We take your privacy seriously.

Information you provide to us. Personal Data you may provide to us through the Platform or otherwise includes:

• Contact data, such as your first and last name, email address, home address, work address, and mobile phone number.

• Communications data based on our exchanges with you, including when you contact us through the Platform, social media, email or otherwise.

• Survey data, such as your responses to surveys that we make available to you on our Platform.

• Marketing data, such as your preferences for receiving our marketing communications and details about your engagement with them.

• Other data not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

Third-party sources. We may combine Personal Data we receive from you with Personal Data we obtain from other sources, such as:

• Public sources, such as government agencies, public records, social media platforms, and other publicly available sources.

• Data providers, such as information services and data licensors that provide demographic and other information that we use to provide the Platform.

Automatic data collection. We, our service providers, and our business partners may automatically log certain data about you, your computer or mobile device, and your interaction over time with the Platform, our communications and other online services, such as:

• Device data, such as your computer or mobile device’s operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type (e.g., phone, tablet), IP address, unique identifiers, language settings, mobile device carrier, radio/network information (e.g., Wi-Fi, LTE, 5G), and general location information such as city, state or general geographic area.

• Online activity data, such as pages or screens you viewed, how long you spent on a page or screen, the website you visited before browsing the Platform, navigation paths between pages or screens, information about your activity on a page or screen, access times and duration of access, and whether you have opened our emails or clicked links within them.

• Communication interaction data such as your interactions with our emails, or other communications (e.g., whether you open and/or forward emails) – we may do this through use of pixel tags (which are also known as clear GIFs), which may be embedded invisibly in our emails.

Cookies and similar technologies. Some of the automatic collection described above is facilitated by the following technologies:

• Cookies, which are small text files that websites store on user devices to allow web servers to record users’ web browsing activities and remember their submissions, preferences, and login status as they navigate a site. Cookies used on our sites include both “session cookies” that are deleted when a session ends, “persistent cookies” that remain longer, “first party” cookies that we place and “third party” cookies that our service providers place.

• Local storage technologies, like HTML5, that provide cookie-equivalent functionality but can store larger amounts of data on your device outside of your browser in connection with specific applications.

• Web beacons, also known as pixel tags or clear GIFs, which are used to demonstrate that a webpage or email was accessed or opened, or that certain content was viewed or clicked.

We may use cookies to allow the technical operation of the Platform, enhance the functionality of the Platform, and help us understand user activity on the Platform (including which pages are most and least visited and how visitors move around the Platform, as well as user interactions with our emails).

In general, we will only use Personal Data for the primary purpose(s) and applicable legitimate purposes for which it was collected (all of which will usually be identified to you at the time we collect it), or for purposes consistent with these primary purposes. Beyond that, we may use your Personal Data for the following legitimate business purposes (or in other ways that we ask you for at the time we collect it):

Platform delivery and operations. We may use your Personal Data to:

• provide, operate and improve the Platform and our business;

• generate generic categories of characteristics or data sets based on your answers to surveys;

• depersonalize or anonymize them;

• generate reports of certain aggregated data sets to serve the needs of our clients;

• communicate with you about the Platform, including by sending announcements, updates, security alerts, and support and administrative messages;

• understand your needs and interests, and personalize your experience with the Platform and our communications; and

• provide support for the Platform, and respond to your requests, questions and feedback.

Marketing. We and our service providers may collect and use your Personal Data to send you direct marketing communications. You may opt-out of our marketing communications as described in the “Opt-out of marketing” section below.

Compliance and protection. We may use your Personal Data to:

• comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities;

• protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims);

• audit our internal processes for compliance with legal and contractual requirements or our internal policies;

• enforce the terms and conditions that govern the Platform; and

• prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft.

With your consent. In some cases, we may specifically ask for your consent to collect, use or share your Personal Data, such as when required by law, or for when we have a new legitimate purpose for using your Personal Data that we did contemplate at the time it was originally collected from you.

In general, we only share or communicate de-identified or anonymized, aggregated information that does not directly or indirectly identify any individual to our customers and partners, on behalf of our users who have decided to participate in a survey, in accordance with the terms and conditions related to such surveys. However, there are some exceptions to this, as explained below.

Sharing with third-party service providers. We share your Personal Data with third-party service providers and/or partners who provide us with website, application development, hosting, analytics, or other services who need to access or process your Personal Data in connection with the services they provide to us. In such cases, they are contractually bound to keep your data confidential and to comply with privacy laws.

Specifically, simplydbs currently has an arrangement with Qualtrics LLC (“Qualtrics”) to provide strategic research and analytics insights from the Personal Data it collects from surveys. Simplydbs has executed a data processing agreement (“DPA”) with Qualtrics, where Qualtrics has committed to process all data shared with it (including Personal Data, if applicable) to perform all necessary services for simplydbs in accordance with applicable global data protection laws, including the GDPR.

Sharing with employees. Our employees are bound by a duty of confidentiality. They only have access to your Personal Data in an anonymized or de-identified form, on a “need-to-know” basis or if reasonably required by their duties.

Sharing with legal authorities. We may also need to disclose Personal Data to comply with a legal obligation or to enforce our rights, including to government authorities and law enforcement agencies where required by applicable law.

Sharing for other purposes we ask you about. From time to time, we may seek your express consent to share your Personal Data with third parties for specified purposes; for example, with developers and/or building owners so that they can collect deeper feedback from you around your survey responses.

To be able to provide specific functionality for the Platform, simplydbs partners with third-party data processing service providers (“Sub-Processors"). Some Sub-Processors have access to Personal Data, while others do not. The Sub-Processors with access to your Personal Data are listed below, with the purposes for accessing your Personal Data also summarized:

Qualtrics - survey, data processing, data warehousing, and data analytics

MailChimp - e-newsletter management

SquareSpace - website management

ASI - implementation and professional services

Weglot - Translation Services

Canva - Design elements

Under certain circumstances and in accordance with applicable data protection laws, you have a number of rights when it comes to the Personal Data you provide to simplydbs:

• Access: right to ask whether we hold Personal Data about you and the right to access that information.

• Rectification: right to request the rectification of any incomplete or inaccurate Personal Data we hold about you.

• Withdrawal of consent: right to withdraw your consent to the disclosure or use of Personal Data collected.

• Destruction request: right to request the destruction of the Personal Data we hold about you.

• Request for information: right to request certain information relating to decisions based exclusively on the automated processing of Personal Data.

We follow generally accepted industry best-practices and standards to protect the information transferred to us. We maintain appropriate physical, technical, logical, and administrative safeguards, proportional to the sensitivity of the Personal Data, to protect it from unauthorized disclosure or access, accidental or unlawful alteration, loss or destruction, misuse, or other unlawful form of processing of the Personal Data in our possession. In circumstances where Qualtrics is processing data on our behalf, we rely on the security measures that Qualtrics has committed to in the DPA we have with them.

Although we ensure that adequate safeguards are in place to protect Personal Data, data transmission over the Internet still comes with inherent risks. We cannot guarantee that third party actors will not maliciously attempt to hack our systems, and we are not responsible for third party interceptions of data in transit if they have managed to circumvent our security protocols in circumstances where there were no vulnerabilities or deficiencies in our systems. In those situations, we cannot be held liable for any misappropriation, interception, modification, deletion, destruction, or use of data provided through our Platform.

If you have reason to believe that any Personal Data has been compromised, please contact us as set forth in the “How to contact us” section.

In the case of a data security breach involving your Personal Data, we will notify you without undue delay after we become aware of such breach, and will work diligently to investigate, contain, and remediate the breach, all as required by applicable law.

The Platform may contain links to websites, mobile applications, and other online services operated by third parties. In addition, our content may be integrated into web pages or other online services that are not associated with us. These links and integrations are not an endorsement of, or representation that we are affiliated with, any third party. We do not control websites, mobile applications or online services operated by third parties, and we are not responsible for their actions. We encourage you to read the privacy policies of the other websites, mobile applications and online services that you use.

We are headquartered in Canada and may use service providers that operate in other countries. Your Personal Data may be stored or transferred or other locations where privacy laws may not be as protective as those in your state, province, or country. If you are considered a “data subject” under the EU General Data Protection Regulation (GDPR), then we will handle your Personal Data in accordance with the GDPR.

We will retain Personal Data only for as long as necessary for the purposes set out in this Privacy Policy and to comply with our legal and regulatory obligations. To find out more about how long we keep Personal Data, please contact us as set forth in the “How to contact us” section.

We reserve the right to modify this Privacy Policy at any time. If we make material changes to it, we will notify you by updating the date of this Privacy Policy and posting it on the Platform or other appropriate means. Any changes to this Privacy Policy will be effective upon our posting of the modified version (or as otherwise indicated at the time of posting). In all cases, your use of the Platform after the effective date of any modifications indicates your acceptance of the modifications. If you have any issues with any modifications, please contact us to discuss them.

o exercise your rights, file a complaint, obtain information about our policies and practices or if you have questions or comments about this Privacy Policy, please contact our Privacy Officer by email at privacy@simplydbs.com or by mail at the following address: 2967 Dundas St. W. #745D.