Privacy Policy

COGNITIVEVR INC. dba Cognitive3D, its parents, subsidiaries and affiliates, (“Cognitive3D”, “we”, or “our”) operates a cloud-based platform for data collection, visualization and analytics tools for measuring human behavior within 3D based content which may be accessed either through an SDK and/or web application (the “Platform”).

This Privacy Policy applies to the Platform, the Cognitive3D website,cognitive3d.com, and any other services or products on which Cognitive3D chooses to apply this privacy policy (collectively, the “Service”). This Privacy Policy details how we collect, use, and disclose data, including personal data, about our users, including you (“you” or “your”).

BY CLICKING “I AGREE” OR SIMILAR CONFIRMATION, BY CREATING AN ACCOUNT ON THE SERVICE OR BY USING THE SERVICE YOU ARE AGREEING TO BE BOUND BY THE PRIVACY POLICY.

IF YOU ARE USING THE SERVICE ON BEHALF OF AN ORGANIZATION, YOU REPRESENT THAT YOU HAVE THE AUTHORITY TO BIND THE ORGANIZATION TO THIS PRIVACY POLICY AND ARE AGREEING TO THIS PRIVACY POLICY FOR THAT ORGANIZATION. WHERE YOU ARE USING THE SERVICE ON BEHALF OF AN ORGANIZATION, “YOU” AND “YOUR” REFERS TO THE ORGANIZATION.

1. HOW WE OBTAIN PERSONAL DATA

The Service involves the collection and processing of your personal and Platform related data, which is information about you or that identifies you.

We obtain your personal data directly from you or when you use the Service. In nearly all cases, our customers (“Customer(s)”) are using our Service in order to track their own customers and users, and in these cases, we follow the terms of our contracts with our customers and this Privacy Policy applies to the personal data collected on behalf of our Customers. In nearly all cases, your provision of personal data to Cognitive3D is governed by those Customer’s agreements with you and their Privacy Policies. If you have any questions or concerns about the disclosure of your personal data, please contact us at your convenience using the contact information found below.

Subject to legal, contractual and technical requirements, you may choose not to provide Cognitive3D with certain data or request the deletion of certain data, which may impact the essential operation of the Service.

2. PERSONAL DATA WE COLLECT

We collect certain personal data when you begin using the Service as controlled by our Customers. The following is a description of the personal data that we may collect, use and process on behalf of our Customers:

a) Asset Preparation Data: To avoid Customers streaming 3D information in every user session, we collect assets on behalf of the Customer during SDK setup which can include 3D scene geometry, including meshes, materials, textures, lighting information, skins, animations and a user-selected screenshot – including the base/static scene, and any dynamic objects selected by our Customers. Some of this information can contain unstructured personal data.

(collectively the “Asset Data”);

b) User Data: User data will include references to Asset Data as well as additional data gleaned from the operation of the Platform. User Data includes IP addresses which is used to identify geographic location, data on how users move their controllers or hands, how users move their head which is also used to infer gaze, where users look and fixate with their eyes, how users look through/move through 3D space and occasionally biometric data as configured by our Customer such as cognitive load, sampled heart rate data, pupillometry or other sensors as equipped by our Customer.

(collectively the “User Data”);

c) your name, email and details of any communications when you contact us directly; and

d) behavioral tracking data when you interact with our Website or Platform.

User Data and some Asset Data may be classified as “Biometric Data” or some similar terms in applicable biometric privacy legislation and thus has special protections with regards to its collection, retention and security. Cognitive3D shall comply with all applicable biometric privacy legislation, including any verification of consent gathering procedures applicable to our Customers.

3. PERSONAL DATA WE DO NOT COLLECT

We do not collect the following data and our Customers are prohibited from sending us the following data:

a) information under regulatory or contractual handling requirements (e.g., Payment Card Industry Data Security Standards), including, but without limitation, financial account numbers, debit or credit card information, magnetic stripe data, or card verification values;

b) government issued personal identifiers, including, but without limitation, driver’s license numbers, passport numbers, or other state issued identification numbers;

c) certain bio-metric identifiers, including genetic data, iris scans, thumb or finger prints or health data;

d) personally identifiable information collected from children under the age of 13 or from online services directed toward children;

e) real time geo-location data which can track or identify an individual’s precise movements;

f) passwords, authentication/authorization credentials, business secrets deemed highly confidential (e.g., highly-confidential business strategies and communications, sensitive attorney-client privileged and confidential communications);

g) export-controlled information for which Customer has not obtained all required export licenses or government approvals; or

h) other information the unauthorized disclosure of which could cause material, severe, or catastrophic harm or impact to any data subjects or third parties.

4. PROCESSING OF YOUR PERSONAL DATA

We process your personal data for our legitimate business purposes, such as providing the Service to our Customers, to understand your needs and the needs of our Customers and to improve the quality of the Service and analyze the data we collect. Specifically, these uses include but are not limited to:

• providing the Service to our Customers, including altering the Service as needed to provide a better experience to you and our Customers;
• creating anonymized reports on Platform activities including use patterns and comfort ratings (analyzing the ease of use of the Consumer’s service/product);
• maintaining and analyzing functionality of the Service, backing up data or testing and researching new features of the Service;
• processing of anonymized data as part of machine learning activities;
• using cookies and third-party data website, email and analytics software to gain a better understanding of Service use and activity;
• for contractual, legal, regulatory or audit obligations, including responding to requests from law enforcement or a government agency asserting lawful authority to obtain the data or where Cognitive3D has reasonable grounds to believe the data could be useful in the investigation of unlawful activity, complying with a subpoena or warrant or an order made by a court, person or body with jurisdiction to compel the production of data, complying with court rules regarding the production of records and data, defending Cognitive3D in a legal, regulatory or administrative proceeding or in a contractual dispute or providing information to our legal counsel.

We may disclose your personal data to our parent companies, affiliates, subsidiaries, employees and contractors for the same purposes described above.

5. THIRD-PARTY SERVICES

This Privacy Policy only applies to personal data that Cognitive3D collects, processes and discloses and does not apply to the collection, processing and disclosure of data by third parties through third-party services, including Amazon (AWS), Zapier, Hubspot, Unity Analytics, Google Analytics, Hotjar, Slack, Netlify, Intercom, Segment, Mailchimp, IP-API, Atlassian Statuspage and Sentry, which may be broader than set forth in this Privacy Policy, and that may be embedded into the Service. In many cases, third-parties may collect personal data about your online activities over time and across different websites and services. We strongly recommend that you read each third-party privacy policy carefully before using the Service. Please contact us directly using the information found below if you would like to learn more about third-party data practices.

6. COOKIES AND TRACKING TECHNOLOGIES

The Service uses tracking technologies, such as cookies and web beacons, to collect data about you, such as your IP address and device information. Based on this data, third-parties may be able to resolve your identity across multiple devices. This data is collected, used and disclosed in accordance with the terms of this Privacy Policy and the applicable third-party privacy policies. Certain Service features may rely on tracking technologies and by declining to accept cookies or by changing certain settings on your device, you may not have access to these features.

7. OBTAINING, RECTIFYING AND CONTROLLING YOUR PERSONAL DATA

You may contact Cognitive3D at privacy@cognitive3d.com to obtain a copy of any personal data we collect about you, the production of which may be subject to a fee as permitted by applicable law. In addition, you may contact Cognitive3D to correct inaccurate personal data or to complete incomplete personal data.

You may be able to opt-out of some or all of the ways in which your personal data is processed, or request the deletion of certain personal data, except where the personal data is necessary or vital for:

• the performance of contractual obligations, such as the agreements between you and our Customers or certain other legal obligations;
• protecting your interests or those of another person; and
• our legitimate interests or the legitimate interests of a third-party,

and may do so by requesting deletion by contacting us using the contact information found below.

8. DATA STORAGE AND RETENTION

While Cognitive3D is a Canadian company, the data you provide through the Service may be stored and processed by third parties in countries around the world. You authorize Cognitive3D and third parties acting on our behalf to process your data in any country of their choosing, which may cause your data, including personal and anonymous data, to be subject to privacy protections and legal rights that may not be equivalent to those in your country.

Cognitive3D complies with international personal data transfer laws in applicable jurisdictions. For European Economic Area (“EEA”) residents, Cognitive3D complies with Articles 44-49 of the European Union’s General Data Protection Regulation (the “GDPR”). Currently, all transfers of personal data to Canada from residents of the EEA are covered by an adequacy decision as described in Article 45 of the GDPR.

Within 30 days of unsubscribing from our emails, Cognitive3D shall delete your name and email address from our records. Your personal data is retained until you request its deletion or until Cognitive3D no longer requires such data for the purpose for which it was collected or until required to be deleted by laws applicable in your jurisdiction. Any biometric personal data collected shall not be retained for a period longer than is permitted by applicable law (typically less than one-year following its use). Please email us at privacy@cognitive3d.com to delete any personal data we hold.

9. CHILDREN

Cognitive3D complies with the U.S. Children’s Online Privacy Protection Act and all other applicable laws and regulations concerning children and the Internet include those applicable in the EEA. The Service is not directed to children under the age of 13 and we do not knowingly collect personal data from children under the age of 13. If we learn that we inadvertently collected personal data from a child under the age of 13, we will delete that information as quickly as possible. If you are a parent or guardian of a child who you believe provided Cognitive3D with personal data without your consent, please contact us at privacy@cognitive3d.com.

We respect the privacy of children and encourage parents and guardians to take an active role in managing their children's online activities. If you are under the age of majority, please make sure you have consent from you parent and/or guardian before using the Services. Some of our Services are not available for use for children under the age of majority, and we do not knowingly collect personal information from children in connection with those Services.

10. DO NOT TRACK DISCLOSURE

Do Not Track (“DNT”) is a web or device setting that allows you to request that receivers of personal data stop their tracking activities. When you choose to turn on the DNT setting in your browser or device or use alternative consumer choice mechanisms, your browser or device sends a special signal to websites, analytics companies, advertising networks, plug-in providers and other web services you encounter to stop tracking your activity.

Cognitive3D does comply with DNT signals as specified and configured in the XR Privacy Framework (“XRPF”). The XRPF, when optionally setup by our Customer, will allow our Customer's users the opportunity to allow or disallow some or all streams of User Data as collected by our Customer. Note that restricting the collection of certain types of personal data in this manner may cause unintended problems with the Service and some or all of the features on the Platform may or may not function as intended.

11. CALIFORNIA “SHINE THE LIGHT” RIGHT

If you are a California resident, California Civil Code Section 1798.120 permits you to opt-out of the sale and sharing of your personal information to third parties. Currently, Cognitive3D does not sell or share your personal information to third parties and as such no opt-out of the sale or sharing of such personal information is necessary. Although Cognitive3D does not sell or share your personal information to third parties, Cognitive3D does provide a general opt-out right to all of our users as described in this Privacy Policy. If you have any other questions about our privacy practices, please email us at privacy@cognitive3d.com.

12. YOUR CALIFORNIA PRIVACY RIGHTS

If you are a California resident, California Civil Code Section 1798.120 permits you to opt-out of the sale and sharing of your personal information to third parties. Currently, Cognitive3D does not sell or share your personal information to third parties and as such no opt-out of the sale or sharing of such personal information is necessary. Although Cognitive3D does not sell or share your personal information to third parties, Cognitive3D does provide a general opt-out right to all of our users as described in this Privacy Policy. If you have any other questions about our privacy practices, please email us at privacy@cognitive3d.com.

13. EUROPEAN USERS AND RIGHTS OF EUROPEAN ECONOMIC AREA RESIDENTS

Cognitive3D has a legitimate interest, as described in Article 6(1)(f) of the GDPR, in collecting your personal data, including but not limited to the Asset Data and User Data, for the purposes described in this Privacy Policy. In all cases, the collection and processing of your personal data, including but not limited to the is necessary for our provision of the Services to our Customers and by contract, you, as such necessity is described in Article 6(1)(b) of the GDPR. In other cases, such as when you provide consent to contact, such as when you contact us directly, Cognitive3D may collect such personal data pursuant to Article 6(1)(a) of the GDPR. In some cases, the processing of your personal data is based on legitimate interests according to Article 6(1)(f) of the GDPR, such as when we collect behavioral tracking data on our Website or Platform.

If you are a resident of the EEA, you have certain rights in regard to your personal data. These rights may include:

• A Right of Access. You have the right to access your personal data that we hold about you free of charge in most circumstances.
• A Right to Rectification. If your personal data is inaccurate or incomplete, you can change the information you provided by contacting Cognitive3D using the e-mail listed below.
• A Right to Erasure. You have the right to obtain deletion of your personal data under most circumstances. In most cases, you may simply request the deletion by using the contact information found below. Please be careful as deletion of data in this manner is permanent and the data cannot be recovered.
• A Right to Object. If the processing of your personal data is based on legitimate interests according to Article 6(1)(f) of the GDPR or if your personal data was collected based on your consent according to Article 6(1)(a) of the GDPR, you have the right to object to this processing. If you object, we will no longer process your personal data unless there are compelling and prevailing legitimate grounds for the processing as described in Article 21 of the GDPR; in particular, if the personal data is necessary for the establishment, exercise or defense of legal claims or if personal data is required for the provision of the Service and you still wish to use the Service.
• A Right to file a Complaint. You have the right to file a complaint with the appropriate supervisory authority in your jurisdiction.
• A Right to Restriction of Processing of your Personal Data. You have the right to obtain restrictions on the processing of your personal data as described in Article 18 of the GDPR.
• A Right to Personal Data Portability. You have the right to receive your personal data in a structured, commonly used and machine-readable format and have the right to transmit such data to another controller under the conditions described in Article 20 of the GDPR.
• A Right to Post-Mortem Control of Your Personal Data. Certain jurisdictions grant post-mortem controls of your personal data and if such rights are applicable in your jurisdiction, you may have the right to establish guidelines for the preservation, the deletion and the transmission of your personal data after your death through a will or through your estate.
• A Right to Opt-out of Marketing Communications. You have the right to opt-out of marketing communications we send you at any time. If you receive any marketing e-mails from us, you can exercise your right to stop such communications by clicking on the “unsubscribe” or “opt-out” link on any marketing e-mails Cognitive3D sends you. To opt-out of other forms of marketing, please contact us using the contact details provided below.

14. CHANGE OF OWNERSHIP OR BUSINESS TRANSITION

In the event of, or in preparation for, a change of ownership or control of Cognitive3D or a business transition such as the sale of some or all Cognitive3D’s assets, we may disclose and/or transfer your personal data to third-parties who will have the right to continue to collect and use such data in the manner set forth in this Privacy Policy.

15. SECURITY

We are committed to ensuring that your data is secure. To prevent unauthorized access, disclosure, or breach, we have put in place suitable physical, electronic, and administrative procedures to safeguard and secure the data we collect and process, including appropriate protections for any sensitive personal data we collect. In particular, any biometric data collected shall be retained by Cognitive3D with added security when compared to other non-sensitive/biometric personal data.

16. CONTACT PREFERENCES

We will communicate with you through your email address, phone or other digital methods in order to conduct the Service and to respond to support requests or comments. If you have provided us with your email address and would like to change the email preferences we associate with you (for example, unsubscribing from receiving certain types of email) you may do so by clicking a link within certain types of emails that we send to you or, if no link is available, by replying with “unsubscribe” in the email title or body. On rare occasions, some types of email are necessary for the Service and cannot be unsubscribed from if you continue to use the Service

17. UPDATES

Cognitive3D reserves the right, in its sole discretion, to modify this Privacy Policy at any time (each an “Update”) and shall make each Update available on our website. You are deemed to accept an Update by continuing to use the Service. Unless Cognitive3D states otherwise, an Update is automatically effective 30 days after posting on the website, except in such case where an Update is immaterial to any of your legal rights or legal obligations of Cognitive3D and such Update is made only to correct a typographical, formatting or grammar inaccuracy, and in such case, an Update is effective immediately after posting on the website.

18. CONTACT US

If you have requests, questions or comments about the Privacy Policy or our data collection in general, please contact our Data Privacy Officer or our Privacy Team at privacy@cognitive3d.com or at: