Children’s Data Retention Policy

Policy Statement

Touchstone Research, Inc. (“TSR,” “we,” “us”) is committed to the principle of data minimization. We retain Personal Information collected from or about children only for as long as is reasonably necessary to fulfill the specific purpose(s) for which it was collected. Personal information collected from or about a child will not be retained indefinitely once the purpose for collection has ended.
This policy applies to all personal information collected from or about children under the age of 13 in connection with our research panel platform, PanelPolls, and any research activities, including Kids Projects conducted on behalf of our clients.

1. Data Retention Schedule
   The following schedule defines the retention periods for each category of children’s personal information held by TSR.

Data Category	Purpose(s) of Collection	Business Need for Retention	Retention Period / Deletion Trigger
Child Profile Information (Collected from Parent) Child’s first and last name, age/DOB, gender, and ethnicity	To enroll the child as a research participant, match the child to appropriate research projects	Continuity of participation eligibility and parental account management.	Retained for as long as the associated parent account is Active. Deleted within 90 days of the parent account becoming Inactive (as defined in Section 3 below), unless reactivated. Deleted immediately upon verified parental request.
Research Session Data — Video and Photo Recordings (Photos, Videos, Audio Recordings)	To conduct qualitative and/or quantitative research on behalf of TSR’s clients, in accordance with the specific study parameters disclosed to and consented to by the parent.	Fulfillment of research deliverables to the commissioning client and internal quality assurance.	Deleted within 90 days of project close, unless a different retention period is specified in the Research Participation Agreement signed by the parent prior to the commencement of the study. Deleted immediately upon verified parental request, subject to any legal hold obligations.
Consent Verification Records	To demonstrate valid parental consent was obtained.	Legal defense and regulatory audit trail.	Retained for 5 years after consent is collected to demonstrate historical compliance.

2. Definition of “Inactive Account”
   An account is considered “Inactive” if there has been no login or meaningful interaction with the account for a continuous period of 12 months.
   
   
3. Deletion Procedures
   When a retention period expires, or a valid deletion request is received, TSR employs the following measures to ensure secure deletion:
   
   3.1 Active Systems
   Data in active databases and file systems is permanently deleted using secure methods (including cryptographic erasure or secure database overwriting) that render the data unrecoverable. Where there is a legitimate business need to retain information in de-identified form (for example, aggregate research statistics), TSR will strip all direct and indirect identifiers so that the data can no longer be linked to a specific child or parent.
   
   3.2 Backup Systems
   We acknowledge that deleted data may remain in backup archives for a short period due to the nature of our backup rotation schedule.
   ● Data in backups is put beyond use (not accessible for ordinary business operations).
   ● Backups are encrypted and subject to strict access controls.
   ● Data in backups will be overwritten in accordance with our backup rotation schedule (e.g., every 30 days), ensuring final deletion.
   
   
4. Parental Deletion Requests
   At any time, a verified parent or legal guardian may:
   • Request access to the personal information TSR holds about their child.
   • Request correction of inaccurate information.
   • Request deletion of their child’s personal information.
   • Revoke consent for their child’s continued participation.

To exercise any of these rights, please submit a Subject Access Request using our online form here, or contact our Privacy Officer in writing:

Touchstone Research, Inc. Attn: Privacy Officer 470 James Street, Suite 007 New Haven, CT 06513 Email: [email protected]

Response Time: TSR will fulfill verified deletion requests within 30 days of receipt.

Revocation of Consent: If a parent revokes consent, TSR will immediately cease collecting new personal information from or about the child and will delete existing children’s personal information in accordance with this policy, subject only to any legal hold obligations.

This Children’s Data Retention Policy is incorporated by reference into the Touchstone Research Privacy Policy and should be read in conjunction with Section 9 (Parent/Family Research Participation Information & COPPA Compliance) of that policy.