Privacy Policy

How we collect, use, and protect your information.

Effective Date: 1 January 2026  |  Last Updated: 12 March 2026

1. Introduction

CorpMetrix Ltd ("CorpMetrix", "we", "our" or "us") is committed to protecting the privacy and security of personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (www.corpmetrix.com) or use our employee engagement survey platform and related services (collectively, the "Services").

Please read this policy carefully. If you do not agree with the terms, please discontinue use of our Services.

2. Data We Collect

We may collect the following categories of personal data:

  • Identity Data: Name, job title, employer name, employee ID.
  • Contact Data: Email address, phone number, postal address.
  • Survey Response Data: Anonymised or attributed responses submitted via CorpMetrix surveys.
  • Technical Data: IP address, browser type and version, device identifiers, time zone, cookie data, pages visited, and access times.
  • Usage Data: Information about how you use our website and Services.
  • Marketing Data: Preferences for receiving marketing communications and your communication preferences.

3. How We Use Your Data

We use personal data to:

  • Deliver and manage the Services, including processing and analysing survey responses.
  • Communicate with you about your account, our products, and support requests.
  • Send marketing communications where you have opted in.
  • Improve and personalise our website and Services through analytics.
  • Comply with legal obligations and enforce our agreements.
  • Prevent fraud and ensure platform security.

4. Legal Bases for Processing

We process personal data under the following legal bases:

  • Contract: Processing necessary to perform a contract with you or your organisation.
  • Legitimate Interests: Improving our services, fraud prevention, and direct marketing to existing clients.
  • Consent: Where you have given explicit consent (e.g., email newsletter sign-up).
  • Legal Obligation: Where we are required by law to process data.

5. Survey Anonymity & Confidentiality

CorpMetrix is committed to protecting survey respondents. Individual responses are never disclosed to employers unless a minimum anonymity threshold (typically 5 responses) is met for any reported group. All survey data is encrypted in transit (TLS 1.3) and at rest (AES-256). Our servers are hosted in Saudi Arabia-compliant data centres where applicable, in accordance with Saudi PDPL requirements.

6. Data Sharing

We do not sell personal data. We may share data with:

  • Client Organisations: Aggregated, anonymised survey results only.
  • Service Providers: Trusted sub-processors (cloud hosting, email, analytics) bound by data processing agreements.
  • Authorities: Where required by applicable law or court order.
  • Business Transfers: In connection with a merger, acquisition, or sale of assets.

7. International Transfers

We may transfer personal data to countries outside your country of residence. When transferring data outside the EEA or Saudi Arabia, we implement appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent mechanisms.

8. Cookies

We use cookies and similar tracking technologies to enhance your experience. You can control cookie preferences via our Cookie Consent banner. For full details, see our Cookie Notice.

9. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy or as required by law. Survey response data is retained for the duration of the client contract plus 12 months, after which it is securely deleted or anonymised.

10. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access your personal data.
  • Correct inaccurate data.
  • Request erasure ("right to be forgotten").
  • Restrict or object to processing.
  • Data portability.
  • Withdraw consent at any time.

To exercise your rights, contact us at privacy@corpmetrix.com.

11. Security

We implement industry-standard technical and organisational measures, including AES-256 encryption at rest, TLS 1.3 in transit, multi-factor authentication (MFA), role-based access controls, regular penetration testing, and ISO 27001-aligned information security practices.

12. Children's Privacy

Our Services are not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last Updated" date. We encourage you to review this policy periodically.

14. Contact Us

For privacy-related queries or to exercise your rights, contact our Data Protection Officer: