01 Overview
Ivitaa Martech Solutions ("Ivitaa", "we", "us", or "our") is a survey sample intermediary and market research support provider registered in Pune, Maharashtra, India.
This Privacy Policy explains how we collect, use, store, and protect personal data when you interact with our websites (ivitaa.com, surveys.ivitaa.com, inquister.com), participate in our survey panel, or engage with us as a client or partner.
We are committed to the GDPR (EU), CCPA/CPRA (California, USA), and India's Digital Personal Data Protection (DPDP) Act 2023. Where these frameworks conflict, we apply the standard most protective of your rights.
02 Data We Collect
From survey panelists (surveys.ivitaa.com):
- Identity data: name, date of birth, gender
- Contact data: email address, mobile number (optional)
- Demographic data: country, region, city, postal code, household size, marital status, number of children
- Professional data: employment status, job function, industry, company size, education level
- Socioeconomic data: household income range
- Behavioral data: consumer interests, lifestyle segments, purchase behavior
- Technical data: IP address, device type, browser type, session identifiers
- Survey response data: answers to research surveys you participate in
From website visitors:
- Technical data: IP address, browser, pages visited, referral source, session duration
- Cookie data: see Section 07
From clients and partners:
- Business contact information (name, email, company, role)
- Project data: survey specifications, target audience criteria, deliverables
03 How We Use Data
We process personal data only for the following lawful purposes:
- Survey panel management: routing you to relevant surveys, managing your profile, crediting incentive points, and communicating with you about research opportunities
- Research project fulfilment: delivering survey completes to our clients on a pseudonymized or aggregated basis
- Platform operation: maintaining and improving surveys.ivitaa.com and related infrastructure
- Fraud detection and quality control: identifying and excluding fraudulent, bot-generated, or low-quality responses
- Legal compliance: meeting obligations under applicable data protection law
- Client and partner relationship management: communicating about projects, invoices, and operational matters
We do not use survey respondent data for direct marketing, individual targeting, or advertising purposes. There is a strict operational and contractual separation between our research activities and any marketing activities we conduct.
04 How We Share Data
We do not sell your personal data. We share data only in the following circumstances:
- Research clients: Survey response data is shared with the client who commissioned the research, in aggregated or pseudonymized form. Individual identifying information is never shared with clients unless you have explicitly consented
- Supply partners: We work with panel marketplaces (Cint, Lucid, PureSpectrum) and vetted affiliate supply partners to fulfil research projects. These partners receive only the data necessary to route respondents and confirm completes
- Technology providers: Hosting, email, analytics, and CRM platforms that process data on our behalf under strict data processing agreements
- Legal authorities: Where required by law, court order, or regulatory obligation
All data processors engaged by Ivitaa are contractually bound to process data only as directed and to maintain appropriate security standards.
05 Your Rights
Depending on your jurisdiction, you have the following rights regarding your personal data:
- Right to access: request a copy of the personal data we hold about you
- Right to rectification: correct inaccurate or incomplete data
- Right to erasure: request deletion of your personal data ("right to be forgotten")
- Right to withdraw consent: withdraw your consent to panel participation at any time, without affecting prior processing
- Right to data portability: receive your data in a structured, machine-readable format
- Right to object: object to processing based on legitimate interests
- Right to opt out of data sale (CCPA): we do not sell personal data; this right is satisfied by default
- Right to non-discrimination (CCPA): exercising your rights will not result in reduced service quality
To exercise any of these rights, contact us at business@ivitaa.com. We will respond within 30 days.
06 Data Retention
- Active panelist profiles: retained while your account is active. Accounts inactive for 12 months are archived; accounts inactive for 24 months are deleted
- Survey response data: retained for the duration of the client project plus a maximum 12-month archival period, then deleted or anonymized
- Technical/log data: retained for 90 days for security and fraud monitoring purposes
- Client and partner data: retained for the duration of the business relationship plus 7 years for financial records (as required by Indian tax law)
You may request early deletion of your data at any time (see Section 05).
07 Cookies
Our websites use cookies and similar tracking technologies for the following purposes:
- Strictly necessary cookies: session management, authentication, security — cannot be disabled
- Analytics cookies: understanding how visitors use our site (Google Analytics or equivalent). You may opt out via our cookie banner
- Functional cookies: remembering your preferences and settings
You can manage cookie preferences via the cookie banner displayed on your first visit, change them anytime using the "Cookie Preferences" link in the footer, or adjust your browser settings. Disabling non-essential cookies will not affect your ability to use our core services.
Our contact form uses Google reCAPTCHA to protect against spam and abuse. This is an essential security measure and is subject to Google's Privacy Policy and Terms of Service.
08 Children
Our panel and services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children under 18 without verifiable parental or guardian consent. If you believe we have inadvertently collected data from a child, please contact us immediately at business@ivitaa.com and we will delete it promptly.
Studies involving respondents aged 13–17 are only undertaken with explicit client justification and a documented parental consent workflow.
09 Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify active panelists via email and update the "Effective Date" at the top of this page. Continued use of our services after changes are posted constitutes acceptance of the updated policy.
10 Contact
For privacy-related enquiries, data subject requests, or to report a concern:
business@ivitaa.com
01 Acceptance of Terms
These Terms of Service ("Terms") govern your use of Ivitaa Martech Solutions' websites and services, including surveys.ivitaa.com, ivitaa.com, and related platforms. By accessing or using our services, you agree to be bound by these Terms.
If you are using our services on behalf of an organization, you represent that you have authority to bind that organization to these Terms.
02 Services Description
Ivitaa provides the following services:
- Survey sample services: sourcing and routing qualified survey respondents for market research clients, drawing from our owned panel and vetted supply partner networks
- Panel participation: enabling individuals to register as survey panelists and participate in research studies in exchange for incentives
- Research operations support: quota management, redirect tracking, QC, and fielding operations for research buyers
Ivitaa operates as a sample intermediary. We are not the author or owner of the surveys you are directed to complete; those are the property of the research clients who commissioned them.
03 Panelist Terms
If you register as a survey panelist on surveys.ivitaa.com, the following apply:
- You must be 18 years of age or older (or 13+ with documented parental consent for eligible studies)
- You must provide accurate, truthful registration information
- You must complete surveys honestly and thoughtfully — providing random, incoherent, or intentionally misleading responses is prohibited
- You may not create multiple accounts or use bots, scripts, or automated tools to complete surveys
- You may not share your survey invitation links with others or participate in surveys for which you do not genuinely qualify
- Violation of these rules will result in account suspension, forfeiture of any accrued incentive points, and permanent exclusion from the panel
Incentives: Points earned through legitimate survey participation are redeemable per the terms displayed in your panelist account. Ivitaa reserves the right to reverse points earned through fraudulent participation and to modify the redemption program with 30 days' notice.
04 Client Terms
If you engage Ivitaa as a market research sample buyer, the following apply in addition to any executed Master Service Agreement (MSA):
- Research projects must have a legitimate research purpose in accordance with the ICC/ESOMAR International Code on Market and Social Research
- Surveys must not be used to collect data for direct marketing, individual targeting, or CRM purposes under the guise of research
- You must provide accurate project specifications (LOI, IR, target audience) to enable feasibility assessment
- Quality disputes must be raised within 5 business days of data delivery with specific, documented evidence
- Ivitaa's liability for any project is limited to the value of fees paid for that specific project
- You are responsible for ensuring your surveys comply with applicable law in all geographies where they are fielded
05 Intellectual Property
All content, software, trademarks, and documentation on Ivitaa's platforms are the property of Ivitaa Martech Solutions or its licensors. You may not reproduce, distribute, or create derivative works without express written permission.
Survey response data collected through Ivitaa's platform on behalf of a client is the property of that client, subject to Ivitaa's data processing rights as set out in the applicable MSA.
06 Prohibited Uses
You may not use Ivitaa's services to:
- Conduct research on illegal topics or for illegal purposes
- Collect data from respondents without their knowledge or genuine consent
- Misrepresent the purpose or sponsor of a research study
- Introduce malware, viruses, or malicious code into our systems
- Reverse engineer, scrape, or extract data from our platforms
- Harass, intimidate, or discriminate against respondents
- Circumvent our quality control or fraud detection systems
07 Limitation of Liability
To the maximum extent permitted by applicable law, Ivitaa's total liability for any claim arising from these Terms or our services shall not exceed the fees paid by you to Ivitaa in the three months preceding the claim.
Ivitaa is not liable for indirect, consequential, incidental, or punitive damages, including loss of profits, data, or business opportunity, even if advised of the possibility of such damages.
We do not warrant that our services will be uninterrupted, error-free, or that survey targets will always be achievable within requested timelines.
08 Governing Law
These Terms are governed by the laws of India. Any disputes arising from these Terms shall be subject to the exclusive jurisdiction of the courts of Pune, Maharashtra, India, except where an applicable MSA specifies an alternative dispute resolution mechanism.
For clients in the European Union, nothing in these Terms limits your rights under applicable EU consumer or data protection law.
09 Contact
01 Our Commitment
Ivitaa Martech Solutions processes survey respondent data, client project data, and operational data on behalf of market research buyers globally. We take the security of this data seriously and have implemented technical and organizational measures proportionate to the risks involved.
This page summarizes our information security posture. For a full Data Processing Agreement (DPA) or security questionnaire response, contact business@ivitaa.com.
02 Technical Safeguards
Encryption in Transit
All data transmitted between users, our platforms, and partner systems uses TLS 1.2 or higher. HTTPS is enforced across all domains.
Encryption at Rest
All databases containing PII and survey response data are encrypted at rest using AES-256 or equivalent standards.
Access Controls
Role-based access controls limit data access to authorized personnel only. Multi-factor authentication is required for all production system access.
Fraud Detection
Device fingerprinting, IP validation, VPN/proxy detection, and behavioral analysis are applied to all survey respondent sessions.
Data Separation
PII is stored in a separate, access-controlled database from survey response data. Linkage is maintained only for operational panel management.
Backups
All project data and panelist profiles are backed up daily to encrypted off-site storage. Recovery procedures are tested periodically.
03 Organizational Measures
- Data minimization: we collect only the data fields necessary for panel management and research fulfilment
- Purpose limitation: respondent data is used exclusively for research purposes and never shared with our marketing or advertising operations
- Employee training: all team members with access to respondent or client data receive data handling training before system access is granted
- Vendor assessment: all third-party processors and supply partners are assessed for security practices before onboarding and must agree to data processing terms
- Incident response: a documented incident response procedure is in place with defined escalation paths and regulatory notification timelines (see Section 05)
- Retention and deletion: defined data retention schedules are enforced; data is deleted or anonymized at the end of retention periods
04 Compliance Status
Our current compliance and certification posture:
05 Incident Response
In the event of a confirmed or suspected data breach, Ivitaa will:
- Contain the incident and isolate affected systems within 4 hours of detection
- Assess the scope, nature, and volume of affected data within 24 hours
- Notify affected clients promptly with full incident details and remediation steps
- Where required by applicable law (e.g., GDPR's 72-hour rule), notify the relevant supervisory authority
- Conduct a post-incident root cause analysis and implement corrective measures
- Provide a written incident report to affected clients upon request
To report a suspected security incident or vulnerability: business@ivitaa.com
06 Subprocessors
Ivitaa uses the following categories of subprocessors for data processing activities:
- Cloud hosting and infrastructure: servers hosted on providers with ISO 27001-certified data centers
- Email and communication: business communication platforms under standard DPA terms
- Survey supply partners: Cint, Lucid, PureSpectrum — each operating under their own ISO/industry certifications and bound by Ivitaa's MSA requirements
- Analytics: anonymized/aggregated website analytics only
A full subprocessor list is available to clients under NDA upon request.
07 Requesting Documentation
The following security documents are available to clients and prospective partners upon request:
- Data Processing Agreement (DPA)
- ESOMAR 37 Questions — answered (publicly available at ivitaa.com/esomar-37)
- Security questionnaire responses
- Vendor onboarding requirements
- Incident response policy summary