Privacy Policy

Who We Are

Kish & Partners Consulting Inc. ("Kish & Partners," "we," "us," or "our") operates the exIQtive.com software platform — a readiness and fair pay SaaS platform used by organizations to define role expectations, measure employee readiness, align compensation to readiness levels, and manage Standard Operating Procedures.

For the purposes of applicable privacy law, Kish & Partners is the data controller for personal data collected through our website and platform. Where our subscribers upload or process their employees' personal data through the platform, the subscriber is the data controller and Kish & Partners acts as a data processor on their behalf.

Scope of This Policy

This Privacy Policy applies to:

• Visitors to exiqtive.com and its subdomains (including account.exiqtive.com)
• Subscriber organizations and their authorized users of the exIQtive.com platform
• Employees and individuals whose data is entered into the platform by a subscribing organization

This policy does not apply to the websites or services of third parties, even if linked from our platform. We encourage you to review the privacy policies of any third-party services you use in connection with exIQtive.com.

If you are an employee whose data has been entered into exIQtive.com by your employer, your primary point of contact for privacy questions is your employer (the data controller). You may also contact us directly using the details in Section 17.

What Personal Data We Collect

3.1 Account and subscriber data

When an organization registers for exIQtive.com, we collect:

• Organization name, size, and industry
• Name, email address, job title, and phone number of the account administrator and authorized users
• Billing information (processed by our payment provider; we do not store full card numbers)
• Login credentials (passwords are hashed; we never store them in plain text)

3.2 Employee data entered by subscribers

Subscribing organizations use the platform to enter data about their employees, which may include:

• Name, job title, department, and employment status
• Role assignments, responsibilities, and readiness levels
• Compensation data (salary, pay range, range penetration)
• Badge and microlearning completion records
• Field inspection results and notes
• Performance scorecard results (when the Performance Module is active)

This data is entered and controlled by the subscribing organization. We process it on their behalf in accordance with our Terms and Conditions and applicable data processing obligations.

3.3 Usage and technical data

When you use the platform or visit our website, we automatically collect:

• IP address and approximate location (country/region)
• Browser type, operating system, and device type
• Pages visited, features used, and time spent
• Session identifiers and authentication tokens
• Error logs and performance data

3.4 IQ agent interaction data

When you use the IQ agent features, we collect the prompts you submit and the outputs generated. This data is used to deliver the service and, in anonymized and aggregated form, to improve IQ agent accuracy over time. See Section 7 for details on how we use anonymized data.

How We Collect Personal Data

We collect personal data through the following means:

• Directly from you — when you register, fill in forms, contact us, or use the platform
• From your employer — when your organization enters your data into the platform as an employee record
• Automatically — through cookies, log files, and usage tracking technologies when you interact with the platform or website
• From third parties — such as payment processors confirming billing information, or implementation partners who onboard your organization

If you are participating in a free trial, personal data collected during the trial period is handled under this policy in full.

How We Use Personal Data

We do not sell personal data. We do not use personal data to make fully automated decisions that have a legal or similarly significant effect on individuals without human review.

How We Share Personal Data

We do not sell, rent, or trade personal data. We share personal data only in the following circumstances:

6.1 Service providers (subprocessors)

We engage third-party service providers that process personal data on our behalf to help us deliver the platform. These subprocessors are contractually bound to process data only as instructed and to maintain appropriate security measures. Our current subprocessors include:

• Knock.io — notification delivery (in-app, email, and push)
• Amazon Web Services (S3 and CloudFront) — media storage and content delivery
• Cloudflare Stream — video hosting and playback
• Google (Gemini API) — AI infrastructure powering the IQ agent
• TipTap — collaborative document editing (Procedures Module)
• Payment processor — billing and subscription payment capture

6.2 Implementation partners

Authorized implementation partners who assist in onboarding or configuring your organization's account may access account-level data as needed to perform their services. Partners are bound by confidentiality agreements and may not use data for any purpose other than the services they provide to you.

6.3 Legal and regulatory disclosures

We may disclose personal data if required to do so by law, court order, or government authority, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Kish & Partners, our subscribers, or the public. We will provide reasonable notice to affected parties where permitted by law.

6.4 Business transfers

In the event of a merger, acquisition, sale of assets, or other corporate restructuring, personal data may be transferred to the successor entity. We will take reasonable steps to ensure that your personal data continues to be handled in accordance with this policy. We will notify affected subscribers of any material change in ownership or control.

6.5 With your consent

We may share personal data for any other purpose with your prior written consent.

Anonymized and Aggregated Data

We may derive anonymized and aggregated data from personal data processed through the platform ("Anonymized Data"). Anonymized Data does not identify any individual or organization and is not subject to this Privacy Policy.

We use Anonymized Data for purposes including: benchmarking, research, improving platform features, improving the accuracy and performance of the IQ agent, and understanding platform usage patterns. This is standard practice in the SaaS industry and helps us build a better product for all subscribers.

All identifiable subscriber and employee data is anonymized within 120 days of subscription termination. We will anonymize earlier on written request.

Data Retention

We retain personal data for as long as necessary to provide the Service and for legitimate business purposes, including:

• Active subscriptions: personal data is retained for the duration of the subscription and for 30 days following termination, during which you may export your data.
• Post-termination: after 30 days, identifiable data is deleted or anonymized within 120 days of termination (see Section 7).
• Legal obligations: we may retain certain data longer if required to comply with applicable law, resolve disputes, or enforce our agreements.
• Backup systems: data deleted from production systems may persist in encrypted backups for up to 90 days before being purged.

We will not retain personal data in a form that identifies individuals for longer than is necessary for the purposes set out in this policy.

Security

We maintain an information security program that includes administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, loss, disclosure, alteration, or destruction. Our security measures include:

• Encryption of data in transit (TLS) and at rest
• Role-based access controls limiting data access to authorized personnel
• Regular security assessments and vulnerability monitoring
• Incident response procedures including breach notification
• Subprocessor due diligence and contractual security requirements

Despite our efforts, no security system is guaranteed to be impenetrable. In the event of a confirmed data breach affecting your personal data, we will notify you within 72 hours of becoming aware of the incident, to the extent required by applicable law.

You are responsible for protecting your account credentials. Please use a strong, unique password, enable multi-factor authentication where available, and notify us immediately at security@exiqtive.com if you suspect unauthorized access to your account.

Cookies and Tracking

We use cookies and similar tracking technologies on our website and platform for the following purposes:

We do not use cookies for third-party advertising or cross-site tracking. You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies will affect the functionality of the platform.

Children's Privacy

The exIQtive.com platform is designed for use by organizations and their employees in a professional context. It is not directed at or intended for use by individuals under the age of 16. We do not knowingly collect personal data from anyone under 16. If we become aware that we have collected personal data from a child under 16 without appropriate consent, we will delete it promptly.

International Data Transfers

Kish & Partners operates primarily in the United States. If you or your employees are located outside the United States — including in Canada — personal data processed through the platform will be transferred to and stored in the United States.

For Canadian subscribers, by using the Service you consent to the transfer of personal information to the United States for processing in accordance with this policy and applicable Canadian privacy law, including PIPEDA. We take reasonable contractual and technical steps to ensure that transferred data is protected to a standard equivalent to that required in Canada.

Data transfers to our subprocessors outside the United States are governed by contractual data processing agreements, including Standard Contractual Clauses where applicable.

California Residents — CCPA Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you additional rights with respect to your personal data.

What we do not do

• We do not sell personal data as defined by the CCPA.
• We do not share personal data for cross-context behavioral advertising.
• We do not collect sensitive personal information as defined by the CCPA beyond what is strictly necessary to provide the Service.

Your CCPA rights

• Right to know — request disclosure of the personal data we have collected about you and how we use and share it
• Right to delete — request deletion of personal data we hold about you (subject to legal exceptions)
• Right to correct — request correction of inaccurate personal data
• Right to opt out of sale/sharing — we do not sell or share personal data, so this right is not applicable
• Right to non-discrimination — we will not discriminate against you for exercising your privacy rights

To exercise these rights, email privacy@exiqtive.com with the subject line "California Privacy Request — [Request type]." We will acknowledge your request within 10 business days and respond within 45 days.

Under California's "Shine the Light" law (Cal. Civ. Code § 1798.83), California residents may request information about any disclosures of personal data to third parties for their direct marketing purposes in the prior calendar year. We do not make such disclosures.

Canadian Residents — PIPEDA Rights

If you are located in Canada, your personal data is handled in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

Your rights under PIPEDA

• Right to access — request access to the personal data we hold about you
• Right to correct — request correction of inaccurate or incomplete personal data
• Right to withdraw consent — withdraw consent to the collection, use, or disclosure of your personal data (subject to legal and contractual limitations)
• Right to complain — file a complaint with the Office of the Privacy Commissioner of Canada if you believe your rights have been violated

We collect, use, and disclose personal data only for the purposes identified in this policy, with your knowledge and consent (express or implied). You may withdraw consent at any time by contacting us, subject to legal or contractual restrictions and reasonable notice.

To exercise your rights, email privacy@exiqtive.com with the subject line "Canadian Privacy Request." We will respond within 30 days.

Your Rights and Choices

Regardless of your location, you have the following rights in relation to your personal data:

• Access — request a copy of the personal data we hold about you
• Correction — request that we correct inaccurate or incomplete personal data
• Deletion — request deletion of your personal data, subject to our legal obligations and legitimate business needs
• Restriction — request that we limit the processing of your personal data in certain circumstances
• Portability — request a machine-readable copy of data you provided to us
• Objection — object to processing based on legitimate interest

If you are an employee whose data was entered by your employer, please direct your request to your employer first. We will cooperate with your employer to fulfil valid requests. You may also contact us directly at privacy@exiqtive.com.

We will investigate and attempt to resolve all privacy complaints within 45 days of receipt. If you are not satisfied with our response, you may contact the applicable supervisory authority in your jurisdiction.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or the features of the Service. When we make material changes, we will notify subscribers by email to the address on their account and post the updated policy on this page with an updated effective date, at least 30 days before the changes take effect.

Your continued use of the Service after the effective date of any updated policy constitutes your acceptance of the changes.

Contact Us

For any questions, requests, or complaints regarding this Privacy Policy or our data practices, please contact us:

Privacy Officer
Kish & Partners Consulting Inc.
Email: privacy@exiqtive.com
Subject line: "Privacy Request — [your request type]"
Website: www.kishandpartners.com

We will acknowledge your request within 10 business days and provide a full response within 45 days. For complex requests, we may extend this period by an additional 45 days with notice.