Behavix Privacy Policy — EU and International

Behavix Behavioral Data Panels · Version 4.0 · Dated 16 October 2026 · Effective on publication

This Privacy Policy explains how Behavix Oy collects, uses and shares information when you choose to take part in Behavix behavioral measurement, and the rights you have. It applies to participants outside the United States. Participants in the United States are covered by our separate U.S. Privacy Policy.

Summary

• Taking part is your choice. Measurement starts only after you have read a description of what is measured and actively accepted it. You can pause or stop at any time.

• What we measure. The apps you use, the websites you visit, your searches, your use of AI assistants, shopping, streaming and media activity, and the advertising you see on the device where you switch measurement on, together with profile information such as your age group and gender.

• What we never collect. The content of your private messages, e-mails or calls, your passwords or payment card numbers, your precise (GPS) location, or your photos, contacts and files.

• Who receives the data. We license pseudonymized data (data keyed to a code instead of your name) to companies that use it for market research, media and advertising measurement, technology and AI development, and financial and investment research. They never receive your name, e-mail address, phone number or postal address, and they are not allowed to try to identify you.

• Your rights. You can access, correct and delete your data, withdraw your consent, and complain to a data protection authority. Contact us at dpo@behavix.io.

1. Who we are

The controller of your personal data is Behavix Oy, a company registered in Finland (Business ID 3416389-5), Kihokkiniitty 7, 02970 Espoo, Finland (“Behavix”, “we”, “us”).

Behavix is a market research and behavioral data company. We develop measurement technology that, with the consent of the people taking part, records how people use digital devices and services, and we turn that information into research data, statistics and insights.

Data Protection Officer: you can reach our Data Protection Officer at dpo@behavix.io or by post at the address above, marked “Data Protection Officer”.

2. What this policy covers

This policy applies to the Behavix behavioral measurement service (the “Service”), which consists of:

• the Behavix measurement software built into the apps of our panel and audience partners (the “Behavix SDK”);

• the Behavix browser extensions and desktop meters;

• Behavix’s own research apps; and

• Behavix Share, which lets you share your viewing history from streaming and connected-TV services;

(together, the “Research Application”), and the related Behavix websites and support channels.

Our partners. Many participants join through the app, website or online panel of one of our partners, for example a survey, rewards or research app (the “Partner”). The Partner is named on the consent screen through which you joined. The Partner is responsible for your account with the Partner and for the information you give to the Partner directly, under the Partner’s own privacy policy. Behavix is responsible for the behavioral measurement that you separately choose to switch on. Where Behavix and a Partner jointly decide how measurement data is used, we act as joint controllers, and you can ask us for the essence of the arrangement between us. You can exercise your rights with either of us.

This policy does not apply to third-party websites, apps or services that you use, which have their own privacy policies.

3. Taking part is voluntary

• Measurement starts only after you have been shown a dedicated consent screen describing what is measured and who receives the data, and you have actively accepted it. There are no pre-ticked boxes, and declining is as easy as accepting.

• If you decline, measurement is not switched on, and this does not affect your membership of the Partner’s panel or app.

• You must be at least 18 years old to take part (see section 13).

• You can pause or stop measurement at any time, as described in section 11.

4. Information we collect

4.1 Information collected by the Research Application

With your consent, the Research Application records the following on the device where you switch it on.

4.2 Information you provide

• Profile information that you give in profiling questions, either to us or to the Partner, such as your age or year of birth, gender, household size and composition, income range, education, employment status and postal-code area or region.

• Survey answers, where you choose to take part in a survey that is linked to your measurement data.

• Messages you send to us, for example support requests or privacy requests.

4.3 Information we receive from the Partner

The Partner through which you joined gives us the Partner’s user ID for you, the profile information described above where you have provided it to the Partner, and information needed to administer your participation and rewards. We do not receive your name, e-mail address, phone number or postal address from the Partner, except where you contact us directly or where this is needed to answer a privacy request you have made.

4.4 Information we derive

From the information above we derive interest, audience and behavior segments, content and brand classifications, and data-quality and fraud scores.

4.5 What we do not collect

• The content of your private messages, e-mails, calls or text messages. Messaging and communication apps are recorded only as app usage (which app, when and for how long).

• Passwords, payment card numbers, bank account details or other information you type into forms, other than the search terms and AI-assistant prompts described above.

• Precise geolocation, such as GPS, Wi-Fi or cell-tower location.

• Audio, photos, contacts or files stored on your device.

We do not decrypt your internet traffic. Where a local VPN configuration is used for measurement on iOS, it is used to identify the domains your device connects to; it does not install a root certificate and does not inspect the content of encrypted traffic.

4.6 Device permissions

Depending on your device, the Research Application asks for permissions that it needs to work, and explains them before you grant them:

• Android Accessibility Service: used to recognize which app is in use and the web addresses, searches and advertisements shown on screen in supported apps and browsers. It is not used to read your private messages or passwords, or to perform actions on your behalf.

• iOS local VPN configuration: used to identify the domains your device connects to, as described above.

• Browser extension permissions: used to record the web pages you visit and related events in that browser.

You can withdraw a permission at any time in your device or browser settings, which stops the related measurement.

5. How we protect your identity in the data

• Pseudonymization. Behavioral data is keyed to a Behavix pseudonymous ID, not to your name or contact details.

• Filtering. We apply on-device suppression and server-side filtering designed to remove personal identifiers, such as e-mail addresses, phone numbers and account or session codes, from web addresses and other collected data.

• Sensitive categories. We maintain exclusion lists of websites and apps in sensitive categories (for example health, religion, sexual life and political organizations) and exclude them from the data we license (see section 6).

6. Sensitive information

We do not ask for, and we take steps to avoid collecting, special categories of personal data, such as information about your health, religion, political opinions, sexual life or sexual orientation, or racial or ethnic origin. Because we measure browsing and app activity, the activity itself may in some cases relate to such topics. Where that happens, we process the data only on the basis of your explicit consent, which the consent screen asks for expressly (Article 9(2)(a) GDPR), and we apply the exclusions described in section 5 to keep such data out of the data we license. We do not use special category data to draw conclusions about you as an individual.

7. Why we use your information, and our legal bases

Profiling. We group participants into segments, for example by interests or behavior, in order to describe markets and audiences. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing, and our customers are contractually prohibited from using the data to make decisions about individuals, such as decisions about credit, insurance, employment or housing.

8. Who receives your information

Customers, including technology and AI companies, may use the data we license to develop analytics and to train AI models, including large language models, under the same restrictions. You can ask us for a list of the specific categories of customers and partners that have received your data.

We also share aggregated statistics that do not identify any individual.

9. International transfers

We store participant data primarily in the European Union (Amazon Web Services, Stockholm region). Some customers and service providers are located outside the European Economic Area, in particular in the United States, the United Kingdom, Switzerland, Canada, Brazil and Japan. When we transfer personal data outside the EEA, we rely on a decision of the European Commission that the destination ensures adequate protection (including the EU–US Data Privacy Framework for certified recipients), or on the European Commission’s Standard Contractual Clauses together with supplementary measures where needed. You can request a copy of the relevant safeguards from dpo@behavix.io.

10. How long we keep your information

11. Your rights and choices

Pausing measurement. You can pause measurement at any time in the settings of the app or extension. While measurement is paused, nothing new is collected. Activity recorded on your device before you paused may still be sent to us.

Withdrawing your consent. You can withdraw your consent at any time by choosing to leave in the app or extension, by uninstalling the Research Application, by withdrawing the device permission, or by writing to dpo@behavix.io. When you withdraw your consent, we stop collection, delete any data recorded on your device that has not yet been sent, delete your record-level data from our systems within 30 days, and tell the customers that received record-level data about you to delete it. We keep only a record of your consent and its withdrawal, as described in section 10. Withdrawing consent does not affect the lawfulness of processing before the withdrawal, or aggregated statistics that no longer identify you.

Under data protection law you also have the right to:

• access your personal data and receive a copy of it;

• have inaccurate data corrected;

• have your data deleted. When we delete your data, we also notify the customers that received record-level data about you, so that they delete it as well;

• restrict our processing in certain cases;

• data portability: receive the data you provided to us in a commonly used, machine-readable format, or have it transmitted to another company;

• object to processing based on our legitimate interests; and

• lodge a complaint with a data protection authority. In Finland this is the Data Protection Ombudsman (tietosuoja.fi). You may also contact the authority in the country where you live or work.

How to make a request. Write to dpo@behavix.io, or use the privacy or support contact in the Partner’s app. Please tell us the app through which you joined and your user ID or the e-mail address of your account in that app, so that we can find and verify your participant record. We respond within one month. Where a request is complex, we may extend this by up to two further months and will tell you why. Requests are free of charge.

Direct marketing. We do not use your data to send you third-party marketing. Every service or invitation message from us contains an easy way to stop further messages.

12. Data already collected and policy updates

If we ask you to confirm or renew your consent, for example after an update to this policy, the consent screen will tell you, in a separate statement before you choose to accept or decline, whether your new consent also covers data already collected from you, the period it covers (at most 24 months before your acceptance), and that this data may be licensed to the customers described in section 8, including financial and investment research firms. Renewed consent never covers data beyond what you were told about when it was collected, and never covers activity from before you first joined. If you decline, we use previously collected data only within the scope of the consent you gave earlier, and you can still ask us to delete it.

We may update this policy from time to time. The date and version at the top show when it was last changed. If we make material changes to what we collect, why we use it or who receives it, we will tell you in the app or through the Partner before the change takes effect and, where the law requires it, ask for your consent again. We do not treat continued use of the Service as consent.

13. Adults only

The Service is only for people aged 18 or over. Partners must enroll only adult members, and we do not knowingly collect information from anyone under 18. If someone else uses your device, please pause measurement while they use it. If we learn that we hold information about a person under 18, we stop collection and delete it.

14. Rewards

Participants may receive rewards, such as points, vouchers or prize entries, for keeping measurement switched on, usually for a minimum number of active days per month. Rewards are normally provided by the Partner under the Partner’s terms, and the type and amount are shown before you opt in. You do not earn rewards for periods in which measurement is switched off.

15. Security

We protect personal data with technical and organizational measures that include encryption in transit and at rest, role-based access control with multi-factor authentication, pseudonymization of identifiers, filtering of personal identifiers, logging of access to participant-level data and security testing. Our information security practices are aligned with the ISO/IEC 27001 standard. No system is completely secure; if a personal data breach puts your rights at high risk, we will tell you without undue delay.

16. Additional information for specific countries

• United Kingdom. We process UK participants’ data under the UK GDPR and the Data Protection Act 2018. Transfers from the UK rely on UK adequacy regulations or the UK International Data Transfer Addendum. You can complain to us first at dpo@behavix.io; we acknowledge complaints within 30 days and tell you the outcome. You can also complain to the Information Commissioner’s Office (ico.org.uk).

• Switzerland. We process Swiss participants’ data under the Federal Act on Data Protection. You can complain to the Federal Data Protection and Information Commissioner (edoeb.admin.ch).

• Brazil. We process data under the Lei Geral de Proteção de Dados (LGPD) on the basis of your consent. You have the rights set out in Article 18 of the LGPD, including confirmation of processing, access, correction, anonymization, portability, deletion, information about the entities with which we share data, and revocation of consent. We answer requests within 15 days. Transfers of data from Brazil to the European Union rely on the mutual adequacy decisions between Brazil and the EU, and other transfers on the standard contractual clauses approved by the ANPD. You can complain to the Autoridade Nacional de Proteção de Dados (ANPD).

• Canada. We rely on your express consent. The Research Application is a technology that records your device activity and is used to build audience profiles; it is switched off by default and is activated only when you accept the consent screen and grant the device permissions, and you can deactivate it at any time as described in section 11. Our privacy officer is our Data Protection Officer, who can be reached at dpo@behavix.io. Your information may be stored and processed outside your province and outside Canada, including in the European Union and the United States, where it may be accessible to the authorities of those countries.

• Japan. We provide personal data to third parties, including recipients in foreign countries, on the basis of your consent. The recipients are located in the countries listed in section 9: the member states of the European Union and the European Economic Area (which Japan recognizes as having equivalent protection), the United States, the United Kingdom, Switzerland, Canada and Brazil. Each has a general data protection framework, which differ in scope; in the United States, protection is provided by federal and state laws rather than a single national law. Recipients are bound by contract to protect the data as described in this policy.

• India. We process data under the Digital Personal Data Protection Act 2023 on the basis of your consent, which you can withdraw as easily as you gave it. Our grievance contact is dpo@behavix.io, and you can also complain to the Data Protection Board of India.

• Other countries. Where local law gives you additional rights, we respect them. Contact us at dpo@behavix.io.

17. Industry standards

We follow the ICC/ESOMAR International Code on Market, Opinion and Social Research and Data Analytics.

18. Contact

Behavix Oy, Data Protection Officer, Kihokkiniitty 7, 02970 Espoo, Finland. E-mail: dpo@behavix.io.
General enquiries: admin@behavix.io.

19. Our website and cookies

This section applies to visitors of our website at behavix.io and its sub-pages (the “Website”). It is separate from the Service: data about your use of the Website is not combined with data from the Service or the Research Application.

What we use. We use Google Analytics 4, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC, to understand how visitors use the Website so that we can improve it. Google acts as our processor.

What is collected. When analytics is active, the Website records:

• the pages you visit, and how you arrived on the Website (for example the referring site or campaign link);

• the links and buttons you click, the buttons you rest your mouse pointer on, the sections of a page you view and for how long, and how far down a page you scroll;

• if you use the revenue calculator, the figures you enter, the estimate it shows, and whether you contact us from it;

• your browser, device type, screen size, language and approximate location (country and city), derived from your IP address. Google Analytics 4 does not store IP addresses.

Google Analytics identifies your browser with a random identifier stored in a cookie. We have turned off Google signals and all advertising features: Website data is not used for advertising or to build advertising profiles, and we do not sell it.

Cookies and similar storage.

• _ga and _ga_<ID> (Google Analytics): distinguish visitors and sessions. Set only when analytics is active. Expire after 2 years.

• bx-analytics-consent (stored in your browser’s local storage, not a cookie): remembers your choice to accept or decline analytics, so that we do not ask again on every page. It contains only that choice and is never sent to us or to Google.

Your choice. To decide whether to ask for your consent, the Website determines which country you are visiting from, based on your IP address. Only the country code is passed to your browser, and it is not stored.

• If you are visiting from the European Economic Area, the United Kingdom or Switzerland, analytics is active only if you click “Accept” in the cookie banner. Until then no analytics cookies are set and no analytics data is sent. The legal basis is your consent (Article 6(1)(a) GDPR).

• Elsewhere, analytics is active by default. The legal basis is our legitimate interest in understanding and improving the Website (Article 6(1)(f) GDPR), and you can object at any time.

Wherever you are, you can change your choice at any time through “Cookie settings” at the bottom of every page. Declining removes the Google Analytics cookies from your browser, and no further analytics data is sent.

Retention. Website analytics data is kept in Google Analytics for 14 months and then deleted automatically.

Transfers. Google may process Website data in the United States. Google LLC is certified under the EU–US Data Privacy Framework, as described in section 9. More information is in Google’s privacy policy at policies.google.com/privacy.

Your rights. The rights described in section 11 apply to Website data as well. Because the Website does not ask for your name or other contact details, we can usually identify Website data only through the identifier in your browser’s cookies. For any question about Website data, contact dpo@behavix.io.