal information as defined by the CCPA/CPRA.

Our Services are not intended for use by children under the age of 13. We do not knowingly collect PI from children under 13. If we become aware that we have collected PI from a child under 13, we will take steps to delete it.

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on our website or by other means. Your continued use of the Services after such changes constitutes your acceptance of the new Terms.

If you have any questions or concerns about this Privacy Policy, please contact us at:

Room to Act, Inc.
dbh@gtmhawthorne.com

• We will process personal data in accordance with GDPR, including having a legal basis for processing, implementing appropriate security measures, and respecting data subject rights.
• For GDPR purposes, we act as a “Data Controller” when determining the purposes and means of processing personal data.
• We will enter into Data Processing Agreements (DPAs) where necessary under GDPR.
• Data may be stored and processed in the United States or in jurisdictions where we operate. We ensure appropriate safeguards are in place for international data transfers in accordance with applicable laws.