Data (PII) Policy

Where absolutely needed, Gradient will collect personally identifiable information (PII) from survey respondents to support analytical needs. This comes with a great deal of responsibility to keep these data safe, and this part of our IT security and Data Handling policy sets out the roles and responsibilities when dealing with sensitive data.

Goals

1. Data and Controls: This document outlines the data we hold, and the controls we have in place to keep that data safe.

2. Access controls: This document includes policies to be followed when giving access to sensitive data, reviewing access to that data, and procedures for each.

This policy is concerned with our handling of the following data:

• Email address
• Standard demographics such as (but not limited to); age, gender, ZIP code, race, ethnicity
• IP address
• Device info
• Name (first and last)
• Date of Birth
• Address
• One or many forms of government issued identification

This document is to be used in conjunction with the Gradient IT Policy and included Data Protection Policy, which lays out the acceptable storage and communication methods for all data being used within the Gradient business. There is no distinction between Personally Identifying Information and other business data in this regard, and all data should be handled sensitively. For the avoidance of doubt, please refer to the Gradient IT Policy for all further details.

For the avoidance of doubt, the default data classification for all data used within, or connected to the business, clients, users or customers of Gradient is Commercial In Confidence, which generally means individuals or businesses share information with the company in confidence and Gradient is obligated not to disclose or use that information without consent.

Access to all data within the Gradient business is subject to a policy of Least Privileged Access. This means that staff, contractors, and other processors of data connected to the business are granted the least amount of access possible to perform their work.

Put simply, people who do not have a business justification to access data, are not granted access to the data.

Only staff performing the following job roles have access to personally identifiable information within the Gradient business;

• Head of Research
• Head of Product
• Research Manager
• Data Scientist
• Project-based contractors/consultants, as assigned and approved by Project Managers