Privacy Policy

Saja Limited ("Saja Limited", "we", "us", or "our") operates Saja (the "Platform"), an online survey and questionnaire platform that enables organisations, businesses, individuals and other users ("Survey Creators") to create, distribute and manage surveys. Saja Limited is a company registered in the Isle of Man.

This Privacy Policy explains how we handle personal information in connection with Saja and the rights of individuals who interact with surveys created using the Platform.

We are committed to protecting personal information and handling it in accordance with applicable data-protection legislation in the Isle of Man, including the Data Protection Act 2018, as amended, and applicable regulations and guidance.

By using Saja, creating an account, creating a survey or responding to a survey, you acknowledge that you have read and understood this Privacy Policy to the extent applicable to you.

Saja allows Survey Creators to collect information from individuals who respond to their surveys ("Respondents"). Survey Creators, and not Saja Limited, are responsible for the survey content and the information they choose to collect from Respondents.

Unless expressly stated otherwise, Saja Limited:

• does not determine the purposes for which Survey Creators collect survey responses;

• does not use survey responses for its own commercial purposes;

• does not sell survey responses;

• does not monitor survey responses for advertising or marketing purposes;

• does not independently analyse the substantive answers provided by Respondents; and

• does not access or review survey responses except where technically necessary to provide, secure, maintain or troubleshoot Saja, where required by law, or where necessary to investigate security, abuse or technical incidents.

Where Saja processes survey responses on behalf of a Survey Creator, the Survey Creator is generally responsible for determining:

• why the information is collected;

• what information is collected;

• the legal basis for collecting the information;

• how the information is used;

• how long the information is retained;

• who may access the information; and

• whether and with whom the information may be shared.

Depending on the circumstances, the Survey Creator may therefore be the data controller for personal information collected through its surveys, while Saja Limited may act as a data processor or service provider. The precise legal relationship between Saja Limited and a Survey Creator may depend on the particular services and configuration being used.

By choosing to participate in and submit responses to a survey through Saja, the Respondent acknowledges that the survey has been created and is administered by the relevant Survey Creator.

The Respondent understands and acknowledges that the Survey Creator is responsible for determining the purposes for which information is collected, the information requested, how the information is used, who may have access to it, how long it is retained and whether it is shared with any third party, subject to applicable law.

By submitting a survey response, the Respondent confirms that they have voluntarily chosen to provide the information to the relevant Survey Creator and trusts the Survey Creator to handle, store, use and otherwise process the information appropriately and in accordance with applicable data-protection and privacy laws.

The Respondent acknowledges that Saja Limited provides the technical infrastructure and Platform through which the survey is delivered and that Saja Limited does not determine the purposes for which the Survey Creator collects or uses the Respondent's survey responses.

Accordingly, Respondents should carefully consider the information they choose to provide and should review any privacy notice, consent notice or other information provided by the Survey Creator before submitting a response.

Questions or concerns relating to:

• the purpose of a particular survey;

• the information being requested;

• the use of survey responses;

• the identity of persons with access to responses;

• the retention of responses; or

• requests concerning the Respondent's survey information

should generally be directed to the relevant Survey Creator.

Nothing in this acknowledgement limits, removes or waives any statutory rights or protections that a Respondent may have under applicable data-protection or privacy legislation.

We may collect and process information necessary to operate and provide Saja.

4.1 Information Relating to Survey Creators

When a person creates or manages a Saja account, we may collect:

• name;

• email address;

• username and login credentials;

• organisation or company information;

• billing and payment information;

• account preferences;

• communications with us; and

• technical information relating to use of Saja.

4.2 Information Relating to Respondents

Survey Creators may configure surveys to collect information from Respondents. The information collected may include:

• name;

• email address;

• telephone number;

• demographic information;

• professional or organisational information;

• responses to survey questions; and

• any other information that the Survey Creator chooses to request.

The Survey Creator determines what information is requested through its survey. Respondents should therefore review any privacy notice provided by the relevant Survey Creator before submitting information.

Survey responses submitted through Saja are stored and processed as part of the service provided to the relevant Survey Creator.

Saja Limited does not use Respondents' answers for its own commercial purposes.

Saja Limited does not sell Respondents' survey responses to third parties.

Saja Limited does not use survey responses to build advertising profiles or for targeted advertising.

Survey Creators are responsible for ensuring that their surveys comply with applicable data-protection and privacy laws and that they have an appropriate legal basis for collecting and processing Respondents' personal information.

Where a Survey Creator requests sensitive or special-category information, the Survey Creator is responsible for ensuring that the collection and processing of that information is lawful.

Saja may allow Survey Creators to configure surveys as anonymous. However, the term "anonymous" should only be used where the information cannot reasonably be used to identify the Respondent, taking into account the information available to the Survey Creator and other parties.

Depending on the configuration of a survey, technical information such as IP addresses, cookies, device information, timestamps or other identifiers may potentially be collected or associated with a response.

Survey Creators are responsible for configuring their surveys appropriately and informing Respondents whether a survey is:

• anonymous;

• confidential; or

• identifiable.

Respondents should not assume that a survey is anonymous unless this has been clearly stated by the Survey Creator.

When you use Saja, we may automatically collect certain technical information, including:

• IP address;

• browser type and version;

• operating system;

• device information;

• date and time of access;

• pages or features accessed;

• referring website;

• security and authentication information; and

• information relating to errors, performance and system activity.

We use this information for purposes such as:

• operating Saja;

• maintaining security;

• preventing fraud and abuse;

• diagnosing technical problems;

• improving reliability and performance; and

• complying with legal obligations.

We may use cookies and similar technologies to:

• operate Saja;

• maintain user sessions;

• remember preferences;

• provide security;

• understand how the Platform is used; and

• improve Platform performance.

Where required by applicable law, we will obtain appropriate consent before using non-essential cookies or similar technologies.

Survey Creators may also use cookies, tracking technologies or third-party services in connection with surveys they create. Saja Limited does not control how Survey Creators configure such technologies.

We may process personal information for the following purposes:

• providing and operating Saja;

• creating and managing user accounts;

• processing subscriptions and payments;

• providing customer support;

• communicating with users about Saja;

• maintaining security;

• detecting and preventing fraud, abuse and unauthorised access;

• monitoring and improving Platform performance;

• maintaining backups and business continuity;

• complying with legal and regulatory obligations; and

• establishing, exercising or defending legal claims.

We will not use survey responses for unrelated purposes or sell them to third parties.

Where applicable, we process personal information on one or more lawful bases, which may include:

• performance of a contract;

• compliance with a legal obligation;

• legitimate interests, where those interests are not overridden by the individual's rights and interests;

• consent; or

• another lawful basis permitted under applicable data-protection law.

Where a Survey Creator is responsible for the processing of survey responses, the Survey Creator is responsible for identifying and documenting the appropriate legal basis for collecting and using Respondents' personal information.

We may share personal information with trusted service providers who help us operate Saja, such as:

• cloud hosting providers;

• database and infrastructure providers;

• payment processors;

• email and communications providers;

• security and fraud-prevention providers;

• customer-support providers; and

• professional advisers.

These providers are permitted to process personal information only as necessary to provide services to us and subject to appropriate contractual and security requirements.

We may also disclose personal information:

• where required by law;

• to law-enforcement or regulatory authorities where legally required;

• to protect our rights, property or safety;

• to protect users or the public from fraud, abuse or security threats; or

• in connection with a merger, acquisition, restructuring or sale of all or part of our business.

We do not sell survey responses or Respondent personal information.

Survey Creators may independently download, export, analyse, share or otherwise process survey responses. Once a Survey Creator obtains information from Saja, its subsequent use of that information is governed by the Survey Creator's own privacy practices and policies.

Respondents should direct questions about a particular survey, the purpose of collecting their information, the use of their responses, deletion of their responses, or requests relating to their survey information to the Survey Creator in the first instance.

Saja Limited is not responsible for how a Survey Creator subsequently uses or shares information obtained through Saja, except to the extent that Saja Limited has its own legal obligations in relation to that information.

Some of our service providers may process personal information outside the Isle of Man. Where personal information is transferred internationally, we will take appropriate steps to ensure that the transfer is carried out in accordance with applicable data-protection requirements.

Depending on the destination and circumstances, this may include appropriate contractual safeguards, adequacy arrangements or other legally recognised transfer mechanisms.

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, accidental loss, destruction, alteration or disclosure.

Security measures may include:

• encryption in transit;

• access controls;

• authentication mechanisms;

• logging and monitoring;

• network and infrastructure security;

• backups;

• vulnerability management; and

• staff confidentiality and security procedures.

However, no online service can guarantee absolute security.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to:

• provide Saja;

• comply with legal obligations;

• resolve disputes; and

• enforce agreements.

Survey Creators are responsible for determining appropriate retention periods for survey responses they collect, subject to applicable legal requirements.

When an account or survey is deleted, information may remain temporarily in backups or system logs before being securely deleted or overwritten in accordance with our retention procedures.

Subject to applicable law and any applicable exemptions, individuals may have rights including:

• the right to be informed about the processing of their personal information;

• the right to access personal information;

• the right to request correction of inaccurate information;

• the right to request deletion of personal information;

• the right to request restriction of processing;

• the right to object to certain processing;

• the right to data portability, where applicable; and

• the right to withdraw consent where processing is based on consent.

Because Survey Creators generally determine the purposes and means of processing survey responses, requests concerning information submitted through a particular survey should normally be directed to the relevant Survey Creator.

If you contact us regarding survey information that we process on behalf of a Survey Creator, we may refer your request to the relevant Survey Creator where appropriate.

Nothing in this Privacy Policy is intended to restrict any rights that an individual has under applicable data-protection legislation.

Saja is not intended to knowingly collect personal information from children in circumstances where such collection is prohibited by law.

Survey Creators are responsible for ensuring that surveys directed at children or involving children's personal information comply with all applicable legal requirements, including requirements concerning parental or guardian consent where applicable.

Where permitted by law, we may send account-related and service communications.

We may also send marketing communications where we have an appropriate lawful basis to do so.

You may opt out of marketing communications by using the unsubscribe mechanism provided in the relevant communication or by contacting us.

Saja may contain links to third-party websites or integrate with third-party services. We are not responsible for the privacy practices of third-party websites or services that we do not control.

You should review the privacy policies of those third parties before providing personal information to them.

We may update this Privacy Policy from time to time to reflect changes to Saja, our practices or applicable legal requirements.

When we make material changes, we will take reasonable steps to notify users where appropriate.

The "Last Updated" date at the beginning of this Privacy Policy indicates when it was most recently revised.

If you have questions about this Privacy Policy or our handling of personal information, please contact us:

Saja Limited

Registered in the Isle of Man

Registered Office: 15 Hillberry Heights, Douglas, IOM IM2 7BN

Company Registration Number: 137004C

Privacy Email: privacy@saja.biz

If your enquiry concerns information submitted through a survey, please identify the relevant Survey Creator and survey where possible.

The Survey Creator may be the organisation responsible for determining the purposes and means of processing your survey information.

Where appropriate, Saja Limited may refer a Respondent to the relevant Survey Creator where that Survey Creator is responsible for the processing concerned.

If you believe that your personal information has been handled improperly, we encourage you to contact Saja Limited first so that we can investigate and attempt to resolve your concern.

You may also have the right to raise a complaint with the Isle of Man Information Commissioner, in accordance with applicable Isle of Man data-protection law.

END OF PRIVACY POLICY

Saja Limited

Saja - Online Survey Platform

Isle of Man

Document version: 1.0

Last updated: 8 August 2026