Skip to content
Contact Sales Free Trial Buy Now
Research Community

Research Privacy Policy

Effective Date: Mar 4, 2026 | Last Updated: Jul 15, 2026

 

1. Introduction

This Privacy Policy explains how Nitro Software, Inc. and its affiliates ("Nitro," "we," "us," or "our") collect, use, share, and protect your personal data when you join or participate in the Nitro User Research Community, including surveys, interviews, usability testing, prototype feedback, and related research activities.

Nitro is a global document productivity SaaS company accelerating digital transformation in a world that demands the ability to work from anywhere, anytime, on any device. As a global player in the eSign and workflow productivity market, Nitro enables organizations to drive better business outcomes through 100% digital document processes and fast, efficient workflows. The Nitro Productivity Platform offers comprehensive SaaS business solutions, including highly secure eSigning and e-ID, powerful PDF productivity, and industry-leading analytics.

This Privacy Policy applies globally and includes specific disclosures required under laws such as the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the UK GDPR, and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA").

In this Privacy Policy, "you" and "your" refer to you as a User Research Community Participant.

By joining or participating in the Nitro User Research Community, you acknowledge that you have read and understood this Privacy Policy.

 

2. Data Controller

For the purposes of applicable data protection legislation, including the GDPR, the UK GDPR, the CCPA/CPRA, and other relevant privacy laws, the data controller for personal data collected in connection with the User Research Community is:

Nitro Software, Inc.

447 Sutter St., Suite 405, #1015

San Francisco, CA 94108

USA

Email: research@gonitro.com

For privacy-related inquiries: privacy@gonitro.com

 

3. Personal Data We Collect

We collect and process data directly from you when you apply to or participate in the Nitro User Research Community. The following categories describe the personal data involved.

3.1 Identifiers

  • First and last name

  • Email address

  • Country and city

3.2 Professional Information

  • Employment status

  • Job title

  • Industry

  • Company name and company size

  • Product usage details

3.3 Demographic Information

  • Language preferences

3.4 Sensitive Personal Information / Special Category Data (Optional)

With your explicit and separate consent, we may collect and process:

  • Racial or ethnic origin

  • Disability or accessibility data

We collect and process this data solely to support inclusive and representative research practices. Providing sensitive personal data is entirely voluntary and will be sought through a separate, specific consent mechanism.

3.5 Research Participation Data

If you participate in research activities, we may collect and process:

  • Survey responses

  • Interview responses

  • Feedback on prototypes

  • Notes taken by researchers

  • Audio or video recordings (only with your explicit consent, as set out in the session consent form)

  • Transcripts generated from recordings

  • Participant Materials: any non-confidential document templates or examples you voluntarily choose to share during a session

  • Feedback: any comments, ideas, suggestions, or other input you provide during a session

Please note that if you provide Feedback during a session, Nitro may use that Feedback to improve its products and services under the terms of the Feedback Licence described in Section 4.1 below.

3.6 Technical Information

Limited technical data may be collected and processed via research platforms, including:

  • Device and browser type

  • Session timestamps

 

4. Purposes and Legal Bases for Processing

Purpose

Categories of Data

 Legal Basis (GDPR Art. 6 / Art. 9)
Evaluating eligibility for research opportunities Identifiers, professional information, demographic information Consent (Art. 6(1)(a))
Inviting and scheduling research participation Identifiers, professional information Consent (Art. 6(1)(a))
Conducting surveys, interviews, and usability studies Identifiers, professional information, research participation data, technical information Consent (Art. 6(1)(a))
Processing sensitive personal data to support inclusive research Sensitive personal information / special category data Explicit consent (Art. 9(2)(a))
Improving Nitro’s products and services Research participation data (aggregated/pseudonymised where feasible) Consent (Art. 6(1)(a))
Using Feedback under the Feedback Licence Feedback (comments, ideas, suggestions) Consent (Art. 6(1)(a)) and legitimate interests (Art. 6(1)(f))
Maintaining research records and consent status Identifiers, research participation data Consent (Art. 6(1)(a)) and legal obligation (Art. 6(1)(c))

 

Consent: You voluntarily choose to participate in the research community. You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal. Please note that where Feedback has already been incorporated into aggregated, anonymised analysis, it may not be possible to disaggregate or reverse that analysis following withdrawal.

Explicit consent: If we process special category data (e.g., racial or ethnic origin, disability), we do so only with your explicit, separately obtained consent.

Legitimate interests: We may use Feedback to improve our products and services where this does not override your fundamental rights and interests.

Legal obligation: Processing required to comply with applicable legal, regulatory, or record-keeping requirements.

We do not use research community data for advertising or unrelated marketing purposes.

4.1 Feedback License

If you provide comments, ideas, suggestions, or other input ("Feedback") during a research session, you grant Nitro a perpetual, worldwide, royalty-free license, including the right to sublicense, to use and build upon your Feedback for the purpose of improving Nitro’s products and services. You will not be compensated for Feedback beyond any agreed research participation incentive.

Your Feedback will not be treated as confidential, but your individual comments will never be attributed to you personally in any internal or external materials. Feedback is used solely in aggregated, anonymized form for product and research purposes.

Your right to withdraw consent under this Privacy Policy and applicable data protection law is not affected by this license. However, where Feedback has already been incorporated into anonymized aggregated analysis, it may not be possible to individually identify or remove it.

5. Automated Decision-Making and Profiling

We do not use automated decision-making.


6. Recipients and Data Sharing

We share your personal data only to the extent necessary for the purposes described above and with the following categories of recipients:


6.1 Nitro Personnel

Authorized Nitro research and operations personnel may access your personal data as needed to conduct and support research activities.


6.2 Service Providers

We may share personal data with service providers acting as data processors, including:

  • User research recording and analysis platforms (including Lookback, Inc., a US-based platform used to record and analyse user research sessions — see Section 7 for information about the associated international data transfer)

  • Survey platforms

  • Scheduling tools

  • Video conferencing providers

  • Secure cloud storage providers

  • Panel Customer Relationship Management platforms (including Participant Kit, a UK-based platform with data centres in the European Union)

All service providers are contractually bound to process data only under Nitro’s instructions and in compliance with applicable data protection laws.


6.3 Business Transfer

In the event of a restructuring, business transfer, or merger and acquisition activity, your personal data may be transferred to the third parties involved in this process.

We do not sell personal data.

7. International Data Transfers

Because Nitro operates globally, your data may be transferred to, stored, and processed in countries outside your country of residence, including the United States.

In particular, session recordings conducted through the Lookback platform are processed and stored on servers in the United States. Lookback, Inc. acts as a data processor on Nitro’s behalf for these recordings.

Where personal data originating in the European Economic Area ("EEA"), the United Kingdom, or Switzerland is transferred to a country that has not been recognised as providing an adequate level of data protection, we ensure appropriate safeguards are in place, including:

  • EU-U.S. Data Privacy Framework (DPF) and related frameworks

  • Standard Contractual Clauses (SCCs) approved by the European Commission

  • UK International Data Transfer Addendum

  • Other legally approved safeguards

You may request a copy of the applicable Standard Contractual Clauses or other transfer safeguards by contacting privacy@gonitro.com.


8. Data Retention

We will retain your personal data for a period of 2 years from the date of your last research session participation, unless:

  • You request earlier deletion, or

  • You explicitly consent to extended retention for specific research purposes.

If you have joined the research community but have not yet participated in a session, your sign-up data will be retained for a period of 2 years from the date of sign-up, unless a session takes place within that period, in which case the session-based retention period applies.

Anonymized or aggregated research findings may be retained longer, as they no longer identify you.


9. Data Security

Nitro implements appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or alteration. These measures include:

  • Encryption and secure storage

  • Access-controlled systems

  • Vendor due diligence

  • Confidentiality obligations

  • Internal data handling policies

For further information about our security practices and certifications, please visit our Trust Center.

10. Your Rights

Depending on your jurisdiction, you may have some or all of the following rights regarding the personal data we process:

  • Access — request a copy of the personal data we hold about you.

  • Rectification — request correction of inaccurate or incomplete data.

  • Erasure (“right to be forgotten”) — request deletion of your data, subject to legal retention obligations.

  • Restriction of processing — request that we limit how we use your data in certain circumstances.

  • Data portability — receive your data in a structured, commonly used, machine-readable format.

  • Objection — object to processing in certain circumstances.

  • Withdrawal of consent — withdraw your consent at any time without affecting the lawfulness of processing before withdrawal.

  • Right not to be subject to automated decision-making — where applicable.


10.1 How to Exercise Your Rights

To exercise your rights, please submit a request via our Data Subject Access Request form at: OneTrust DSR Portal

Or send an email to: privacy@gonitro.com

We may verify your identity before processing requests. We will respond within the timeframes required by applicable law (generally within one month).


11. Additional Rights for California and U.S. Residents

If you are a California resident or a resident of another U.S. state with comprehensive privacy legislation (such as the CCPA/CPRA, Virginia CDPA, Colorado CPA, Connecticut CTDPA, or similar laws), you may have additional rights, including:

  • Right to know — the categories and specific pieces of personal information we have collected, the sources of collection, the business or commercial purposes for collecting it, and the categories of third parties with whom we share it.

  • Right to delete — request deletion of your personal information, subject to legal exceptions.

  • Right to correct — request correction of inaccurate personal information.

  • Right to opt out of “sale” or “sharing” — we do not sell your personal information, and we do not “share” it for cross-context behavioural advertising.

  • Right to limit the use of sensitive personal information — California residents may contact privacy@gonitro.com to exercise this right.

  • Right to non-discrimination — we will not discriminate against you for exercising any of your privacy rights.

Under California law, certain data qualifies as “Sensitive Personal Information,” including racial or ethnic origin, disability information, and audio or video recordings. Nitro does not sell personal information, does not share personal information for cross-context behavioural advertising, and does not use sensitive personal information for advertising purposes. We use sensitive personal information only as necessary to conduct research and support inclusive participation.


12. Opting Out or Withdrawing

Participation in the Nitro User Research Community is voluntary. You may at any time:

  • Withdraw from the research community

  • Request deletion of your data

  • Decline future research invitations

To opt out or withdraw, email: research@gonitro.com

13. Children’s Privacy

The Nitro User Research Community is intended for individuals aged 18 or older. We do not knowingly collect or process personal data from minors under 18 for research participation. If you believe we have inadvertently collected such data, please contact us so we can take appropriate action.


14. Contact Us

Query Contact
This privacy policy privacy@gonitro.com
Research practices research@gonitro.com
Data Subject Rights requests Nitro DSR Portal
Data Protection Officer (DPO) https://www.gonitro.com/contact-dpo  or privacy@gonitro.com

 


15. Supervisory Authority and Dispute Resolution

If you believe your data protection rights have been infringed, you have the right to lodge a complaint with a supervisory authority:

  • EEA residents: your local Data Protection Authority (a list is available at http://edpb.europa.eu). Where Nitro EMEA Limited is the data controller, the lead supervisory authority is the Irish Data Protection Commission (http://dataprotection.ie).

  • UK residents: the Information Commissioner’s Office (ICO) — http://ico.org.uk.

  • All other residents: the supervisory authority or regulator applicable in your jurisdiction.


16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. Where changes are material, we will notify you by email or through the research community platform prior to the changes taking effect. The “Last Updated” date at the top of this policy reflects the most recent revision.