PRIVACY POLICY

‍

This Privacy Policy applies to websites, forms, services, agreements, and other materials linked to or referencing this Privacy Policy (collectively, the “Site”), which may be provided by or on behalf of OPEXEngine LLC, a company headquartered in Boston, Massachusetts, USA, (“OPEXEngine”, “we”, “us”, or “our”). Personal data collected through the Site is collected by us for our own business purposes. We may act as data controller with respect to the personal data you share with OPEXEngine under this Privacy Policy.

‍

OPEXEngine reserves the right, at its sole discretion, to alter and update this Privacy Policy from time to time. We, therefore, invite you to review the current version of the Privacy Policy each time you return to or use the Site.

‍

Some terms are defined throughout this Privacy Policy. Please refer to the definitions in this Privacy Policy below.

Types of Data Collected

We require you to register with the Site to access certain features. We may collect the following information from you during the registration process, in your use of the Site, or otherwise in our communications with you:

• identifiers, such as your name, date of birth, age, address, country of residence, phone number, email address, account login and password, or other identification details;
• commercial information including records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies;
• sensitive personal information such as geolocation information, the region or country in which you are located, tax status (e.g., W-4 information), and Social Security numbers (collected from employees solely for tax and employment compliance purposes);
• education information, such as your university affiliation and the information included in your curriculum vitae;
• professional information, such as your job title, company, and work history;
• financial information, such as bank account details for payroll purposes (collected from employees);
• employee census data provided by your employer or an investor in your employer, such as job title, department, salary, location, employee type (e.g., contractor or full-time), and hire date, which we process on behalf of your employer to provide our services;
• audio, electronic, visual, or similar information, such as photographs or voice recordings;
• information about your relationship with OPEXEngine, topics of interest to you, and your reasons for contacting or communicating with OPEXEngine,
• your preferences, such as how often you wish to receive marketing or other communications; and
• other information you choose to share with OPEXEngine or submit through the Site or in communications with us.

‍

Personal Data We Collect Automatically

We and our third party service providers use cookies, web beacons, and other tracking technologies to collect personal data about you automatically as you use the Site or communicate with us. Examples of this type of personal data include, but are not limited to:

• information about your estimated location as may be determined from your IP address;
• information about the device you are using, such as:
• Internet Protocol (or IP) address or device ID/UDID, protocol and sequence information;
• browser language and type;
• domain name system requests;
• browsing history, time spent at a domain, time and date of your visit, number of clicks, or location data;
• HTTP headers, application client and server banners;
• hardware model, operating system, application version number, device or browser data; and
• Internet or other electronic network activity information, such as the dates and times of your use of the Site, the route by which you choose to access the Site, and your use of any hyperlinks or downloadable content available through the Site.

We may combine this information with other personal data that we collect about you. For additional information about our use of these technologies, please see our Cookies Policy below.

‍

Where we rely on consent as the legal basis for processing your personal data, we will request your affirmative consent through a clear, specific mechanism (such as an opt-in checkbox or consent form) before processing begins. You may withdraw your consent at any time by contacting dataprivacy@opexengine.com. Where we rely on other legal bases (such as contractual necessity or legitimate interest), your use of the Site does not constitute consent to processing; rather, the applicable legal basis is identified in the “Legal Basis for Processing” section above. Please do not send us any information you do not wish OPEXEngine to use.

‍

How we Collect Data

OPEXEngine collects personal data from you when you request information from or communicate with OPEXEngine and/or supply information through the Site (such as when you use a service, register for an event, download a document, fill out a form, send emails to or opt to receive emails from OPEXEngine, agree to participate in surveys, or apply for a role at OPEXEngine). We also collect personal data from third-party sources, including data aggregators, referrals, and your employer or investors in your employer.

We may collect your personal data from the following sources:

• You directly (i.e., email, phone, in-person, or through account registration or forms on the Site),
• The Site or our social media accounts, if you choose to submit your information through the Site or social media accounts,
• Third-party data aggregators and platforms,
• Referrals from business contacts or existing customers,
• Your employer or an investor in your employer, in connection with services we provide to them,
• Publicly available databases.

You do not have to provide us with any personal data. However, if you do not, we may be unable to communicate with you, handle your requests, or provide you with services.

Legal Basis for Processing

OPEXEngine only collects personal data from you or about you that is reasonably necessary for us to provide you with products or services, to contact you for the purposes of carrying out our contractual obligations, to establish a business relationship with you, to send you marketing communications in accordance with your communication preferences, to process your job application, to improve our products and services or recruiting, marketing, and onboarding processes, for a legitimate business interest, or to comply with our legal or regulatory obligations. Our legal bases for processing include:

• Contract: where processing is necessary to perform our contract with you or your employer (e.g., providing services, invoicing);
• Legitimate interest: where processing is necessary for our legitimate business interests, such as improving our services, marketing our own products and services, prospecting, and managing our business operations. Where we rely on legitimate interest, we have conducted a balancing test to ensure that our interests do not override your fundamental rights and freedoms. You may contact us at dataprivacy@opexengine.com to request information about our legitimate interest assessments;
• Consent: where you have provided your consent to specific processing activities, such as receiving marketing communications or sharing your personal data with third parties for their own marketing purposes. You may withdraw your consent at any time; and
• Legal obligation: where processing is necessary for compliance with applicable law (e.g., tax filings, employment law requirements).

Where consent is required, OPEXEngine will request your consent to process your personal data. You are free to withdraw your consent at any time by contacting dataprivacy@opexengine.com.

Use of your Personal Data

We primarily use your personal data to provide you with the Site, market and improve our services, and communicate with you. We also may use your personal data as follows:

• to communicate with you, including to respond to your comments or requests for information, to request feedback on our products and services, and to notify you about changes to your subscriptions or to the services and products you use;
• to provide services to your employer or an investor in your employer pursuant to our contract with them, including benchmarking, analytics, and reporting services;
• to help us understand our customers, to tailor and enhance our product and service offerings, anticipate and resolve problems with any products or services supplied to you, create products or services that may meet your needs;
• to invoice you and process payments for products or services;
• to provide access to restricted pages or contents of the Site (e.g., password protected webpages or services);
• to comply with legal and/or regulatory requirements and cooperate with regulators and law enforcement bodies;
• to facilitate your activity and to identify you when you log into your account through the Site;
• to send you marketing communications and advertising in line with your communications preferences and where permitted by applicable law about products and services that we believe would be of interest to you, including products and services offered by third parties;
• to share with third-party partners for their own marketing purposes, where you have provided your consent;
• to evaluate the success of our advertising campaigns, to improve our products and services, to assess patterns of use, and to plan and evaluate our marketing and business development programs; and
• to protect our rights, your rights, and the rights of others, and to meet our own high standards of business practice.

With whom do we share personal data?

To the extent permitted by law and subject to any contractual limitations on sharing personal data (as set forth in the relevant agreement for products or services), we may share your personal data with our business partners for the purposes described in this Privacy Policy. We may also share your personal data in the following circumstances:

‍

With respect to personal data you provide directly to us (such as your contact information, account credentials, and marketing preferences), we act as a data controller. With respect to employee census data provided to us by your employer or an investor in your employer for the purposes of our benchmarking and analytics services, we act as a data processor on behalf of your employer or the applicable investor.

• Third-Party Service Providers: We may share your personal data with third parties who perform services on our behalf. These service providers include providers of cloud, productivity, hosting, file storage, marketing, CRM, document management, accounting, data processing, consulting services, human resources, and payroll services. We do not authorize these third parties to use your personal data for purposes other than for which it has been provided, except as permitted by applicable law. We use reasonable efforts to confirm that these third parties maintain reasonable security to protect your information from unauthorized access or processing.

Please note that certain of our third-party service providers may use personal data we share with them for their own purposes in addition to providing services to us, including to improve and develop their products and services. Where required by applicable law, we will obtain your consent before sharing your personal data with third parties for their own purposes.

• Legal Authorities or Basis: We may share your personal data with legal or regulatory authorities, courts, and government agencies, where we believe that doing so would be in accordance with, permitted, or required by any applicable law, regulation, or legal process or as necessary to provide you with services.
• Sale of Business: We may transfer your personal data to a third party in the event of any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, brands, affiliates, subsidiaries or other assets. To the extent permitted by applicable law, we may share your personal data with a prospective buyer or transferee of our business or assets as part of the diligence process, provided that we require any such third party to maintain the confidentiality of your personal data and protect it with appropriate technical, administrative, and physical security measures.

We may share your personal data with other third parties as directed by you or subject to your consent.

International Transfers of Personal Data

Our affiliates and other third parties with whom we share your personal data may be located in other countries, including countries that do not offer the same protection to your personal data as the country in which you reside or are located. We and our affiliates and third parties may transfer, process, and store your personal data outside of your home country, including in the United States, Canada, India, Germany, the Netherlands, the United Kingdom, Ireland, Japan, Australia, and other countries in which our service providers maintain facilities. For the avoidance of doubt, if you are resident in the European Economic Area ("EEA") or the United Kingdom (“UK”) this may include the transfer of your personal data from within the EEA or UK to a country outside of the EEA or UK. We have put in place appropriate safeguards for international transfers, such as Standard Contractual Clauses approved by the European Commission and the UK Addendum to the Standard Contractual Clauses, as well as technical safeguards in accordance with applicable legal requirements. Where required, we have conducted transfer impact assessments to evaluate the level of data protection in the recipient country and have implemented supplementary measures where necessary. You may request a copy of the relevant transfer safeguards by contacting dataprivacy@opexengine.com.

Retention of your Personal Data

OPEXEngine will keep your personal data for as long as needed to provide you with services, to fulfill our relationship with you, for the purposes outlined in this Privacy Policy, in accordance with our retention policies, and as required or permitted by applicable law. In general, we apply the following retention criteria: (i) identifiers, commercial information, and professional information are retained for the duration of our business relationship with you plus three (3) years; (ii) financial information (e.g., payroll data for employees) is retained for the period required by applicable law; (iii) internet or electronic network activity information is retained for up to twenty-four (24) months; (iv) sensitive personal information (e.g., Social Security numbers) is retained only for as long as required for the specific compliance purpose for which it was collected; and (v) personal data associated with job applications may be retained for a period of up to five (5) years. Where personal data is no longer necessary for the purposes for which it was collected, we will securely delete or anonymize it.

Publicly Disclosed Information

Please note that OPEXEngine is not responsible for any information you may disclose publicly in any chat rooms, message boards, or similar web pages, including those hosted on or linked to the Site. You should keep in mind that, whenever you publicly disclose information about yourself online (for example, via message boards or chat rooms), such information could be collected and used by people whom you do not know. In addition, certain message boards and similar user forums may display IP addresses along with the message poster’s name and message. OPEXEngine bears no responsibility for any action or policies of any third parties who collect any information users may disclose on the message boards, chat areas, or other user forums, if any, on the Site.

Use of Cookies

We may use cookies or to obtain certain types of information when you browse or use the Site. You can find information about what personal data is collected and how it is used in our Cookies Policy below.

Links to other Websites and Services

The Site may contain links to third-party websites, including social networking sites, that are governed by their own terms and privacy policies. OPEXEngine does not bear any liability and responsibility for the content or your use of such websites. Such websites are governed by their own terms of use and privacy policies, which you should review before browsing or submitting information to them. OPEXEngine is not responsible for the privacy practices of such websites. In addition, a link to a third-party website does not mean that OPEXEngine endorses or accepts any responsibility for the content or the use of such a website. OPEXEngine shall not bear any liability and responsibility for such content or for your use of these websites.

Security of your personal data

OPEXEngine has implemented appropriate technical and organizational security measures intended to protect your personal data from loss, misuse, alteration, or destruction. Despite these precautions, however, OPEXEngine cannot guarantee that unauthorized persons will not obtain access to your information. For additional information about how OPEXEngine protects your personal data, read our Commitment to Security. If you have reason to believe that our security measures or your interactions with us are no longer secure (i.e., you feel that the security of an account you have with us may have been compromised), please contact us immediately at dataprivacy@opexengine.com.

Your Rights

You may have the following set of rights with respect to your personal data:

• Right to opt out of marketing communications
• Right to access your personal data
• Right to request information regarding your personal data
• Right to request correction of your personal data
• Right to request transfer (portability) of your personal data in a structured, commonly used, and machine-readable format
• Right to request erasure of your personal data
• Right to withdraw your consent to the processing of your personal data
• Right to object to the processing of your personal data
• Right to restrict or limit the processing your personal data
• Right to lodge a complaint with a supervisory authority (such as the supervisory authority in your member state of habitual residence or place of work or where the alleged infringement took place)

Please note that the above-mentioned rights may not be applicable to you in certain cases and are subject conditions as specified under applicable law. We may require you to verify your identity if you elect to exercise your rights, and we will try our best to comply with your request as soon as reasonably practicable, but no later than the timeframe required by law.

For more information or to exercise your rights, please submit your request to dataprivacy@opexengine.com. Please include your full name, contact details, and the nature of your request in any such communication.

‍

Additional Information for California Residents (CCPA/CPRA)

If you are a California resident, this section applies to you in addition to the rest of this Privacy Policy. This section is provided to comply with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”).

‍

Categories of Personal Information Collected. In the preceding twelve (12) months, we have collected the following categories of personal information as defined under the CCPA: identifiers; commercial information; internet or other electronic network activity information; geolocation data; sensitive personal information (including Social Security numbers and precise geolocation); professional or employment-related information; education information; financial information; and audio, electronic, visual, or similar information. The sources from which we collect personal information and the purposes for which we use it are described in the “Types of Data Collected,” “How we Collect Data,” and “Use of your Personal Data” sections above.

‍

Categories of Third Parties Receiving Personal Information. We may share your personal data with third party providers of cloud, productivity, hosting, file storage, marketing, CRM, document management, accounting, data processing, consulting services, human resources, and payroll services. Certain of our third-party service providers may use personal data we share with them for their own purposes in addition to providing services to us, including to improve and develop their products and services, train machine learning and artificial intelligence models, conduct research, and for marketing.

‍

Sale and Sharing of Personal Information. In the preceding twelve (12) months, we may have sold or shared (as those terms are defined under the CCPA) the following categories of personal information: identifiers, internet or other electronic network activity information, and professional or employment-related information. The business purpose for such sale or sharing is to support our data enrichment, lead generation, and business intelligence services. You have the right to opt out of the sale or sharing of your personal information.

‍

Sensitive Personal Information. We may collect sensitive personal information, including geolocation data. We do not use or disclose sensitive personal information for purposes other than those permitted under the CCPA. You have the right to limit our use of your sensitive personal information.

‍

Retention. We retain personal information for as long as necessary to fulfill the purposes for which it was collected, as described in the “Retention of your Personal Data” section above, and as otherwise required or permitted by applicable law.

‍

Your California Privacy Rights. As a California resident, you have the following rights under the CCPA: (i) the right to know what personal information we have collected, used, disclosed, and sold or shared about you; (ii) the right to request deletion of your personal information; (iii) the right to correct inaccurate personal information; (iv) the right to opt out of the sale or sharing of your personal information; (v) the right to limit the use and disclosure of your sensitive personal information; and (vi) the right to not be discriminated against for exercising any of the foregoing rights. To exercise any of these rights, please contact us at dataprivacy@opexengine.com. We will verify your identity before processing your request. You may also designate an authorized agent to make a request on your behalf by providing the agent with written, signed permission to act on your behalf, or by providing proof that the agent holds a valid power of attorney. We may require the authorized agent to verify their own identity and may contact you directly to confirm that you authorized the agent to act on your behalf.

‍

Do Not Sell or Share My Personal Information. To opt out of the sale or sharing of your personal information, you may: (i) click the “Do Not Sell or Share My Personal Information” link available on our website; (ii) submit your request to dataprivacy@opexengine.com; or (iii) submit a request through any opt-out preference signal recognized by our website (such as the Global Privacy Control). We will process your opt-out request within the period of time required by applicable law.

‍

Disclosure Regarding Use of Personal Data for AI/ML Training. As described in this Privacy Policy, certain third-party service providers with whom we share personal data may use such data to train machine learning and artificial intelligence models. The categories of personal information that may be used for this purpose include identifiers and internet or other electronic network activity information. Where required by applicable law, we will obtain your consent before sharing your personal data for these purposes, and you may opt out of the sale or sharing of your personal information as described above.

Additional Information for Residents of Other U.S. States

If you are a resident of Virginia, Colorado, Connecticut, Texas, Oregon, Montana, or another U.S. state with a comprehensive consumer privacy law, you may have similar rights to those described for California residents above, including the right to access, correct, and delete your personal data, the right to opt out of the sale of personal data, targeted advertising, or profiling in furtherance of decisions that produce legal or similarly significant effects, and the right to appeal a denial of a privacy request. To exercise any of these rights, or to appeal a decision regarding your privacy request, please contact us at dataprivacy@opexengine.com. We will respond to verified requests within the timeframes required by applicable law. For residents of states that recognize opt-out preference signals (such as the Global Privacy Control), we will honor such signals as a valid opt-out request to the extent required by applicable law.

Communication Preferences

If you receive marketing communications from OPEXEngine, you can opt-out of receiving future emails or unsubscribe from participating in our marketing programs:

• By contacting us at dataprivacy@opexengine.com; or
• through the “unsubscribe” link, which is accessible in every marketing email you receive from OPEXEngine.

We will try to comply with your request as soon as reasonably practicable as required by law. Please note that we may need to retain certain information for recordkeeping purposes, to complete any transactions that you began prior to your request, or for other purposes as required or permitted by law. In addition, please note that even if you opt-out of receiving marketing communications, we may need to send you service-related communications.

Automated Decision Making

OPEXEngine does not engage in decision-making based on the automated processing of your personal data, including profiling, which produces legal effects concerning an individual or similarly significantly affects an individual.

Job Applicants

If you apply for a job at OPEXEngine, you will be asked to submit personal data to OPEXEngine such as your name, contact details, information about your education and work history, and any other background information that might be relevant for your application or that you choose to share with OPEXEngine. If you do not provide this personal data to us, we might not be able to process your application.

OPEXEngine will use this personal data as described in this Privacy Policy, as well as to assess your application and candidacy for the position to which you have applied. Without limiting the generality of the foregoing, this may include: (i) evaluating your skills and experience in relation to the qualification required for the job to which you have applied; and (ii) tracking feedback and interactions we have with you throughout the recruiting process.

We may also use your personal data when analyzing our internal recruiting processes to determine (i) which recruit sources to focus on; (ii) how to improve integration and training programs for new hires with different educational backgrounds and work experience; and (iii) how to enhance our interview model to improve hiring quality.

As more particularly described in this Privacy Policy, we might share your personal data with our affiliates as well as with third parties such as recruitment service providers, background check providers, and IT system providers.

Children

The Site is not directed at or intended to be used by children 16 years of age or younger.

Contact

If you have any questions about this Privacy Policy or how OPEXEngine handles your personal data, please contact us by email dataprivacy@opexengine.com or by US Mail to Data Protection, OPEXEngine LLC, c/o Bain & Company, 350 Boylston Street, Boston, MA 02116. Our Data Protection Lead can be reached at dataprivacy@opexengine.com for questions related to data protection impact assessments, international transfers, or the exercise of your rights under applicable law.

Definitions

For the purposes of this Privacy Policy:

• “personal data” means any information relating to an individual who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. The definition of personal data under this Privacy Policy includes any information that is subject to privacy laws and regulations applicable to our business.
• “cookies” are technology that automatically collect pieces of data based upon your use of the Site that, among other things, identify you as a unique user, facilitate your ongoing access to and use of the Site, and help diagnose server problems. If you prefer to disable cookies, we suggest consulting the “help” section of your browser.

Cookies Policy

OPEXEngine uses cookies to improve your experience on and in using the Site. More information about how and why we use cookies and how you can manage them can be found in this Cookies Policy.

‍

This Cookie Policy explains how and why cookies, web beacons, pixels, and other similar technologies may be stored on and accessed from your device when you use or visit the Site. This Cookie Policy should be read together with, and forms part of, our Privacy Policy.

‍

Cookies may consist of small text files that are stored by your browser on your computer’s or other device’s hard drive. Cookies can be placed on your device directly by the Site (first-party cookies) or by a third party through the Site (third party cookies).

‍

Cookies can be further categorized into two types:

• Session cookies are only stored on your device during your browser session. They are deleted when you close your browser.
• Persistent cookies remain on your device for a set period of time even after your browser session has ended.

Most internet browsers accept cookies by default, but you can modify your browser preferences to block or restrict cookies. There are a variety of tools publicly available to manage cookies and similar technologies that collect information related to your use of websites. Learn more from (i) the FTC or (ii) the Digital Advertising Alliance opt-out page, which allows users to opt-out from receiving interest-based advertising.

How We Use Cookies

The Site uses different categories of cookies for the purposes described below.

‍

Strictly Necessary Cookies

These cookies are required for the operation of the Site and the use of its features. They include, for example, cookies that enable you to log into secure areas of the Site.

‍

The Site cannot function without such cookies and they are therefore automatically set when you visit them. You can set your browser to block or alert you about these cookies, but some parts of the Site will not work (please see “Managing Cookies” below for more information).

‍

Analytical or Performance Cookies

The Site may use analytical or performance cookies such as Google Analytics to carry out some analytics on and enhance the Site. These cookies allow us to collect information about how you use the Site, which pages are the most visited, or where people visiting the Site are located. This enables us to determine what content is of most interest to our users and to ensure that users are finding what they are looking for easily.

‍

Functionality Cookies

These cookies are used to recognize you when you return to the Site and to personalize content for you. For instance, this enables us to remember some of your preferences or choices, the last pages you visited, or searches you carried out, or to keep you logged in. This helps us to speed up navigation, provide you with a better experience of the Site and improve the Site and our services.

We may use cookies to collect information about your activity on the Site, such as which pages you viewed or which videos you watched. This helps us to understand what content is of interest to you.

‍

Targeting Cookies

These cookies record your visit to the Site, the pages you have visited, and the links you have followed. We may use this information to make the Site more relevant to your interests.

We may also use cookies to enable you to share content on networking or social media sites or for marketing and promotional purposes.

Managing Cookies

Strictly necessary cookies are automatically set on your browser when you visit or use the Site. These cookies are required for the Site to work properly and cannot be disabled using our cookie banner.

‍

On the www.opexengine.com website, you have the choice to accept or refuse other cookies by clicking on “Accept all cookies” or “Use only strictly necessary cookies” on our cookie banner respectively. Please note that certain functionalities of the Site might not work if you choose to disable other cookies.

‍

You can also use the settings of your browser to prevent your browser from accepting new cookies (including strictly necessary cookies), get notified when new cookies are dropped on your browser, and disable or delete cookies altogether (including strictly necessary cookies). Please note that deleting existing cookies will not prevent cookies from being set during your next visit to or use of the Site. You can find more information about how to manage cookies in the “help” section of your browser.

‍

If you have any questions about this Cookie Policy, please contact dataprivacy@opexengine.com.

Last updated on June 1, 2026.

‍