Your privacy matters at PandaOpinion.

Who we are

PandaOpinion Limited is a market research company that operates the PandaOpinion panel and research platform. We are registered in Hong Kong and our registered office is Room A5, 7/F, Astoria Building, 34 Ashley Road, Tsim Sha Tsui, Hong Kong.

For the purposes of the EU General Data Protection Regulation (GDPR), PandaOpinion Limited is the controller of the personal information described in this policy, except where we act as a processor on behalf of a research client. When we act as a processor, the client is the controller and their privacy notice governs the research project. We process that data only on the client's documented instructions.

Scope of this policy

This policy applies when you visit pandaopinion.com, create or use a panel account, complete a survey or profile questionnaire, contact our team, receive research invitations, or otherwise interact with our services. It covers panel members, prospective members, research clients and business contacts, and visitors to our website.

It does not apply to third-party websites, apps or surveys that we do not control. When a study is hosted or delivered by a partner, that partner's privacy notice may also apply. We encourage you to read it before taking part.

Personal information we collect

We collect information directly from you, automatically when you use the service, and from research clients, panel partners, service providers and publicly available sources. The categories we collect depend on how you interact with us:

• Account and identity data. Email address, password (stored in hashed form), email verification status, nickname, country, language preference and account status.
• Profile and research data. Age or date of birth, gender, household composition, education, employment, consumer habits, interests, opinions, survey answers, study participation and quality-control records.
• Sensitive information. Some surveys or profile questions may ask about racial or ethnic origin, health, political opinions, religious or philosophical beliefs, sexual orientation, sex life or trade union membership. You are never required to answer these questions. Where we collect sensitive information, we ask for your explicit consent and use it only for research purposes.
• Rewards and payout data. Reward balance, redemption history, payout method, transaction records and, where required by law, tax information.
• Device and usage data. IP address, approximate location derived from IP address, browser and device type, operating system, language, pages viewed, timestamps, referring page, cookie identifiers and security or fraud-prevention signals.
• Communications. Emails, support requests, complaints, survey invitations and records of our correspondence with you.
• Business contact data. Name, work email address, telephone number, organisation, role, project requirements, billing details and communications with prospective or current research clients.

How we use information and our lawful bases

We use personal information to:

• create and administer your panel account, verify your email address and provide member support;
• match you with research studies, send invitations and administer participation and rewards;
• analyse survey responses and produce aggregated or de-identified research results for clients;
• detect duplicate accounts, fraud, low-quality responses and security threats;
• operate, maintain and improve the website, panel and research platform;
• respond to enquiries, prepare proposals and deliver services to research clients;
• comply with legal, tax, accounting and regulatory obligations; and
• send service messages and, where permitted, research invitations and marketing communications.

Under the GDPR, we rely on the following lawful bases. We only use the basis that applies to the particular activity:

• Contract. To create and administer your account, deliver studies you agree to take part in, pay rewards and provide services to clients.
• Consent. For optional profile questions, sensitive information, research invitations and marketing where consent is required, and non-essential cookies. You can withdraw consent at any time.
• Legitimate interests. To keep the service secure, prevent fraud and duplicate accounts, improve our services, communicate with business contacts and establish or defend legal claims. We balance these interests against your rights and freedoms.
• Legal obligation. To keep tax, payment, accounting and other records, and to respond to lawful requests from authorities.
• Vital interests.In the rare case where processing is necessary to protect someone's life.

You are not required by law to provide personal information. However, if you do not provide the information needed to create an account, complete a study or receive a reward, we may not be able to provide those services.

Cookies and similar technologies

We use a small number of cookies and similar technologies to operate the portal. These include authentication and session cookies that keep you signed in, a preference cookie that remembers your language choice, and security cookies used to protect the service from misuse. We do not use advertising cookies or cross-site tracking cookies.

• Strictly necessary. Session and authentication cookies such as tk_public_token and tk_public_auth, which expire when your session ends or after the remembered-login period you choose.
• Preferences. A language cookie such as tk_locale, which remembers whether you prefer English or Chinese for up to one year.
• Security and performance. Limited technical logs used to detect abuse, troubleshoot errors and keep the service available.

You can block or delete cookies in your browser settings. Blocking strictly necessary cookies may prevent you from signing in or using some parts of the service. Where consent is required by law, we will ask for it before setting any non-essential cookies.

How we share personal information

We share personal information only as described in this policy and only for the purposes we explain:

• Service providers. Hosting, email delivery, survey hosting, payment and payout, identity verification, fraud prevention, security, customer support, analytics and professional advisers. They process information on our behalf under contracts that require confidentiality and appropriate security.
• Research clients. Clients receive aggregated results and de-identified records. We do not disclose your name, email address, phone number or identity document to a client unless you separately consent.
• Research partners and sample suppliers.Where a study is delivered with a partner, we share only the information needed to route you to the study and administer your participation. The partner's privacy notice will apply to its processing.
• Legal and safety. We may disclose information when required by law, legal process or a lawful request from a public authority, or when necessary to protect our rights, users or the public.
• Business transfers. If we merge with, acquire or sell all or part of our business, information may be transferred as part of that transaction, subject to appropriate safeguards.
• With your consent. We may share information for other purposes when you explicitly ask us to or consent to it.

We do not sell personal information, rent it to third parties or use it for behavioural advertising. We do not disclose personal information to clients for their own marketing.

No sale of personal information

We do not sell or rent personal information. We disclose only aggregated or de-identified research results to clients, and we use contractual and technical measures to keep that data from being linked back to you.

If our practices change, we will update this policy and, where required by law, obtain your consent or provide an opt-out before the change takes effect.

International transfers

We are based in Hong Kong and may process information in Hong Kong and in other countries where we, our affiliates or our service providers operate, including the United States, the European Union and Asia. Privacy laws in those countries may differ from the laws where you live.

Where we transfer personal data from the EU/EEA, we use appropriate safeguards, including the European Commission Standard Contractual Clauses and transfer risk assessments. You can ask us for more information about the safeguards we use by contacting us using the details below.

How long we keep personal information

We keep personal information only for as long as we need it for the purposes described in this policy, unless a longer period is required or permitted by law. Our typical retention periods are:

• Account and profile data: while your account is active, then for up to 24 months after closure for legal, audit and dispute-resolution purposes.
• Survey responses and research records: for the duration of the study and up to 24 months after the study closes, unless a client contract or law requires a longer period.
• Reward, payout and tax records: up to seven years after the relevant transaction or as required by tax and accounting law.
• Support and complaint records: up to 24 months after the matter is closed.
• Security and website logs: up to 12 months, unless needed to investigate a security incident or legal claim.
• Marketing preferences: until you opt out, plus a suppression record so we do not contact you again.

When information is no longer needed, we delete it or turn it into aggregated or de-identified data that cannot reasonably be linked back to you.

How we protect personal information

We use administrative, technical and organisational safeguards designed to protect personal information against unauthorised access, loss, misuse and alteration. These include encrypted connections, hashed passwords, access controls, least-privilege permissions, monitoring, vendor due diligence and an incident response process.

No method of transmission or storage is completely secure. You are responsible for keeping your password confidential and for telling us promptly if you believe your account has been compromised. If we become aware of a breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant authority as required by law.

Your rights under the GDPR

If you are in the EU/EEA, you have the following rights in relation to your personal data, subject to the conditions and exceptions in applicable law:

• Right of access. You can ask for a copy of the personal data we hold about you and information about how we use it.
• Right to rectification. You can ask us to correct inaccurate or incomplete personal data.
• Right to erasure. You can ask us to delete your personal data where there is no lawful reason for us to keep it.
• Right to restriction. You can ask us to restrict processing while we verify or consider a request.
• Right to data portability. You can ask for data you provided to us in a structured, commonly used and machine-readable format, and ask us to transfer it where technically feasible.
• Right to object. You can object to processing based on legitimate interests or to direct marketing. We will stop unless we have compelling legitimate grounds or a legal requirement to continue.
• Right to withdraw consent. Where processing is based on consent, you can withdraw it at any time without affecting processing that already took place.
• Rights relating to automated decisions. You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.
• Right to complain. You can lodge a complaint with your local supervisory authority.

We respond to requests without undue delay and normally within one month. If a request is complex, we may extend that period by up to two further months and will tell you if we do. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.

How to exercise your rights

To exercise a privacy right, email support@pandaopinion.comwith the subject line “Privacy request”, or write to us at PandaOpinion Limited, Room A5, 7/F, Astoria Building, 34 Ashley Road, Tsim Sha Tsui, Hong Kong.

Please tell us which right you want to exercise and include enough information for us to find your account, such as the email address you used to register. We may ask you to verify your identity before we act on a request.

We will explain if we cannot comply with a request and the legal reason. You can also complain to your local data protection authority.

Children and minors

The panel and our services are intended for people aged 18 and over. We do not knowingly collect personal information from children under 18. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

Marketing and communications

We send service messages that are necessary to operate your account, such as verification emails, security notices and study administration messages. Where we rely on consent or legitimate interests, we may also send research invitations and updates. You can opt out of marketing emails using the unsubscribe link in the message or by contacting us. We will still send essential service messages.

For business contacts, we may send relevant service information based on our legitimate interests. You can ask us to stop at any time.

Automated quality and fraud checks

We use automated checks to detect duplicate accounts, fraudulent activity, low-quality responses and security threats. These checks may use IP address, device and browser signals, response timing, answer patterns and attention checks. They can affect whether a response qualifies for a reward or whether an account is restricted.

These checks do not make decisions that produce legal or similarly significant effects without human involvement. You can contact us to ask for a human review of a decision that affects your account or reward.

Changes to this policy

We may update this policy to reflect changes in our practices, technology or legal requirements. When we make a material change, we will update the date at the top of this page and, where appropriate, notify you by email or through the panel. We will use information collected before the change in accordance with the policy that was in effect when it was collected, unless you consent to the new use or the law requires otherwise.

Contact and complaints

For privacy questions, requests or complaints, contact our Privacy Team at support@pandaopinion.com or write to PandaOpinion Limited, Room A5, 7/F, Astoria Building, 34 Ashley Road, Tsim Sha Tsui, Hong Kong.

If you are in the EU/EEA, you can also complain to your local supervisory authority. Where we are required to appoint an EU representative, we will publish their contact details in this section and route privacy requests to them.