Privacy Policy for Participants in Market Research Studies

The specific information provided for each study may supplement or modify this Policy. When a study involves specific processing activities, an additional clause will be provided before participation.

• Entity: AUTENTIC LABS SL
• Tax ID: B24842650
• Registered office: Carrer de Llull, 63 2 6. 08005 Barcelona SPAIN
• Email: hola@autentic.ai
• Website: autentic.ai

Hereinafter, "AUTENTIC".

The role of the Research Entity may vary depending on the study.

3.1. Autentic as controller

The Research Entity will act as controller when it determines the purposes and essential means of processing by itself, for example to manage its participant panel, select people for studies, control quality and prevent fraud, manage incentives, maintain participation records, and conduct its own research.

3.2. Autentic as processor

In some studies, the client will determine the purpose and essential means and the Research Entity will process the data according to the client's instructions.

In that case, the client will be the controller and its identity will be communicated. Autentic will act in accordance with the data processing agreement and the documented instructions of the client.

3.3. Joint controllership

Autentic and the client may be joint controllers when they jointly determine the purposes and essential means of a processing activity.

When there is joint controllership, the identity of the joint controllers will be communicated and their responsibilities will be allocated through an agreement.

3.4. Independent controllers

When Autentic and the client process data for their own purposes and independently decide how to do so, each will act as an independent controller.

The mere communication of data between the parties does not by itself imply joint controllership. The specific information for each study must correctly identify the applicable model.

We may process data of current or potential participants, panel members, and people who appear incidentally in materials provided by participants.

Depending on the study, we may process the following categories:

• Identification data: Name, surname, alias, internal identifier, signature, identification document when strictly necessary, photograph, image, or voice.
• Contact data: Email address, telephone number, postal address, country, city, and preferred communication channel.
• Sociodemographic data: Age, date or year of birth, gender, household composition, family situation, education level, employment status, profession, sector, income range, or other variables needed to segment the sample.
• Consumption and preference data: Purchases, brands used, consumption habits, frequency of use, opinions, ratings, interests, expectations, purchase intention, and experience with products or services.
• Responses and content: Responses and reactions.
• Technical data: IP address, device or session identifiers, browser, operating system, language, time zone, connection date and time, activity logs, and technical data needed for security or fraud prevention.
• Professional data: Company, position, duties, experience, sector, organization size, professional contact information, and opinions expressed in a professional capacity.
• Economic data: Data needed to pay incentives or tax data, when necessary.
• Recordings: Image, voice, body language, interventions, and transcripts of interviews or sessions.
• Special categories of data: Some studies may involve information about health or disability, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation, biometric data intended to uniquely identify a person, and genetic data. These categories will only be processed when necessary, specific information has been provided, and there is a valid exception under Article 9 of the GDPR, such as explicit consent where applicable. Acceptance of this Policy generally must not be understood as explicit consent to process special categories of data.

Data may be obtained directly from the participant, from a client that has provided a legitimate list of potential participants, or from companies that provide panelists for this participation.

When data has not been obtained directly from the data subject, the information required by applicable law will be provided within the applicable time limits, unless a legal exception applies.

• Managing participation in a study: processing registration, verifying requirements, organizing sessions, sending reminders, and managing participation. The legal basis is performance of the participation relationship requested or accepted by the data subject and, where applicable, their consent.
• Conducting surveys, interviews, and analysis: collecting opinions and analyzing responses to prepare research results. The legal basis is performance of the agreed participation, consent when necessary, and legitimate interest in conducting lawful research, depending on the characteristics of the study.
• Recording and transcribing sessions: faithfully preserving interventions, carrying out qualitative analysis, preparing transcripts, and enabling their review. The legal basis is the participant's consent or, in specific contexts, performance of participation when recording is essential and has been clearly disclosed.

Promotional or advertising use of image or voice will require separate authorization.

• Preparing aggregated reports: preparing analyses, conclusions, statistics, presentations, and reports for Autentic or the client. The legal basis is performance of the study and legitimate interest in obtaining research results.
• Selecting and segmenting participants: checking whether a person meets the quotas or methodological profiles of a study. The legal basis is the application of measures requested by the person to participate, consent where applicable, and legitimate interest in ensuring methodological validity.
• Managing panels and communities: maintaining a database of people interested in participating, updating profiles, and sending compatible invitations. The legal basis is the relationship between the parties insofar as the person wishes to be a panelist. Leaving the panel may be requested at any time.
• Managing incentives and payments: checking entitlement to the incentive, making payment, handling incidents, and complying with accounting and tax obligations. The legal basis is performance of the participation relationship and compliance with legal obligations.

When processing is based on consent, participation will be voluntary. Consent must be given through an affirmative action and optional purposes will be presented separately without using pre-ticked boxes. Withdrawal will be as easy as giving consent.

Withdrawal may prevent continued participation in a study when the processing is essential, for example if an interview must be recorded in order to analyze it and there is no reasonable alternative.

Profiles may be created to select participants, classify responses, and identify consumption or opinion patterns.

As a general rule, these profiles will not produce legal effects or significantly affect the person.

When there is a decision based solely on automated processing that produces such effects, specific information will be provided about its logic, significance, and consequences, as well as the applicable safeguards.

Automated systems may be used to detect serious inconsistencies with the terms and conditions, as well as to verify participation from locations or devices incompatible with the conditions of the study.

When an automated decision may significantly affect payment of an incentive or permanent exclusion, the affected person may request human review, express their point of view, and challenge the decision where the GDPR grants them such rights.

The data may be communicated or made available to:

• Clients or sponsors of the study. The identity of the client may initially remain confidential when revealing it could bias the research, provided that the information is supplied at a later point.
• Authorities: Data may be communicated to courts, law enforcement authorities, tax administrations, data protection authorities, or other bodies when there is a legal obligation or valid request.

Some providers, clients, or group companies may be located outside the European Economic Area.

When an international transfer takes place, one of the mechanisms recognized by the GDPR will be used. When necessary, the circumstances of the transfer will be assessed and supplementary measures will be adopted.

Data will be retained for the time necessary for each purpose.

Data obtained during the selection process for people who ultimately do not participate will be retained for a maximum of six months from the end of the selection process. After that period, the data will be deleted or anonymized, unless the person has consented to joining a panel or receiving new invitations.

Identification and contact data of people who participate in a one-off study will be retained during performance of the study and, as a general rule, for a maximum of six months from its completion.

Recordings of interviews, focus groups, or sessions will be retained for the period strictly necessary for their transcription, analysis, and validation; therefore, they will be retained for a maximum period of six months from the end of the study.

Data of people registered in a research panel or community will be retained while they remain active and there is a valid legal basis to keep their profile.

Retention periods must not be extended generally or indefinitely without justification.

Technical and organizational measures appropriate to the risk will be adopted.

No system is absolutely invulnerable. In the event of a security breach, the assessment, documentation, and notification procedures provided for by the GDPR will be applied.

• Access: the data subject has the right to know whether the controller processes personal data concerning them and, if so, has the right to access that data and obtain information about the processing carried out.
• Rectification: This is linked to the inaccuracy or incompleteness of the data. The data subject has the right to rectify inaccurate personal data and have incomplete personal data completed.
• Erasure: The data subject has the right to obtain erasure of their personal data ("right to be forgotten") when the data is no longer necessary for the purpose for which it was collected, consent on which the processing was based is withdrawn, the data subject objects to the processing, the data has been unlawfully processed, it must be erased to comply with a legal obligation, or it was obtained in relation to the offer of information society services directed at minors.
• Restriction of processing: this is a right of the data subject consisting of marking stored personal data for the purpose of limiting its future processing. Restriction of processing means that, at the request of the data subject, the indicated personal data will no longer be processed.
• Objection: the data subject has the right to object to the processing of their data when it is based on certain specific grounds and a reason related to their personal situation is invoked.
• Data portability: the data subject has the right to receive the personal data provided to the controller in a structured, commonly used, machine-readable format, if the processing is based on consent or on a contract or when the processing is carried out by automated means.
• Not to be subject to individual automated decisions: the data subject has the right not to be subject to a decision based on automated processing of their data, including profiling, that produces legal effects concerning them or similarly significantly affects them.

These requests may be sent to the postal address indicated above or to dpd@autentic.ai.

When a person considers that the processing infringes applicable law, they may contact Autentic or the Data Protection Officer at dpd@autentic.ai.

They may also file a complaint with the Spanish Data Protection Agency.

Surveys or platforms may use cookies, local storage, pixels, session identifiers, or other technologies. On the public website we use PostHog (EU region) to analyze page visits, button clicks and navigation recordings. The identifier is stored for the browser session. In Autentic People, the house number links registration to the visitor journey. We hide form fields, the displayed email and response topics; we do not capture audio, network request content or the personalized house scene. We respect browser Do Not Track and Global Privacy Control signals.

Detailed information must be included in a separate Cookie Policy where applicable.

People registered in panels may be invited to periodically update their profile.

Autentic may delete or limit profiles when they are inactive, duplicated, inaccurate, fraudulent, have requested removal, and are no longer necessary.

This Policy may be modified due to legal, technological, methodological, or organizational changes. The update date will be indicated at the beginning.

When a change substantially affects an existing processing activity, it will be communicated by appropriate means and new consent will be requested when necessary.

For any question related to this Policy: