The ESOMAR 37, answered in full

Q1What experience does your company have in providing online samples for market research? How long have you been providing this service? Do you also provide similar services for other uses such as direct marketing? If so, what proportion of your work is for market research?

Ivitaa Martech Solutions is a survey sample intermediary and market research support provider based in Pune, India, operated under Grimbell Business Solutions LLP. We have been providing survey sample and fielding services since 2022, with active supply-side integrations with Cint, Lucid, and PureSpectrum, and demand-side relationships with agencies including PanelFocus, Keto MR, Opnion.io, and Market Mirror.

Our service lines include:

• Survey sample sourcing and routing (our primary service)
• Panel management and respondent recruitment through surveys.ivitaa.com
• Research operations support (quota management, redirect tracking, fielding dashboards)
• Digital marketing services (Meta advertising, lead generation) — operated as a distinct business division under Grimbell Business Solutions LLP

Approximately 80% of our revenue is derived from market research sample services. Digital marketing is operated as a fully separate division with distinct client contracts, team members, and operational infrastructure. There is no overlap or co-mingling of research respondent data with marketing activities.

Q2Please describe the activities, structure and ownership of your company.

Ivitaa Martech Solutions is a division of Grimbell Business Solutions LLP, a registered limited liability partnership incorporated in Pune, Maharashtra, India. The business is privately held and founder-operated.

Business entities under the group umbrella:

• Ivitaa Martech Solutions — survey sample intermediary, panel management, fielding operations
• Grimbell Business Solutions — digital marketing agency (Meta ads, lead generation, marketing automation)
• Inquister Analytics — market research positioning and traffic generation platform
• Gleepzy Research — survey tracking and operational monitoring

The market research and survey sample functions are operated under Ivitaa and Inquister Analytics. These entities do not engage in individual targeting, direct marketing, or CRM services using research respondent data.

Q3What is your privacy policy? How do you make it available to the people you invite to take part in surveys? What is your opt-in/opt-out policy?

Ivitaa maintains a comprehensive privacy policy published at ivitaa.com/privacy-policy, aligned with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and India's Digital Personal Data Protection (DPDP) Act 2023.

• Respondents who join through Ivitaa's own panel registration flow (currently in development at surveys.ivitaa.com) will complete an explicit double opt-in process upon launch
• Privacy policy is presented and must be acknowledged at registration, before any data is collected
• Respondents routed through supply partners (Cint, Lucid, PureSpectrum) are subject to those partners' own privacy frameworks and consent flows, which we verify during vendor onboarding
• Respondents may withdraw consent, request data deletion, or update their profile at any time via business@ivitaa.com
• Survey data collected on behalf of clients is never shared with third parties for non-research purposes

Q4Are you a member of ESOMAR and/or other professional associations?

Ivitaa Martech Solutions is currently in the process of applying for ESOMAR Corporate Membership. We are committed to the ICC/ESOMAR International Code on Market and Social Research and align our operational practices with ESOMAR's quality and ethical standards.

Current commitments:

• Alignment with ESOMAR's 37 Questions framework (this document)
• Signatory of the Global Data Quality (GDQ) Pledge
• Operational practices consistent with ESOMAR guidelines for online sample providers
• Data protection practices aligned with GDPR and CCPA requirements
• Zero-tolerance policy for fraudulent respondents, in line with industry-standard ethics

We will update this document upon formal ESOMAR membership confirmation.

SECTION 2 · SAMPLE SOURCES AND RECRUITMENT

Q5What online sample sources do you have? Please describe them.

Ivitaa sources respondents through two primary channels:

• Supply partner marketplaces: We are integrated as a buyer on Cint Exchange, Lucid (now Cint), and PureSpectrum. These platforms provide access to aggregated panel supply from hundreds of vetted panel partners globally.
• Owned respondent recruitment: Ivitaa is actively building a proprietary respondent panel (surveys.ivitaa.com — in development). Panel recruitment via Meta and Google performance advertising, social channels, and referral programs is underway. At present, the majority of supply is sourced through our programmatic marketplace integrations.
• Affiliate supply network: We work with select vetted supply partners who route respondents through our Viviyaana tracking platform. Each partner is onboarded under a formal agreement with defined QC requirements.

Q6What is the relationship between your company and the owners of the online sample sources you use?

For supply partner marketplaces (Cint, Lucid, PureSpectrum): Ivitaa operates as a buyer/demand-side partner. We access respondent supply through their platforms under their standard terms of service. We do not own these panels.

For owned and affiliate supply:

• All supply partners are onboarded through a formal partner agreement defining quality standards, fraud prevention responsibilities, and data handling requirements
• We conduct feasibility verification and quality audits on partner supply before and during project execution
• Partners are required to confirm their respondents have provided valid, informed consent for survey participation
• We maintain the right to exclude or terminate supply partners who fail quality thresholds

We are transparent with clients about which supply sources are being used for each project upon request.

Q7Do you have a supplier qualification process? How do you select, qualify, and monitor your suppliers?

Yes. Every supply partner who routes respondents to Ivitaa projects undergoes a formal onboarding process before receiving live traffic.

Qualification process includes:

• Company verification: legal entity, contact details, and operating history
• Panel quality review: recruitment methodology, profiling depth, fraud control infrastructure
• Test deployment: a controlled pilot project to assess completion rates, fraud signals, and redirect accuracy before full activation
• MSA execution: all partners operate under a Master Service Agreement defining QC SLAs, data handling obligations, and termination conditions
• Ongoing monitoring: partner performance is tracked per project. Partners exceeding fraud thresholds or failing QC checks are paused and reviewed

Q8What information do you hold on your panelists? How do you source this information?

For respondents registered in Ivitaa's own panel (surveys.ivitaa.com), we collect and maintain the following profile data:

Profile data collected at registration and updated periodically:

• Core demographics: age, gender, country, state/region, city, postal code
• Household: household size, marital status, number of children
• Employment: employment status, job function, industry, company size
• Education: highest level completed
• Income: household income range
• Device: primary device type used for surveys
• Language preferences
• Behavioral interests: consumer categories, lifestyle segments

For supply partner respondents, profile data is managed by the respective platforms and made available for targeting and quota control. This is our primary source of respondent data at present

For respondents who will be registered in Ivitaa's owned panel (surveys.ivitaa.com — in development), we intend to collect and maintain the following profile data upon launch

• Core demographics: age, gender, country, state/region, city, postal code
• Household: household size, marital status, number of children
• Employment: employment status, job function, industry, company size
• Education: highest level completed
• Income: household income range
• Device: primary device type used for surveys
• Language preferences
• Behavioral interests: consumer categories, lifestyle segments

Q9How do you recruit respondents for your panels? What is your recruitment process?

Ivitaa is building its owned panel through the following recruitment channels, currently in active development:

• Paid digital advertising: Meta (Facebook/Instagram) and Google Ads campaigns targeting specific demographic profiles
• Social media organic: recruitment posts across social platforms
• Referral programs: existing panelists can refer others and earn bonus incentives
• Coregistration: partnerships with relevant content and rewards sites
• Survey intercepts: respondents who complete surveys through partner channels and opt in to join the owned panel

At present, all respondent supply for client projects is fulfilled through our programmatic marketplace integrations and vetted affiliate supply partners."

Q10Do you use affiliate networks or referral programs for recruitment? If so, how do you manage the quality of recruits from these sources?

Yes. Ivitaa uses referral programs for owned panel recruitment and works with select affiliate supply partners.

• Affiliate-recruited respondents are subject to the same registration and verification process as direct recruits
• Device fingerprinting and deduplication checks are applied at entry to prevent duplicate registrations
• Affiliate partner performance is monitored for completion rates, fraud rates, and quality scores
• Affiliate partners with consistently low-quality traffic are removed from the program
• Commission structures are tied to verified completes, not clicks or raw registrations, which reduces incentive for low-quality recruitment

Q11What is your sample recruitment policy for children and young people?

Ivitaa does not permit respondents under the age of 18 to register for or participate in surveys through our owned panel without verifiable parental or guardian consent.

• Age verification is conducted at registration; respondents indicating they are under 18 are excluded unless a supervised, consent-documented process is in place for the specific project
• Youth-targeted studies (ages 13–17) are only undertaken with explicit client justification and documented parental consent workflow
• Studies targeting children under 13 are not supported on our platform
• We comply with COPPA (USA), GDPR provisions for minors (EU), and equivalent standards for other geographies

Q12What happens to respondents who do not answer or who decline survey invitations? How do you manage dormant or inactive panelists?

Ivitaa's owned panel (currently in development) will apply the following engagement-based management policies upon launch:

• Panelists inactive for 6 months will be flagged and receive a re-engagement communication
• Panelists inactive for 12 months will be archived and excluded from active survey routing
• Archived panelists may be reactivated upon response to re-engagement campaigns
• Panelists requesting removal will be immediately excluded and their data deleted per our privacy policy
• Invitation frequency is capped to prevent survey fatigue, with a minimum cool-down period between invitations

SECTION 3 · SAMPLING AND PROJECT MANAGEMENT

Q13What profiling information do you hold on at least 80% of your panelists? How often is each data point updated?

For supply partner respondents, profiling depth varies by platform. They maintain rich demographic profiles across their panel networks; specific profiling availability for a given audience can be confirmed at feasibility stage.

For Ivitaa's owned panel (in development), upon launch we will maintain the following data points for at least 80% of active panelists:

• Age / date of birth — collected at registration; confirmed annually
• Gender — collected at registration
• Country and region — collected at registration; self-updatable
• Employment status and industry — collected at registration; prompted for update every 6 months
• Household income range — collected at registration; prompted for update annually
• Education level — collected at registration
• Device type — detected automatically at each session

Profile data collected through supply partner platforms (Cint, Lucid, PureSpectrum) is managed and maintained by those platforms. Profiling depth and update frequency varies by platform. Clients requiring specific profiling confidence levels should discuss this with us prior to project scoping.

Q14What information do you need about a project to provide a feasibility estimate?

To provide an accurate feasibility estimate, we require:

• Target geography (country, region, or city level)
• Target audience definition (demographics, screener criteria, behavioral qualifications)
• Length of Interview (LOI) in minutes
• Estimated Incidence Rate (IR), if known
• Required sample size (n) per cell/quota
• Survey start date and field close date
• Any exclusion criteria (e.g., industry exclusions, competitor employees)
• Survey hosting platform and redirect link type

We provide feasibility estimates within 24 hours of receiving a complete project brief. For projects with unusual audiences or very low IR (under 10%), we recommend a 48-hour feasibility check with a soft-launch test.

Q15How do you draw a sample to fulfil your clients' requirements?

Sample is drawn through our Viviyaana tracking and routing platform, which manages the full respondent flow from invitation to completion.

• Quota targeting: demographic and behavioural quotas are configured per project and enforced in real time
• Source blending: supply is drawn from the optimal combination of our partner marketplaces (Cint, Lucid, PureSpectrum) and owned panel based on audience requirements
• Programmatic routing: for projects on programmatic marketplaces, bids are set per quota cell to optimize for incidence rate and delivery speed
• Soft launch: all projects begin with a controlled soft launch (typically 10–15% of target n) to validate screener performance, IR, and quality before full launch
• Real-time monitoring: completion rates, dropout rates, and quota fill are monitored continuously throughout fieldwork

Q16Do you permit 'river sampling' or 'intercept sampling'? If so, how do you ensure quality?

Ivitaa accesses some respondent supply via programmatic/open-market routing through Cint and PureSpectrum, which may include river/intercept elements depending on the project. We do not route unverified open-river traffic directly.

• All programmatic supply passes through deduplication and device fingerprinting checks before survey entry
• VPN and proxy detection is applied to flag and exclude suspicious sessions
• Respondents who fail attention checks, exhibit speeder behavior, or straight-line responses are excluded at QC
• Clients are informed when programmatic sources are included in the supply mix

Q17Do you set limits on respondent survey participation? What is your policy on survey frequency?

For Ivitaa's owned panel (in development), the following participation limits will apply upon launch:

• Maximum 2 surveys per respondent per day
• Maximum 4 surveys per respondent per week
• Topic-specific cool-down periods (e.g., healthcare studies: 30-day exclusion after participation; product category studies: 14-day exclusion)
• Project-level deduplication: each respondent can only complete a specific survey once, enforced by unique respondent ID tracking
• For supply partner respondents, frequency management is governed by the respective platform's policies

Q18How do you maintain the quality of your panel data?

Panel data quality is maintained through the following practices:

• Periodic re-profiling: active panelists are prompted to review and update key demographic data every 6 months
• Email validation: all registered panelists must confirm their email address via double opt-in at registration
• Behavioral consistency checks: responses that are logically inconsistent with profile data (e.g., age mismatches) are flagged for review
• Inactive panelist archiving: panelists who have not engaged in 12 months are removed from active routing
• Data integrity monitoring: profile fields are checked for implausible values during upload

SECTION 4 · DATA QUALITY AND VALIDATION

Q19What processes do you have in place to ensure data quality? Please describe.

Ivitaa applies a multi-layer quality framework across all survey projects:

• Pre-survey: device fingerprinting, deduplication check, VPN/proxy detection, bot traffic screening
• In-survey: attention check questions (traps), red herring answer options, response time monitoring (speeders flagged at under 50% of expected LOI), straight-line detection on grid questions, open-end response validation
• Post-survey: statistical analysis for response pattern anomalies, open-end review for gibberish or copy-paste responses, cross-tab consistency checks, final fraud score review before delivery
• Delivery: only records passing all QC layers are included in the final dataset delivered to clients

Q20Please describe the measures you take to ensure that respondents are who they say they are.

Respondent identity verification for owned panel members includes:

• Email verification via double opt-in at registration
• Mobile number verification for higher-value respondent tiers
• Device fingerprinting: each respondent's device is linked to their profile; new devices trigger additional verification
• IP address cross-check against registered location and declared geography
• Behavioral profiling: registration response patterns are compared to known bot and fraudulent user signatures
• For supply partner respondents, identity verification is performed by the respective platform per their standard protocols

Q21Do you use digital fingerprinting or other technologies to identify fraudulent respondents?

Yes. Ivitaa applies the following automated fraud detection technologies:

• Device fingerprinting: browser and device fingerprints are checked against our deduplication database
• IP address analysis: IP addresses are checked against known proxy, VPN, and datacenter IP ranges
• Geolocation verification: declared country and region are cross-checked against IP geolocation data
• User-agent analysis: non-standard or spoofed browser agents are flagged
• Response time analysis: sessions completing surveys in less than 50% of expected LOI are flagged as speeders
• Behavioral biometrics: mouse movement, click patterns, and session behavior are analyzed for bot-like activity on the Viviyaana platform

Q22How do you ensure the quality of open-ended questions?

Open-ended responses are reviewed through both automated and manual processes:

• Automated screening: responses are checked for minimum length, character repetition, and nonsensical input patterns
• Gibberish detection: AI-assisted flagging of responses that do not form coherent sentences
• Copy-paste detection: duplicate responses across respondents are identified and flagged
• Language matching: responses in languages other than the survey language are flagged for review
• Manual review: on projects with client-specified OE quality requirements, a manual review pass is performed before delivery

Q23What do you do to ensure data quality when 'river' or 'intercept' samples are used?

When programmatic/intercept supply sources are used, all standard QC measures apply (see Q19–Q22), with additional intercept-specific controls:

• Entry deduplication: a unique session token is generated per respondent entry to prevent link-sharing exploitation
• IP-level throttling: no more than a defined number of completes per unique IP address per project
• Referral source tracking: all respondent entries are tracked by supply source to enable source-level quality analysis
• Threshold-based exclusion: supply sources with fraud rates exceeding our threshold are suspended mid-project

Q24How do you handle respondents who are found to be not qualified or not honest?

Respondents who fail screener criteria are redirected to a standard screen-out URL and are not counted toward project delivery.

Respondents found to have provided dishonest or poor-quality responses are handled as follows:

• Immediate exclusion from the delivered dataset
• Flagged in our respondent quality database to suppress from future projects
• For owned panel members: formal quality score reduction; repeated offenders are permanently removed from the panel
• For supply partner respondents: the issue is reported to the relevant partner for action
• Clients are notified if fraudulent completions are detected post-delivery, and replacement completes are provided at no charge

Q25What information do you provide to your clients about quality control?

Upon project completion, Ivitaa provides clients with the following QC documentation upon request:

• Total invited, screened out, quota-terminated, and completed counts
• Fraud/QC removal count and reason codes
• Supply source breakdown (at platform level)
• Field duration and daily completion pacing
• Average completion time versus expected LOI
• Any anomalies identified and actions taken during fieldwork

SECTION 5 · POLICIES AND COMPLIANCE

Q26What is your organization's approach to data protection? What data protection legislation are you compliant with?

Ivitaa Martech Solutions is committed to responsible data stewardship. Our data protection framework is aligned with:

• General Data Protection Regulation (GDPR) — for respondents in the European Union and EEA
• California Consumer Privacy Act / CPRA (CCPA) — for respondents in California, USA
• India Digital Personal Data Protection (DPDP) Act 2023 — as our primary jurisdiction of incorporation
• COPPA — for any studies involving respondents under 13 in the USA

Data protection is implemented through explicit consent collection, data minimization, purpose limitation, access controls, encryption of PII at rest and in transit, and defined data retention and deletion policies. Our Data Protection contact is business@ivitaa.com.

Q27How do you handle personally identifiable information (PII)? What are your data security practices?

PII is handled with strict separation from research data:

• PII (name, email, phone) is stored in an encrypted, access-controlled database separate from survey response data
• Survey responses are stored as anonymized/pseudonymized records; PII linkage is maintained only where required for panel management
• All data is transmitted over HTTPS/TLS 1.2+
• Access to PII databases is restricted to authorized personnel and requires multi-factor authentication
• Client data is never used for purposes beyond the contracted research project
• Data deletion requests are processed within 30 days
• Server infrastructure is hosted on cloud providers with ISO 27001-certified data centers

Q28What processes do you have for handling data breaches?

Ivitaa maintains a Data Breach Response Policy that includes:

• Immediate containment: upon detection of a potential breach, affected systems are isolated within 4 hours
• Internal escalation: the founding team and any affected data controllers are notified immediately
• Assessment: scope, nature, and volume of affected data is assessed within 24 hours
• Regulatory notification: if the breach meets notification thresholds under applicable law (e.g., GDPR's 72-hour rule), regulators are notified accordingly
• Client notification: affected research buyers are notified promptly with full details of the incident and remediation steps
• Remediation and post-incident review: root cause analysis and corrective actions are documented and implemented

Q29Please describe your company's approach to research on sensitive topics.

Ivitaa recognizes that some research topics require elevated care in recruitment, consent, and handling.

Our approach for sensitive research includes:

• Enhanced consent language: surveys on sensitive topics (health, financial distress, political opinion, ethnicity, religion, sexual orientation) include explicit, plain-language consent covering the nature of the questions
• Opt-out at any time: respondents are clearly informed of their right to exit the survey at any point without penalty
• Healthcare and medical studies: only undertaken with a client-provided ethics committee approval confirmation for clinical or sensitive health studies
• Debriefing: where required, sensitive surveys include a closing debrief with appropriate support resources
• Data handling: sensitive data categories are handled with additional access restrictions and are not retained beyond project completion

Q30What are your policies for incentivizing respondents?

Ivitaa uses a points-based incentive system for owned panel members.

Key policies include:

• Incentives are commensurate with survey length and effort — not inflated to attract low-quality or mercenary respondents
• Points are redeemable for cash, gift cards, or charitable donations at the respondent's choice
• Incentive amounts are disclosed to respondents before they begin a survey
• There is no penalty for screener terminations — respondents receive a partial incentive for honest disqualification
• Incentive gaming (rapid clicking, straight-lining to earn rewards) is detected and results in point reversal and quality flagging
• For supply partner respondents, incentive structures are managed by the respective platforms

Q31Do you have a complaint or grievance process for respondents?

Yes. Respondents who experience issues with a survey or with Ivitaa's platform can submit complaints through:

• Email: business@ivitaa.com or contact@ivitaa.com
• Complaints are acknowledged within 48 hours and resolved within 5 business days for standard issues
• Complaints involving data privacy are escalated to our Data Protection contact and handled under our privacy policy
• Escalated complaints may be referred to the relevant data protection authority if not resolved satisfactorily

Q32What are your policies on the use of subcontractors?

Ivitaa uses supply partners (Cint, Lucid, PureSpectrum, and vetted affiliate partners) to fulfil respondent requirements.

Our subcontractor policy includes:

• All supply partners are onboarded through a formal qualification process (see Q7)
• Partners are bound by MSAs that include data handling obligations, QC standards, and confidentiality requirements
• Partners are not permitted to further subcontract supply without Ivitaa's prior approval
• Clients are informed of the types of supply sources used (marketplace vs. owned panel) upon request
• Ivitaa retains full responsibility to the client for the quality of all delivered completes, regardless of source

Q33What is your approach to collecting and processing the personal data of children and young people?

See Q11 for full details. In summary: Ivitaa does not collect data from respondents under age 13 under any circumstances. For respondents aged 13–17, a documented parental/guardian consent process is required, and such studies are only undertaken at the explicit request of clients with a legitimate research justification. We comply with COPPA, GDPR Articles 8 and 17 provisions for minors, and equivalent child data protection legislation in other jurisdictions.

Q34Do you implement 'data protection by design' in your systems and processes?

Yes. Privacy-by-design principles are embedded in Ivitaa's technical infrastructure:

• Data minimization: only the data fields necessary for survey participation and panel management are collected
• Purpose limitation: collected data is used only for the stated purpose at time of collection
• Pseudonymization: survey response data is stored with respondent IDs rather than direct identifiers
• Encryption by default: all databases containing PII use encryption at rest; all communications use HTTPS/TLS
• Access controls: role-based access controls limit which team members can access which data categories
• Retention limits: data is retained only as long as necessary and deleted per defined retention schedules

Q35What are the key elements of your information security compliance program?

Ivitaa's information security program includes:

• HTTPS/TLS 1.2+ encryption for all data in transit
• Encrypted databases for all PII storage
• Multi-factor authentication for administrative access to all production systems
• Regular security reviews and access audits
• Incident response plan with documented procedures (see Q28)
• Vendor security assessments for cloud hosting and third-party tools
• Employee data handling training for all team members with access to research data

We are currently working toward ISO 27001 and ISO 20252 alignment as part of our 2027 compliance roadmap.

Q36Please describe how you ensure relevant legislation is followed when conducting your research.

Ivitaa ensures legislative compliance through the following mechanisms:

• Jurisdictional consent frameworks: our consent flows are tailored to the applicable legal requirements of each respondent's geography
• GDPR: explicit lawful basis for processing is documented for all research activity involving EU/EEA respondents
• CCPA/CPRA: California respondents are provided with disclosure of data categories collected and the right to opt out of data sale (we do not sell respondent data)
• DPDP Act 2023: as an Indian entity, we apply the domestic data protection framework to all operations
• Legal review: major new service lines or geographies involving data processing are reviewed against applicable local law before launch
• Ongoing monitoring: we track changes to data protection legislation in our key operating geographies

Q37Do you have a business continuity plan? What provisions do you have in place for survey data if your company is sold, becomes insolvent, or ceases trading?

Ivitaa maintains operational continuity planning appropriate to our scale:

• All active project data is backed up daily to encrypted off-site storage
• In the event of a system outage, our supply partner platforms (Cint, Lucid, PureSpectrum) can continue servicing active projects independently
• Client data is retained for a minimum of 12 months post-project and can be exported to clients at any time upon request
• In the event of a business cessation, all respondent PII would be securely deleted per our privacy policy, and clients would be notified to retrieve their data within a defined window
• Respondents would be notified of any material change in data controller status that affects their personal data