UNBOUNDED

Unbounded AB Sensitive Data Consent Policy

Version 1.2 - Last Updated: January 20, 2026

Introduction

This policy explains how Unbounded AB ("Unbounded," "we," "us," or "our") processes sensitive personal data (also called “special categories of personal data”) when you explicitly consent to participate in surveys that include such topics.

We maintain a separate Services Privacy Policy that governs interaction with our survey ads. It is available at www.unboundedsource.com/en/privacy-services. This policy extends the Services Privacy Policy, and you acknowledge that you have reviewed the Services Privacy Policy. As spelled out in the Services Privacy Policy, where required by law, we obtain your explicit consent before processing your data. In other cases, we may rely on other legal bases. For sensitive personal data we obtain a second consent in addition to your original consent.

What is “sensitive personal data”

Sensitive personal data under GDPR Article 9 can include information revealing your:

  • health;

  • political opinions;

  • racial or ethnic origin;

  • religious or philosophical beliefs;

  • trade union membership; and

  • sex life or sexual orientation.

When we process sensitive personal data

We will only collect and process your answers to sensitive survey questions if you provide explicit consent. If you do not consent, you can still participate in surveys that do not include sensitive topics.

What we do with your sensitive answers

If you consent, we may:

  • display surveys that include sensitive questions;

  • collect and process your answers to produce research insights and statistical results;

  • use your answers for quality control and fraud prevention (e.g., detecting duplicate or automated responses); and

  • share aggregated or de-identified results with organizations commissioning research studies.

We do not use your sensitive answers for advertising, profiling, or targeting.

Who receives the results

We share results with organizations commissioning research studies, such as businesses, public bodies, NGOs, educational institutions, and consulting or research firms. We design shared results to be aggregated, statistical, or otherwise de-identified so they are not intended to identify you.

If a specific study requires sharing identifiable or respondent-level data, we will clearly disclose this to you at the time and obtain any additional consent required.

Withdrawal of consent for sensitive answers

You can withdraw your explicit consent at any time using the withdrawal control provided in the survey.ad experience or by contacting us (see “Contact”). Withdrawal does not affect processing that took place before withdrawal. After withdrawal, we will stop collecting and processing your sensitive answers going forward. If your sensitive answers have already been included in aggregated or de-identified research outputs, it may not be feasible to remove them from those outputs.

Data retention for sensitive answers

We retain sensitive answers in identifiable or pseudonymous form only as long as necessary for research delivery, quality control, fraud prevention, and methodology improvement. We then delete them or transform them into aggregated/de-identified data.

Additional Information for Residents of Europe

If you are a resident of the European Economic Area (EEA), this section applies to you.

For sensitive personal data we rely on:

  • GDPR Article 6(1)(a) (consent), and

  • GDPR Article 9(2)(a) (explicit consent for special categories of personal data).

Legal Basis for Processing

We rely on your consent to collect and process sensitive personal data.

Data Transfers

Unbounded AB is based in Sweden. We primarily store and process data on servers located within the European Union (EU). We might store and process data in other locations depending upon the location of clients and end users. However, the global nature of our services means that your personal data may be transferred to, or accessed by, entities outside of your home country, including outside the EEA. We take appropriate measures to ensure that such international data transfers comply with applicable data protection laws and that your data remains protected as it travels. When we transfer personal data from the EEA to countries not deemed to have “adequate” data protection laws (for example, transfers to the United States or other countries), we rely on approved safeguards under the GDPR. The primary mechanism we use is the European Commission’s Standard Contractual Clauses (“SCCs”). We have SCCs in place with our service providers outside the EU/EEA as required. In some cases, we may also rely on an adequacy decision (if the country has been approved by the EU as having essentially equivalent protections).

You can contact us at privacy@unboundedsource.com if you would like more information about international data transfers or to obtain a copy of the relevant transfer agreements (such as SCCs) we use. We will provide as much information as we are able to, although we may need to redact certain contractual details for confidentiality reasons.

Data Controller

Unbounded AB acts as the data controller for the personal data we collect. Our clients are separate controllers for their own analysis. Ad exchanges, ad networks, app/game publishers, and website owners are independent controllers. Our contact information is as follows:

Unbounded AB
Tre Liljor 3
113 44 Stockholm
Sweden

Email: privacy@unboundedsource.com

Additional Information for Residents of the United States

Certain U.S. state privacy laws define “sensitive personal information” to include data such as health information, political opinions, religious beliefs, sexual orientation, and similar characteristics.

When you explicitly consent to participate in surveys involving such topics, Unbounded processes your sensitive personal information solely for research and analysis purposes, as described in this policy.

We do not use sensitive personal information for targeted advertising, profiling, or inferring characteristics about you, and we do not sell or share it for such purposes.

You may withdraw your consent or limit the processing of sensitive personal information at any time as described above, without penalty or discrimination.

Updates to this Sensitive Data Consent Policy

We may update this policy to reflect changes in practices, laws, or technology. The “Last Updated” date will be revised accordingly. If we make material changes to how we process your sensitive personal data, we will provide notice and, where required by applicable law, obtain your renewed consent.

Contact Us

If you have any questions, concerns, or requests regarding this Sensitive Data Consent Policy or how Unbounded AB handles your personal data, please do not hesitate to contact us:

Unbounded AB
Tre Liljor 3
113 44 Stockholm
Sweden

Email: privacy@unboundedsource.com

Revision History

Version 1.0 - Last Updated: March 11, 2025

Version 1.1 - Last Updated: April 14, 2025

Version 1.2 - Last Updated: January 20, 2026