Privacy Policy

1. About this Privacy Policy

This Privacy Policy explains how QIDE LTD collects, uses, stores and shares personal information when you use: • the Qide mobile application; • the Qide website; • Qide questionnaires, pulse surveys, recommendations and action plans; • organisation-sponsored Qide accounts; and • any related Qide services, communications or support. Together, these are referred to as the "Service". This Privacy Policy is also the privacy policy for the Qide mobile application and is intended to be accessible through the App Store, Google Play, the Qide website and the app itself.

2. Who we are

The Service is operated by: QIDE LTD Company number: 17268503 Registered office: Apartment 150, Carrara Tower, 1 Bollinder Place, London, England, EC1V 2AF For privacy enquiries, contact: Email: privacy@qide.me QIDE LTD is referred to in this policy as "Qide", "we", "us" or "our".

3. A short summary

The most important points are: • Qide helps individuals and teams understand motivation, workplace experience and possible actions for improvement. • Your employer or organisation does not automatically receive all of your individual survey answers. • The app will indicate when information is private, shared with another person or included in team-level insights. • We do not sell personal information. • We do not use private survey content for third-party advertising. • Qide does not provide medical diagnoses or make employment decisions. • You can request access, correction or deletion of your personal information. • You can delete or request deletion of your Qide account through the app or our website.

4. When an organisation provides Qide to you

You may use Qide: independently, using an account you create for yourself; or through an employer, team or other organisation that has invited you to use Qide. When you use Qide independently, Qide will generally act as the controller of your personal information. This means we decide why and how that information is used. When an organisation provides Qide to you, that organisation may act as the controller of some information associated with its Qide workspace. Qide may process that information on the organisation's behalf and under its instructions. For example, an organisation may control information about: who has been invited to its workspace; team membership and reporting relationships; participation or completion status; actions that have been intentionally shared with a manager; organisation-level or team-level insights; and information the organisation has provided to Qide. Qide remains a controller for certain purposes of its own, including account security, fraud prevention, service administration, legal compliance and managing communications with you. Where an organisation controls your information, its own employee or workforce privacy notice may also apply.

5. Information we collect

6. How we use personal information

7. Legal bases

Depending on the circumstances, Qide relies on one or more of the following legal bases: • Contract: where processing is necessary to provide the Service you requested. • Legitimate interests: where processing is necessary to operate, secure, administer or improve Qide and those interests are not overridden by your rights. • Legal obligation: where we must process information to comply with law. • Consent: where we ask for permission, including for certain optional communications, cookies or features. • Customer instructions: where Qide acts as a processor for an organisation that controls the information. Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

8. What your manager or organisation can see

Qide is designed to explain the visibility of information before it is shared. Depending on the configuration and feature, organisation administrators or managers may be able to see: your name, work email, team and role; that you were invited or created an account; onboarding or questionnaire completion status; actions you have intentionally shared; manager actions connected to you; team-level trends or aggregated insights; and individual-level information where the relevant screen clearly tells you before submission that it will be shared. Your organisation does not automatically receive unrestricted access to all private questionnaire answers, personal notes or free-text responses. Unless a screen clearly states otherwise, or you actively choose to share information, individual questionnaire answers and personal reflections are treated as private from your manager and organisation. Limited authorised Qide personnel and service providers may access information where necessary to operate, secure, troubleshoot or support the Service. Where a feature shares information, Qide will aim to identify: what will be shared; who will receive it; and whether it is shared individually or as part of team-level information. Team-level insights may be withheld, combined or generalised where showing them could make it too easy to identify an individual.

9. Artificial intelligence, scoring and profiling

Qide may use automated systems to: score or categorise questionnaire responses; identify themes in your responses; produce an archetype or motivation profile; suggest possible blockers; recommend actions; and personalise explanations and reminders. At a high level, questionnaire responses are mapped to relevant categories or scores. Those results, together with other information you provide, may then be used to select or generate recommendations. Automated outputs may be incomplete, inaccurate or unsuitable. They should be treated as prompts for reflection rather than verified facts. Qide does not: diagnose medical or mental-health conditions; determine whether someone is suitable for employment; decide whether someone should be promoted, disciplined or dismissed; determine pay or performance ratings; or make solely automated decisions that are intended to have legal or similarly significant effects on users. Employers and managers must apply their own judgement and must not use Qide output as the sole basis for a significant employment decision. Where we use an external artificial-intelligence provider, information may be sent to that provider to generate an output. We limit the information sent where reasonably possible and require providers to process it for the agreed service. We do not use identifiable private questionnaire responses to train general-purpose artificial-intelligence models without providing separate notice and obtaining any permission required by law. You may contact us if you believe an automated result is materially inaccurate or would like further information about how it was produced.

10. Sensitive and health-related information

Qide is a workplace motivation and development tool. It is not designed to collect medical records or diagnose health conditions. Responses about motivation, psychological safety, stress or workplace experience may nevertheless feel sensitive. Please do not enter detailed medical information, information about another person's health or other highly sensitive information into optional free-text fields unless a feature specifically requests it and explains how it will be used. Where special-category information is processed through an organisation-sponsored account, the organisation is responsible for identifying an appropriate lawful basis and special-category condition. Qide processes that information under the organisation's instructions. Where Qide controls such processing, we will identify an appropriate legal condition and provide any additional notice or choice required.

11. Who we share information with

12. International transfers

Qide is based in the United Kingdom. Some service providers may process information in the United Kingdom, European Economic Area, United States or other countries. Where personal information is transferred internationally, we use an appropriate legal mechanism where required. This may include: a recognised adequacy decision; the UK International Data Transfer Agreement; the UK Addendum to approved standard contractual clauses; European Commission standard contractual clauses; or another legally recognised safeguard. You may contact privacy@qide.me for further information about relevant safeguards.

13. How long we keep information

We retain personal information only for as long as reasonably necessary for the purposes described in this policy. Our intended standard retention periods are: • Active account information: for as long as the account remains active. • Deleted individual accounts: removed from active systems normally within 30 days after a valid deletion request. • Organisation-controlled information: retained in accordance with the organisation's instructions and customer agreement, normally for the duration of the account and for up to 30 days afterwards unless otherwise agreed or legally required. • System backups: deleted or overwritten through the normal backup cycle, normally within 90 days. • Security and technical logs: normally retained for up to 12 months, unless required for an active investigation. • Support and feedback records: normally retained for up to 24 months after the matter is closed. • Subscription, tax and accounting records: retained for up to seven years where required for legal, tax or accounting purposes. • Marketing preferences: retained until you withdraw consent or object. We may keep limited suppression information to ensure we respect an unsubscribe request. • Anonymised statistics: may be retained indefinitely where they no longer identify an individual. We may retain information for longer where necessary for litigation, fraud prevention, legal compliance or the protection of legal rights.

14. Your data-protection rights

Depending on the circumstances and applicable law, you may have the right to: • request access to your personal information; • request correction of inaccurate or incomplete information; • request deletion of information; • request restriction of processing; • receive certain information in a portable format; • withdraw consent; • object to certain processing; • object to direct marketing; • request information about relevant automated processing; and • complain to a data-protection authority. Your right to object: You may object to processing based on Qide's legitimate interests. We will stop the relevant processing unless we have compelling legitimate grounds to continue or the information is needed for legal claims. You have an absolute right to object to direct marketing. To exercise your rights, contact privacy@qide.me. We may need to verify your identity before completing a request. Where your organisation controls the relevant information, we may refer your request to the organisation or assist it in responding. You may also contact your organisation directly. You may complain to the UK Information Commissioner's Office. If you live or work in the European Economic Area, you may also have the right to complain to the data-protection authority in the country where you live or work.

15. Deleting your account

You can initiate account deletion: • through the Delete Account option in the Qide app; • through Qide's web-based account deletion page; or • by emailing privacy@qide.me. Deleting the app from your device does not by itself delete your account. When an account is deleted, we delete or anonymise associated personal information unless: it is controlled by an organisation and we are required to follow that organisation's instructions; it must be retained by law; it is needed for security, fraud prevention or legal claims; it forms part of financial or transaction records we must retain; or it has already been irreversibly anonymised. Where information must be retained, it will be limited, protected and not used for unrelated purposes. If you have an organisation-sponsored account, deletion may also remove access to the organisation's Qide workspace. Your organisation may retain its own records under its own policies.

16. Security

We use appropriate technical and organisational safeguards designed to protect personal information. These may include: access controls; restricted administrative access; authentication controls; encryption in transit and, where appropriate, at rest; logging and monitoring; secure software-development practices; backups; supplier assessments; and incident-response procedures. No online system is completely secure. You are responsible for keeping authentication links, passwords and devices secure and for notifying us if you suspect unauthorised access.

17. Children

Qide is intended for adults aged 18 and over. We do not knowingly provide the Service to or collect personal information from children under 18. If you believe that a child has provided information to Qide, contact privacy@qide.me.

18. Third-party services and links

Qide may contain links to third-party websites or services. Those services operate under their own terms and privacy policies. Qide is not responsible for how an independent third party handles information after you leave the Service.

19. Changes to this policy

We may update this Privacy Policy to reflect changes to: the Service; our data practices; our suppliers; legal requirements; or security and operational needs. We will update the date at the top of the policy. Where a change materially affects how personal information is used, we will provide reasonable notice through the app, website, email or another appropriate method before the change takes effect where required.

20. Contact us

For privacy questions, rights requests or complaints, contact: QIDE LTD Company number: 17268503 Email: privacy@qide.me