Privacy Policy

Background

1. This Privacy Policy is issued on behalf of Dipolar Pty Limited ACN 081 623 181 (Australia) and its subsidiaries, including Web Creator Suite LLC (USA) and Web Creator Suite Ltd (UK) (together "Dipolar Group").
2. When we mention "Dipolar", "we", "us" or "our" in this Privacy Policy, we are referring to the relevant company in the Dipolar Group responsible for controlling the processing of your personal data. The entity which is the primary controller for your personal data will be the Dipolar Group company which either provides the Qualzy platform and related services to you as a Client of the Dipolar Group or which is used by you as a Participant. However, your personal data will also be controlled by the other Dipolar Group entities listed above.
3. This Privacy Policy applies to Dipolar's use of your personal information including in connection with Dipolar's website and the Qualzy web-based platform accessible at https://qualzy.com, https://qualzy.com.au, https://qualzy.co.uk, https://mywebtasks.com, https://mywebtasks.com.au, https://mywebtasks.co.uk and any other affiliated website or platform operated by the Dipolar Group that may be introduced from time to time (Qualzy) which provides a service that enables our Clients to create Projects and allows Participants to participate in those Projects.
4. This Policy also describes your data protection rights, including if the UK GDPR or EU GDPR applies, the right to object to some of the processing which Dipolar Group carries out in certain circumstances. More information about your rights, and how to exercise them, is set out in the "What rights do you have?" section.

Definitions

When used in this Privacy Policy, the following commonly used terms have the meanings defined below:

Clients are our customers who use Qualzy to create and manage Projects including prospective, current and former customers and also including employees, consultants and contractors of any of them.

EU GDPR means the General Data Protection Regulation ((EU) 2016/679).

Participants are individuals who participate in interactive communities, discussions, surveys and live chats (Engagements) in relation to a particular Projects created by Clients.

Personal data / personal information means any information relating to an identified or identifiable natural person and any data or information defined as personal data or personal information in applicable Privacy Laws, but does not include information or data that has been anonymised.

Privacy Laws means the laws (including local, state and federal laws) applicable to the relevant Dipolar Group company relating to the collection, holding, use, disclosure or processing of your personal data or personal information.

Protected Health Information (PHI) means any personal information that relates to an individual's past, present, or future physical or mental health condition, the provision of health care to the individual, or payment for the provision of health care, which identifies the individual or could reasonably be used to identify the individual, as defined under the Health Insurance Portability and Accountability Act (HIPAA).

Projects means projects created by Clients on the Qualzy platform to allow Participants to participate in Engagements in relation to a particular topic to generate qualitative and quantitative market research data for the Client.

Sensitive data / sensitive information means personal information that is defined as being sensitive or a special category of information under the applicable Privacy Laws such as data relating to your health, race, ethnicity, sexual orientation, religious or philosophical beliefs or political opinions.

UK GDPR means the EU GDPR, as applicable as part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018 as amended.

Users refers to both Clients and Participants.

Other capitalised terms have the meaning given in this Privacy Policy.

About This Policy

We are committed to the protection of personal information and data protection within the scope of applicable Privacy Laws. This Privacy Policy covers our treatment of personal information that we collect, use, process and disclose in connection with Qualzy.

Because the privacy position with respect to our Clients is different from that with respect to Participants on Projects, this Privacy Policy has separate sections dealing with each as well as sections that are applicable for all Users, as follows:

• Part A: Privacy Policy for Participants;
• Part B: Privacy Policy for Clients;
• Part C: General Provisions Applicable to Participants and Clients; and
• Part D: Security Policy.

(Please note that Parts A and C will not apply to Participants' personal data processed by any entity in the Dipolar Group where it merely acts as a processor under the UK or EU GDPR).

We may update this Privacy Policy from time to time to reflect changes in applicable laws or the way we handle personal information and we will provide you with a new Privacy Policy when we make any substantial updates. The current version will be located at Privacy Policy and is also available on request using the contact details at the end of this policy below. We may also notify you in other ways from time to time about the processing of your personal information.

By accessing Qualzy, you accept and agree to Dipolar's terms and conditions, whether as a Client or a Participant (Terms), and you acknowledge that you have read the terms of this Privacy Policy.

Where we process Protected Health Information (PHI) on behalf of Clients in the United States, we may act as a Business Associate under HIPAA. In such cases, we will enter into a Business Associate Agreement (BAA) with the Client to define responsibilities for safeguarding PHI.

Part A — Privacy Policy for Participants

This section applies to the privacy of the personal information submitted by Participants (except Participants' personal data processed by any entity in the Dipolar Group where it merely acts as a processor under the UK or EU GDPR). Any reference to "you" in this Part A is a reference to a Participant.

Collecting Your Personal Information

Dipolar collects personal information when you register as a Participant on Qualzy or interact with us and our website. This may include, but is not limited to, identification information (your name, username and password, gender, age/date of birth), contact information (address, phone number and contact details), marketing information (marketing preferences, including any consents you have given us), device information (information related to the browser or device you use to access Qualzy), profile information (user name and password, gender, age/date of birth, interests, preferences, feedback and information submitted through your participation in a Project and any other personal data that you choose to provide to us). We may also give you the option of providing a photo or video to be associated with your Qualzy participant record (uniquely identified by your email address).

If you submit personal or sensitive data as part of your participation on a Project, the Client responsible for the Project will collect and use that information in accordance with its own privacy policy. We are not responsible for and do not control the Client's collection and use of such information and it is your responsibility to be aware of, and we encourage you to read, the Client's privacy policy in respect of each Project in which you participate. If you have any concerns regarding the Client's collection and use of personal information, please contact the Client directly.

We will also collect personal data (which may include sensitive data) when you submit such information through your participation on a Project.

You do not have to provide us with any personal information, however if you do not do so we may not be able to facilitate your participation in some or all Projects.

If your personal details change, it is your responsibility to update your Qualzy account with those changes so your records are complete, accurate and up to date.

We do not monitor or control the notifications provided to you by Clients or the information which may be sought from you during a Project in any way.

You are not anonymous to us when you log into Qualzy, post content, comments or respond to any posts or messages (whether public or private).

When you use Qualzy to participate in a Project or otherwise communicate in a public forum on Qualzy, your name and all the material that you post may be visible to other Participants that are involved in the same Project.

Qualzy complies with the Health Insurance Portability and Accountability Act (HIPAA), ensuring the security and confidentiality of protected health information (PHI) collected, stored, and transmitted through the platform.

Qualzy complies with the Children's Online Privacy Protection Act (COPPA). We do not knowingly collect personal information from children under 13 without verified parental consent. If we learn that we have inadvertently collected such information, we will take steps to delete it promptly.

Use and Disclosure of Your Personal Information

We collect and use personal data as required to perform our contract with you, conduct our business and pursue our legitimate interests, or to comply with our legal obligations.

We have set out below, in a table format, a description of the ways we plan to use your personal data and, if the UK GDPR or EU GDPR apply, which of the legal bases we rely on to do so and what our legitimate interests are where appropriate.

Where required by law, we make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We will not use your personal information for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).

We may also use your personal information where you give us consent or where we are otherwise permitted by applicable Privacy Laws to do so, in particular:

1. we place cookies and use similar technologies in accordance with the Cookies section below and our Cookies Policy provided to you when those technologies are used; and
2. on other occasions where we ask you for consent, we will use the data for the purpose which we explain at that time.

Withdrawing Consent

Wherever we rely on your consent for our use, disclosure or processing of your personal information, you will always be able to withdraw that consent either through controls on the Qualzy platform, by contacting us or by contacting the Client that created the relevant Project, although we may have other legal grounds for processing your data for other purposes, such as those set out in the table above and this will not affect the lawfulness of any use, disclosure or processing carried out before you withdraw your consent.

Overseas Disclosure of Personal Information

We may disclose some of your personal information overseas in circumstances where the Client or the Client's organisation is based outside the jurisdiction in which you are located. You should review the Client's privacy policy when you are agreeing to participate in a Project to determine where your personal information may be disclosed.

We may also disclose information to members of the Dipolar Group and our service providers that are located outside your jurisdiction, including in United States, United Kingdom, EU or Australia.

If you are located:

1. in the UK, and the disclosure is to a recipient in a country that has not been deemed to provide an adequate level of protection for personal data (including the United States and Australia) we may use specific contracts or binding corporate rules approved for use in the UK which give personal data the same protection it has in the UK. A copy of the relevant mechanism can be provided for your review by contacting us using the contact details below;
2. in the EU, and the disclosure is to a recipient in a country that is not subject to an adequacy decision by the EU Commission (including the United States and Australia), data will be adequately protected by EU Commission approved standard contractual clauses, a vendor's Processor Binding Corporate Rules, or another lawful basis for transfer. A copy of the relevant mechanism can be provided for your review by contacting us using the contact details below; or
3. in Australia, we will either take reasonable steps to ensure the overseas recipient does not breach the Australian Privacy Principles in relation to any of your personal information that we disclosed to them or be reasonably satisfied that the overseas recipient is subject to a law, or binding scheme which you can access, that overall, protects your personal information in a substantially similar to the way as the Australian Privacy Principles.

Please contact us using the contact details below if you would like further information on the specific mechanism used by us when transferring your personal information out of your jurisdiction.

How Long Will We Retain Your Data?

Where we process registration data, or other personal data associated with our legitimate business purposes (specifically as a Participant in a Project created by one of our Clients) we will retain this data for as long as our Client does not remove you through deletion, and does not choose to convert Project Participants into anonymous participants.

Where we process personal data with your consent, we will retain it until you ask us to stop and for a short period after this (to allow us to implement your requests), unless we have other legal grounds for processing your data for other purposes, such as those set out in the table above.

Part B — Privacy Policy for Clients

This section applies to the privacy of personal information submitted by Clients and any other person who submits personal information to us other than Participants (e.g. website visitors, other business contacts). Any reference to "you" is a reference to a Client.

Collecting Your Personal Information

We may collect personal information and other information about you when you:

1. provide us with personal information by interacting with us, such as in an email, letter, by telephone, during a meeting or by other means;
2. open an account with us;
3. complete and submit an online application or any other online form; or
4. access and use our services through Qualzy or otherwise.

The personal information we collect may include identification information (your name, your company name) contact information (email address, physical and postal address) marketing information (marketing preferences, including any consents you have given us), device information (information related to the browser or device you use to access Qualzy and timezone location information), profile information (user name and password, feedback and information submitted through your use of Qualzy and any other additional personal that you choose to provide us). We may also collect billing information when you use our services.

You do not have to provide us with any personal information, however if you do not do so we may not be able to facilitate your creation and management of Projects.

If your personal details change, it is your responsibility to update your Qualzy account with those changes, so your records are complete, accurate and up to date.

We do not monitor or control the notifications provided by you to Participants or the information which may be sought in a Project in any way. If a Participant has any concerns regarding the extent to which personal information will be collected as part of a Project or the handling or use of such personal information, then we will inform the Participant to contact you for further information.

Collecting Your Sensitive Information

We will not collect your sensitive information from you or any third party.

Use and Disclosure of Your Personal Information

We have set out below, in a table format, a description of the ways we plan to use your personal data and, if the UK GDPR or EU GDPR apply, which of the legal bases we rely on to do so and what our legitimate interests are where appropriate.

Where required by law, we make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We will not use your personal information for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).

If you provide a credit or debit card as payment, we also use third parties to process the payment and to check the validity of the sort code (where applicable), account number and card number you submit in order to prevent fraud.

We may also use your personal information where you give us consent or where we are otherwise permitted by applicable Privacy Laws to do so, in particular:

1. we may place cookies and use similar technologies in accordance with the Cookies section below and the Cookies Policy provided to you when those technologies are used; and
2. on other occasions where we ask you for consent, we will use the data for the purpose which we explain at that time.

Overseas Disclosure of Personal Information

Personal information that we collect from or about you may be transferred to and stored at a destination outside the jurisdiction in which you are located. For example, if you are based in the UK, your personal information may be transferred outside the UK and EEA.

We may also disclose information to members of the Dipolar Group and our service providers that are located outside your jurisdiction, including in United States, United Kingdom, EEA or Australia.

Where any of these locations do not provide an adequate level of data protection, we ensure appropriate safeguards are in place to protect the transfer of your personal data to these countries. A copy of the relevant mechanism can be provided for your review by contacting us using the contact details below.

In Australia, we will either take reasonable steps to ensure the overseas recipient does not breach the Australian Privacy Principles in relation to any of your personal information that we disclose to them or be reasonably satisfied that the overseas recipient is subject to a law, or binding scheme, that overall, protects your personal information in a substantially similar to the way as the Australian Privacy Principles and you have access to mechanisms to enforce that law.

Please contact us using the details given below if you want further information on the specific mechanism used by us when transferring your personal information out of your jurisdiction.

How Long Will We Retain Your Data?

Where we process registration data, or other personal data associated with our legitimate business purposes as set out in the table above, we will retain this data for as long as you are a registered user of our platform and you have not removed your account.

Where we process personal data for marketing purposes or with your consent, we will retain it until you ask us to stop and for a short period after this (to allow us to implement your requests) unless we have other legal grounds for processing your data for other purposes, such as those set out in the table above. For example, in some jurisdictions we are required to keep a record of the fact that you have asked us not to send you direct marketing so that we can respect your request in future.

Part C — General Provisions Applicable to Participants and Clients

This Part C will not apply to Participants' personal data processed by any entity in the Dipolar Group where it merely acts as a processor under the UK or EU GDPR.

Third Parties and Third Party Disclosures

Qualzy may contain links to third party websites, and advertisers, or make available services obtained from third parties. If you follow a link to any of these websites, or use any services obtained from third party service providers via Qualzy that require you to provide personal information (including sensitive information if relevant) directly to such third parties, note that they have their own privacy policies and we are not responsible for their collection and use of personal information you provide to them directly. If you use Qualzy to link to another site, or use a service obtained from a third party service provider via Qualzy, you will be subject to that site's or third party's terms and conditions of use, privacy policy and security statement. We strongly encourage you to view these before disclosing any of your personal information on such sites.

We do not control, and, to the extent permitted by applicable laws, do not accept any responsibility or liability for, the privacy policy of, and collection, use or disclosure of personal information, by any party other than us (including any User of Qualzy, the operators of any website to which Qualzy links, or third party service providers to whom you directly provide your personal information including sensitive information if relevant).

We may share categories of personal information for the purposes set out in the tables above with the following recipients or categories of recipients:

1. other entities in the Dipolar Group;
2. third party services providers that perform functions on our behalf. Examples include website hosting and maintenance, customer service operations, identity checking, translation service providers, sending postal mail and e-mail, marketing and advertising consultants, processing payments and providing customer service;
3. third parties for their own use, including their direct marketing purposes (please see below for your choices);
4. credit reference agencies, law enforcement and fraud prevention agencies to prevent, investigate and/or report fraud, terrorism, misrepresentation, security incidents or crime, or as otherwise required by law, to protect our rights or the rights of third parties, or to protect the safety and security of any person or entity; or
5. with your consent or as otherwise disclosed at the time of data collection or sharing.

More information about the disclosure of personal information to hosting providers and translation and sentiment analysis providers are set out below.

In the event that parts or all of our business is sold or integrated with another business, your details will be disclosed to our advisers and any prospective purchaser's adviser and will be passed to the new owners of the business and the new owners may use your personal information in the same way as set out in this Privacy Policy.

We may use a third party to provide hosting or similar services and as a result your personal information may be collected and stored using physical infrastructure owned by third parties. In these circumstances:

• we will retain logical control of the personal information; and
• the third party will not be permitted to access, use or disclose the personal information except to the extent necessary to provide the services (e.g. creating data back-ups or performing maintenance services) or if disclosure is required by a governmental entity.

Updating Information

All Clients may make any changes to their information at any time by logging into the platform and editing their personal information. Participants may make changes to their personal information by contacting the moderator for the Project they are participating in and requesting the change.

Security Measures

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. Information about our security measures are set out in our security policy located at Security Policy.

What Rights Do You Have?

Under certain circumstances and depending on the jurisdiction in which you reside, you may have rights under data protection laws in relation to your personal data.

Wherever we rely on your consent for our use, disclosure or processing of your personal information, you will always have the right to withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. You may do this through controls on the Qualzy platform, by removing your Qualzy account or by contacting us, although we may have other legal grounds for processing your data for other purposes, such as those set out in the table above.

If the EU GDPR or UK GDPR applies, you have the following rights:

In some cases, we are able to send you direct marketing without your consent, where we rely on our legitimate interests. You have an absolute right to opt-out of direct marketing, or profiling we carry out for direct marketing, at any time. You can do this by following the instructions in the communication where this is an electronic message, or by contacting us using the details set out below.

If you are a resident of California, then, subject to applicable limitations under California law, you may request that we provide you with a list of categories of personal data that we have disclosed to third parties for the purposes of direct marketing during the immediately preceding calendar year, as well as the identities of those third parties. You may do so by contacting us at the address listed below.

If Australian Privacy Laws applies you have the right to request access to or correction of your personal information.

The rights described in this Section may be limited, for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law or have compelling legitimate interests to keep, or which we are otherwise permitted to retain under applicable Privacy Laws.

To exercise any of your rights, you can get in touch with us using the details set out below. If you have unresolved concerns, you have the right to complain to the data protection authority where you live, work or where you believe a breach may have occurred.

How We Protect Personal Information

We store personal information in a combination of computer storage facilities and other records. In so doing, we have taken numerous steps to protect your personal information from misuse, interference and loss, and unauthorised access, modification or disclosure. Additionally, we take reasonable steps to destroy or permanently de-identify or anonymise personal information (as required by applicable laws) when we no longer need it.

We cannot guarantee the absolute security of that information, or that our systems will be completely free from third party interception or are incorruptible from viruses. We cannot and do not guarantee that information you send from your computer to us over the internet will be protected by any form of encryption (encoding software). In light of this, to the extent permitted under applicable laws, we cannot and do not warrant the security or privacy of your personal information, including payment and account details. You are entirely responsible for maintaining the security of your passwords and/or account information.

Cookies

We may, subject to obtaining your consent where required by applicable Privacy Laws, use cookies as follows:

Qualzy may use cookies to track User traffic patterns and to better serve you when you revisit Qualzy. These cookies may collect information about your activities on our website and across nonaffiliated websites and apps over time, as well as about relationships among different devices and browsers. Further information about the cookies we use is included in our Cookie Policy.

Most advertising networks offer you a way to opt out of data collection for targeted advertising. If you would like to find out more information about targeted advertising or opt out of such data collection by participating companies, please visit:

• Digital Advertising Alliance
• Digital Advertising Alliance of Canada
• European Interactive Digital Advertising Alliance

Information is also generated whenever a page is accessed on Qualzy that records information such as the time, date, activities, and specific page. We may collect such information for statistical and maintenance purposes that enables us to continually evaluate the performance of Qualzy.

Qualzy may also collect cookies for use by analytics services, such as Google Analytics. These services use cookies and scripts to collect and store information. Please see the following links for more information about Google Analytics:

• https://www.google.com/privacy_ads.html
• https://www.google.com/privacy.html
• https://www.google.com/analytics/tos.html

We do not tie information gathered using third party analytics to your personal information.

Translations

Qualzy can optionally translate content from one language to another utilising Google's pre-trained automatic translation APIs.

Only the individual piece of text being translated is transferred to Google's servers; no other content is sent.

Data is transferred to Google's Servers using TLS. TLS, or Transport Layer Security, is the industry standard security technology for establishing an encrypted link between our servers and the Google Cloud infrastructure.

Google does not use any of your content (i.e. the text sent for translating) for any purpose except to provide us with the translation.

None of the data sent to Google's Servers is persisted on their servers. The content is stored for a short period of time in order for them to perform the translation and return the results.

In this activity Google acts as a data processor only. Full details of the data usage is available at Google's Translation Data Usage FAQ.

Sentiment Analysis

Qualzy can optionally perform advanced sentiment analysis on the text content posted in some topic types. Part of this analysis requires the use of Google Cloud Natural Language Processing APIs.

Only the individual piece of text being analysed is transferred to Google's Servers.

Data is transferred to Google's Servers using TLS. TLS, or Transport Layer Security, is the industry standard security technology for establishing an encrypted link between our servers and the Google Cloud Infrastructure.

Google does not use any of your content (i.e. the text sent for analysis) for any purpose except to provide us with the sentiment analysis.

None of the data sent to Google's Servers is persisted on their servers. The content is stored for a short period of time in order for them to perform the sentiment analysis and return the results.

In this activity Google acts as a data processor only. Full details of the data usage is available at Google's Natural Language Data Usage FAQ.

Automated Processing and Artificial Intelligence

Qualzy may use artificial intelligence ("AI") or machine learning technologies to assist in providing and improving our services, such as identifying discussion topics, clustering responses, or generating automated summaries.

Where artificial intelligence ("AI") is used to process Client Content, Participant Generated Content, or other data generated through the platform, we apply safeguards to ensure fairness, accuracy, and non-discrimination including data minimisation and pseudonymisation where possible.

How You Can Access Your Personal Information

Depending on the rights available to you in your jurisdiction and at your request, we will provide you with a copy of any personal information which we hold about you, unless an exception under the applicable Privacy Laws applies. Where permitted by the Privacy Laws, we may charge a fee for retrieving this information, in which case we will inform you of the fee and obtain your agreement to that fee before providing the information.

Depending on the rights available to you in your jurisdiction, you may access, edit, update and/or delete the personal information that we hold about you, unless we are legally permitted or required under Privacy Laws to deny you access to, and/or to retain, the information.

We will promptly acknowledge and investigate any complaint about the way we manage personal information.

If your personal information is held by a Client, access to such personal information held by that Client is subject to their privacy policy. Please contact the relevant Client in the first instance if you have any questions or would like to exercise any of your rights in respect of the personal information held by the Client.

Part D — Security Policy

We take data security very seriously. We have appropriate measures in place to help ensure that your personal data is kept secure. We have detailed below all steps taken by us to secure your data.

Storage and Security of Personal Information

Information and Data will be stored in data centres. The location of the data centre depends on the Dipolar entity that is providing the Qualzy services. The location of data centres and the security measures that are taken are described in our security policy located at Security Policy.

How to Contact Us for Further Information or Make a Complaint

If you have any questions about this Privacy Policy, or if you wish to make a complaint about our collection, use or disclosure of your personal information under this Privacy Policy, or you wish to contact our data protection officer, please contact us at privacy@qualzy.com.