Privacy Notice

Effective June 29, 2026

Culture Index, LLC ("Culture Index") is committed to protecting personal information. This Notice describes the collection, use, disclosure, and protection of personal information in connection with Culture Index websites, surveys, and related services (the "Services"). This Notice is intended to align with the general standards of applicable privacy laws, including the European Union's General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and similar U.S. state privacy laws.

This Notice applies to individuals who complete a Culture Index Survey (the "Survey") and individual users of Culture Index's systems. Use of the Services is subject to the practices described in this Notice. Privacy rights available to Survey takers are described in Section 6.1.

1. Responsibility for Personal Data

1.1 Culture Index as Data Controller

Culture Index is a "data controller," meaning Culture Index decides how the psychometric survey works, how it is scored, platform security, and the analytics performed on aggregate data to validate and improve the Services.

1.2 Working with Our Clients (Independent Data Controllers)

When an organization (the "Client") asks a Survey taker to complete a survey, Culture Index and the Client each act as independent data controllers for different processing activities. Culture Index and the Client are not joint controllers within the meaning of Article 26 of the European Union's General Data Protection Regulation (GDPR). Each party is responsible only for the processing activities it directs and its own compliance with applicable data protection law:

  • Culture Index is the sole controller for the design of the survey, the collection of your responses, the scoring methodology, the security of the platform, the validation and improvement of the Services, and the delivery of results to the Client. Culture Index is responsible for compliance with data protection law in connection with these activities, including lawful basis, security, breach notification, international transfer safeguards, and responding to data subject requests directed to Culture Index.
  • The Client is an independent controller of the results once they are delivered. The Client determines how Survey results are used within the organization and is solely responsible for employment, hiring, promotion, compensation, retention, and other personnel-related decisions, and for complying with the data protection and employment laws that apply to those decisions.

Privacy rights may be exercised through either Culture Index or the Client. Culture Index addresses inquiries relating to the Survey and the personal data it processes. The Client addresses inquiries relating to the Client's use of Survey results and management processes within the organization. The party that receives a request that should be handled by the other party will forward it without undue delay.

1.3 Service Providers

Culture Index utilizes trusted partners for services such as cloud hosting of our applications and data, communications services, and security. Within the privacy and data protection regulations, these partners are commonly referred to as Data Processors and Subprocessors. Each partner is under contract to ensure protection of the data. A list of these partners is available upon request by contacting [email protected].

2. Information Culture Index Collects

2.1 Data Types

Culture Index collects the following categories of information in connection with the Services:

  • Basic Identifiers: Name, email, phone number, birth month and day (excluding birth year), IP address, and login details when applicable.
  • Work Details: Job title, department, and the position being applied for, if requested.
  • Survey Responses: Responses provided and selections made while completing the Survey.
  • Survey Insights (Inferred Data): Culture Index uses the Survey responses to create a profile of the individual's work style preferences and behavioral traits. These are generated using arithmetic calculations and numerical comparisons—not machine learning or other forms of artificial intelligence (AI). They are not medical diagnoses, as further explained in Section 6.3.
  • Website Usage Data: Information about devices used to access the Services and activity on the website, collected through cookies and similar technologies.

2.2 Sensitive Information

To the extent any information described in Section 2.1 is considered "sensitive" or "special category" data under applicable law, such information is used solely to provide and improve the Services. Sensitive or special category data is not used for advertising purposes or to infer characteristics for unrelated purposes. Processing of such data is based on explicit consent, applicable employment law provisions, or another lawful basis permitted under the CCPA, GDPR, or other applicable laws and regulations. Rights relating to the use of sensitive or special category data are described in Section 6.1.

3. Why Culture Index Processes Survey Taker Data

Under privacy laws such as the GDPR, a lawful basis is required for the processing of personal data. Culture Index relies on the following lawful bases, as applicable:

  • Performing a Contract: Personal data is processed to provide Survey results and related Services requested by the Survey taker or the Client.
  • Legitimate Interests: Personal data is processed to maintain platform security, prevent fraud, improve Survey methodology, and support the operation and enhancement of the Services.
  • Consent: Certain processing activities, including marketing communications and the use of non-essential cookies, are based on consent. Consent may be withdrawn at any time through applicable website settings or by contacting [email protected].
  • Legal Obligation: Personal data may be retained or processed as required to comply with applicable laws, regulations, court orders, tax requirements, and record-retention obligations.

4. How the Survey Works

4.1 The Process

The Survey uses automated scoring based on statistical research to create a profile. No machine learning or other AI is involved in these computations. These results are shared with the Client that requested completion of the Survey.

4.2 How the Survey is Used

The Client may use the Survey in connection with recruitment, hiring, placement, team composition, employee development, coaching, succession planning, and other workforce-related decisions. Culture Index provides Survey results and related insights but does not make employment, promotion, compensation, or other personnel decisions on behalf of the Client. Responsibility for the interpretation and use of Survey results, as well as compliance with applicable employment laws and regulations, remains solely with the Client.

5. Sharing Personal Data

Personal data may be disclosed in the following circumstances:

  • Client. Survey results and related reports may be provided to the Client that requested completion of the Survey.
  • Service Providers and Subprocessors. Personal data may be disclosed to service providers and subprocessors performing services on behalf of Culture Index under written contractual obligations, as described in Section 1.3.
  • Professional Advisors. Personal data may be disclosed to professional advisors, including legal counsel, auditors, consultants, and insurers, subject to confidentiality obligations.
  • Legal and Regulatory Requirements. Personal data may be disclosed to regulators, courts, law enforcement agencies, or other governmental authorities where required by law or where necessary to protect the rights, property, or safety of Culture Index, Clients, Survey takers, or others.
  • Corporate Transactions. Personal data may be disclosed in connection with a merger, acquisition, financing transaction, reorganization, sale of assets, or other corporate transaction, subject to applicable legal requirements.

Culture Index does not sell personal data or share it for cross-context behavioral advertising, as those terms are defined under U.S. state privacy laws. Personal data is not used for advertising.

6. Privacy Rights and Representations

6.1 Privacy Rights

Depending on location, the Survey Taker may exercise the following rights:

  • Right to Know and Access. The Survey taker may request confirmation regarding whether Culture Index processes personal data and may request a copy of such data, including the categories of personal data, sources of collection, purposes of processing, and categories of recipients.
  • Right to Portability. The Survey taker may request a copy of personal data in a structured, commonly used, and machine-readable format, where applicable.
  • Right to Correction. The Survey taker may request correction of inaccurate or incomplete personal data.
  • Right to Erasure (Right to Be Forgotten). The Survey taker may request deletion of personal data, subject to applicable legal, contractual, and regulatory exceptions.
  • Right to Object and Restrict. The Survey taker may object to or request restriction of certain processing activities, including processing based on legitimate interests, direct marketing activities, and processing during the pendency of an appeal as contemplated by Article 18 of the GDPR.
  • Right to Limit the Use of Sensitive Personal Information. Where applicable, the Survey taker may request that Culture Index limit the use of sensitive personal information to those purposes permitted by applicable law.
  • Right to Withdraw Consent. Where processing is based on consent, the Survey taker may withdraw consent at any time.
  • Right to Lodge a Complaint. The Survey taker may submit a complaint to a supervisory authority, including, for residents of the European Union, the data protection authority in the Survey taker's country of residence.

Requests relating to the exercise of privacy rights may be submitted to [email protected]. Culture Index will respond within 45 days or within any shorter timeframe required by applicable law. Culture Index will not discriminate against or retaliate against any Survey taker for exercising applicable privacy rights.

6.2 Bias and Fairness

Culture Index conducts periodic validation of its Survey methodology. Documentation is maintained describing the construct and the validation studies that support it. Where the Services are deployed in states and regions that require independent bias audits or impact surveys of automated employment decision tools, Culture Index will cooperate with its Clients to support compliance with these regulations.

6.3 Non-Medical Representation

The Culture Index Survey was designed as a personality inventory that measures work-related traits and behaviors. It was developed and is interpreted by experts in the field of workplace personality inventories — not by medical or health care professionals. The Survey does not seek information about an individual's physical or mental impairments or health conditions. In fact, the noninvasive Survey collects only self-reported information on workplace traits and behaviors. As such, the Survey is not a medical examination and users of the Survey should not attempt to use the Survey to diagnose or identify impairments or disabilities.

6.4 U.S. State-Specific Disclosures

6.4.1 California (CCPA)

The following disclosures are provided to satisfy the specific requirements of the CCPA:

  • Categories of personal information collected in the preceding 12 months: Identifiers, professional/employment information, survey responses, inferred data including sensitive personal information, and internet/usage data, as described in Section 2.
  • Categories of sources: Survey takers, Clients, and Culture Index service providers.
  • Business or commercial purposes: as described in Sections 3 and 4.
  • Categories of recipients of personal data: As described in Section 5.
  • Sale or Sharing of Personal Information: Culture Index does not sell personal information and does not share personal information for cross-context behavioral advertising. Personal information may be disclosed to service providers when acting as Data Processors and Subprocessors, as described in Section 1.3.
  • Right to Limit Use of Sensitive Personal Information: Applicable rights regarding sensitive personal information are described in Section 6.1. Culture Index does not use sensitive personal information for purposes beyond those permitted under the CCPA without providing applicable rights to limit such use.
  • Notice of Financial Incentives: Culture Index does not offer financial incentives in exchange for the collection, retention, disclosure, or sale of personal information.

6.4.2 Other U.S. States

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Rhode Island, Indiana, and Kentucky have the rights described in Section 6.1, subject to the specific scope, exceptions, and procedures of their respective state laws. For the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, requests should be submitted to [email protected].

6.4.3 Washington, Nevada, and Other Health-Data Statutes

To the extent any inferences described in Section 2 are believed to constitute "consumer health data" under Washington's My Health My Data Act, Nevada's consumer health data statute, or similar state laws, Culture Index provides the rights and protections required by those laws, including the right to withdraw consent and the right to deletion, as described in Section 6.1.

7. Cookies

Culture Index uses cookies and similar technologies to operate the Services, maintain functionality, remember user preferences, and analyze website usage. Where required by applicable law, a cookie consent mechanism allows selection of permitted categories of non-essential cookies. Cookie preferences may be managed through the website or browser settings.

8. Data Security and Retention

8.1 Security

Culture Index maintains physical, technical, and organizational safeguards designed to protect personal data from unauthorized access, disclosure, alteration, loss, or destruction. Such safeguards are reviewed periodically and updated as appropriate. Although no security measure can provide absolute protection, Culture Index applies reasonable and appropriate safeguards consistent with applicable law and industry standards.

In the event of a personal data breach, Culture Index will notify affected individuals, Clients, supervisory authorities, and other parties to the extent and within the timeframes required by applicable law, including the 72-hour notification requirement under Article 33 of the GDPR and the notification requirements of U.S. state breach notification statutes.

8.2 Retention

Culture Index retains personal data only for as long as necessary to fulfill the purposes for which it was collected, including the provision of Services, validation and improvement of Survey methodology, maintenance of Survey results for future opportunities involving the Survey taker, and compliance with applicable legal and regulatory obligations. Where applicable law requires a minimum retention period, personal data will be retained for at least the required period. This includes support of Client obligations to retain employment-related records, including retention of certain California applicant data for a minimum period of four years.

9. International Data Transfers

Personal data collected through the Services may be transferred to, stored in, and processed within the United States and other jurisdictions in which Culture Index, its Clients, or its Service Providers operate. Where personal data is transferred from the European Economic Area, the United Kingdom, or Switzerland to a jurisdiction that has not been recognized as providing an adequate level of data protection, Culture Index relies on appropriate safeguards, which may include:

  • Standard Contractual Clauses approved by the European Commission, supplemented by additional safeguards where appropriate;
  • The United Kingdom International Data Transfer Agreement (IDTA) or the U.K. Addendum to the Standard Contractual Clauses;
  • The Swiss-U.S. Data Privacy Framework and the U.K. Extension to the EU-U.S. Data Privacy Framework, to the extent Culture Index maintains applicable certification; and
  • Other lawful data transfer mechanisms permitted under applicable law.

10. Children's Privacy

The Services are not directed to children. Culture Index does not knowingly collect personal data from children below sixteen (16) years old or the minimum age required by applicable law in the jurisdiction in which the child resides. If Culture Index becomes aware that personal data has been collected from a child in violation of applicable law, such data will be deleted promptly.

11. Changes to This Notice

Culture Index may update this Notice as necessary to reflect changes in business practices, legal requirements, regulatory guidance, or the Services. Any revisions will be reflected by updating the Effective Date of this Notice. Where required by applicable law, or where changes are considered material, additional notice may be provided through appropriate means, including email or a prominent notice on the Culture Index website, before such changes become effective.

12. Contact Us

For questions about this Notice or to exercise applicable privacy rights, contact us at: