Privacy Policy

01 Introduction

This Privacy Policy explains how TRAXE Forms handles personal information in connection with its websites, accounts, applications, data collection tools, collaboration environments, analytical services, artificial intelligence functionality, integrations, and related services.

We recognize the importance of privacy, confidentiality, transparency, accountability, and responsible data governance.

This Policy describes the categories of information involved, the purposes of processing, how information may be shared, the rights available to individuals, and the safeguards and procedures applicable to personal information.

The treatment of personal information depends on the relationship between TRAXE Forms, its customers, and the individuals whose information is processed.

02 Scope

This Policy applies to personal information processed in connection with:

• Visits to TRAXE Forms websites.
• Account registration and authentication.
• Customer and organizational workspaces.
• Form creation, publication, and response collection.
• Surveys, applications, registrations, assessments, and research activities.
• Dataset imports, exports, processing, and reporting.
• Statistical analysis and research tools.
• AI-assisted features.
• Collaboration and project administration.
• Billing, support, communications, and security operations.
• Connected applications and service integrations.

Additional notices may apply to particular forms, research studies, customer agreements, geographic regions, or specialized services.

03 Roles and Responsibilities

3.1 TRAXE Forms as a Data Controller

TRAXE Forms may act as a data controller, or equivalent legally designated party, when determining the purposes and means of processing personal information for its own business operations.

Examples include account administration, billing, service communications, security, support, contractual management, and certain website operations.

3.2 TRAXE Forms as a Data Processor

When customers use TRAXE Forms to collect, store, transform, analyze, or manage information about respondents or other individuals, the customer generally determines the purposes and lawful basis for that processing.

In these circumstances, TRAXE Forms generally acts as a processor or service provider on the customer's behalf, subject to the applicable agreement and law.

3.3 Customer Responsibilities

Customers are responsible for determining the lawful basis for collecting and using respondent information, providing required notices, obtaining necessary permissions, respecting applicable data subject rights, and complying with relevant research and sector-specific requirements.

Where an individual submits information through a customer-created form, the customer or the organization identified in the form's privacy notice should ordinarily be contacted first regarding the purposes of that collection and requests concerning the submitted information.

04 Categories of Personal Information

Depending on how the Services are used, information processed may include the following categories.

4.1 Account and Identity Information

Names, usernames, email addresses, account identifiers, organizational affiliations, account preferences, access permissions, and authentication-related information.

4.2 Customer and Business Information

Organization names, business contact information, billing details, subscription information, contractual records, and support correspondence.

4.3 Form and Respondent Information

Information entered through forms, surveys, questionnaires, registrations, applications, assessments, or other customer-created collection instruments.

Depending on the Customer's activities, this may include contact details, demographic information, professional information, location, images, documents, survey answers, and other categories defined by the Customer.

4.4 Research and Analytical Information

Imported datasets, variables, measurements, observations, responses, statistical outputs, research notes, classifications, coded qualitative information, reports, and associated metadata.

4.5 Technical and Usage Information

Device information, browser characteristics, IP addresses, timestamps, access logs, security events, application interactions, diagnostic information, and related operational metadata.

4.6 Collaboration Information

Workspace memberships, invitations, permissions, comments, assignments, review activities, access history, and administrative actions.

4.7 AI Processing Information

Prompts, instructions, uploaded material, contextual information, generated drafts, suggested analyses, and outputs submitted to or produced through AI-assisted workflows.

The specific information processed depends on the selected AI functionality and its processing arrangements.

4.8 Communications Information

Support requests, email correspondence, service notifications, contact preferences, and communication-delivery records.

05 Sensitive and Special-Category Information

Customer-created forms may process information considered sensitive or specially protected under applicable law.

Examples may include health information, biometric information, financial information, information about children, political or religious beliefs, precise location, and other protected categories.

Customers must ensure that such processing is lawful, proportionate, appropriately authorized, and subject to safeguards suitable for the information and activity concerned.

Additional contractual, technical, organizational, or legal restrictions may apply.

06 Sources of Information

Personal information may be obtained:

• Directly from account holders.
• From authorized customer administrators or collaborators.
• From respondents completing customer-created forms.
• Through datasets or files imported by authorized users.
• From integrated services acting under authorized arrangements.
• From communications with the platform.
• Through technical operation, authentication, security, and usage of the Services.

Customers must have appropriate authority to provide information obtained from other sources.

07 Purposes of Processing

TRAXE Forms processes personal information, as applicable, to:

1. Provide, operate, and administer the Services.
2. Create and authenticate accounts.
3. Facilitate form creation, publication, and response collection.
4. Store, organize, validate, import, transform, and export datasets.
5. Support analysis, reporting, visualization, and research.
6. Enable authorized collaboration and workspace administration.
7. Provide AI-assisted functionality.
8. Manage subscriptions, billing, and contractual relationships.
9. Provide support, service notices, and requested communications.
10. Maintain security, investigate misuse, and prevent fraud.
11. Monitor reliability, troubleshoot faults, and maintain platform integrity.
12. Comply with legal obligations and respond to lawful requests.
13. Improve functionality and user experience where a lawful basis and applicable contractual permissions exist.

Customer-controlled personal information is processed according to the relevant customer's documented instructions and applicable contractual arrangements, except where processing is independently required or permitted by law.

08 Legal Bases for Processing

Where laws such as the GDPR or UK GDPR apply, TRAXE Forms identifies an appropriate legal basis for processing personal information in its capacity as controller.

Depending on the activity, the legal basis may include:

• Performance of a contract.
• Compliance with a legal obligation.
• Legitimate interests, where applicable and not overridden by individuals' rights.
• Consent, where required or selected as the appropriate basis.
• Other grounds available under applicable law.

The relevant legal basis depends on the specific processing activity and jurisdiction.

When acting as a processor, TRAXE Forms generally relies on the customer's documented instructions and the lawful arrangements governing the customer's processing.

09 Forms and Respondent Privacy

Customers determine the purposes and content of the forms they publish.

Respondents should receive relevant privacy information appropriate to the collection activity, including the identity of the responsible organization and the purposes for which their information is requested.

A respondent's submission of information does not automatically establish consent for every subsequent use. Consent, where required, must satisfy applicable legal standards.

Customers are responsible for the lawful use, disclosure, retention, and interpretation of collected information.

TRAXE Forms processes respondent information within the applicable service and contractual framework.

10 Artificial Intelligence and Automated Processing

TRAXE Forms may provide AI-assisted capabilities for form design, content preparation, data transformation, research, statistical analysis, reporting, and related purposes.

Depending on the functionality selected, information may be processed through TRAXE Forms AI technologies, approved external AI service providers, or other contracted processing arrangements.

AI processing may involve the transmission or transformation of information submitted by users, subject to applicable agreements and disclosures.

Customers should avoid submitting information to AI workflows unless they possess the necessary rights and lawful basis to process that information.

TRAXE Forms does not treat AI-generated conclusions as a substitute for human judgment, professional review, or legally required oversight.

Any use of personal information for model development, training, evaluation, or service improvement must be governed by an applicable legal basis, contractual permissions, and relevant disclosures. Specific provider and training arrangements must be identified in the applicable processing documentation.

Where automated decisions have legal or similarly significant effects, applicable rights and safeguards, including human intervention where legally required, must be respected.

11 Sharing and Disclosure

Personal information may be disclosed, where appropriate and lawful, to:

• Authorized users and collaborators within the relevant customer workspace.
• Cloud hosting, infrastructure, storage, and technical service providers.
• Communication and email delivery providers.
• Payment and billing service providers.
• AI and analytical service providers.
• Customer-authorized integration partners.
• Professional advisers, auditors, and other appropriately bound recipients.
• Public authorities where disclosure is lawfully required.
• Successors or relevant parties to a legitimate business restructuring, subject to applicable safeguards.

TRAXE Forms will apply contractual and organizational safeguards appropriate to the relevant processing relationship.

Customers control information they independently export, publish, or disclose to third parties.

12 International Data Transfers

The Services may involve processing or access across national borders.

Where personal information is transferred internationally, the parties must comply with applicable cross-border transfer restrictions and use appropriate safeguards.

Depending on the relevant law and transfer, these may include adequacy mechanisms, approved contractual clauses, international data transfer agreements, supplementary safeguards, consent or another legally recognized transfer basis.

Customers may have additional responsibilities concerning the countries in which their respondent information is collected or processed.

Specific hosting locations, transfer routes, and subprocessors must be disclosed through applicable contractual or service documentation.

13 Data Retention

Personal information is retained only for periods justified by the applicable purposes, contractual obligations, lawful instructions, technical requirements, and legal duties.

Retention considerations may include:

• Customer-selected retention arrangements.
• Active account and contractual requirements.
• Research and institutional obligations.
• Auditability and evidentiary requirements.
• Security and fraud-prevention needs.
• Disputes and legal holds.
• Backup and recovery arrangements.
• Statutory retention obligations.

Different categories of information may be subject to different retention periods and disposal procedures.

Customer-controlled data is subject to applicable contractual processing instructions and lawful retention exceptions.

14 Data Export, Deletion, and Account Closure

Customers may request access, export, correction, deletion, or closure of eligible accounts and resources, subject to their rights, applicable procedures, contractual commitments, and legal requirements.

Requests may require verification of identity, ownership, authority, affected data scope, and the rights of other parties.

Deletion requests involving shared resources, respondent data, historical records, independently controlled datasets, external service copies, or legal holds may require separate treatment.

Deletion of active service records does not necessarily imply immediate removal from all backups or independent third-party systems.

Where information must be retained, appropriate restrictions and safeguards apply.

Individuals seeking deletion of information supplied through a customer-created form should generally contact the relevant customer/controller, although TRAXE Forms may assist with requests where required by law or agreement.

15 Information Security

TRAXE Forms applies security controls appropriate to the nature of the Services and the information processed.

Security considerations include authentication, authorization, access management, encryption where appropriate, monitoring, secure software development, infrastructure security, incident response, and administrative controls.

No online system can guarantee absolute security.

Customers are responsible for securing their accounts, protecting credentials, properly configuring permissions, and handling downloaded or exported information safely.

Security incidents involving personal information will be managed in accordance with applicable law and contractual notification requirements.

16 Cookies and Similar Technologies

TRAXE Forms may use cookies, browser storage, and similar technologies for authentication, security, preferences, functionality, service measurement, and other disclosed purposes.

Where applicable law requires consent for non-essential technologies, the relevant technologies must be subject to appropriate consent and preference controls.

Further information about technology categories, providers, purposes, retention, and available choices is provided through the applicable Cookie Policy or cookie disclosures.

17 Communications and Marketing Preferences

TRAXE Forms may send service-related communications concerning account security, authentication, transactions, subscriptions, operational matters, and important changes.

Marketing communications are subject to applicable consent, notice, and opt-out requirements.

Individuals may exercise available marketing preferences or unsubscribe through the mechanisms provided in relevant communications.

Unsubscribing from marketing does not necessarily prevent essential security, contractual, or legally required communications.

18 Privacy Rights

Depending on applicable law and circumstances, individuals may have rights to:

• Obtain information about personal data processing.
• Access personal information.
• Request correction of inaccurate information.
• Request deletion or erasure.
• Restrict or object to processing.
• Withdraw consent where consent is the applicable legal basis.
• Request data portability.
• Challenge certain automated decisions.
• Opt out of specified uses or disclosures.
• Lodge complaints with a competent supervisory authority.
• Exercise other rights available under local law.

Rights may be subject to identity verification, lawful exemptions, procedural requirements, and the respective responsibilities of TRAXE Forms and its customers.

Individuals will not be discriminated against for exercising legally protected privacy rights.

19 Rights Requests and Customer-Controlled Data

Where TRAXE Forms acts as controller, privacy requests may be submitted through the designated contact or rights-request mechanism.

Where information is controlled by a customer, TRAXE Forms may refer the individual to the relevant customer or assist the customer in responding, subject to applicable law and contractual obligations.

Requests involving multiple organizations or independently controlled datasets may require coordination among the responsible parties.

20 Children's Privacy

TRAXE Forms is not intended to facilitate unlawful collection or processing of children's personal information.

Customers who collect information relating to children must comply with applicable parental authorization, age-verification, child-protection, educational, and privacy requirements.

Additional safeguards may be required according to the age of the child, jurisdiction, data category, and collection purpose.

21 Third-Party Websites and Integrations

The Services may contain links to or integrate with third-party websites and applications.

Independent third parties may process information under their own privacy notices and legal responsibilities.

Customers should review those practices before enabling integrations or transferring data.

22 Regional Privacy Provisions

European Economic Area and United Kingdom

Where the GDPR or UK GDPR applies, individuals may exercise the rights and protections available under those laws, subject to relevant conditions and exceptions.

Processing arrangements between customers and TRAXE Forms may require a Data Processing Agreement and applicable international transfer safeguards.

United States

Residents of certain US states may have additional rights concerning access, deletion, correction, portability, sensitive information, targeted advertising, data sales or sharing, and profiling.

Where applicable, required notices and opt-out mechanisms must be provided in accordance with the relevant state law.

Tanzania and Other Jurisdictions

Processing involving Tanzania is subject to applicable Tanzanian data protection requirements, including obligations concerning lawful processing, registration where required, individual rights, security, and cross-border transfers.

Where other national or regional privacy laws apply, TRAXE Forms and the relevant customers must comply with their respective legal obligations.

Additional country-specific notices or contractual terms may supplement this Policy.

23 Changes to This Privacy Policy

This Policy may be updated to reflect changes in applicable law, processing arrangements, business practices, security requirements, or the Services.

Material changes will be communicated as required by law.

The applicable effective date and version will be identified when an updated Policy is published.

24 Contact and Complaints

The privacy contact, registered address, and rights-request channel remain to be confirmed. This preview does not establish a privacy contact channel. Individuals may also contact a competent data protection or supervisory authority where they have a legal right to do so. For information collected through customer-created forms, review the relevant form-specific privacy notice to identify the responsible organization.