Touchwork Privacy Policy
Contents
- Who We Are and What This Policy Covers
- Our Role: Touchwork and Our Clients
- Information We Collect
- How We Use Information
- AI-Assisted Analysis
- Text Messaging
- How We Share Information
- Cookies and Similar Technologies
- Your Choices and Rights
- Nevada Residents
- US State Residents
- Canadian Residents
- UK Residents
- Children, Education and Healthcare Data
- Security
- Data Retention
- International Data Transfers
- Third-Party Links
- Changes to This Policy
- Contact Us
1. Who We Are and What This Policy Covers
Effective date: October 1, 2026
Touchwork, Inc. ("Touchwork," "we," "us" or "our") is a Nevada corporation and the Experience Operations (XO) company. Our Experience Operations Platform, XOP, helps organizations collect real-time feedback, run audits and inspections, manage issue reports and service requests, and act on what they learn.
This policy explains how we handle personal information when you:
- visit touchwork.com or our other websites
- give feedback, answer a survey, send a text message or submit a request through XOP for one of our clients
- contact us, subscribe to our newsletter, register for a webinar or download content
It does not cover the websites or practices of the organizations that use XOP. Section 2 explains how those fit together.
2. Our Role: Touchwork and Our Clients
Most of the personal information we handle is collected for our clients, such as universities, airports, hospitals, senior living communities and food service providers. When you leave feedback in a dining hall or report an issue in an airport restroom, the organization that invited you decides how that information is used. Touchwork processes it on their instructions.
In legal terms, we act as a "service provider" or "processor" for that information. Our clients can access the information collected through their programs and may use it to improve their operations or follow up with you. Their use is governed by their own privacy policies and their contracts with us.
If you have a question or request about information you gave through a client's program, please contact that organization directly. If you contact us instead, we will pass your request to them or help them respond.
We make our own decisions about information from website visitors, newsletter subscribers, webinar registrants and business contacts. For that information, Touchwork is responsible under this policy.
3. Information We Collect
We collect information you give us, information collected automatically when you use our websites and services, and information from other sources.
Information you give us:
- Contact details, such as your name, email address, phone number, job title and organization
- Feedback and survey responses, including ratings, comments and any photos you choose to submit
- Demographic details, such as age range or class year, when a client's program asks for them
- Loyalty or membership numbers, when a client's program asks for them
- Contest entry details, such as name, date of birth and mailing address
- Food allergy and dietary information, when you use OrderIT through your institution
- Messages you send us
Information collected automatically:
- IP address, approximate location based on IP address, device type, browser and operating system
- Pages you visit, the dates and times of your visits and the site that referred you
- For text message feedback, your phone number, message content and timestamps
- The location or station where feedback was given, for example through a QR code or tablet
Information from other sources:
- Our clients, for example when they provide contact lists for a survey program
- Business contact data providers and public sources, such as professional networking sites, which we use for business-to-business marketing
- Event, webinar and association partners
- Service providers that help us run our business
You can choose not to give us information. If you do, some features may not be available, such as entering a contest or receiving a follow-up.
4. How We Use Information
We use personal information to:
- Provide XOP to our clients, including routing feedback and alerts to the right team, producing reports and tracking issues to resolution
- Follow up on your feedback, when you or the client organization asks for it
- Respond to your questions and fulfill your requests, such as downloads, webinar registrations and demo requests
- Send business contacts information about our products, events and publications, which you can opt out of at any time
- Run promotions or contests on behalf of our clients
- Operate, secure and improve our websites and services, and diagnose technical problems
- Create aggregated, de-identified benchmarks and industry norms, such as XOP Benchmark, that do not identify you or any client
- Comply with the law, enforce our terms and protect the rights and safety of Touchwork, our clients and others
If we want to use your personal information for a purpose that is materially different from the one it was collected for, we will ask for your consent first.
5. AI-Assisted Analysis
XOP includes AI-assisted analysis, called Abda, that finds themes, sentiment and likely root causes in feedback. We use it only to provide our services to the client that collected the feedback.
- We use a number of carefully selected third-party AI providers. Under their terms of service, they do not use the data we send them to train their models.
- We do not use any personal information or client data to train AI models.
- AI results support people's decisions. We do not use AI to make decisions about you that have legal or similarly significant effects.
6. Text Messaging
When you text feedback to a client's program number, or opt in to receive text messages, we process your phone number, message content and timestamps on behalf of that client.
- No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent will not be shared with any third parties, except service providers that help us deliver the messages.
- You can reply STOP at any time to stop receiving messages, or HELP for help.
- Message and data rates may apply. Message frequency varies by program.
- Mobile carriers are not responsible for delayed or undelivered messages.
7. How We Share Information
We do not sell personal information for money. We share it only in these situations:
- With the client organization that collected it through XOP
- With service providers that help us run our business, such as hosting, email marketing, customer relationship management, analytics, text messaging, AI analysis and customer support. They may use the information only to provide services to us, under contract.
- As part of a merger, acquisition, financing or sale of assets, in which case the information stays protected by this policy or one at least as protective
- When required by law, such as a subpoena, court order or government request, or to protect the rights, property or safety of Touchwork, our clients or others
- With your consent
We may also share aggregated or de-identified information that cannot reasonably be used to identify you.
8. Cookies and Similar Technologies
Our websites and surveys use cookies, pixels and similar technologies. A cookie is a small file placed on your device that lets a site recognize it.
| Type | What it does | Can you turn it off? |
|---|---|---|
| Essential | Keeps the site and surveys working, and stops the same survey being submitted twice | No, the site needs these to work |
| Analytics | Google Analytics shows us how visitors use the site, so we can improve it | Yes |
You can choose which cookies to allow through the cookie banner on our website, and control cookies through your browser settings. You can also opt out of Google Analytics with Google's browser add-on at tools.google.com/dlpage/gaoptout. Blocking some cookies may affect how the site works.
We do not use cookies for advertising, and we do not sell personal information or share it for targeted advertising. There is no common standard for "Do Not Track" signals, so we do not respond to them.
9. Your Choices and Rights
You have choices about how we use your information, wherever you live:
- Marketing emails: use the unsubscribe link in any email, or contact us.
- Text messages: reply STOP.
- Cookies: see section 8.
- Access, correction and deletion: contact us using the details in section 20. We will verify your identity before acting on your request.
If your request is about information collected through a client's program, we will refer it to that client or help them respond (see section 2). You can also ask someone to make a request for you, as long as we can verify they are authorized. We will not treat you differently for using your rights.
We respond within the time allowed by applicable law. Sections 10 to 13 explain the extra rights you may have depending on where you live.
10. Nevada Residents
Touchwork, Inc. is a Nevada corporation. This section is our notice under Nevada's online privacy law (NRS 603A.300 to 603A.360).
- The categories of covered information we collect are listed in section 3.
- The categories of third parties we may share it with are listed in section 7.
- How to review and request changes to your information is explained in section 9.
- How we tell you about material changes to this policy is explained in section 19. The effective date is at the top of section 1.
- Google Analytics may collect information about how you use our sites.
Nevada consumers can ask us not to sell their covered information. We do not currently sell covered information as Nevada law defines it. You can still send a request to our designated request address, privacy@touchwork.com, with the subject line "Nevada opt-out request."
11. US State Residents
Several US states, including California, have consumer privacy laws. Based on our size and how we handle personal information, these laws do not currently apply to Touchwork. If one begins to apply, we will update this policy.
We do not sell personal information or share it for targeted advertising. Wherever you live in the US, you can ask to access, correct or delete your information as described in section 9.
12. Canadian Residents
If you live in Canada, we handle your personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws.
- We rely on your consent, either express or implied, to collect, use and share your information. You can withdraw your consent at any time, subject to legal or contractual limits. Withdrawing it may affect the services we can provide.
- You can ask to access your personal information and correct it if it is wrong.
- Your information may be stored and processed in the United States and other countries where we or our service providers operate. While there, it may be accessible to courts, law enforcement and national security authorities under local law.
- Our privacy officer can be reached at privacy@touchwork.com.
If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada.
13. UK Residents
If you are in the United Kingdom, the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 may apply.
For website and marketing information, Touchwork is the controller. For information collected through a client's XOP program, the client is the controller and we are their processor (see section 2).
We rely on these legal bases:
- Legitimate interests, to run and secure our websites and to market to business contacts
- Consent, for non-essential cookies and certain marketing emails
- Contract, to provide services you or your organization requested
- Legal obligation, where the law requires us to process information
You have the right to access, correct or delete your information, restrict or object to its use, receive a copy in a portable format and withdraw consent at any time. To use these rights, contact us using the details in section 20.
When we transfer UK personal information to the United States, we protect it with safeguards recognized under UK law, such as the UK International Data Transfer Addendum in our client contracts. We are registering for the EU-US Data Privacy Framework and its UK Extension (the UK-US data bridge), and will update this policy once our registration is complete.
You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk.
14. Children, Education and Healthcare Data
Children: Our websites are not directed at children under 13, and we do not knowingly collect personal information from them for our own purposes. When a school or other client uses XOP with young people, the client is responsible for any consent required, and we process the information only on their instructions. If you believe a child has given us personal information, contact us and we will delete it.
Education: When we provide services to schools, colleges and universities, we use student information only to deliver those services and never for advertising.
Healthcare: XOP is not designed to collect protected health information as defined by the Health Insurance Portability and Accountability Act (HIPAA), and we do not act as a HIPAA business associate. Healthcare clients use XOP for feedback on services such as dining, cleaning and facilities, and patients should not include medical details in their feedback. Food allergy and dietary information collected through OrderIT is used only to prepare and track safe meals for the institution that provides the service.
15. Security
XOP is SOC 2 Type 2 compliant. We use administrative, technical and physical safeguards to protect personal information from loss, misuse and unauthorized access, including encryption in transit and at rest. Access is limited to people who need it to do their jobs.
No system is completely secure, so we cannot guarantee the security of information sent over the internet. If a security incident affects your personal information, we will notify you and our affected clients as required by law.
16. Data Retention
We keep personal information for as long as set out in our agreement with the relevant client.
We may keep aggregated or de-identified information that cannot identify you.
17. International Data Transfers
Touchwork is based in the United States, and we store and process personal information in data centers in Virginia. Some of our service providers operate in other countries and may access personal information to support our services.
When information moves across borders, we protect it with contracts and other safeguards required by applicable law. Sections 12 and 13 give more detail for Canadian and UK residents.
18. Third-Party Links
Our websites may link to other websites, including client sites. We are not responsible for their content or privacy practices, so please read their privacy policies before sharing personal information with them.
19. Changes to This Policy
We may update this policy from time to time. The effective date at the top shows when it last changed. If we make a material change, we will post a notice on our website before the change takes effect, and email you if we have your address and the change affects you.
20. Contact Us
For questions, requests or complaints about this policy or your personal information, contact:
Touchwork, Inc.
Attn: Privacy
732 S. 6th St., Ste. N
Las Vegas, NV 89101
Email: privacy@touchwork.com
This email address is also our designated request address for Nevada opt-out requests and the contact for our privacy officer for Canadian residents.