Privacy policy

1. Introduction

ShopperFacts (ShopperFact, Inc., "we", "our" or "us") is committed to protecting the privacy and security of personal information. This Privacy Policy describes how we collect, use, disclose and safeguard information when you use our shopper research services, virtual shopping environments and related platforms, or visit this website.

This policy applies to our clients, partners, research participants who take part in studies run on our platforms, and visitors to this website.

2. Information we collect

Information provided by clients:

• Company information and business contact details
• Project specifications and requirements
• User credentials for platform access
• Billing information

Research participant data we process on behalf of clients. Our clients recruit participants and collect survey and demographic data on their own platforms. When a participant enters one of our virtual shopping environments we receive only a pseudonymous respondent identifier passed by the client's survey platform. The behavioural data we generate (navigation, product views and interactions, selections and purchases, dwell times) is linked solely to that identifier. We do not collect names, contact details or other directly identifying information from research participants, and we act as a data processor for this data.

Technical information: IP address and device identifiers, browser type and version, access times and dates, and platform interaction and performance logs.

Website contact form: if you contact us through this website we collect your name, email address and the content of your message, and use them exclusively to answer your enquiry.

3. How we use information

We use the information we collect to:

• Deliver shopper research and insights to our clients
• Operate, secure and improve our virtual shopping platforms
• Generate reports and performance metrics for the project they belong to
• Communicate with clients and respond to enquiries
• Comply with legal obligations

We do not use research participant data for any purpose other than delivering the agreed project outputs.

4. Legal basis for processing

We process personal information on the basis of:

• Contract performance: to fulfil our service agreements with clients
• Legitimate interests: to operate, secure and improve our services
• Legal obligations: to comply with applicable law
• Consent: where it has been explicitly provided, including the consent our clients obtain from research participants

5. Information sharing and disclosure

We never sell, rent or trade personal information.

We share information only:

• With the client that commissioned the project, as part of its deliverables
• With the infrastructure providers that host and run our services: Amazon Web Services (hosting, database and content delivery, us-west-2 region) and Google Workspace (corporate identity and email). Both operate under their standard data processing terms and hold independent security certifications, including ISO 27001 and SOC 2
• With our contracted information security specialists, for monitoring and incident response
• To comply with legal obligations or protect rights, safety or property
• In connection with a business transfer or acquisition

We may share aggregated, anonymised analytics that cannot identify any individual.

6. Data security

Our Information Security Management System is aligned with ISO 27001:2015 and has been in place since December 2021; the formal certification audit is planned for 2027. Measures include:

• Encryption of data in transit (TLS) and at rest
• Role-based access control with Single Sign-On and Multi-Factor Authentication for all personnel
• Client-level data segregation
• Endpoint protection on all company devices
• Continuous security monitoring and periodic penetration testing by contracted specialists
• A documented Incident Response Plan. Affected clients are notified within 72 hours of a confirmed incident involving their data, and within 24 hours for critical incidents

7. Data retention

We retain information only as long as necessary to fulfil the purposes in this policy, comply with legal and regulatory requirements, and resolve disputes. Project data is kept for the duration of the engagement and for the period agreed with the client, after which it is securely deleted from production systems, backups and storage. Technical logs are kept for up to 12 months and website contact enquiries for as long as needed to answer them.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict its processing, to withdraw consent, and to lodge a complaint with a supervisory authority.

Research participants should direct requests to the organisation that invited them to the study, which holds their identifying data; we act on that organisation's instruction to locate, correct or delete the records tied to the respondent identifier. For anything else, contact us at info@shopperfacts.com.

9. International data transfers

Our production infrastructure operates in the AWS us-west-2 region (United States). Where personal data is transferred across borders we rely on appropriate safeguards, including standard contractual clauses and the technical and organisational measures required by applicable law.

10. Children's privacy

Our services are not directed to individuals under 18 and we do not knowingly collect personal information from children.

11. Cookies

This website and our platforms use only essential cookies, for authentication, security and platform functionality. We do not use advertising or tracking cookies.

12. Third-party links

Our website and platforms may link to third-party services. We are not responsible for their privacy practices.

13. Changes to this policy

We may update this policy to reflect changes in our practices or legal requirements. Material changes are notified through platform notices or email to registered users, and the effective date above is updated.

14. Data protection contact

Alfredo Cruz Morales, Head of Information Security, is responsible for data protection matters. Rodolfo Cavallari Cuellar is Managing Director.

Email: info@shopperfacts.com

15. Compliance

This policy is designed to comply with the Mexican Federal Law on Protection of Personal Data Held by Private Parties and to support our clients' obligations under the EU General Data Protection Regulation, the California Consumer Privacy Act and comparable laws in the jurisdictions where we operate (Mexico, the United States and Spain).

16. Dispute resolution

We are committed to resolving privacy concerns. Please contact us first at info@shopperfacts.com. If you are not satisfied, you may contact the relevant data protection authority.