Privacy policy

This privacy notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) – or equivalent provision under applicable data protection laws – and aims to transparently describe the methods and purposes of the processing of personal data (or personally identifiable information, PII) carried out within the scope of the activities and services offered by HumanTruths, in order to ensure processing that complies with the principles of fairness, lawfulness and transparency, taking into account the specific circumstances and context in which personal data are processed.

1. Contact details

HumanTruths, Inc. (hereinafter “HumanTruths”), with registered office at 9 Wiley Road, Belmont, MA 02478, USA, can be contacted at the following e-mail address: admin@humantruths.ai.

2. Data processing roles

With regard to personal data processing activities connected with the provision of services, HumanTruths may operate either as Data Controller or as Data Processor, depending on the specific processing activity carried out and/or the relevant operational context.

1) Data Processor (Client acting as Data Controller)

For the majority data processing activities, HumanTruths acts as Data Processor, operating on behalf of the Client, who determines the purposes and means of the processing and acts as Data Controller pursuant to Article 4 GDPR.
In this context, the personal data processed by HumanTruths consist of data provided or otherwise made available by the Client, which the Client has collected or obtained in its capacity as Data Controller, including, for example and without limitation, data originating from social media campaigns, publicly available or lawfully accessible sources, databases or other data collection initiatives conducted by the Client in compliance with applicable law.

In such cases, HumanTruths processes personal data:

• on behalf of the Client, exclusively based on documented instructions received, acting as Data Processor pursuant to Article 28 GDPR under a specific contractual agreement;
• solely for the purpose of fulfilling its contractual obligations, properly performing the contract, and providing the requested services in accordance with the Client’s instructions, without independently determining the purposes or means of the processing.

Data subjects shall primarily exercise their rights against the Data Controller (Client). HumanTruths will cooperate with the Data Controller, within the scope of its responsibilities and in accordance with applicable law, in handling such requests.

2) Data Controller

HumanTruths acts as Data Controller when it independently determines the purposes and means of processing personal data, for example in order to:

• directly provide its services to data subjects;
• manage contractual and administrative relationships with clients;
• perform administrative, accounting and legal activities;
• ensure security, monitoring, and improvement of services provided;
• carry out institutional, informational, promotional, and marketing activities.

This notice applies to all data subjects whose personal data are processed by HumanTruths, including, for example:

• users and client representatives;
• participants in research activities (interviews, surveys, studies);
• individuals whose data are processed indirectly within research projects.

Unless otherwise specified, the categories of data processed, security measures adopted, and rights granted to data subjects, apply uniformly to all processing activities, regardless of whether HumanTruths acts as Data Controller or Data Processor.

3. Purposes and legal basis of processing

In connection with the provision of its services and the performance of its activities, HumanTruths may process the personal data of Data Subjects for the following purposes, in accordance with Articles 5 and 6 of Regulation (EU) 2016/679.

1) Contractual, administrative, operational and security purposes

• management of contractual and administrative relationships with clients;
• performance of contractual obligations and management of the contractual relationship with the Client, including compliance with legal, accounting, tax, and administrative obligations;
• provision of the services offered, management of the HumanTruths platform, configuration of settings, technical support, and system security.

Legal basis for processing (Article 6(1)(b), (c), and (f) GDPR, where applicable, or equivalent legal bases under applicable data protection laws):

• necessity for the performance of a contract to which the Data Subject or the Client is a party or for the implementation of pre-contractual measures requested by them;
• compliance with legal, regulatory, or administrative obligations to which HumanTruths is subject;
• legitimate interest of HumanTruths in ensuring system security, preventing misuse, and guaranteeing the proper functioning of the platform.

2) Research activities and analysis of collected data

• conduction of qualitative and quantitative research activities;
• collection and pseudonymization or anonymization of data;
• analysis and processing of behavioral data, opinions, responses, and feedback;
• aggregation and structuring of data;
• generation of insights and research results for clients, primarily in aggregated form and not attributable to individual Data Subjects.

Legal basis for processing (Article 6(1)(b), (f), and (a) GDPR, where applicable, or equivalent legal bases under applicable law):

• necessity for the performance of the contract with the Client and the provision of the requested research services;
• legitimate interest in conducting research, analysis, and service improvement activities, while safeguarding the rights and freedoms of Data Subjects;
• explicit consent of the Data Subject, where required by applicable law or by the data collection methods.

It is specified that the analysis activities carried out by HumanTruths do not involve fully automated decision-making processes within the meaning of Article 22 GDPR, nor do they produce legal effects or similarly significant adverse impacts on Data Subjects.

3) Service communications

• sending of technical, operational, and informational communications necessary for the use of the services provided by HumanTruths (e.g., technical updates, changes to functionalities, security notices). Such communications may be sent via e-mail, telephone, other automated contact tools, or other contact channels provided directly by the Data Subject or indirectly through the Client.

Legal basis for processing (Article 6(1)(b) and (f) GDPR, where applicable, or equivalent legal bases under applicable law):

• necessity to provide essential information for the use of the services and the management of the contractual relationship;
• legitimate interest in ensuring service continuity, security, and quality.

4) Informational, recruiting or promotional activities

• sending informational or recruiting communications via e-mail, telephone and/or other automated contact tools (e.g. social media, etc.) regarding opportunities for Data Subjects to participate in research activities, studies, or projects carried out by HumanTruths, within the limits and in the manner permitted by law;
• sending commercial offers relating to services or products not directly related to those provided by HumanTruths, via e-mail, telephone, or other automated contact tools (e.g. social media, etc.) provided directly or indirectly by the Data Subject through the Client.

Legal basis for processing (Article 6(1)(f) and (a) GDPR, where applicable, and equivalent provisions on electronic communications and marketing):

• legitimate interest in informing Data Subjects about opportunities to participate in research and studies, within the limits permitted by law;
• free, specific, and informed consent of the Data Subject for the sending of promotional and commercial communications not strictly related to services already provided.

5) Disclosure of data to third parties and additional recipients

Personal data processed by HumanTruths may be disclosed, in compliance with the purposes and legal bases outlined above, to:

• service providers supporting the operation of the platform and the performance of the contract (e.g., IT service providers, cloud and hosting providers, technical support, communication and mailing tools);
• commercial partners and third parties directly involved in research activities and shared projects, solely to the extent necessary for the performance of the assigned activities and in accordance with the instructions of the Data Controller, subject to the implementation of appropriate technical and organizational security measures;
• public authorities and competent bodies, where required by law or by judicial or administrative orders.

Legal basis for processing (Article 6(1)(b), (c), (f), and (a) GDPR, where applicable, or equivalent legal bases under applicable data protection laws):

• necessity for the performance of a contract to which the Data Subject or the Client is a party, or for the implementation of pre-contractual measures;
• compliance with legal obligations to which HumanTruths is subject;
• legitimate interest of HumanTruths and/or the Data Controller in ensuring the proper performance of services, business continuity, security, and coordination with third-party service providers, provided that such interests do not override the rights and freedoms of the Data Subject;
• explicit consent of the Data Subject, where required by law, in particular for disclosures not strictly necessary for contractual or legal purposes or for promotional activities.

Important note: personal data shall not be transferred to third parties for promotional purposes without the prior explicit consent of the Data Subject, except where permitted by law or where such data have been pseudonymized or anonymized.

Failure to provide consent will prevent the Data Controller from pursuing only those purposes for which such legal basis is required. The Data Subject has the right to withdraw consent at any time and to object to the processing.

4. Categories of personal data processed

Depending on the context, necessity, and role assumed by HumanTruths, and limited to what is strictly necessary, the following categories of personal data may be collected and processed:

• identification and contact data: first name, last name, e-mail address, telephone number, date of birth, place and province of birth, place, province, and address of residence;
• behavioral, research, and content data (e.g., questionnaire responses, interviews, opinions, feedback), within the scope of project and/or contractual purposes;
• service usage data and interactions with the platform;
• administrative, tax, and accounting data necessary for contract performance and legal compliance.

Data are processed in accordance with applicable data protection laws and using appropriate technical and organizational measures.

Special categories of personal data (Article 9 GDPR) are processed only where strictly necessary, in compliance with the safeguards provided by law and, where required, on the basis of explicit consent. Special categories of personal data that may be processed are:

• health data (such as vaccination history, side effects of medications, therapy adherence)
• gender and/or sexual orientation;
• racial and/or ethnic origin;
• political opinions;
• religious and/or philosophical belief.

5. Methods of processing

Personal data are processed using IT tools, through manual and electronic means, in compliance with the principles of lawfulness, fairness, transparency, data minimization, accuracy, storage limitation, and security.

Personal data are processed by HumanTruths and/or by expressly authorized persons or entities appointed as authorized personnel, Data Processors, or Sub-processors (including, by way of example, employees, collaborators, and suppliers), acting on the basis of documented instructions and subject to confidentiality obligations.

HumanTruths adopts appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or unlawful disclosure, in accordance with recognized security standards and applicable law (Article 32 GDPR, where applicable).

6. Data retention

Personal data are retained for no longer than is strictly necessary to achieve the purposes for which they were collected and processed and, in any case for a maximum period of 10 years.

With respect to contractual and research-related purposes, contact data (e.g. e-mails, telephone numbers) are retained for a maximum period of 10 years from the termination of the contractual relationship between the Client and the Data Controller.

With regard to processing activities carried out for so-called “soft spam” purposes based on legitimate interest, data shall be processed unless the Data Subject objects to such processing and requests erasure.

With regard to processing based on consent, data shall be processed for two (2) years from the date on which consent is provided by the Data Subject, unless the Data Subject objects to the processing or withdraws consent.

Upon expiration of these retention periods, data shall be anonymized or erased, unless further retention is required to comply with legal obligations and/or to establish, exercise, or defend legal claims.

7. Recipients or categories of recipients and scope of data disclosure

Processing activities related to the services offered by HumanTruths take place at the Company’s premises and through its IT systems. Personal data are not disseminated and are processed solely for the purposes for which they were collected. They may, however, be disclosed, within the scope of the indicated purposes and applicable legal bases, to the following categories of recipients:

i) HumanTruths personnel, including employees and collaborators involved in the relevant processing activities, formally authorized in writing;

ii) third parties acting as independent controllers or appointed as Data Processors or Sub-processors, with whom specific confidentiality agreements are executed, including, by way of example, legal and professional consultants, law firms, entities involved in the pursuit of the described purposes, service providers necessary for business operations, and – subject to the Data Subject’s consent – companies to which personal data may be transferred for marketing purposes.

An updated list of Data Processors and other recipients is available at HumanTruths and may be consulted upon request.

8. Data transfers

Personal data processed by HumanTruths are stored and processed through IT infrastructures and servers located in the United States. Where operational, technological, or security needs require, HumanTruths reserves the right to transfer servers and/or data abroad. In such cases, HumanTruths ensures that international data transfers are carried out in compliance with applicable laws and in accordance with recognized data protection principles, standards, and best practices, by adopting appropriate technical, organizational, and contractual safeguards to ensure a level of protection essentially equivalent to that provided under the applicable laws of the country of origin.

Transfers relating to Data Subjects located in the European Union:

For Data Subjects residing or located in the European Economic Area (EEA), HumanTruths further ensures that, where cloud providers, service providers, or platforms established outside the EEA are used, any processing of personal data by such recipients is carried out in compliance with applicable data protection and privacy laws.

Transfers of personal data are performed subject to appropriate safeguards, including adequacy decisions adopted by the European Commission, Binding Corporate Rules, Standard Contractual Clauses approved by the European Commission, or other lawful transfer mechanisms and safeguards as provided for under the GDPR. In the absence of such safeguards, transfers will be carried out only with the explicit consent of the Data Subject.

In all cases, data transfers are carried out in compliance with the principles of necessity, proportionality, and data minimization.

9. Data subject rights

By contacting HumanTruths at the e-mail address admin@humantruths.ai, Data Subjects may exercise the rights provided by applicable law (Article 13 GDPR and Articles 15-16-17-18-20-21-22 GDPR, or equivalent provision under applicable data protection laws). In particular, Data Subjects have the right to:

• obtain confirmation as to whether or not personal data concerning them are being processed and access such data in an intelligible form;
• obtain rectification or completion of inaccurate or incomplete data and restriction of processing in the cases provided for by the applicable law;
• obtain erasure of personal data in the cases provided for by the applicable law;
• object at any time, on grounds relating to their particular situation, to processing based on the applicable law, including processing for direct marketing purposes and related profiling;
• receive the personal data provided to HumanTruths in a structured, commonly used, and machine-readable format and, where technically feasible, transmit such data to another controller without hindrance;
• withdraw consent at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal, where applicable;
• lodge a complaint with the competent supervisory authority;
• obtain confirmation that erasure, rectification, or restriction operations have been notified to recipients to whom the data have been disclosed, unless this proves impossible or involves a disproportionate effort;
• not be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects them.