Privacy Policy

Website: true-opinion.com Operated by: Precise Research Solutions Pvt. Ltd. Last updated: 29^th November 2024

1. Introduction and Scope

Precise Research Solutions Pvt. Ltd. ("Company", "we", "us", "our") operates the website true-opinion.com and related services, including our online research panel, through which members register, build a profile and are invited to take surveys run by our research clients (together, the "Services"). We respect your privacy and are committed to protecting your personal data.

This Privacy Policy explains what personal data we collect, why we collect it, how we use, share and protect it, and what rights you have. It is written to comply with:

the EU General Data Protection Regulation (GDPR) and, where applicable, the UK GDPR;
the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA);
Canada's Personal Information Protection and Electronic Documents Act (PIPEDA);
India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the rules made under it, together with the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent applicable;
Singapore's Personal Data Protection Act 2012 (PDPA);
the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL);
Brazil's Lei Geral de Proteção de Dados (LGPD); and
Australia's Privacy Act 1988 and the Australian Privacy Principles (APPs).

By using the Services, you acknowledge that you have read this Policy. Where the law requires your consent, we will ask for it separately and you may withdraw it at any time.

2. Who Is Responsible for Your Data

For the purposes of data protection law, Precise Research Solutions Pvt. Ltd. is the data controller (GDPR), the business (CCPA), the organization accountable for personal information (PIPEDA) and the Data Fiduciary (DPDP Act).

Company details

Address: Block-F, Lane #3, Building #17, First Floor, Krishna Nagar, Delhi-110051, India
Email for privacy matters: compliance@true-opinion.com
Data Protection Officer: Karun Bansal, dpo@true-opinion.com
Grievance Officer (India): Deepika@true-opinion.com
EU/UK Representative (if appointed): Karun@true-opinion.com

3. Personal Data We Collect

3.1 Information you provide to us

Account data: your email address (which is also your username), password, full name, home and billing address, phone or mobile number, country, state or city, date of birth or age, gender and language.
Profile data: your answers to the profile questions we ask when you register and afterwards, for example about annual and household income, education, employment status, company size, interests, and purchase or media habits. We use these answers to match you with relevant client surveys.
Reward and payment data: your reward balance and redemption history, your chosen payout method (such as PayPal or bank cheque) and the details needed to send it, and your entries into prize draws.
Communications: messages you send to our support team, feedback, and your responses to our emails.

3.2 Information collected automatically

Device and technical data: IP address, browser type and version, operating system, device identifiers, device type, network and carrier, screen resolution, time zone and language settings.
Log data: like most websites, our web servers keep log files each time a device accesses them, recording IP address, internet service provider, pages viewed, operating system, device type and timestamps.
Location data: your country, state and city, determined from your IP address and other technical signals. We do not collect precise GPS location.
Usage data: pages viewed, links clicked, referring URLs, dates and times of visits, and how you move through our registration, profile and survey-entry pages.
Cookies and similar technologies, including Google Analytics and our fraud-detection tools: see Section 7.

3.3 Information from other sources

Referral and affiliate partners who direct you to our website.
Third parties and public sources: information that a third party shares with us because you gave it permission to do so, or that you have made publicly available online.
Analytics and fraud-prevention providers, such as Google Analytics and IP-intelligence or device-checking tools, which give us technical signals about the device and connection you use to register and use the Services.
Client survey platforms, which may tell us limited status information, such as whether a survey was completed, when you return from it.

3.4 Sensitive data

Some profile questions may ask about sensitive topics, such as health, ethnicity, religion, political opinions or sexual orientation. Answering such questions is always optional, and we process this data only with your explicit consent (GDPR Art. 9; PIPEDA; DPDP Act) and only to match you with relevant surveys. We do not collect government ID numbers or biometric data, and we do not collect precise geolocation.

3.5 Survey Responses Are Held by Our Clients, Not by Us

Surveys are programmed, hosted and run by our research clients, not by us. When you open a survey, you leave our Services and are taken to the client's survey platform, where the client collects your answers directly. We do not receive or store your survey responses. This Policy does not cover how a client handles them: each client is responsible for its own privacy notice and for its own compliance with data protection law.

4. How We Use Your Personal Data and Our Legal Bases

Purpose	Examples	Legal basis (GDPR/UK GDPR)	Basis under other laws
Providing the Services	Creating and managing your account, building your profile, matching you to client surveys, sending survey invitations	Performance of a contract	Consent; necessary for the service (PIPEDA, DPDP)
Rewards, prize draws and payouts	Crediting rewards, running prize draws, processing redemptions, preventing duplicate or invalid claims	Contract; legal obligation (tax and accounting)	Consent; legal obligation
Sharing with a client at its request	Passing your personal information to a research client that asks for it	Consent	Consent
Fraud detection and data quality	Using cookies, IP tracking and analytics to detect duplicate accounts, bots, VPN or proxy use and location mismatches	Legitimate interests (securing the Services and protecting research integrity)	Reasonable purposes (PIPEDA); consent or legitimate uses (DPDP)
Location determination	Working out your country, state and city for survey eligibility and fraud checks	Contract; legitimate interests	Consent; reasonable purposes
Sensitive profile data	Optional profile questions on sensitive topics	Explicit consent	Explicit consent
Communications	Survey invitations, account, reward and service notices (we do not send third-party marketing)	Contract	Consent
Analytics and improvement	Understanding site usage with Google Analytics, testing, troubleshooting	Consent for non-essential cookies; legitimate interests	Consent; reasonable purposes
Security and legal compliance	Responding to lawful requests, investigating illegal or fraudulent activity, enforcing our Terms, protecting rights	Legal obligation; legitimate interests	Legal obligation

We will not use your personal data for purposes that are materially different from those above without informing you and, where required, obtaining fresh consent.

5. Automated Decision-Making and Fraud Controls

To protect the integrity of research, we use automated and semi-automated checks (for example, IP and device analysis, response-quality scoring and duplicate-account detection). These checks may lead to survey disqualification, exclusion from surveys, or withholding or reversal of rewards, for suspected fraudulent activity or breach of our Terms, or account suspension. If you believe a decision was made in error, you may contact us at the address in Section 2 to request human review and to express your point of view.

6. How We Share Your Personal Data

We do not sell your personal data, and we never make any user data or posts public. We do not share your account or profile data with our research clients or anyone else, except with your consent or as described below:

Research clients: sometimes a client asks for your personal information. We share it only after you give your consent. When you choose to take a survey, you are sent to the client's survey, where the client collects your responses directly (Section 3.5). We may pass a unique participant ID and basic routing information so the client can track participation.
Research agencies: any information passed to associated market research agencies is anonymous.
Service providers (processors): hosting, cloud storage, email delivery, analytics (including Google Analytics), customer support, fraud-prevention and IP-intelligence providers, and payment providers (such as PayPal or banks) that deliver your rewards. They may process data only on our instructions and under written agreements.
Professional advisers, auditors and insurers.
Authorities: where we believe in good faith that disclosure is necessary to comply with a court order or legal process, to investigate or act against illegal, suspected or fraudulent activity, or to protect rights, safety and security.
Corporate transactions: in a merger, acquisition or asset sale, your data may be transferred subject to this Policy or with notice to you.

7. Cookies and Similar Technologies

We use cookies, IP tracking and third-party tools, as follows:

Strictly necessary cookies for login, security and core functions;
Preference cookies to remember your settings;
Analytics cookies and APIs, including Google Analytics, to understand how the Services are used (Google's own privacy policy applies to its processing); and
Fraud-prevention cookies and IP tracking, which record your IP address and device signals to detect duplicate accounts, automated activity and use of VPNs or proxies, and to determine your country, state and city. These are essential to the integrity of our panel, and we rely on legitimate interests or, where the law requires it, your consent.

Where required (for example, in the EU, UK and Canada), we ask for your consent before placing non-essential cookies, and you can change your choice at any time through our cookie settings [link]. You can also control cookies through your browser settings. We honor recognized opt-out preference signals such as Global Privacy Control (GPC) for California residents. We do not currently respond to "Do Not Track" signals, as there is no common standard.

For more detail, see our Cookie Policy.

8. International Data Transfers

We are based in India. We store the personal data of users in the European Economic Area (EEA) on servers located in the EU, and the personal data of users in the United States on servers located in the United States and India. [State where data of UK and other users is stored.] Our staff and service providers, including those in India, may access this data. These countries may have data-protection laws that differ from those where you live.

EEA users: your data is stored in the EU. Because our team in India may access it remotely, this access is a transfer outside the EEA to a country without a general adequacy decision. We rely on safeguards such as the Standard Contractual Clauses (and the UK Addendum or IDTA for UK users) and supplementary measures where needed.
US users: your data is stored in the United States and India. Our service providers are bound by contracts that require them to protect it.
Canadian users: your data is processed in the countries where our servers and staff are located and may be accessible to courts and authorities there. We use contractual and other means to provide a comparable level of protection.
Indian data: we transfer personal data outside India only to the extent permitted under the DPDP Act and any restrictions notified by the Government of India, and we will comply with any data-localization requirements that apply to us.

You may contact us for a copy of the safeguards we use.

9. Data Retention

We keep personal data only as long as necessary for the purposes in this Policy, including to meet legal, tax, accounting and reporting requirements. As a guide:

Account and profile data: kept while your account is active. We delete it within 30 days of account closure or a verified deletion request. Accounts with no activity for 24 months are closed after an email notice, and their data is then deleted.
Reward and payout records: 8 years, to meet Indian tax and company-law record-keeping rules.
Fraud and security records (IP addresses, device signals, and records of suspended accounts): 24 months from the incident or suspension, to prevent re-registration of banned accounts.
Analytics data: 14 months, according to our Google Analytics retention settings.
Marketing preferences and suppression lists: until you opt out, plus the records needed to honor that opt-out.
Records we must keep by law: for the period the law requires.

When data is no longer needed, we delete or anonymize it.

Closing your account. You can close your account in your account settings or by emailing compliance@true-opinion.com. Closing it ends your membership and cancels all earned and pending reward points, and you stop receiving survey invitations once emails already queued have cleared. We then delete your personal data within 30 days, except for records we must keep by law (such as reward payout records) and the fraud-prevention records described above. You can ask us to delete your data at any time.

10. Data Security

We use reasonable technical and organizational measures to protect personal data, including encryption in transit, access controls, staff confidentiality obligations, vendor due diligence, and regular security reviews. No system is completely secure. If a personal data breach occurs that is likely to harm you, we will notify you and the relevant regulators as required by law (for example, within 72 hours to EU/UK supervisory authorities where feasible, to the Data Protection Board of India and affected individuals under the DPDP Act, and to the Office of the Privacy Commissioner of Canada and affected individuals where there is a real risk of significant harm, and to the regulators and affected individuals that the laws of Singapore, Brazil, Australia and the UAE require).

We use secure server software (SSL) and firewalls to protect your information from unauthorized access, disclosure, alteration or destruction. You are responsible for keeping your password and account information secret. If you suspect unauthorized access to your account, tell us immediately at compliance@true-opinion.com.

11. Your Rights

You may exercise the rights below by contacting us at [privacy@true-opinion.com] or through the account settings page. We may need to verify your identity before acting on a request. We will respond within the time required by applicable law (generally within one month under GDPR, 45 days under CCPA, 30 days under PIPEDA, and within the period prescribed under the DPDP Rules). Exercising your rights will not result in discrimination.

Self-service. You can view, update or delete your profile information and email preferences at any time by logging in and choosing "Update Account Information". Your email address is also your username, so use the new address to log in if you change it. We may take reasonable steps to verify your identity before granting access or changes. For any other request, email compliance@true-opinion.com.

11.1 European Economic Area, UK and Switzerland (GDPR)

You have the right to: access your data; correct inaccurate data; erase your data ("right to be forgotten"); restrict processing; data portability; object to processing based on legitimate interests or for direct marketing; withdraw consent at any time (without affecting earlier lawful processing); and not be subject to decisions based solely on automated processing that significantly affect you. You may also lodge a complaint with your local supervisory authority (for example, the ICO in the UK, or the authority in your EU Member State of residence).

11.2 California, USA (CCPA/CPRA)

If you are a California resident, you have the right to: know what personal information we collect, use, disclose and share; access a copy of it; delete it; correct inaccurate information; opt out of the sale or sharing of personal information; limit the use of sensitive personal information; and non-discrimination for exercising your rights. You may use an authorized agent to submit a request on your behalf.

Categories of personal information collected in the last 12 months: identifiers (name, postal address, email address, phone number, IP address, device ID); account log-in credentials; customer records and demographic information you provide in your profile, including income, education and employment details; financial information needed to pay rewards (such as PayPal or bank details); commercial information (reward balance and redemption history); internet and network activity; approximate geolocation (country, state, city); inferences drawn to match you with surveys; and, where you choose to provide it, sensitive personal information (such as racial or ethnic origin, religious beliefs, or health information).

Sources: directly from you, automatically from your device, and from partners and service providers (see Section 3).

Business purposes: as set out in Section 4.

Disclosure: we disclose identifiers, internet activity and approximate geolocation to service providers for the business purposes in Section 4 (hosting, analytics and fraud prevention), and identifiers and payout details to payment providers (such as PayPal or banks) to deliver your rewards. We do not disclose your profile data to research clients or other third parties without your consent.

Sale and sharing: we do not sell personal information, and we do not share your account or profile data with research clients or other third parties. Our use of analytics cookies such as Google Analytics could be treated as "sharing" for cross-context behavioral advertising under California law. If you wish to opt out, use the "Do Not Sell or Share My Personal Information" link [link] or enable GPC in your browser. We do not knowingly sell or share the personal information of consumers under 18.

Sensitive personal information is used only for the purposes you have consented to and not to infer characteristics about you beyond that purpose.

Shine the Light: California residents may request information about disclosures of personal information to third parties for their direct marketing purposes by contacting us.

California notice: our separate Privacy Notice for California Residents gives more detail on California rights.

11.3 Canada (PIPEDA)

We collect, use and disclose personal information with your knowledge and consent, for purposes that a reasonable person would consider appropriate. You have the right to: access your personal information and learn how it has been used and disclosed; challenge its accuracy and have it corrected; withdraw consent (subject to legal or contractual restrictions and reasonable notice); and ask questions about our privacy practices. Our Privacy Officer (Section 2) is accountable for compliance. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) or your provincial regulator. Québec residents may have additional rights under Law 25, including information about automated decisions and the right to data portability.

11.4 India (DPDP Act, 2023)

If you are a Data Principal under the DPDP Act, you have the right to: obtain a summary of the personal data we process and the processing activities, and the identities of other Data Fiduciaries and processors with whom it is shared; correct, complete or update your data; erase your data when it is no longer needed for the purpose or when you withdraw consent, unless retention is required by law; withdraw consent at any time, with the ease with which it was given; grievance redressal, by contacting our Grievance Officer (Section 2), who will respond within the period prescribed by law; and nominate another individual to exercise your rights in the event of your death or incapacity. If your grievance is not resolved, you may approach the Data Protection Board of India. You also have duties under the Act, including not furnishing false information or impersonating another person.

We process personal data in India on the basis of your consent, or for the "certain legitimate uses" recognized in the Act (for example, compliance with law). A notice describing the data and purpose is provided at or before the time we request your consent, and you may access that notice in English or in any language listed in the Eighth Schedule to the Constitution of India on request.

11.5 Singapore (PDPA)

If you are in Singapore, we handle your personal data in line with the Personal Data Protection Act 2012. We collect, use and disclose it only for the purposes in Section 4, with your consent or where the PDPA allows. You may ask for access to the personal data we hold about you and how it has been used or disclosed in the past year, ask us to correct errors, and withdraw your consent at any time on reasonable notice. We will tell you the consequences of withdrawing, such as no longer being able to remain a member. We respond to access and correction requests within 30 days. If we transfer your data outside Singapore, we take steps to ensure it receives protection comparable to the PDPA. We notify the Personal Data Protection Commission (PDPC) and affected individuals of data breaches that are likely to cause significant harm or are of significant scale. Our Data Protection Officer (Section 2) handles PDPA queries, and you may also complain to the PDPC.

11.6 United Arab Emirates (PDPL)

If you are in the UAE, we process your personal data in line with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, to the extent it applies and is in force. You have the right to be informed about how we process your data, to access it, to ask for correction or erasure, to restrict or object to processing (including automated processing that significantly affects you), to receive your data in a portable format, and to withdraw consent at any time. We process sensitive data only with your explicit consent where the law requires it. We transfer data outside the UAE only where the PDPL permits, with appropriate safeguards or your consent. You may complain to the UAE Data Office. If you are located in the DIFC or ADGM, the data protection laws of those zones may also apply and give you similar rights, and you can contact us to exercise them.

11.7 Brazil (LGPD)

If you are in Brazil, we process your personal data in line with Law No. 13,709/2018 (LGPD), relying on your consent, the performance of a contract, our legitimate interests, or compliance with a legal obligation (Section 4). You have the right to: confirmation that we process your data; access; correction; anonymization, blocking or deletion of unnecessary or excessive data, or data processed unlawfully; portability; deletion of data processed with your consent; information about the entities with which we share your data; information about the consequences of refusing consent; withdrawal of consent; and review of decisions made solely by automated processing. We reply to a simplified request immediately and provide a full declaration within 15 days. Our Data Protection Officer (the encarregado, Section 2) is your contact point. We transfer data out of Brazil using mechanisms the LGPD recognizes, such as the standard contractual clauses approved by the Brazilian data protection authority (ANPD), or with your specific consent. We notify the ANPD and affected individuals of security incidents that may cause relevant risk or damage. You may complain to the ANPD.

11.8 Australia (Privacy Act 1988)

If you are in Australia, we handle your personal information in line with the Privacy Act 1988 and the Australian Privacy Principles. You may ask for access to your personal information and for it to be corrected, and we respond within 30 days. You may opt out of our communications at any time. You may deal with us anonymously or under a pseudonym only where it is practicable, which it is not for membership and reward accounts. Where we disclose your information to recipients outside Australia (Section 8), we take reasonable steps to ensure they handle it in line with the Australian Privacy Principles. We notify the Office of the Australian Information Commissioner (OAIC) and affected individuals of eligible data breaches that are likely to result in serious harm. If you have a complaint, please contact us first. If you are not satisfied with our response, you may complain to the OAIC (www.oaic.gov.au).

12. Children's Privacy

The Services are intended only for individuals aged 18 and over, and you must be at least 18 to register. We do not knowingly collect personal data from anyone under 18. We do not target advertising to children, consistent with the US Children's Online Privacy Protection Act (COPPA).

Why 18: Indian law (the DPDP Act) treats anyone under 18 as a child, requires verifiable parental consent before a child's data is processed, and prohibits tracking or behavioral monitoring of children. Because we use IP tracking and analytics to detect fraud, we accept members aged 18 and over only.

If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

13. Marketing Communications

We send survey invitations, account and reward notices, and service messages as part of your membership. We contact you only for market research purposes and not for third-party marketing. You may unsubscribe at any time using the link in any email or in your account settings. Service messages (for example, security alerts or changes to this Policy) will continue while you have an account.

14. Third-Party Websites and Surveys

Surveys are hosted by our research clients, and the Services may also contain links to other websites. We do not control their privacy practices and are not responsible for them. Please read the privacy notice of any client or third-party site before you provide information.

15. Changes to This Policy

We may update this Policy from time to time. We will post the updated version on this page with a new "Last updated" date and, where changes are material, notify you by email or a prominent notice on the website and, where required, ask you to accept the updated Policy before you continue to use the Services.

16. Contact Us and Complaints

For questions, requests or complaints about this Policy or our handling of your data, contact:

Precise Research Solutions Pvt. Ltd. (TrueOpinion)

Block-F, Lane #3, Building #17, First Floor, Krishna Nagar, Delhi-110051, India

Privacy and data requests: compliance@true-opinion.com. General enquiries: admin@true-opinion.com.

Data Protection Officer: Karun Bansal, compliance@true-opinion.com

Grievance Officer (India): [Name], [email], [phone]

We respond to privacy-related communications within 30 days of receiving them.

You also have the right to complain to a data protection authority in your region, including your EU/UK supervisory authority, the California Attorney General or California Privacy Protection Agency, the Office of the Privacy Commissioner of Canada, or the Data Protection Board of India.

17. Governing Law and Jurisdiction

This Policy is governed by the laws of India, and the courts in New Delhi, India have jurisdiction over disputes arising from it. We do not ask you to waive any of your rights under data-protection law. Nothing in this Policy or our Terms limits the mandatory rights you have under the laws of your own country or region (including the GDPR, UK GDPR, CCPA, PIPEDA, the DPDP Act, the PDPA, the PDPL, the LGPD and the Australian Privacy Act), your right to complain to your local regulator, or your right to bring a claim in your local courts where the law allows.

18. Related Documents

This Policy should be read together with our Terms & Conditions, which set out the rules for rewards, prize draws and membership, and our Cookie Policy.