Privacy Policy

Resource Systems Group, Inc. (“RSG”, “we,” “our,” or “us”) collects and processes information that identifies you or can reasonably be linked to you. This Privacy Policy describes how we collect, use, disclose, and otherwise process personal information, and it applies to personal information we collect or process about you through our website, application(s), surveys, services and other interactions with you. Our collection and processing of personal information is subject to applicable laws and regulations governing privacy and data protection (“Data Privacy Laws”).

We may update or modify this Policy at any time by posting the amended version to our website and including the effective date of the updated version. By using our services and providing us with your personal information, you agree to the terms of this Policy and our collection and use of information in accordance with this Policy. If you do not agree to be bound by this Policy, you should not access or use our services or disclose any personal information to us through our services.

Prior to your participation in certain research projects, we may present you with a license agreement, terms of use, instructions, or a privacy notice specific to that project (collectively, “Project-Specific Documentation”), which may contain further terms governing our treatment of your personal information. We will provide Project-Specific Documentation to you before we collect personal information through the relevant survey or application. Except as stated otherwise in this Policy, if Project-Specific Documentation conflicts with this Policy, the Project-Specific Documentation governs.

This Policy does not apply to our processing of personal information:

In the employment context for our own workforce or for our own employment purposes.
On behalf of clients, to the extent we act as a service provider or processor and such processing is governed by applicable agreements with those clients.
To the extent such processing is otherwise excluded from the scope of applicable Data Privacy Laws.

I. How To Contact Us

If you want to exercise your rights applicable under Data Privacy Laws, update your preferences and information, or have any questions or concerns about this Policy or about RSG’s processing of personal information, please contact our privacy officer as follows:

Tim Young, CTO
Resource Systems Group, Inc.
55 Railroad Row, Suite 200
White River Junction, VT 05001
802.295.4999
dataprivacy@rsginc.com

II. Information We Collect and How We Collect It

A. Information You Provide to Us

We collect personal information you provide to us, such as when you visit our website, respond to a survey invitation, determine your eligibility to participate in a research project, create or update a survey account, download or use one of our mobile applications, participate in a survey or research project, request a reward for completing a research project, or otherwise contact or engage with us, including over a web form, the telephone, online chat, social media, or in person.

The information we collect depends on the parameters of the research we are conducting and is described in the applicable Project-Specific Documentation. You may choose not to provide us with certain information, although that may disqualify you from participating in a survey or research project.

Information you provide to us may include, but is not necessarily limited to, the following:

Identifiers
- Contact information, such as name, physical and mailing address, phone number, and email address
- Account credentials, such as a user name or email address in combination with a password or security question that permits access to a survey account you establish as part of your participation in a research project
Demographic Information. Gender, age, date of birth, household income, household composition, employment status, and educational status
Location Information. Home, work, and school address, zip code, and other locations you identify to us
Travel and Mobility Information. Travel habits, trip purposes, modes of travel, vehicle ownership and availability, and other travel-related information
Survey Responses. Your answers to survey questions, including your opinions, preferences, and attitudes
Reward and Incentive Information. Information necessary to deliver a reward for completing a research project, such as name, mailing address, and email address
Sensitive Personal Information, including:
- Precise geolocation data, as further described below
- Additional demographic data, such as information about your race and ethnicity, as may be described in the applicable Project-Specific Documentation
- Information about children, where a research project involves the collection of information about members of your household who are children

Except as described in this Policy or in the applicable Project-Specific Documentation, we do not knowingly collect sensitive personal information, including information revealing political opinions, religious or philosophical beliefs, or trade union membership; genetic or biometric data; information concerning health, sex life, or sexual orientation; government-issued identifiers; financial account or login credentials; or the contents of your nonpublic communications. Where Project-Specific Documentation states that we collect such information, that documentation will explain the collection and request your informed consent.

B. Information Automatically Collected

In addition to information you choose to submit to us, we and/or our service providers may automatically collect and/or store certain information when you visit or interact with our website, use one of our applications, participate in a research project, or open or click on emails we send you. This information may be stored and/or accessed from your personal computer, laptop, tablet, mobile phone, or other device.

Information we collect automatically may include, but is not necessarily limited to, the following:

Device Information. IP address, URL address, unique device identifiers, device and/or browser settings, browser type, operating system, and other information regarding your interactions with our website and mobile applications.
Precise Geolocation Data. Our mobile applications collect Global Positioning System (GPS) location data while you are participating in a research project. These data trace your locations over the course of a day, week, month, or year, depending on the monitoring period identified in the applicable Project-Specific Documentation.
Advertising Identifiers. We may collect the advertising ID of your device. An advertising ID is a user-resettable identifier assigned by a device or operating environment. Where we collect your advertising ID, we do so only to the extent permitted by the terms and conditions that govern your device.
Cookies. Our website may use cookies. Cookies are text files that our web server may place on your device to store your preferences or help us improve our services. We collect the following information via cookies: aggregate statistical information, information related to your use of our website (including the links you click, your movement around the website, the pages you visit, the number of times you open a page, and which information is consulted), your IP address, and your browser type. You can set your browser to notify you when you receive a cookie, allowing you to accept or reject it and to delete it when you leave our website. However, if your browser does not accept cookies, you may not be able to use all features of our website or participate in certain research projects. For more information about cookies and how to control and delete cookies in various browsers, you can visit https://aboutcookies.org/. This website is not affiliated with us.
Third-Party Analytics. We may use third-party analytics tracking technologies and tools to collect information about how you use our website, such as the frequency of visits, pages viewed, traffic data, location, referring and exit pages, and error information. These tools may also collect device information, discussed above. These tools examine website activities to prepare usage reports, and this information helps us improve our website and enhance user experience. Tracking information will be shared with the third-party analytics provider, which may use that information for its own purposes. While the tracking information we collect through such tools is not sufficient on its own for RSG to identify you, the third-party analytics provider may be able to combine it with other data it has to identify you.

If you would like to limit the ability of tracking technologies and tools to track your activity on our website, you can either configure your preferences for cookie settings on our website or disable cookies in your Internet browser settings, although doing so may impact the performance and effectiveness of our website. Additionally, Do Not Track is a preference you can set in your web browser to inform websites that you do not want to be tracked. You can enable or disable Do Not Track by visiting the preferences or settings page of your web browser. However, these features are not yet uniform, so we do not currently respond to such features or signals. If your browser transmits a Global Privacy Control (“GPC”) signal, we will treat that signal as a valid request to opt out of the sale or sharing of personal information and out of targeted advertising, to the extent required by applicable state law.

C. Information Provided by Third Parties

We may receive personal information about you from third parties. The client sponsoring a research project may provide us with your contact information in order to invite you to participate. We may also receive information from service providers and vendors that collect information from you on our behalf and at our direction, including providers that operate survey platforms, contact and inquiry forms, communications tools, and reward and incentive fulfillment services.

We also purchase datasets about mobile device users from third parties, which inform the market research we conduct for our clients. The individuals in these datasets are not identified to us when we acquire them. The information in these datasets includes device advertising IDs, GPS location data, information regarding application usage, and information about general usage of the devices. Although the information in these datasets is not personal information when we acquire it, at times it becomes personal information after we combine it with the personal information we collect through our research projects, because we are then able to identify specific individuals in the datasets. Where we obtain advertising IDs from third parties, we retain and use them only to the extent permitted by the terms and conditions that govern the relevant devices.

To the extent you wish for us to stop receiving information about you from any third party, please contact that third party directly. To the extent you have inquiries or requests with respect to RSG’s use of your information, please contact us as described above.

III. Children

Except as stated otherwise in Project-Specific Documentation, we do not knowingly collect or solicit personal information from anyone under the age of 18, or knowingly allow such persons to participate in our research projects. If you are under 18, please do not attempt to register for a research project or send any information about yourself to us, including your name, telephone number, or email address. No one under age 18 should provide personal information to us or through our surveys or applications. If we learn that we have collected personal information from a child under age 18 without verification of parental consent, we will delete that information as quickly as possible, except as provided below. If you believe that we might have any information from a child under age 18, please contact us as described above.

Please note that at times, depending on the nature of the research project, you may provide us and we may collect personal information regarding children. If you provide us with personal information about a child, you represent that you are that child’s parent or legal guardian and that you have the authority to provide that information to us.

Upon request, we will provide a parent or guardian who has provided proper identification with the following: (1) a description of the specific types of personal information collected from the child, (2) the opportunity to refuse or permit our further collection and use of personal information from the child, and (3) a reasonable means for the parent or guardian to obtain any personal information collected from the child. If a parent or guardian does not permit our continued collection and use of personal information from a child, we will delete the child’s personal information and terminate the account of the child, as applicable.

IV. How We Use Your Information

Due to the range of research we conduct, RSG may process personal information for a broad range of purposes. While it would be imprudent to attempt to list every such purpose, the following lists some of the more common purposes for which we process personal information. The purposes for which we process personal information collected through a particular research project are further described in the applicable Project-Specific Documentation.

Conduct Research. Activities related to conducting research on behalf of our clients, including determining your eligibility to participate in a research project, tailoring survey questions to you, collecting and analyzing your survey responses and travel data, ensuring that our participants are a representative sample of the population being studied, validating and cleaning research data, and preparing findings, statistics, and reports for our clients.
Deliver Research Results to Clients. Providing market research, analysis, and data to the client sponsoring a research project, which allows our clients to plan, evaluate, and improve the products, services, and infrastructure they provide, including rail service, highways, transit systems, roadways, and consumer products.
Communications and Participant Support. To invite you to participate in a research project, deliver participation codes and credentials, send reminders and notifications about your participation, respond to your questions and requests for support, and communicate with you about administrative matters and changes to this Policy and our other policies.
Administer Rewards and Incentives. Determining eligibility for and delivering any reward offered for completing a research project, and administering the terms of any incentive program.
Research and Product Development. Retaining and analyzing information for research purposes; generating statistics and aggregate findings; performing algorithmic analysis and consumer modeling as described under Use of Artificial Intelligence below; and creating, evaluating, developing, improving, and enhancing our surveys, applications, and research methods.
Inferences and Data Enrichment. Using location data, other information collected through our research projects, and information acquired from third parties to infer additional information about you, including your income, the advertising identifier of your mobile device, and the location of your home, work, and school.
Compliance, Safety, Claims, and Website. To comply with applicable laws and regulations; to ensure safety and protect RSG, our personnel, individuals, third parties, and our technology systems; to establish, enforce, and exercise our rights and defend against claims; to detect, respond to, prevent, or protect against illegal or unlawful activity, fraud, malicious or deceptive activities, identity theft, or any other security incident, and to assist investigations by police or other responsible authorities; and to monitor, develop, and maintain the operation, security, and integrity of our website, applications, and technology systems.
Business Relationships. Interact with clients, prospective clients, and other third parties with respect to RSG’s or their business activities and interests.
Other Administrative Functions. Carrying out audits to ensure compliance with our regulatory and legal obligations; dealing with complaints, inquiries, and incident reports; maintaining and servicing your survey account or file; obtaining data analytics; and identifying and repairing errors that impair intended website and application functionality.
Operations. Activities related to RSG’s operations, including administration, accounting, finance, technology, cybersecurity, privacy, vendor and service provider management, and records management, and engaging in other research, business, operational, financial, technological, and other activities that are reasonably anticipated based on your relationship with RSG or otherwise compatible with the processing of personal information in furtherance of conducting our research.
Legal and Risk Management. Seeking advice on our legal rights and obligations, and identifying, contacting, or bringing legal action against someone who may be causing injury to or interference with (intentionally or unintentionally) our rights or property, our personnel, participants, or anyone else who could be harmed by such activities.

V. How We Share Your Information

Except as necessary or appropriate to conduct our research and provide our services, RSG does not disclose your personal information to any third party. We may disclose personal information with certain third parties who we engage to help us run our business and conduct our research, and with the clients that sponsor our research projects, including for the following purposes and in the following circumstances.

Clients That Have Retained Us to Conduct Research. We disclose personal information, information derived from personal information, and aggregate information to the client sponsoring a research project, unless the applicable Project-Specific Documentation specifically precludes such disclosure. Our clients include municipalities, government agencies, political subdivisions, organizations that oversee transportation systems, and manufacturers of consumer goods. At times, we may provide you with more information in Project-Specific Documentation about a specific client, the categories of clients, or a client’s industry or sector.
Where You Direct Us To. Based on consent and direction given to us by individuals and third parties about whom the personal information pertains or who otherwise have authority or consent to provide such consent or direction.
Third-Party Service Providers. For the purpose of operating our business and conducting our research, we may transfer your personal information to our third-party service providers who use that information only to conduct RSG business. For example, these service providers may handle survey platform hosting, mobile application development and support, data storage and cloud hosting, contact and inquiry forms, email and text message distribution, reward and incentive fulfillment, website analytics, and other services for RSG. We only provide our service providers with the information they need to perform their services and work with them to respect and protect your information.
Third Parties That Assist With Research Participation. In certain circumstances, we disclose contact information, including your name, phone number, email address, and physical address, to third-party businesses that may contact you by email, telephone, or text message to assist you in completing a survey or research project on behalf of our clients.
Reward and Incentive Fulfillment. Where a research project offers a reward for completion, we may share your contact information with third-party businesses we partner with to deliver that reward.
Legal Requirements and Security
- If required to do so by applicable law, legal process or warrant, or order of any court or governmental agency or authority, including lawful requests by public authorities to meet national security or law enforcement requirements. We will notify you of any such request unless prohibited by law.
- To enforce our policies, or to protect our or others’ rights, property, or safety.
- To assist in fraud protection or investigation, including exchanging information with other companies and organizations for fraud protection.
- To public health and law enforcement agencies, authorities, and officials.
- To professional service providers, including attorneys, accountants, tax professionals, financial advisers, and consultants, if doing so is necessary or appropriate to obtain professional services from them
Site Monitoring. Web analytics providers who monitor and analyze the use of our website. For more information, please visit the applicable provider’s privacy policy.
Corporate Transfers. In connection with a sale, merger, consolidation, change in control, transfer of substantial assets, reorganization, or liquidation of RSG. If RSG is subject to a merger or acquisition with or by another organization, we may share information with the other organization in connection with the transaction, and your personal information may be transferred to such organization upon completion of the transaction.

VI. Text Message Communications

Certain research projects require us to send you a secure participation code that you use to access a survey or application and to log back in during the study period. Where a research project requires a code of this kind, we ask you to provide an email address or a mobile phone number so we can deliver it to you. If you provide a mobile phone number, we may send you that code and any replacement code by text message.

We may also send you text message reminders to complete a survey during the study period, notifications about your participation, and responses to your requests for support. Reminders are optional, and we send them only if you separately elect to receive them. We do not send marketing or promotional text messages.

We send text messages only where you have provided your mobile phone number and consented to receive them. We obtain that consent at the point we collect your mobile phone number, and the disclosures presented at that time describe the messages you will receive. Providing a mobile phone number is not a condition of participating in any research project, and you may choose to receive your participation code by email instead.

You may opt out of receiving text messages from us at any time by replying STOP to any message we send you. You may also submit a request as described under Privacy Rights and Requests below. We honor opt-out requests received by any reasonable means, and we will stop sending you text messages within the time required by applicable law. Message frequency varies depending on the research project and your participation. Message and data rates may apply.

RSG does not sell or share your mobile phone number with any third party for marketing or promotional purposes. We do not share your consent to receive text messages with any third party, other than the service providers and carriers that transmit the messages on our behalf. This paragraph applies notwithstanding any other provision of this Policy or any Project-Specific Documentation.

VII. Legal Bases for Processing Personal Information

RSG processes personal information for several different purposes and legal bases, including to fulfill our contractual, statutory, common law, and other commercial and legal relationships and duties, including conducting research and providing our services; in furtherance of our legitimate interests in conducting research for our clients; and in connection with public interest.

In addition, we may collect and use your personal information pursuant to your informed consent, which you provide by confirming the prompts presented on our website, application(s), or in connection with a research project and by continuing to participate in that research project, consistent with this Policy and any applicable Project-Specific Documentation. Without your consent to the collection and use of the personal information required for a particular research project, we may not be able to allow you to participate. You may withdraw your consent at any time as described under Privacy Rights and Requests below.

Where you provide us with personal information about another person, you represent that each person whose consent is required under applicable law has consented to your sharing that information with us for the purposes described in this Policy and any applicable Project-Specific Documentation.

If and to the extent necessary and not prohibited by applicable law, RSG also may process personal information for one or more of the following reasons: to comply with local, state, federal, or foreign laws, rules, or regulations; to comply with a civil, criminal, judicial, executive, legislative, agency, or other regulatory inquiry, investigation, subpoena, summons, or other legal process; to cooperate with a law enforcement agency or authority concerning conduct or activities that RSG in good faith believes may violate a local, state, federal, or foreign law, rule, or regulation; to investigate, establish, exercise, prepare for, or defend any allegation or claim concerning conduct that RSG in good faith believes may violate an RSG rule or policy or a local, state, federal, or foreign law, rule, or regulation; to protect an interest that is essential for the life or physical safety of an individual or another person; to detect, respond to, prevent, or protect against illegal or unlawful activity, fraud, harassment, malicious or deceptive activities, identity theft, or any other security incident; to create, evaluate, develop, improve, enhance, and otherwise manage our research projects and services; and to engage in other research, business, operational, financial, technological, and other activities that are reasonably anticipated based on your relationship with RSG or otherwise compatible with the processing of personal information in furtherance of conducting our research and providing our services.

For individuals and personal information subject to the GDPR: The legal basis on which we process your personal information depends on how you use our website and applications, how you participate in our research projects, and your relationship with RSG. Where our processing is based on a contractual requirement, your failure to provide the relevant personal information may result in RSG terminating the contract.

VIII. Privacy Rights and Requests

Depending on the jurisdiction in which you reside or are located, you may have specific rights under applicable law, including the right to access, correct, or delete the personal information we hold about you. Only you, or someone legally authorized to act on your behalf, may make a verifiable request related to your personal information. Please understand that we are required to verify your request and may require you to provide some information to enable us to carry out such verification. We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.

Making a request does not require you to create an account with us. We will only use personal information provided in a request to verify the requestor’s identity or authority to make the request.

Where applicable law applies to the processing of your personal information, your rights may include the following:

The right to review and access your personal information
The right to receive a copy of your personal information in a usable format and transmit it to a third party (known as the right of data portability)
The right to request us to erase your personal information when we no longer need such data in connection with our research or services (subject to certain exceptions that may apply under applicable law)
The right to correct any inaccuracies related to your personal information
The right to know the categories of personal information we collect, the categories of sources from which we collect it, the purposes for which we collect and disclose it, the categories of third parties with whom we share it, and the period for which we retain it or the criteria used to determine that period
The right to opt out of the sale or sharing of your personal information
The right to limit the use and disclosure of your sensitive personal information
The right to withdraw your consent to our collection and use of your personal information, provided that any withdrawal of your consent does not affect the lawfulness of our use of your personal information before the withdrawal
The right to request that we restrict our processing of your personal information
The right to object to our processing of your personal information based on our legitimate interests or on public interest
The right to opt out of being profiled using automated decision-making technology based on your work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements
The right to opt out of targeted advertisements selected based on personal information from your activities over time and across nonaffiliated websites or online applications
The right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. Please note that we do not use your personal information to profile you in any way that produces legal or similarly significant effects

To make a request concerning these rights, please complete and submit the Privacy Rights Request Form on our website. RSG will respond to all complete requests within 30 days, subject to extension of that period. Also, there may be a delay in processing a request while we verify that the request is valid and originates from a person authorized to make it.

There may be valid reasons that require or permit us to decline to honor a request, in whole or in part, including legal and regulatory requirements that we retain and process certain information. Also, honoring certain requests may limit or prevent us from providing certain services to the individual about whom the request is made. In those situations, we will notify you in writing within 30 days, subject to extension of that period. You may also contact our privacy officer for information about and help with those situations.

Tim Young, CTO
Resource Systems Group, Inc.
55 Railroad Row, Suite 200
White River Junction, VT 05001
802.295.4999
dataprivacy@rsginc.com

Non-Discrimination. We will not discriminate against you for exercising any of the rights described in this Policy. Unless permitted by applicable law, we will not deny you services, charge you different prices or rates, or provide you a different level or quality of services because you exercised your privacy rights. Consistent with applicable law, we may offer rewards for completing a research project, and we may withdraw or withhold a reward if you opt out of the disclosure of your personal information to our clients.

Authorized Agents, Appeals, and Complaints

Authorized Agents. Where the law of your jurisdiction provides, you may authorize an agent to make a request on your behalf. To do so, you must provide the agent with written and signed authority to act for you, and provide us with written and signed notice that we may act on requests submitted by that agent. We may also require you to verify your own identity directly with us before acting on the agent’s request. A parent or legal guardian may submit a request on behalf of a minor.

Appeals. Where the law of your jurisdiction provides a right of appeal, and if we refuse to take action on a request to exercise your rights, you may appeal our refusal within a reasonable period of time. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decision, within the time period specified in the applicable law. If the appeal is denied, we will also provide you with information about how to file a complaint with the relevant regulatory authority, as described below.

Complaints. Regulatory authorities that oversee privacy laws generally advise individuals to raise an objection or challenge with the relevant organization before lodging a formal complaint. If you are dissatisfied with our response, or if you wish to file a complaint with a regulatory authority directly, you may do so as follows:

United States: You may file a complaint with the Attorney General’s office of the state in which you reside.

European Economic Area and United Kingdom: You may lodge a complaint with a supervisory authority in the European Union member state of your habitual residence, place of work, or the place of the alleged infringement. In the United Kingdom, you may lodge a complaint with the Information Commissioner’s Office.

Canada: You may file a complaint with the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca/en/report-a-concern/.

Australia: You may file a complaint with the Office of the Australian Information Commissioner at https://www.oaic.gov.au/.

Please note that the links above are subject to change by the relevant regulatory authorities, and you may need to visit another site or contact the relevant authority by other means in order to file a complaint.

IX. Rewards and Incentives

RSG may offer a reward to individuals who complete a research project in its entirety. These rewards include gift cards or certificates. If you do not complete the research project for which a reward is offered in its entirety, we may not provide the reward. Any reward we offer represents a good-faith estimate of the value of the personal information collected through the relevant research project, based on our contract with the client that sponsored it.

Where a research project offers a reward for completion, the applicable Project-Specific Documentation will provide more information about the reward and its terms. You may choose not to receive a reward by following the instructions in the Project-Specific Documentation or by submitting a request as described under Privacy Rights and Requests above.

Consistent with the non-discrimination provisions described above and with applicable Data Privacy Laws, we retain the right to withdraw or withhold a reward if you opt out of the disclosure of your personal information to our clients.

X. Use of Artificial Intelligence

RSG uses artificial intelligence, or AI, to process personal information and for other purposes, including for the purposes and bases described above and with respect to our research and services. While it would be imprudent to attempt to list every such use of AI, particularly since it is an evolving technology, the following lists some ways that RSG uses AI to process personal information and for other purposes: organize, summarize, analyze, recognize patterns, and identify specific aspects of information; review and categorize open-ended survey responses; process and validate survey and travel data through our data processing pipelines; perform algorithmic analysis and consumer modeling, including through the development and application of proprietary or open source algorithms, applications, programs, and tools that analyze personal and non-personal information and assist with market research; create records, documents, text, communications, and similar content generated by AI based on information and prompts input into AI; conduct research and analysis; use notetakers and transcribers for meetings and video conferences; and perform other discrete aspects of our research and services.

RSG has established an AI steering committee that oversees our AI activities and has adopted internal policies governing the ethical, legal, fair, and responsible use of AI, including an internal AI acceptable use policy. Our use of AI is subject to human review and validation, and we apply appropriate security practices to our AI and data handling activities. RSG may use research data, including personal information, to develop, train, evaluate, and improve statistical and machine-learning models used in connection with our research and services, where permitted by applicable law, contractual obligations, and project-specific documentation, and subject to appropriate privacy, security, and governance safeguards.

RSG does not permit third-party AI service providers to use personal information submitted to their services to train or improve AI models for their own purposes.

RSG does not use AI to make fully automated decisions that produce legal or similarly significant effects concerning you.

XI. Video and Audio Recording

RSG uses technology to facilitate meetings, video conferences, and other events, including technology that captures video, images, and audio, such as recording devices and AI notetakers and transcribers. By participating in RSG meetings, video conferences, and events, you consent to RSG’s recording and processing of video, images, and audio collected during such meetings, video conferences, and events.

XII. Links to Other Sites

Our website may link to third-party platforms. If you click on one of those links, you will be taken to websites we do not control. This Policy does not apply to the information practices of those third-party websites. You should read the privacy policies of third-party websites carefully. We are not responsible for the content, privacy policies, actions, or security of third-party websites.

XIII. Data Security and Retention

We use appropriate technical, administrative, and physical safeguards to protect against loss, unauthorized access, destruction, misuse, modification, and improper disclosure of the personal information we collect, in both physical and electronic form. To that end, we use encryption in transit and cloud services that comply with globally recognized security practices and standards to protect personal information submitted to us, both during transmission and once we receive it. We take reasonable and appropriate steps to contract for and monitor the services we use to determine that they remain compliant with such practices and standards. We also provide information security awareness training to our personnel and conduct periodic quality assurance audits. However, no internet transmission is completely secure, and we cannot guarantee absolute security. Any transmission of personal information is at your own risk.

At times, your access to a survey or application is protected by a participation code or password. You are responsible for preventing unauthorized access to your account and personal information by protecting your code or password and limiting access to your device and browser.

Unless stated otherwise in this Policy or in the Project-Specific Documentation, we store and process the personal information we collect from you on information systems located in the United States. Unless stated otherwise in the Project-Specific Documentation, Personal information we collect from residents of Canada is stored and processed on information systems located in Canada. Some non-personal information may remain on data storage systems in the country or territory where the information was originally provided.

We will retain your personal information for as long as is necessary to fulfill the purpose for which we collected it and any other permitted linked purpose and in compliance with our data retention policies. For example, we will retain and use your personal information to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies. Where our contract with a client requires us to delete the information we have collected for a research project at the end of the project or after a defined period, we will do so.

Factors that may be relevant to determining how long we keep personal information include:

The purposes for which we collected it
The nature of our relationship with the client that sponsored the research project, and the existence of other ongoing or expected projects with that client
The nature of the personal information in question
The length of time we have an ongoing relationship with you and the length of time thereafter during which we may have a legitimate need to reference your personal information to address issues that may arise
Your preferences and how you engage with our website, applications, and research projects
Our internal research needs
Any applicable legal or regulatory requirements, and
Whether we need the information for our business purposes, or to protect our rights, for example in actual or potential litigation.

XIV. Cross-Border Data Transfers and Data Privacy Framework

If and to the extent RSG transfers personal information from another country into the United States, RSG does so in compliance with the Data Privacy Laws of the originating country and for the purposes outlined in this Policy. If and to the extent we transfer personal information of individuals in the European Economic Area or the United Kingdom to the United States, we do so under the EU-U.S. Data Privacy Framework (DPF) and the UK Extension to the EU-U.S. DPF. In addition, we may implement the standard contractual clauses (SCCs) approved by the European Commission and the UK Addendum to the SCCs approved by the UK authorities where appropriate.

RSG complies with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF as set forth by the U.S. Department of Commerce with respect to personal information we process from the European Economic Area and the United Kingdom and transfer to the United States.

RSG has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal information received from the European Union and the United Kingdom, including Gibraltar, in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. If there is any conflict between the terms in this Policy and the EU-U.S. DPF Principles, the principles govern. To learn more about the DPF program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

The categories of personal information we collect, the purposes for which we collect and use it, the third parties to which we disclose it, and the rights you have with respect to it are described elsewhere in this Policy. If you have any question or complaint regarding our adherence to the DPF, please contact us.

A. Liability for Onward Transfers

We remain responsible and liable for the personal information we receive under the DPF and subsequently transfer or disclose to third parties for external processing on our behalf. RSG remains liable under the DPF Principles if such third parties process personal information in a manner inconsistent with the DPF Principles, unless RSG proves that it is not responsible for the event giving rise to the damage.

B. Compelled Disclosure

In certain situations, RSG may be required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. RSG will notify you of any such request unless prohibited by law.

C. Recourse Mechanism and Binding Arbitration

In compliance with the DPF, we commit to resolve DPF Principles-related complaints about our processing of personal information. EU and UK individuals with inquiries or complaints regarding our processing of personal information received in reliance on the DPF should first contact RSG. In the event such complaints concerning our processing of personal information received in reliance on the DPF remain unresolved, EU and UK individuals may refer such unresolved complaints to JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit JAMS for more information or to file a complaint. The services of JAMS are provided at no cost to you. In case your complaint indicates a violation of obligations under the DPF Principles and your complaint cannot be resolved directly with RSG, or through the independent dispute resolution mechanism stated above, you may have the right to invoke binding arbitration under certain circumstances. For additional information on this option, please see Annex I of the DPF.

D. Regulatory Oversight

RSG is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission, which has jurisdiction over RSG’s compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF.

E. Periodic Review and Verification

RSG will renew its DPF certification annually, unless we subsequently determine that we no longer need such certification or employ a different adequacy mechanism. Prior to recertification, RSG will conduct a self-assessment to confirm that our attestations and assertions regarding the processing of personal information are accurate and that we have appropriately implemented these practices.

XV. Questions or Concerns

Tim Young, CTO
Resource Systems Group, Inc.
55 Railroad Row, Suite 200
White River Junction, VT 05001
802.295.4999
dataprivacy@rsginc.com

Last Updated: October 26, 2026