GDPR Privacy Notice

Effective Date: January 8, 2026
Last Updated: January 8, 2026

1. Introduction

This GDPR Privacy Notice supplements our main Privacy Policy and provides additional information for individuals located in the European Economic Area (EEA), United Kingdom, and Switzerland regarding their rights under the General Data Protection Regulation (GDPR) and similar data protection laws.

2. Data Controller

ImpactHXM LLC is the data controller responsible for your personal data. Our contact information is provided at the end of this notice.

3. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Consent: Where you have given clear consent for us to process your personal data for a specific purpose.
• Contract: Where processing is necessary to fulfill a contract with you or to take steps at your request before entering into a contract.
• Legitimate Interests: Where processing is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Legal Obligation: Where processing is necessary to comply with a legal obligation.

4. Your Rights Under GDPR

Under the GDPR, you have the following rights:

• Right of Access: You have the right to request a copy of the personal data we hold about you.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): You have the right to request deletion of your personal data in certain circumstances.
• Right to Restrict Processing: You have the right to request restriction of processing of your personal data in certain circumstances.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing of your personal data in certain circumstances, including for direct marketing purposes.
• Rights Related to Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you.

5. Exercising Your Rights

To exercise any of these rights, please contact us using the information provided below. We will respond to your request within 30 days. In certain cases, we may need to verify your identity before processing your request. If your request is complex or if we receive a large number of requests, we may extend the response period by an additional 60 days, in which case we will notify you.

6. International Data Transfers

As ImpactHXM is based in the United States, your personal data may be transferred to and processed in the United States. We ensure appropriate safeguards are in place to protect your personal data in accordance with GDPR requirements, including Standard Contractual Clauses approved by the European Commission.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. The specific retention period depends on the nature of the data and the purposes for processing.

8. Right to Lodge a Complaint

If you believe that we have not complied with your data protection rights, you have the right to lodge a complaint with a supervisory authority in the EU member state of your habitual residence, place of work, or place of the alleged infringement.

9. Contact Us

For any questions about this GDPR Privacy Notice or to exercise your rights, please contact us: