PRIVACY POLICY

Personal information is any information that permits an individual to be identified. This information may include, but is not limited to, your name, mailing address, telephone number(s), email address(es), personal educational, healthcare and financial history, personal identification numbers (such as social insurance number, health care number) and, in certain circumstances, your opinions and individual preferences. Personal information, however, does not include your business contact information including your name; business title; or business address, business telephone number, or business fax number. However, if you participate in one of our surveys in your capacity as an employee of an organization, your responses will be treated as personal information.

When we connect with you, we identify the purpose for which we use your personal information. We will obtain your consent, in any case, prior to such use. One of the primary purposes for which we collect your personal information is to conduct social research by conducting surveys. If you provide us with sensitive personal information such as health or financial information, we will obtain your express consent for the collection, use, and disclosure of that information.

We identify to whom, and for what purposes, we will disclose your personal information at the time we collect such information from you and obtain your consent to such disclosure. For most studies, your specific personal information is never shared—a unique identifier code is attached to your survey results and only that ‘code’ is forwarded to the client to link results to any one record. Any personally identifiable information is ‘stripped’ from the collected data to ensure anonymous results. For some studies, however, personal information may be released to a third party with the prior approval of the participant. For example, we may ask the participant to disclose their personal information for the following reasons: • To our client for the client’s purposes of conducting further research; • To our client to identify specific survey results for an individual as part of the research process (such identification of results is detailed to respondents in the opening survey script); • To a third party we engage to perform functions on our behalf (such as a mailing house with which we have a long-standing business relationship and a non-disclosure agreement in order to send you a notification letter in advance of the survey). Such parties are restricted from using your personal information in any way other than to provide services to Malatest; • Such other disclosures of personal information to such designated persons/parties for which you provide your written consent; and • As otherwise permitted by law when applicable and required

We obtain your consent prior to collecting and prior to using or disclosing your personal information for any purpose. You may provide your consent to us either orally or in writing. For example, when you respond to a survey, you provide your consent to allow us to use your personal information for the purposes of conducting social research and, in certain circumstances, to disclose your personal information to our clients. From time to time, we may collect, use, or disclose your personal information based on your consent and as permitted by law.

Occasionally, we conduct surveys with children under 13 but only with the appropriate parental or legal guardian consent for the survey. Depending on the sensitivity of the survey topic, we may seek parental or legal consent for interviewing young people between the ages of 13 and 17. If we become aware that personal information from a child under 13 has been collected without the appropriate consent of such child’s parent or guardian for the survey, we will use all reasonable efforts to delete such information from our records.

The security and privacy of your personal Information is very important to us. We have put in place physical, administrative, electronic, contractual and technological security procedures to protect your personal information. Only those employees who need access to your information to perform their duties have access to your personal information. Every Malatest employee and our business partners (contractors) are responsible for maintaining the confidentiality of all information to which they have access. Our employees and contractors are informed about the importance of privacy and receive ongoing updates on privacy related policies. We are committed to ensuring the security of your personal information to protect it from unauthorized access, collection, use, disclosure, copying, modification or disposal, or similar risks. Security measures in place to protect your personal information include the use of physically secured office spaces; locked filing cabinets; the use of user IDs, passwords, and firewalls; and restricted employee access, as appropriate.

We will use, disclose, or retain your personal information for as long as necessary to fulfill the purposes for which it was collected and as permitted or required by law. We have established minimum and maximum retention periods and procedures for maintaining and destroying your personal information.

At your written request, and to the extent permitted by law, we will make available to you any specific personal information on you that is in our custody or control for any data collection method that contains personally identifiable information. We will make such information available to you in a form that is generally understandable, including explaining any abbreviations or codes. To ensure the privacy of all individuals, proof of your identity will be required prior to the release of any information. To request access to your personal information which is in our control, we ask that you contact our Privacy Officer at privacy@malatest.com.

We will ensure that your personal information is kept as accurate as possible. When we collect personal information from you, we rely on you for its accuracy.

You can, at any time, write to us about the accuracy of the personal information we have collected. If the personal information is inaccurate, we will gladly modify it. Where appropriate, we will transmit the amended information to third parties that may also be impacted by this change.

We will attempt to respond to your written request within thirty days of receipt of the request; we will advise you in writing if we cannot meet your request within this time. As provided for by PIPEDA, you have the right to make a complaint to the federal Privacy Commissioner with respect to our compliance with this time limit. Please ensure that all written correspondence includes a method of contacting you (such as your mailing or email address) to enable us to provide you with the requested feedback.

Yes, there may be some fees associated with accessing your personal information, as allowed under law. We will not assess any costs to you for access to your personal information or on our privacy policy or practices without first providing you with an estimate of the approximate costs, if any. You may withdraw your requests for access to information by notifying us within the 30-day notice period disclosed on the estimate.

We will request that you provide sufficient identification to permit access to the existence, use, or disclosure of your personal information. Any provided proof of identity will be used only for this purpose.

We have implemented physical, organizational, contractual, and technological security measures to protect your personal information from loss or theft, unauthorized access, disclosure, copying, use, or modification. The only employees who can access your personal information are those with a research need to know or whose duties reasonably require such information. All employees who have access to personal information have appropriate security clearances, have been trained in their privacy obligations, and hold positions of trust within our company. As we are a 100% Canadian owned and operated company, data, including your personal information that we collect, never leaves Canada. As a result, your personal information is not subject to the information sharing provisions of the USA Freedom Act or to any other non-Canadian legislation.