Privacy Policy

Your privacy is important to Charles River Analytics, Inc. (“Charles River,” “we,” or “us”).  This Privacy Policy describes Charles River’s information practices in connection with the Sites and Applications, including what type of information is gathered and tracked, how the information is used, and with whom the information is shared. As described below, this Privacy Policy applies to your interactions with the Sites, Applications, and the Services as well as other interactions with Charles River.  Capitalized terms used but not defined in this Privacy Policy shall have the meaning set forth in the Terms of Use.

BY USING THE SITES OR THE APPLICATIONS, YOU INDICATE YOUR UNDERSTANDING AND ACCEPTANCE OF THE TERMS OF THIS PRIVACY POLICY. IF YOU DO NOT ACCEPT THESE TERMS, DO NOT USE THE SITES OR THE APPLICATIONS.

Please carefully read this Privacy Policy as it may have changed since your last visit to the Sites or Applications. Continued use of the Sites or Applications indicates your understanding and acceptance of any changes made to this Privacy Policy and posted to the Sites and Applications. This Privacy Policy does not cover the privacy practices of Partners or any third-party websites to which the Sites and Applications may link.

Definitions

• “Applications” means applications available as in-browser applications on Charles River or Partner sites, or as native iOS or Android applications on compatible End-User devices.
• “End User” means a person using the Applications.
• “Personal Information” means data that reasonably can be used to identify or describe an individual, such as your name, business affiliation, postal address, telephone number, or email address.
• “Partner” means an entity that makes the Applications or Services available through its own site.
• “Services” refers to the products, services, and Applications, offered by CRA and its Partners to Customers and End Users pursuant to a separate written agreement.
  
  

Applicability

This Privacy Policy applies to all information collected from End Users and Site Visitors by Charles River (or carefully selected third parties acting on our behalf). This Privacy Policy does not apply to information provided by End Users to Partners. This Privacy Policy does not cover the practices or policies of any Partner with respect to information provided by End Users. Any activity by the End User on any Partner site, other than use of the Applications, as well as any information provided to the Partner by the End User through other means, is subject to the Partner’s privacy policy. We encourage you to read the privacy policies of Partners.

INFORMATION WE COLLECT AND HOW WE USE IT

We collect certain information from Site Visitors and End Users using the Sites and Applications as described in this section. The information collected from Site Visitors and End Users may include Personal Information, however, we only collect Personal Information when you voluntarily provide it to us. Site Visitors do not need to provide Personal Information to simply browse the Sites.

We may collect your Personal Information when you:

• submit a Site Form
• subscribe to marketing communications
• participate in surveys and evaluations
• request information or materials
• apply for a position, or submit your resume
• submit questions or comments
• create an account
• submit any information to us
• contact us by any means using information available on the Sites or Applications.
  
  

The types of Personal Information we collect may include (but are not limited to):

• your first and last name
• your home, billing, or other physical address (including street name, city/town, state/province, postal code, country)
• your email address
• your telephone number
• your demographic data (including but not limited to citizenship, gender, race, ethnicity, and disability status)
• other identifier that permits us to make physical or online contact with you
  
  

We collect and use Site Visitor’s and End User’s information, including Personal Information, to operate and improve the Sites and Applications, and to deliver the Services or carry out the transactions requested by the Site Visitor or End User. These uses may include providing you with more effective customer service; making the Sites or Applications easier to use by eliminating the need for you to repeatedly enter the same information; performing research and analysis aimed at improving our Services and technologies; and displaying content and advertising that are customized to your interests and preferences. We also use your Personal Information to communicate with you. We may send certain mandatory service communications such as welcome letters, information updates, information on technical service issues, and security announcements. We may also contact you to inform you of other Services available from us and our affiliates.

SHARING OF PERSONAL INFORMATION

We will not sell, rent, or lease your information, including your Personal Information, to others. We may share Personal Information with other companies working on our behalf. Except as described in this Privacy Policy, we will not disclose your Personal Information to third parties for their own marketing purposes unless you have provided consent.

Sharing with third-party providers: In some cases, we use third parties to collect, use, analyze, and otherwise process information, including Personal Information, on our behalf. Any information you share with these third parties is subject to their privacy policies. This includes our use of certain products and services provided by third parties for the purposes of enabling certain features on the Sites, such as Site Forms. For example, the information submitted through Site Forms may be processed by third-party providers such as Google. Third parties that process information on our behalf may include, but not be limited to: Salesforce, Active Campaign, LinkedIn Recruiter, and Greenhouse.  By submitting a Site Form, you consent to us sharing your Personal Information with any third party that provides us with the products or services used to enable Site Forms, or otherwise processes information on our behalf.

We occasionally hire other third parties to provide limited services on our behalf, such as handling the processing and delivery of mailings, providing customer support, hosting sites, processing transactions, or performing statistical analysis of our Services. Service providers will be permitted to obtain only the Personal Information they need to deliver the service. They are required to maintain adequate safeguards to protect the confidentiality of the information and are prohibited from using your information for any other purpose.

Sharing with our Partners: Some Services may be co-branded and offered in conjunction with another company. If you register for or use such co-branded offering, both Charles River and Partner may receive information collected as part of the co-branded offering. If so, the privacy policy of such Partner shall apply to that company’s use of this information. We may also team up with carefully selected Partners to participate in limited marketing campaigns solely to promote our Services, or the Partner’s products and services, to you. You may opt-out of receiving these marketing messages at any time by following the instructions in the email message. If you request something from the Sites (for example, a Service, a callback, demonstration, or specific marketing materials), we will use the information you provide to fulfill your request or inquiry. To help us do this, we may share Personal Information with our Partners.

Compelled disclosures: We may access or disclose your information, including your Personal Information, if we believe such action is necessary to: (a) comply with the law or legal process served on Charles River or its affiliates, the Applications, or the Sites; (b) protect and defend the rights or property of Charles River or its affiliates (including the enforcement of our agreements); or (c) act in urgent circumstances to protect the personal safety of users of our Services or members of the public.

YOUR CHOICES

Opting Out:  We provide a number of ways for you to “opt-out” of receiving additional information from us or having us provide your Personal Information to our partners. We may offer you these choices at the time you give us your Personal Information.

If you do not wish to continue receiving certain marketing materials (e.g., email messages), you can opt-out of receiving these materials by following the instructions provided in the materials. This option does not apply to communications primarily for the purpose of administering orders, contracts, support, software updates, or other administrative and transactional notices.

How to update your information:  To modify the contact information that you have provided to us, you can contact us at legal@cra.com or by mailing us at 625 Mount Auburn Street, Cambridge, MA 02138. Please note that we cannot modify all information provided to us, such as anonymized data. We will comply with requests to modify information to the extent that we are able to do so.

SAFEGUARDING YOUR INFORMATION

In order to protect your information, including your Personal Information, from improper disclosure, we use commercially reasonable efforts to maintain a secure operating environment to protect any Personal Information we collect. We use the most accurate and current Personal Information you provide in order to process your request. Once received we limit access of your Personal Information to only those employees with a legitimate business need to review it. Browsers offer varying degrees of security, particularly in regard to encryption; review your browser’s settings for more information. For your protection, make sure your browser is set and configured to support Secure Socket Layer (SSL) 2.0/3.0 and employs 128-bit encryption. All acceptable browsers provide detailed information on security levels in “Properties” or “Document Information” from the browser’s menu bar. See your browser’s “Help” tab or documentation for more information. Finally, we take care to dispose of your Personal Information properly so that third parties will not be able to access it. This includes destroying, erasing, or making unreadable the Personal Information. While we are committed to protecting your privacy, please be aware that no transaction over the internet can be completely secure.

We regularly review our compliance with this Privacy Policy. Please feel free to direct any questions or concerns regarding this statement or the Sites or Applications treatment of Personal Information by contacting us at the addresses indicated below.

COOKIES AND BROWSER INFORMATION

We use cookies for a variety of purposes. Cookies are small text files placed on the hard drive of the Site Visitor’s device. Cookies are commonly used to track web activity and provide an enhanced experience when using the internet. We may use cookies to collect non-personally identifiable information from Site Visitors. We use cookies to help us better understand Sites usage in the aggregate so that we know what areas of the Site Visitors prefer. If you simply want to browse, you do not have to accept cookies from the Sites. Most browsers are defaulted to accept and maintain cookies. If you do not want websites to be able to use cookies, you can alter the configuration of your browser to not accept cookies. Unless you have adjusted your browser settings so that it will refuse cookies, our system will issue cookies when you direct your browser to our Sites. Third-party vendors, including Google, may use cookies to serve ads to you while you are using the Sites based on your prior visits. For more information about how Google Analytics collects and uses data and how to opt out, visit https://policies.google.com/technologies/partner-sites.These cookies are not tied to your Personal Information.

With or without cookies, the Sites keeps track of number of users, browser type, device type, geolocation, usage data, such as the source address from which a page request originates (i.e., your IP address, domain name), date and time of the page request, the referring website (if any), and other parameters in the URL (e.g., search criteria). We use this data to better understand Sites usage in the aggregate so that we know what areas of the Site, Site Visitors prefer (e.g., based on the number of visits to those areas). This information is stored in log files and is used for aggregated and statistical reporting. It is not attributed to you as an individual.

Site Visitors should review any applicable Partner privacy policy to learn if and how Partners use cookies.

Links to Other Sites:  The Sites and Applications may provide links to third-party websites, such as those of our business partners and online advertisers. You should review their privacy policies to learn more about what, why, and how they collect and use personally identifiable information.

For Questions or Concerns:  If you have questions or concerns regarding this statement, you should first contact legal@cra.com.

Other correspondence may be sent to:

Legal Affairs

Charles River Analytics, Inc.
625 Mount Auburn Street
Cambridge, MA 02138

Changes to this Privacy Policy: We reserve the right to change this Privacy Policy from time to time. If we do make changes, the revised Privacy Policy will be posted on the Sites and Applications, if applicable.

ADDITIONAL NOTICES FOR MINORS, CALIFORNIA RESIDENTS, AND INTERNATIONAL RESIDENTS

NOTICE TO CHILDREN UNDER 18 AND THEIR PARENTS OR LEGAL GUARDIANS: THE SITES AND APPLICATIONS ARE INTENDED FOR ADULTS. WE DO NOT KNOWINGLY OR INTENTIONALLY COLLECT INFORMATION FROM ANYONE UNDER THE AGE OF 18 THROUGH THE SITES AND APPLICATIONS. IF YOU ARE UNDER THE AGE OF 18, PLEASE DO NOT PROVIDE ANY PERSONAL INFORMATION TO CHARLES RIVER. WE CANNOT CONTROL WHAT SITE VISITORS OR END USERS SUBMIT THROUGH THE SITES OR APPLICATIONS. IF YOU KNOW OF ANYONE UNDER THE AGE OF 18 WHO HAS PROVIDED US WITH INFORMATION, PLEASE CONTACT US IMMEDIATELY AND WE WILL REMOVE THE INFORMATION.

STATE-SPECIFIC PRIVACY RIGHTS: We acknowledge that under data privacy laws in several states (including California, Colorado, Connecticut and Virginia), individuals have certain rights associated with their Personal Information and other information. Although we are not currently covered by those state data privacy laws, we assure you that we do not sell information about you.

NOTICE TO INTERNATIONAL RESIDENTS: The Companies are headquartered in the United States and have service providers operating in the United States. Our Sites and Applications are primarily operated and managed on cloud-based servers located and operated within the United States. In order to submit information through the Sites or Applications, you may be sending your Personal Information to the United States. Accordingly, if you reside or are located outside of the United States, your Personal Information may be transferred to or accessed in a country that may not provide the same level of protection for your Personal Information. We are committed to protecting the privacy and confidentiality of Personal Information when it is transferred.

Additional Information for Site Visitors in the European Economic Area and United Kingdom: The Companies are headquartered in the United States and has operations and service providers in the United States and around the world. As such, we and our service providers may receive and/or access your Personal Information in jurisdictions that may not provide levels of data protection equivalent to those in your country of residence. By using the Sites or Applications, or otherwise interacting with us, regardless of where you live or where you provide information to us, you consent to our use and our service providers’ use of your Personal Information worldwide and to the transfer of your Personal Information to countries outside of your country of residence, including the United States. In certain circumstances, courts, regulatory agencies, law enforcement agencies, or security authorities in those other countries may be entitled to access your Personal Information.

Notwithstanding the July 10, 2023, ruling by the European Court of Justice confirming the adequacy of the EU-US Privacy Shield Framework. We continue to take adequate measures designed to protect the transfer of Personal Information of individuals in the European Economic Area (EU Member States, Iceland, Liechtenstein, and Norway) (“EEA”), such as relying on the European Commission-approved Standard Contractual Clauses (“SCCs”) as a legal mechanism for such transfer, or other adequate transfer mechanism as required under relevant data protection laws, as well as additional safeguards, where appropriate. A copy of these clauses may be obtained by contacting us at the email address listed below.

For transfers to or from the United Kingdom (“UK”), we make use of the SCCs, as adapted for the UK. For individuals located in the EEA or the UK, the terms “PII” and “Personal Information,” as used in this Privacy Policy, are equivalent to “personal data” under applicable European and UK data protection legislation. If you are located in the EEA, the UK, or Switzerland, you have certain rights and protections under applicable law regarding the processing of your Personal Information, as defined by the General Data Protection Regulation (“GDPR”), and the following notices apply to you:

Legal Basis for Processing: When we process your Personal Information, we will do so in reliance on the following lawful bases:

• To perform our responsibilities under our contract with you (e.g., providing the services you requested).
• When we have a legitimate interest in processing your Personal Information to operate our business or protect our interests (e.g., to provide, maintain, and improve our Services, conduct data analytics, and communicate with you).
• To comply with our legal obligations (e.g., to maintain a record of your consents and track those who have opted out of non-administrative communications).
• When we have your consent to do so (e.g., when you opt in to receive non-administrative communications from us). When consent is the legal basis for our processing your Personal Information, you may withdraw such consent at any time.
  
  

Data Retention: We store Personal Information for as long as reasonably necessary to comply with our legal, regulatory, or other compliance obligations. We store other data for as long as necessary to carry out the purposes for which we originally collected it and for other legitimate business purposes, including to meet our legal, regulatory, or other compliance obligations.

Your Rights: For individuals in the European Union, according to the GDPR, you have the following statutory rights:

• Information. At the point where Personal Information is collected from the data subject, as defined by the GDPR, or obtained from another source, there is a requirement to inform the data subject about our use of that Personal Information and the rights of data subjects over it. Compliance with this right is provided within this Privacy Policy.
• Access. You have the right to obtain confirmation as to whether or not Personal Information concerning you is being processed, and, where that is the case, all necessary information to make the process transparent. You also have the right to obtain a copy of your Personal Information being processed.
• Rectification. You have the right to require rectification of inaccurate data about you.
• Erasure. You have the right to ask for the deletion of your data in certain circumstances.
• Restrict processing. You have the right to restrict processing of data under certain specified circumstances.
• Data portability. You have the right to request for the receipt or the transfer to another organization, in a machine-readable form, of your Personal Information.
• Object to processing. You have the right to ask us to stop using all or some of your Personal Information under certain specified circumstances.
• Right to withdraw consent. When you have given your explicit consent for the processing of your data, you can withdraw it at any time without justification. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.
  
  

If you would like to exercise your rights, please let us know by sending an email to legal@cra.com.

You also have the right to lodge a complaint with your local Data Protection Authority or to the Data Protection Authority where the alleged infringement of the GDPR took place.

This Privacy Policy was last amended on October 1, 2024