PRODUCTPINION INC.
RESEARCH PRIVACY

POLICY NOTICE

How we handle the contact details participants choose to give us
Last updated Sept 22 2026. Applies to participants in ProductPinion research studies.


1. Overview

PRODUCTPINION INC. (the “Company,” “we,” or “us”) runs research studies in which participants give feedback on products. This Research Participant Privacy Notice (“Notice”) explains how we handle contact details that participants choose to give us.

This applies to some studies, not all of them. Most of our studies collect no personal data whatsoever. In a small number of studies, we offer participants the option of leaving an email address at the end. Where we do, the option appears on its own screen after all research questions are complete, and it is clearly marked as optional.

You do not have to give us anything. If you choose not to share your email, you are paid and approved exactly the same, and we hold no personal data about you at all.

PRODUCTPINION INC., [registered address], is the data controller for the personal data described in this Notice. Questions, contact us at support@productpinion.com.


2. Information We Collect

Where a study includes the optional contact step, and only if you opt in, we collect:

• Your email address
• Your initials

Both are optional. Providing them is not required to complete the study and has no effect on your payment or approval.

We do not collect your full name, phone number, home address, date of birth, or any other identifier. Your answers to the study are stored separately and are not linked to your contact details, so nothing you said in a study can be traced back to you.


3. Use of Information

We use your email address for one purpose: to let you know when a brand is looking for people to work with directly. That might be trying a product and recording a short video about your honest reaction to it, or a longer piece of feedback work.

We send you the brief and the brand’s own contact details. Whether you get in touch with them is entirely your decision. If you do nothing, nothing happens, and we will not chase you.

Your initials are used only to address you correctly in those emails and to confirm we are speaking to the right person when you reply.

We do not use your details for marketing, newsletters, promotions or advertising. We do not use them to identify you, and we do not match them against your study answers or any other source of data.


4. Lawful Basis for Processing

We rely on your consent, under Article 6(1)(a) of the UK GDPR and the EU GDPR. You give that consent by ticking the box and entering your email on the opt in screen.

You may withdraw consent at any time, and withdrawing is as easy as giving it. Use the unsubscribe link in any email we send, or write to support@productpinion.com. Withdrawal does not affect anything done before you withdrew, and has no effect on any payment you have already received.


5. Data Retention

We keep your contact details until whichever of these happens first:

• You ask us to remove them, or click unsubscribe
• [24] months pass with no response from you to any invitation

We then delete them permanently. Deletion requests are actioned within [30] days.

Study responses are held separately under our standard research retention schedule and contain no personal data.


6. Data Storage and Security

Contact details are held in a dedicated database table, separate from study response data, hosted on Microsoft Azure in North America. They are encrypted at rest using AES 256 and in transit using TLS 1.2 or higher.

• Access is limited to a small number of named ProductPinion administrators, on a least privilege basis
• Multi factor authentication is enforced on every administrator account, through Auth0
• Database credentials are held in Azure Key Vault, never in source code, and rotated regularly
• Database access is restricted to private endpoints and approved network addresses, and access is logged and auditable
• Contact details are held apart from research data, so exposure of one would not expose the other
• All staff are bound by written confidentiality obligations and are prohibited by internal policy from attempting to identify any participant

International transfers. If you are in the UK or the EEA, your data is transferred to and stored in North America. That transfer is covered by [Standard Contractual Clauses and the UK International Data Transfer Addendum], alongside the measures above.

If something goes wrong. We operate a documented incident response process. In the event of a breach affecting your data we would notify the relevant supervisory authority, the recruitment platform you took part through, and you directly where required.


7. Data Sharing and Third Parties

We do not share your contact details with anyone. Not with brands, not with advertisers, not with data brokers. We never sell, rent or license them.

When a brand is looking for participants, we email you the details and the brand’s own contact information. If you are interested, you contact them yourself. We disclose nothing on your behalf, and a brand never learns you exist unless you choose to reach out.

If you do choose to contact a brand, what happens next is between you and them. That relationship is covered by the brand’s privacy policy rather than this one, and you should read it before sharing anything further, such as a delivery address. We are not part of that conversation and do not receive a copy of it.

The only third parties involved are our infrastructure providers, who process data on our instructions under written agreements and never use it for their own purposes:

• Microsoft Azure. Hosting and database storage in North America.
• Auth0. Access control for our internal systems.
• [Email service provider]. Sending the emails we write to you.


8. Your Rights

Under the UK GDPR and the EU GDPR you have the right to:

• Access the personal data we hold about you
• Correct it if it is wrong
• Delete it
• Restrict or object to how we use it
• Receive a copy of it in a portable format
• Withdraw your consent at any time

To exercise any of these, email support@productpinion.com. We will comply within [30] days. We will not charge you and we will not treat you differently for asking.

If you are unhappy with how we have handled your data, you may complain to your data protection regulator. In the UK that is the Information Commissioner’s Office at ico.org.uk. In the EEA it is the supervisory authority in your country.

California residents. You have the right to know what we collect, to have it deleted, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined under the CCPA.


9. Use by Minors

Our studies are intended for individuals aged 18 and older. We do not knowingly collect data from minors. If we discover we have collected data from a minor, it will be deleted immediately.


10. Changes to This Notice

We may update this Notice periodically. Updates will be posted on our website. Where a change materially affects how we use contact details already collected, we will tell the people affected by email before it takes effect.


11. Related Policies and Contact

This Notice sits alongside our general Privacy Policy at productpinion.com/privacy. Where the two differ on research participant data, this Notice applies.

For questions about this Notice or how we handle data, contact us at:

Email: support@productpinion.com