Your trust is very important to us. This means AlphaBase is committed to protecting the privacy and security of your personal information.

It is important that you read this notice so that you are aware of how and why we are using such information. This privacy notice describes how we collect and use personal information about you during and after your relationship with us, in accordance with data protection law. It is important to note that in most circumstances we do not collect personal identifiable information from users, but there are specific circumstances in which we do. The following document outlines those circumstances, what to expect and your rights, as well as the other data we collect about you during and after your interactions and relationship with us.

We’ve tried to make this notice as easy to read as possible, but if anything is unclear, please contact the AlphaBase Data Protection Officer and we’ll be happy to clear it up.

We reserve the right to make changes to this Privacy Policy at any time and for any reason. We will alert you about any changes by updating the “Last Updated” date of this Privacy Policy (see statement in bold at the foot of this section). Any changes or modifications will be effective immediately upon posting the updated Privacy Policy on the Site, and you waive the right to receive specific notice of each such change or modification.

You are encouraged to periodically review this Privacy Policy to stay informed of updates. You will be deemed to have been made aware of, will be subject to, and will be deemed to have accepted the changes in any revised Privacy Policy by your continued use of our websites after the date such revised Privacy Policy is posted.

While this is a Privacy Policy, it is also compliant with the requirements of the General Data Protection Regulation (“GDPR”), ePrivacy, LGPD, CCPA, CalOPPA.

The policy was last updated 2 November, 2023.

Alpha Base Research Ltd is registered with the Information Commissioners’ Office (ICO) under the 1998 Data Protection Act, registration number C1103931.

Regarding Personal Identifiable Information, in most cases we will only ask for your name and email address, if you request to participate in market research with us or to be contacted about a product you expressed an interest in or to participate in market research. See also “Why are we collecting?” below.

If you are invited to participate in market research and you agree to participate, we will likely ask you for more information, which is covered below.

Examples of types of data we might collect:

• Personally identifiable information, such as your name, email address, and telephone number, and demographic information, such as your age, gender, address and interests, that you voluntarily give to us when you register with the website or when you choose to participate in various activities related to the website, such as participating in market research or signing up to newsletters or promotional emails. You are under no obligation to provide us with personal information of any kind, however your refusal to do so may prevent you from using certain features of the website and/or participating in market research (since it is integral market research that we have the ability to invite you to participate). You can withdraw consent at any time by completing this form. See “Your rights”, below.
  ‍
• Special category data: Some of the data that you provide us will fall within what data protection law describes as ‘sensitive’, or ‘special categories of personal data’, such as your racial or ethnic origin, political opinions, religious beliefs or information concerning your health or sexual orientation. We use this information in the same way we use all the other information we collect, but the law requires that we have your explicit consent to collect and use it. Each time we ask questions that fall into one of these categories, if you haven’t consented to our use of data in that category we’ll remind you that we need it. You will always have the option to skip these questions if you would prefer not to allow us to use that category of data. From the moment you withdraw your consent for any category we will make no further use of any data you have shared in that category when producing research or providing services to our clients, unless and until you choose to re-consent. You can withdraw consent at any time by completing this form. See “Your rights”, below.
  ‍
• All financial information is stored by our payment processor, [Paypal,] [Stripe,] [Particity] and you are encouraged to review their privacy policy and contact them directly for responses to your questions.

• Derivative Data: Information our servers automatically collect when you access our portfolio of sites, such as your IP address, your browser type, your operating system, your access times, and the pages you have viewed directly before and after accessing one of our websites.‍
  ‍
• Cookies: We may use cookies and other tracking technologies on the website to help customize the website and improve your experience. For full details of our Cookie Policy click here.

We do not knowingly solicit personal identifiable information from children under the age of 13. If you become aware of any data we have collected from children under age 13, please directly contact the AlphaBase Data Protection Officer.

AlphaBase will collect and process the personal information provided to us by you, which is your email address, telephone number and name, from the thealphabase.com website or one of our portfolio of websites. This information will be used for:

• Marketing purposes: To contact you regarding the product you have shown an interest in. We will only use your details to contact you about this promotion unless the email address you provided has been used to subscribe to additional promotions in the past.
  ‍
• Invite you to take part in research opportunities: if you register with AlphaBase and its portfolio of websites, it is integral to your participation that we are able to send you emails and notifications inviting you to participate in research projects.

If you have provided us with consent, the personal information you have provided will be passed to the client who is using AlphaBase's services or platform. This personal information will likely include your name, telephone number and email address. You will be advised at the time of submitting this data as to the purpose of us requesting it and it will only be used for this purpose. See also “How will we use your data" above. If you wish to withdraw your consent at anytime, you can do so: see "Your rights" below.

AlphaBase is the 'data controller' of this information. This means that AlphaBase decides what your personal information is used for and the ways in which it is processed.

We have a legitimate interest to process your personal information, such as name, telephone number and email address, to help our clients develop better products and services for end users. We consider that, on balance, this processing is not disproportionate to your rights and freedoms and any impact this processing may have on you.

We may also share your personal information in other specific circumstances. See also "Who might you share my data with?"

• Third-party service providers: We may share your information with third parties that perform services for us or on our behalf, including payment processing, data analysis, email delivery, hosting services, customer service, and marketing assistance.
  ‍
• Legal reasons: If we believe the release of information about you is necessary to respond to legal process, to investigate or remedy potential violations of our policies, or to protect the rights, property, and safety of others, we may share your information as permitted or required by any applicable law, rule, or regulation. This includes exchanging information with other entities for fraud protection and credit risk reduction.
  ‍
• Sale or bankruptcy: If we reorganise or sell all or a portion of our assets, undergo a merger, or are acquired by another entity, we may transfer your information to the successor entity. If we go out of business or enter bankruptcy, your information would be an asset transferred or acquired by a third party. You acknowledge that such transfers may occur and that the transferee may decline honour commitments we made in this Privacy Policy.

Most of the data we share is not personally identifiable, however in some cases, with you consent, we will share your name, telephone number and email address with one or more of the following:

Who we may share your personal data with:

In order to use your personal data in the ways described above, we may share it within AlphaBase, with trusted third parties who provide services to us, and in specific circumstances, with our clients (but only if you have specifically agreed to that). Here is some more information about the types of organisation and what we may share with them:

Our clients

While our business is built on providing clients with anonymised research insights, on specific circumstances our client may ask us to share your personal details, such as name, telephone number and email. For example, where you have signed up to participate in market research with our client or you have asked to be notified about when a new product or service from our client will become available. Whether you choose to participate or share this data is completely up to you. At the point where this data is collected from you, you will have been asked if you are happy for your data to be shared in this way. When participating in market research, you may be asked if it’s “ok” for the interview to be filmed. This is not a condition of taking part but an option we will discuss with you. You will also be advised as to what this video will be used for, what personal data is associated with it (such as your face, which is recognisable as you) and how long the video will be held for. You have a right to request a copy of the video recording and can withdraw your permission for the recording to take place or be used at any time.

If you wish to withdraw your consent at anytime, you can do so—see "Your rights."

Our service providers

We work with trusted service providers that carry out certain functions on our behalf so we can provide our services to you.

These organisations process data on our behalf. They only have access to the personal data that they absolutely need to provide the specific service to us, and in all cases we have contractual safeguards in place to ensure that they do not disclose or use it for any other purposes. In some cases, these organisations (for example our payment processors) may need to process your personal data for their own specific purposes, for example to ensure they are compliant with regulations or laws governing their own sectors. Our service providers fall within the following categories:

• Acquisition technology (helps us to attract people to AlphaBase)
• Providers of cash payments, gift cards and other incentives (make it possible to pay or reward people at the appropriate time)
• Data collection technology (enables us to securely collect data submitted by research participants and others)
• Research technology (allows us to provide interesting and engaging research opportunities)
• Cloud & physical data storage
• Data matching partners (that match our data to third-party data on our behalf)
• Web application firewall (protects web applications by filtering and monitoring HTTP traffic between a web application and the Internet)
• Communications platforms and technologies (enables us to communicate with our research participants and others)
• Online advertising (helps us to attract people to join AlphaBase)
• Sanctions checks (reduces the risk of money laundering, terrorist financing, corruption, and other financial crime arising from our activities)

Our acquisition partners

If you decide to register with an organisation to receive opportunities from companies like AlphaBase, that organisation will pass your name and contact information to us so we can contact you about an AlphaBase research study.

Other companies that sell data

As described above, we may purchase data from companies that sell certain types of data that is valuable to us. In some cases, we will pass personally identifiable information to these companies to enable them to match these data sets on our behalf, and pass that matched data back to us. As with our other service providers, we have contractual safeguards in place to ensure that these companies delete the data once the match has been completed and do not disclose or use the data for any other purpose.

Other organisations

These circumstances are unusual, but we may share personal data with other organisations if:

• We have to share your information to comply with legal or regulatory requirements (or we reasonably believe that we need to disclose your information for such purposes);
• we need to share personal data in order to establish, exercise or defend our legal rights, including with our legal and other professional advisors
• We restructure our business or if we buy or sell any business or assets we may share your data with the prospective buyer or seller all or substantially all of our company assets are acquired by another party, your data will be one of the transferred assets

We only retain information as long as is necessary in relation to the purpose for which it was gathered. For example, the personal identifiable information you provided when you registered, via one of our websites, for product updates or to take part in market research, is retained for no more than one year. In the event that your personal data has been shared with a third-party, such as if you participated in market research and had your depth interview filmed, we will have a data sharing agreement in place with that client to require them to hold the video for no more than one year. We may also only make such videos available to clients via streaming technology so that they do not have the ability to retain a copy of the video file.

If you wish to withdraw your consent at anytime, you can do so—see "Your rights."

We use administrative, technical, and physical security measures to help protect your personal information. While we have taken reasonable steps to secure the personal information you provide to us, please be aware that despite our efforts, no security measures are perfect or impenetrable, and no method of data transmission can be guaranteed against any interception or other type of misuse. Any information disclosed online is vulnerable to interception and misuse by unauthorised parties. Therefore, we cannot guarantee complete security if you provide personal information. As a result, as a matter of policy, we ask for and store the minimum of personal identifiable information necessary to deliver a service to our clients.

Transferring personal data outside the EEA

If you are based in the European Economic Area (“EEA”), UK or Switzerland, we take all steps possible to ensure that your personal data remains within those areas. However, in some cases we need to share data with other third parties that are in countries outside those areas. These countries may not have similar data protection laws and so they may not protect the use of your personal information to the same extent.

In these cases we put in place appropriate safeguards to make sure your personal data remains adequately protected. Specifically, we make use of one of the following:

• Standard contractual clauses: we use standard contractual clauses for the transfer of personal data to organisations outside the EEA and UK. These contractual commitments have been adopted by the European Commission and ensure adequate protection for personal data transferred to countries outside the EEA by binding recipients of personal data to certain data protection standards including obliging them to apply appropriate technical and security measures. We use standard contractual clauses when we transfer data to recipients that are not located in a country covered by an “adequacy decision” (see below). For example, if transferring data from UK, EEA or Switzerland to the US, we would need a Standard Contractual Clause since an Adequacy Decision between EEA and the US no longer exists.
  ‍

• Adequacy decisions: where the European Commission, or other relevant competent authority, has determined that a country outside the EEA, UK or Switzerland offers an adequate level of data protection, personal data may be sent to that third country without implementing any other safeguards mentioned above. AlphaBase may rely on adequacy decisions when transferring data to companies based in countries where such assurances have been given. For example, post-Brexit, there is an adequacy decision for data being transferred from the EEA to the UK.

You have certain rights in relation to the personal data that we hold about you, which are designed to give you more choice and control over your personal data. These rights are explained below.

UK and EEA

In the UK and EEA you have the following rights. For US rights, see below.

• The right to request access to personal data: You can request confirmation that we are processing your personal data, and a copy of the data we hold about you and related information (including when you gave us permission to use your data).
  ‍
• The right to request rectification of personal data: You can ask us to correct any inaccurate data about you and to complete any incomplete data that we hold about you.
  ‍
• The right to request erasure of personal data: You can request that we delete the personal data we hold about you. Please note that by asking us to delete your personal data you will no longer be able to participate research opportunities or to receive any product updates, you previously requested.
  ‍
• The right to withdraw consent: Whenever you have given us your consent to use your personal data, you have the right to change your mind at any time and withdraw that consent.
  ‍
• The right to request a restriction on processing of personal data: You can request that we restrict our use of your data to storage only, that we stop using it for all other purposes or that we retain data that was due for deletion.
  ‍
• The right to object to the processing of personal data: you can object to certain types of processing of your personal data in certain specific circumstances.
  ‍
• The right of data portability: Whenever you have given us your consent to use your personal data, you have the right to receive a copy of your personal data in a structured and machine-readable format and, where possible, have this sent to another organisation.
  ‍

United States

You can make the following requests with respect to your personal information. Depending on where you live and what you are asking us to do, we may or may not be obligated comply with your request, and/or the time required to complete a request may vary:

• Right to Know: You can request that we disclose to you the categories of personal information we collected about you, the categories of sources from which we collected the personal information, the categories of personal information we sold or disclosed, our business or commercial purpose for collecting and selling the personal information, the categories of third parties with whom we shared the personal information, over the past 12 months.
  ‍
• Right to Access: You can request that we provide you with a copy of the specific pieces of personal information we collected about you over the past 12 months.
  ‍
• Right of Deletion: You can request that we delete your personal information that we maintain about you, subject to certain exceptions.
  ‍
• Do Not Sell My Info: You can request that we not sell your personal information by completing the form below. For purposes of these rights, “sell” means the sale of your personal information to an outside party for monetary or other valuable consideration, subject to certain exceptions set forth in applicable law. Any opt-out of cookie-based tracking for advertising purposes is specific to the device, website, and browser you are using, and is deleted whenever you clear your browser’s cache. If you clear your browser’s cache you will need to resubmit your request.
  ‍

If you want to request access to undertake any of the above, you can make this request by filling out this form or by contacting help@thealphabase.com.

California Civil Code Section 1798.83, also known as the “Shine The Light” law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to the AlphaBase Data Protection Officer.

If you are under 18 years of age, reside in California, and have registered with AlphaBase for email marketing or to be a research participant, you have the right to request removal of unwanted data that you publicly post. To request removal of such data, please complete this form, and include the email address associated with your account and a statement that you reside in California. We will make sure the data is not publicly displayed on any of our websites, but please be aware that the data may not be completely or comprehensively removed from our systems. See “Right to be Forgotten” statement, below.

It is important to note that it is not possible to make public posts on any AlphaBase websites at this time. In circumstances where we run promotions on third-party platforms, such as Facebook Advertising, Google Ads or LinkedIn Ads, you will need to contact this third party directly to request removal of any public post.

Right to Be Forgotten

This is called the “right to erasure” or the "right to be forgotten". This right means you can ask for your personal information to be deleted. Sometimes we can delete your information, but other times it's not possible, like if the law tells us we can't. If that's the case, we'll consider if we can limit how it is used. If you want to request your information is deleted, you can find details of how to do this in "Your rights," above.

Market Research Participant

You may at any time review or change the information in your account or terminate your account by:

• Completing this form
• Contacting the AlphaBase Data Protection Officer

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, some information may be retained, as per the “Right to be Forgotten” statement, above.

Emails and Communications

If you no longer wish to receive correspondence, emails, or other communications from us, you may opt-out by:

• Completing this form
• Contacting the AlphaBase Data Protection Officer
• Clicking “unsubscribe” or “marketing preferences” in any correspondence we send you

If you no longer wish to receive correspondence, emails, or other communications from third parties, you are responsible for contacting the third party directly.

Behavioural Advertising

As described above, we use Google and Facebook advertising platforms, which use your Personal Information to provide AlphaBase with the means of delivering targeted advertisements or marketing communications we believe may be of interest to you. For more information about how targeted advertising works, you can visit the Network Advertising Initiative’s (“NAI”) educational page. You can opt out of targeted advertising by visiting the pages below.

• Facebook
• Google

We do not envisage that any decisions that will have a legal or other significant effect on you will be taken about you using purely automated means, however we will update this notice if this position changes and notify you of those changes, by updating the “Last Updated” date of this Privacy Policy.

In order to conduct our work and enable you to participate in market research with us, we may use platforms provided by third parties. These sub-processors process data that you input into our services, which may include personal data. We’ve set out some information on who these sub-processors are and what services they provide here.

Amazon Web Services

Cloud infrastructure service provider. 410 Terry Avenue North Seattle, WA 98109-5210, United States.

Facebook

Advertising platform. Facebook Headquarters 1 Hacker Way Menlo Park, CA 94025.

Google

Advertising platform, analytics provider, video calling platform and cloud infrastructure service provider. 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States.

Microsoft

Advertising platform and cloud services provider. 13031 West Jefferson Boulevard, Suite 200 Los Angeles, CA.

Pollfish

Online survey platform. 205 E 42nd St, New York, NY 10017, USA.

Stripe

Invoicing, credit card processing, and billing. 354 Oyster Point Blvd, South San Francisco, CA 94080, United States.

Testing Time

Research platform. TestingTime AG, Weststrasse 50, 8003 Zurich, Switzerland.

Vimeo

Video hosting platform. 555 W 18th St, New York City, New York, 10011, United States.

Webflow

Website platform. 398 11th Street, Floor 2, San Francisco, CA 94103.

For more detail on how sub-processing works, see our Cookie Policy or the relevant section relating to market research activities, above.

‍