1. Nature and purpose of the processing
The processor processes personal data in order to provide the service: creating and sending surveys, running AI-led and telephone-based interviews, collecting web signals, analysing answers and producing reports. The data is processed only on the customer’s documented instructions, which consist of the agreement and the customer’s settings in the service.
2. Categories of data subjects and data
- Data subjects: the customer’s customers, employees, website visitors and other respondents, as well as the customer’s users.
- Data: contact details (name, email, phone, company, segment), answers and open text, timestamps, technical information about web signals (path, signal type, anonymous session ID). The customer is responsible for not collecting sensitive personal data without a legal basis.
3. The processor’s obligations
- Staff with access are bound by confidentiality.
- Appropriate technical and organisational measures are taken, including encrypted transfer (HTTPS), hashed passwords, access control per workspace, data minimisation and backups.
- The processor assists the customer with requests from data subjects (such as access and erasure) and with impact assessments.
- Personal data breaches are reported to the customer without undue delay and no later than 48 hours after they are discovered.
4. Sub-processors
The customer approves that the processor engages sub-processors for hosting, email delivery and AI services. A current list is provided on request. New sub-processors are notified to the customer in advance and the customer has the right to object. Sub-processors are bound by obligations equivalent to those in this agreement.
5. Transfers to third countries
Data is primarily processed within the EU/EEA. If a sub-processor processes data outside the EU/EEA, the level of protection is ensured through the European Commission’s standard contractual clauses or another valid transfer mechanism.
6. AI processing
Respondents’ answers are sent to the AI service to formulate follow-up questions, summaries, translations and classifications. The data is not used to train the AI provider’s models, to the extent the provider’s terms allow. Aggregated portfolio insights are sent without personal data.
7. Audit
The customer has the right to request the information needed to demonstrate compliance with the obligations in this agreement, and to carry out an audit with reasonable notice and at its own expense.
8. Termination
When the agreement ends, the processor deletes or returns the personal data at the customer’s choice, no later than within 30 days, unless the law requires continued storage. The customer can export its data in the service before termination.