We provide you with customer support which requires us to access your information and Personal Data to assist with, for instance, technical troubleshooting.

We internally use your data, for the following limited purposes:

1.2.1 To monitor, maintain, and improve our services and features.

We internally perform statistical and other analysis on information and Personal Data we collect (including usage data, and question and response data) to:

• benchmark across industry vertically;
• analyze and measure user behavior and trends in order to understand how people use our Services, and;
• to monitor, troubleshoot and improve our Services.

When we do this, no individual survey respondents will be identified.

1.2.2 To prevent potentially illegal activities.

1.2.3  To develop aggregated benchmarks

We may use your data and the client organization metadata in aggregated form for the development of benchmarks. We may look at statistics like averages and distributions of responses belonging to an organizational level, such as business unit, region and age and tenure group.

When we do this, no individual diagnostic respondents will be identified.

1.2.4 To respond to legal requests and prevent harm.

If we receive a subpoena or other legal request, we may need to inspect the data we   hold to determine how to respond.

We use third-party service providers who help us to provide you with our services. We give relevant persons working for the providers access to your information, but only to the extent necessary for them to perform their services for us. Examples of service providers include online survey vendor, hosting services, email service providers, and other IT Solution Providers.

No individuals can reasonably be identified or linked to any part of the information we share with third parties to improve or promote our services.

We may disclose your information as required or permitted by law, or when we believe that disclosure is necessary to protect our rights, and/or to comply with a judicial proceeding,   court order, subpoena, or other legal process served on us.

If you want to access, update, or delete anything in your master data or responses, you may request access to and correction of the information and Personal Data we hold about you by contacting customer support on dataprivacy@innovisor.com

You can obtain the following from Innovisor:

• Confirmation that your data is being processed
• Access to your personal data; and,
• Other supplementary information

This information will be provided to you without delay and at the latest within one month of the request receipt.

In the message to our customer support you should provide us with information the questions before a request can be processed:

1. Are you an EU resident, an EU company, or an EU organization?
2. What company do you work for?
3. What are you requesting? Right to be informed, right of access, right to rectification, right to erasure, right to restrict processing, right to data portability, and right to object

4.1.1 Background verification.

All employment candidates, contractors and third parties are subject to background   verification. Employees sign both a nondisclosure agreement and a statement of  understanding after the Information Security Awareness Training.

4.1.2 Information security awareness training.

All employees receive information security awareness training once a year. The training is around understanding the company’s policies and the handling of information and Personal Data in a secure way.

4.2.1 IT Governance framework.

We conform, adhere, and implement the general requirements of ISO 27002-2013, and SOC 2 Type 1 and 2

4.2.2 IT Equipment.

All employees are issued Innovisor-owned equipment, and all Innovisor-owned equipment is managed by the office IT Information Security Manager. Per company’s policy, employees cannot store your information and Personal Data on removable media. If the Innovisor-owned equipment is being disposed, the IT Information Security Manager removes data by considering the following steps:

• overwrite data on the device (e.g., overwrite a device with binary zeroes or random data under Unix), and;
• re-install an operating system on the drive.

4.2.3  Antivirus.

We use antivirus software on endpoints and servers that store, transmit or process your information and Personal Data. The antivirus signature files are kept up to date and system and security patches are applied in a timely manner to the endpoints and servers that store, transmit and process the personal information and data.

4.2.4 Timeout period on applications.

We institute an inactivity period on applications and systems that are used to store, transmit, process or access your personal information and data.

4.2.5 Third-Party Service Providers

We use third-party service providers which are all cloud-hosted. Their data centers are located in the European Union and all communications are sent over SL/TLS connections. Secure Sockets Layer (SSL) and Transport Layer Security technology protect communications by using both server authentication and data encryption. We have adopted storage and transmission practices of the most secure institutions in the world by using 256-bit AES encryption to encode data during storage and transmission. This ensures that information and personal data in transit are safe, secure, and available to intended recipients.

4.2.6 Passwords

We impose a minimum password length and complexity on any of the SaaS vendors and IT equipment. Passwords must be:

• at least 8 characters in length;
• not be equal to current and previous passwords;
• not be a single word that appears in the dictionary, and;
• composed only of characters in the Roman alphabet, numbers, or symbols on the US keyboard.

The Innovisor password policy also mandates a new password after three months.

After ten failed login attempts, the user account will be locked out and the user will be requested to contact the IT Information Security Manager to re-activate the account.

We may modify this Policy at any time to make sure your information and Personal Data are protected anytime. If we do so, we will provide you with additional, prominent notice as is appropriate under the circumstances.

Latest update: 9 January 2024