Kresnicka Research and Insights LLC (KR&I) takes privacy seriously and is committed to protecting Personal Information. This Research Privacy Policy (“Policy”) addresses what Personal Information may be collected or acquired during the conduct of our clients’ research projects and how we comply with data protection laws.

KR&I is an independent, US-based research company. We are committed to protecting the privacy and personal data of individuals who participate in our research studies. This Privacy Policy explains how we collect, use, and process your personal data and your rights concerning that data. We comply with all applicable data protection laws in the regions where we operate, including:

• United States: The California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), and other state and federal laws.
• Mexico: Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP).
• Brazil: General Data Protection Law (LGPD).
• European Union: The General Data Protection Regulation (GDPR).
• United Kingdom: The UK General Data Protection Regulation (UK GDPR).
• Japan: Act on the Protection of Personal Information (APPI)
• India: The Digital Personal Data Protection Act, 2023 (DPDP Act).
• Australia: APP 8 Compliance.

We collect personal information necessary to conduct our market research studies. This may include:

• Identifiers: Name, email, postal address, telephone number, and unique identifiers assigned for research purposes.
• Demographic data: Such as, but not limited to age, gender, ethnicity, and household information.
• Commercial information: Your past purchases or purchasing tendencies for a specific client.
• Opinions and feedback: Your responses to our survey questions.
• Sensitive personal data: Only when relevant to a specific study and with your explicit consent. This may include information about health, racial or ethnic origin, or political opinions.

We collect information through various methods:

• Directly from you: When you participate in a survey, interview or focus group.
• From third parties: We may obtain your information from our clients or recruiters who have legally obtained your consent to share it for market research purposes.

We use your personal data for the following purposes:

• To conduct market research: We analyze your feedback to provide anonymous and aggregated insights to our clients.
• To contact you: If you have provided your consent, we may contact you to invite you to participate in a study.
• To fulfill incentives: If a study offers an incentive, we may use your contact information to pay or deliver it.
• To meet legal obligations: We may process or disclose your information when required by law or to protect our legal rights.

For individuals in the EU and UK, our legal basis for processing personal data includes:

• Consent: Your explicit consent to participate in a study or receive marketing communications.
• Legitimate interests: When processing is necessary for our legitimate business interests, such as detecting fraudulent activity, and those interests do not override your data protection rights.
• Contractual necessity: When processing is necessary to fulfill a contract with you, such as delivering a promised incentive.
• Legal obligation: When we are legally required to process your data.

Depending on your location, you have certain rights concerning your personal data. You may also have local extensions to these rights outlined below. To exercise these rights, please contact us using the details in the “Contact Us” section.

• Right to know/access: The right to know what personal information we have collected about you and to receive a copy of that data.
• Right to rectification: The right to correct inaccurate personal data.
• Right to erasure (right to be forgotten): The right to request the deletion of your personal data.
• Right to object: The right to object to the processing of your personal data for direct marketing or based on our legitimate interests. While you have that right, please know that we never use your information for any marketing reasons whatsoever.
• Right to restrict processing: The right to restrict our use of your personal data under certain circumstances.
• Right to data portability: The right to receive any data containing your personally identifiable information, if any, in a structured, commonly used, and machine-readable format.
• Right to withdraw consent: You can withdraw your consent at any time where we rely on it to process your data.

For California residents (CCPA/CPRA): You have the specific rights detailed above, including the right to opt-out of the “sale” or “sharing” of your personal information. We do not sell or share personal data with third parties for cross-context behavioral advertising, but if we ever were to, you would have the right to opt out.

For residents of Mexico (LFPDPPP): You have rights exercise ARCO (Access, Rectification, Cancellation, and Opposition) rights specified by the LFPDPPP, described in section 5 above.

For residents of India (DPDP Act): You have the right to access, correct, and erase your personal data, and to withdraw consent. You also have the right to a grievance redressal mechanism.

For residents of Australia: Unresolved complaints may be escalated to the Office of the Australian Information Commissioner (OAIC).

As a US-based firm, your data may be transferred to and processed in the United States and other countries where we operate. When transferring data from countries outside of the US, we ensure the transfer complies with applicable laws. We do this by:

• Standard Contractual Clauses (SCCs): Implementing SCCs to protect your data.
• The EU-US and UK Extensions to the DPF: Adhering to the EU-US Data Privacy Framework and its UK Extension to provide appropriate safeguards.
• US-Japan Adequacy Decision: Recognizes that our respective data protection laws offer equivalent protection.
• Australia: APP 8 Compliance.

We have implemented technical and organizational security measures to protect your personal data from loss, misuse, and unauthorized access. This includes:

• Access controls to limit who can see your data.
• Encryption and pseudonymization where appropriate.
• Regular security audits and staff training.

KR&I complies with the legal, regulatory, and ethical standards that govern our research. As a result, from time to time we review and improve our Personal Information protection measures and will update this Privacy Policy as required by business practice or law. Please review this Privacy Policy on a regular basis.

If you have any questions or concerns about this Policy or additional questions about how your Personal Information is used, disclosed, or secured by KR&I, then please contact us at info@kresnickaresearch.com, attn: Privacy Officer.

Updated: September 24, 2025