EU and UK Privacy Addendum

1. Who is responsible

The Groundbreakers Inc. is normally the controller of account, billing, direct customer, website, product-operations, public local-knowledge, and independently used Product Intelligence Data. When an organization uses Build, Evidence Base, document, or report features to process personal data under its instructions, that organization may be the controller and we may act as its processor. Linkable processor data is used for our independent product-intelligence purposes only where the customer has authorized that separate controller processing and applicable law permits it. Our Data Processing Addendum addresses that relationship.

2. Purposes and lawful bases

• Contract: account administration, authentication, diagnostics, reports, requested research, Build sessions, subscriptions, support, and delivery of requested features.
• Legitimate interests: service security, fraud and abuse prevention, essential first-party operational telemetry, reliability, report-quality review, product and methodology improvement, research, maintenance of source-aware public local knowledge, protected benchmarking and comparisons, customer support, and establishment or defence of legal claims. We balance these interests against the effects on individuals and apply restricted access, minimization, correction, de-identification, aggregation, cohort, and suppression controls. You may object as described below.
• Consent: optional Google and Firebase analytics and any other processing for which consent is requested. Consent may be withdrawn without affecting earlier lawful processing.
• Legal obligation: tax, accounting, regulatory, court, law-enforcement, and privacy-compliance requirements.
• Vital interests: only in the unusual case where processing is necessary to protect someone's life or physical safety.

Where we process data solely on a customer's instructions as processor, the customer determines the applicable lawful basis.

3. Categories and recipients

The categories of account data, diagnostic responses, complete reports, documents, session information, payment metadata, communications, operational events, and public or derived local knowledge are described in the Privacy Policy. Recipients include the customer and recipients it selects, our personnel with a need to know, and the providers in our Subprocessor Register. Unrelated customers and the public receive only protected benchmark or comparison outputs, not identifiable respondents or private source reports.

4. Your rights

Subject to legal conditions and exceptions, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests or direct marketing. You may withdraw consent. You may also lodge a complaint with the supervisory authority where you live or work, or where you believe an infringement occurred. UK residents may contact the Information Commissioner's Office at ico.org.uk.

Send requests to ibarker@thegroundbreakers.net. We may verify identity and will respond within the period required by applicable law.

5. Automated analysis

The Service uses automated systems to tailor questions, generate reports, extract documents, synthesize evidence, and answer requests. These outputs support human judgment. We do not use them to make solely automated decisions about a person that produce legal or similarly significant effects.

6. International transfers

We are established in Canada. For transfers from the EEA to Canadian organizations covered by Canada's recognized adequate protection, we rely on the European Commission's adequacy decision where applicable. Where adequacy does not cover a transfer or onward transfer, we use an available lawful mechanism such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or International Data Transfer Agreement, or another approved safeguard. We assess transfer circumstances and use supplementary measures where appropriate. You may request information about the safeguard relevant to your data.

7. Retention and objection

Retention is described in the Privacy Policy, including intended indefinite retention of restricted Product Intelligence Data, structured public local knowledge and provenance, and first-party operational activity records. We periodically review the necessity, accuracy, access, and safeguards for personal information retained for these purposes. Where processing relies on legitimate interests, you may object based on your particular situation. We will stop unless we demonstrate compelling legitimate grounds or need the data for legal claims. A valid erasure request may require us to delete linkable information despite our intended retention. We stop direct marketing when you object or unsubscribe.

8. Representatives and contact

Ian Barker is our Privacy Officer but is not described as a statutory data protection officer. We periodically assess whether EU GDPR Article 27 or the corresponding UK representative requirement applies. If a representative is required, we will appoint one and publish its identity and contact details here before the relevant offering or monitoring requires it.

The Groundbreakers Inc., 604 Mount Pleasant Road, 34023, Rosedale, ON M4S 0C4, Canada. Email: ibarker@thegroundbreakers.net.