|
Data Protection law will change on 25 May 2018. This Privacy Notice sets out your rights under the new laws:
The General Data Protection Regulation (GDPR) (EU) 2016/679 is a regulation in EU law on data protection and privacy for all individuals within the European Union.
It addresses the export of personal data outside the EU.
SurveyExpression is committed to protect and respect your privacy.
This Privacy Policy & Security Statement applies to www.surveyexpression.com which is owned and operated by Outside Software Inc. (VAT ID: RO16266620) from Bucharest, Romania.
By Signing up to an account with us, filling out a survey or visiting our site, you agree to our Privacy Policy. Specifically, you expressly consent to us processing your personal data as described in this Privacy Policy & Security Statement.
Furthermore, if you have enabled the use of cookies on your web browser, then you consent to our use of cookies as described in this Privacy Policy & Security Statement.
This Privacy Policy & Security Statement does not provide any additional terms and conditions nor warranties whether expressly or implied.
All terms and conditions are on the Terms & Conditions page. This Privacy Policy & Security Statement provides transparency to our users as how their data is collected and used and serves as a privacy notice as required by legislation.
If you have any further queries, please don't hesitate to contact us: office@surveyexpression.com or by writing to Outside Software Inc's address (see Contact page).
Introduction
Our Privacy Policy & Security Statement describes how we capture and use personal data that we collect about visitors to our website.
Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.
SurveyExpression acts as a data controller for all personal data which our account holders and site visitors input, except for any personal data which the account holder's survey respondents fill out.
For the personal data which the account holder's survey respondents fill out onto any of the surveys commissioned by the account holder, SurveyExpression acts as a data processor,
processing only in accordance to our account holder's instructions; the account holder in such circumstances is the data controller.
Definitions
An "Account Holder" is anyone who creates surveys, administers surveys or collects surveys using our services.
A "Survey Respondent" is anyone who fills out a survey powered by SurveyExpression.
A "Site Visitor" is anyone who visits our site.
Privacy Policy for Account Holders
An "Account Holder" is anyone who creates surveys, administers surveys or collects surveys using our services.
The data we collect from you
We collect the following data from you:
- - Account Information: this is the information you put on when opening an account including your name, username, email address etc.
Where you pay for using our service, our payment providers will also collect information regarding the payment method you have selected
(including billing address, card number, expiry date etc).
- - Survey Questions & Answers
- - Account Settings
- - Address Book: including any email addresses and names you put in.
- - Any other information you share with us including support tickets, emails, queries and testimonials.
The legal basis for us collecting the above data is that it is necessary for us to provide you the services under contract.
For Survey Questions & Answers, we act as data processor, in this regard we follow your instructions regarding how you want to process that data.
Billing Information
We do not collect any billing information from you. All billing details are collected and processed by our payment providers:
MyCommerce and Paypal.
What we do with the information we collect
We use the information we collect to provide our services to you. This includes:
- - Providing you customer support and help about our services when you contact us.
- - Contacting you about your account, billing information, changes to our Terms of Use, changes to other policies, and any other issues regarding our services.
- - For trouble shooting and testing of our services to ensure that it is secure, reliable and of high standard.
- - Maintain and improve our services.
- - To enforce our Terms of Use to ensure you are not carrying out any prohibited activities.
- - To prohibit illegal activity using our services.
- - To respond to legal requests, court orders or lawful requests from government agencies.
- - For providing our services to you as per your request.
Bear in mind you may make the survey public through your account, in that case any information on the survey will be made available to the public.
If an Account Holder does not select the "Anonymous Survey" feature, then the IP addresses of the survey respondents will also be stored by us.
Marketing and promotional emails
Where you have consented, we will contact you regarding promotional activities and marketing in order to inform you about offers and helpful tips about our service, you have a right to withdraw that consent at any time by following the simple instruction on the email or emailing office@surveyexpression.com telling us you no longer wish to receive promotional emails.
Please also see your rights below.
Sharing & Disclosure of your data
We use sub-processors to store our data safely and securely. All survey data is stored in the UK. All our sub-processors have robust security features to ensure that they have the appropriate technical and organisation measures to keep personal data secure, furthermore, they are contractually bound to not access, modify, disclose or erase the data without our instructions. You agree and specifically consent to our use of the following third party sub-processors:
We also use payment processors to accept card payments. Please check the privacy policies and terms & conditions of those. We use the following 2 payments processors:
We may disclose account details to the billing contact (if different, and if billing contact demands it).
We may disclose account details to your organization, where the registered account belongs to the organization itself.
We may disclose account or billing details if required by law or to comply with a court order or legal process.
We may disclose account details if there is a change in business ownership in the event of a merger, change in ownership, consolidation amalgamation or other corporate change, you agree that the successor will process that data instead of SurveyExpression following a notice of 1 month given to all of SurveyExpression's customers.
SurveyExpression is heavily focused on the privacy of your data, it does not sell your survey data.
Your data to third countries
We do not transfer your data to third countries. Any data is stored in the UK and EU at all times.
Rights to your data
If you are an Account Holder, you have the following rights to your data (please see below under the Heading "General Statement" for more information):
Right to access: You have the right to access the data we hold about you and for you by logging in to your account. From your account you can access all of your account data and the data of your surveys and responses.
You also have the right to access any information we hold about you and your account in a common machine readable format for free of charge, unless your request is excessive or repetitive.
We will process your request without undue delay and at the latest within 1 month, unless, your request is complex or numerous in which case we may take up to 3 months, but we will inform you within 1 month if this is the case.
Right to rectify: when you log on to your account, you can also rectify or update any information on your account or any questions and responses from surveys you have commissioned. If you are not able to do so, please contact us at office@surveyexpression.com.
Right to erase: When you log on to your account, you may also erase any data on your account with the exception of data that is required for you to keep your account open (such as your email address, name etc). You may erase any survey questions or responses as you like when you are inside your account.
You also have the right erase any other data which we hold about you including raising any questions or support tickets, if you would like to do so please contact us at office@surveyexpression.com
When you terminate your account, all of your data will be erased.
When you delete your data or terminate your account, it may still be stored with us for up to an additional 5 days due to the backups we have.
Right to object: You have the right to object to us using your data for marketing purposes. If you would like to do so please contact us at office@surveyexpression.com. This will be done free of charge and without undue delay.
Communication from the site
We send all new members a welcoming email to verify their registration.
Established members may occasionally receive information on improvements to our service, general service announcements, and a newsletter. Contact us if you would like to opt out of this type of communication.
On rare occasions it is necessary to send out a strictly service related announcement. For instance, if our service is temporarily suspended for maintenance we might send users an email. Generally, users may not opt-out of these communications; however, these communications are not promotional in nature.
Retention Periods:
We will retain your data for as long as necessary to carry out the service to you. If you wish to cancel your account, please contact us at: office@surveyexpression.com.
Privacy Policy for Survey Respondents
A "Survey Respondent" is anyone who fills out a survey powered by SurveyExpression.
The information SurveyExpression collects about Survey Respondents
On the instructions of the Account Holder, we collect your survey responses on their behalf. We then store those survey responses for the Account Holder. If you would like your survey responses erased, rectified, accessed or for any other queries about your responses, please contact the Account Holder directly. Please bear in mind that not all surveys are anonymous and some Account Holders may ask you to put in your personal data.
SurveyExpression's Use of the information we collect about you
We do not use your survey responses other than carrying out the service for the Account Holder.
Your survey responses are owned and managed by the Account Holder who will have its own policy on data handling and would decide on whether your survey responses are kept private,
disclosed to third parties, or provided to the public.
We do however employ a high standard of security, so if the Account Holder keeps your survey responses private, it will be stored in a highly secured environment –
for more information please see our security section below.
We do not sell your survey data to other parties nor do we store it to contact you for a purpose other than under the direction of Account Holder.
We only share your data with third parties if necessary to carry out the service(s) that the Account Holder has requested and as mentioned in this Privacy Policy & Security Statement.
If an Account Holder does not select the "Anonymous Survey" feature, then your IP address will be stored along with your responses.
Your rights to the data we process on behalf of the Account Holder
If you want to access your data, rectify your data, erase your data, object to the processing of your data, or for any other inquiries regarding the handling of your data, please contact the Account Holder directly. The Account Holder is able to amend, erase and access all the survey data and responses from its account.
If you believe that the Account Holder is not complying with its legal obligation(s) regarding your data, please contact our legal team for a resolution: office@surveyexpression.com.
You can opt out of receiving survey requests by contacting the Account Holder directly. Alternatively you can also click on the link supplied in an invitation email to opt out of receiving survey requests.
Data Retention
Please note that as the Account Holders control their own survey data, if you are a Survey Respondent to an Account Holder's survey you will need to contact them directly to amend or delete anything in your survey responses.
Privacy Policy of All Site Visitors
A "Site Visitor" is anyone who visits our site.
Cookies
We use both session ID cookies and persistent cookies. For the session ID cookie, once users close the browser, the cookie simply terminates. A persistent cookie is a small text file stored on the Site Visitor's hard drive for an extended period of time.
Persistent cookies can be removed by following Internet browser help file directions (see below).
With session cookies we are able to ensure that only people who have entered in correct login details are able to use password-protected areas,
and only areas that they are authorized to use. Persistent cookies enable us to track and target the interests of our users to enhance the experience on our site.
When you visit our site, we use cookies to store data on your device. This is so that we can:
- - Distinguish you from other users of our website.
- - Helps us to improve our website's performance and your experience of using our website.
- - Make it easier and more convenient for you to log in to our site, by storing the username and password on your device.
- - For ensuring secure login.
- - In certain surveys under the Account Holder's direction, to ensure that a survey respondent can't retake the same survey more than once.
- - To track referral data and see how you got to our site.
- - To measure your usage of our services.
Google Analytics
This cookie helps us measure how you interact with our website. It does this by recording what a Site Visitor has done on pages and interactions with our website
and is used to collect and analyse information about how Site Visitors use our site. We use Google Analytics platforms to collect and compile reports that help us improve our services.
The cookies collect information in an anonymous form, including the number of visitors to the site, where visitors have come to the site from and the pages they visited.
A unique User ID number is assigned to users who sign up with SurveyExpression in order to better understand their use of our service while logged in,
no personally identifiable information is collected by this process.
To opt out of Google Analytics, please visit https://tools.google.com/dlpage/gaoptout/
How to control cookies from your web browser
Web browsers accept cookies by default. You can however change your setting to decline cookies. To learn more about this, please visit this link: https://www.aboutcookies.org/how-to-control-cookies/
Do note that changing the setting on your browser to reject cookies means that you may not have access to important features on our site.
As the legal basis of using cookies, it is necessary for the purposes of the legitimate interests pursued by SurveyExpression and other parties as applicable (including Google). Our legitimate interests are:
- - Distinguish you from other users of our website.
- - Helps us to improve our website's performance and your experience of using our website.
- - Make it easier and more convenient for you to log in to our site, by storing the username and password on your device.
- - For ensuring secure login.
- - In certain surveys under the Account Holder's direction, to ensure that a survey respondent can't retake the same survey more than once.
- - To track referral data and see how you got to our site.
- - To measure your usage of our services.
However, if you believe that such interests are overridden by the interests or fundamental rights and freedoms of you as the data subject and that those require protection of your personal data, please contact us at office@surveyexpression.com.
We will block access to your data or give you the means to quickly do so, while we make a decision as to your request.
Source Data
SurveyExpression records the source of how you got to our site, including for example from another website or from a link to our website.
Log Files
We collect information about you when you visit our site including which webpages you visit, when you have visited them etc. We may also keep log files which contain data about the device you're using, the IP address, internet service provider, operating system, timestamps and files you view from our site.
IP Addresses
By visiting our site, your IP address will be recorded by our servers and stored in log files. These log files are used for record keeping, tracking referring websites, inferring your general location, and for security purposes to avoid SPAM, abuse and DDOS attacks.
Device Data
We collect data about the device and system you use to access our site. In particular, we collection your IP address, operating system, device type, browser type and your general location of accessing the site.
Security
Security is one of the most important segments of surveyexpression.com website. surveyexpression considers security of our users' data critical. We handle online information with commitment to ensure a secure environment that can be trusted to fulfill all confidentiality requirements. Documented steps are taken to safeguard information according to established security standards and procedures and we continually assess the newest technology for protecting information.
surveyexpression.com servers and databases are hosted by one of the most trusted providers in the UK (Fasthosts) in a state of the art secured location:
https://www.fasthosts.co.uk/dedicated-servers/features
surveyexpression.com software infrastructure is updated regularly with the latest security patches and permanently tested. The site is constantly monitored and surveyexpression is proud to state that the site was up and running 99.962% of the time, starting with the last 3 years.
To ensure data security, surveyexpression.com website can only be accessed over TLS/SSL. SSL (Secure Sockets Layer) allows the connection between your customer's browser and your server to be encrypted. After the connection is made, the information transmitted between your customer's browser and your server is encrypted securely and is therefore totally private.
surveyexpression.com uses a 2048-bit RSA key SSL certificate offering the highest possible level of security for our customers.
Right to complain
If you feel that we have mistreated the handling of your data, you have the right to complain to us in which case we will rush to resolve the matter as quickly as possible and prevent any further mishandling.
You also have the right to complain to the Information Commissioner's Office.
Necessary Disclosure by law
Though we make every effort to preserve user privacy, we may need to disclose personal information when required by law wherein we have a good-faith belief that such action is necessary to comply with a current judicial proceeding, a court order or legal process served on our website.
Links
This website contains links to other sites. Please be aware that we, SurveyExpression, are not responsible for the privacy practices of such other site. We encourage our users to be aware when they leave our site and to read the privacy statements of each and every website that collects personally identifiable information. This privacy statement applies solely to information collected by this website.
General Statement
For this section, the following definitions apply:
Controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
Personal data: any information relating to an identified or identifiable natural person ("Data Subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Data subject: any identified or identifiable natural person, whose personal data is processed by the controller responsible for the processing.
Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Recipient: a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing.
Third Party: a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.
Restriction of processing: the marking of stored personal data with the aim of limiting their processing in the future.
Processing: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Profiling: any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
Consent: Consent of the data subject is any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
Data Subject Rights
Certain regulations afford EU Data Subjects with rights. These rights are summarized below. In order to assert any of these rights please contact our DPO or another SurveyExpression employee at any time.
- - Right to Confirmation: Each data subject has the right to obtain from SurveyExpression (acting as controller) confirmation as to whether or not his or her personal data is being processed. This includes the right to confirm whether his or her personal data is transferred to a third country or to an international organisation as well as the appropriate safeguards relating to the transfer.
- - Right to Access: Each data subject has right to obtain from SurveyExpression (acting as controller), free information about his or her personal data stored at any time and a copy of this information, however, SurveyExpression reserves the right to charge a ‘reasonable fee' when a request is manifestly unfounded or excessive, particularly if it is repetitive.
- - Right to Rectification: Each data subject has the right to rectify inaccurate personal data concerning him or her that is being processed by SurveyExpression (acting as controller) without undue delay. Furthermore, the data subject has the right to complete any incomplete personal data and to provide supplementary statements to rectify that personal data.
- - Right to Erasure: Each data subject has right to erase any personal data concerning him or her which is being processed by SurveyExpression (acting as controller) without undue delay. SurveyExpression may refuse to grant you this right if a statutory exemption applies.
- - Right of Restriction of Processing: Each data subject has the right to restrict the processing of personal data from SurveyExpression (acting as controller) where a statutory ground applies.
- - Right to Data Portability: Each data subject has the right to receive the personal data concerning him or her, which was provided to SurveyExpression (acting as controller), in a commonly used machine-readable format.
- - Right to Object: Each data subject has the right to object to SurveyExpression (acting as controller) to the processing of his or her personal data if a statutory basis exists.
- - Right not to be subject to automated individual decision-making, including profiling: Each data subject has the right not to be subject to a decision based solely on automated processing, including profiling.
- - Right to Withdraw Consent: Where consent forms the basis for processing by SurveyExpression (acting as controller), the data subject has the right to withdraw his or her consent to the processing of his or her personal data at any time. Data Subjects can contact SurveyExpression's Data Protection Officer or any other employee to withdraw consent at any time.
- - Right to Complain to the Supervisory Authority - Information Commissioner's Office (ICO)
Security of processing
SurveyExpression has implemented technical and organizational measures to ensure personal data processed remains secure, however, absolute security cannot be guaranteed. Please contact our DPO or Security Team (office@surveyexpression.com) for further details.
Law & jurisdiction
This Privacy Policy & Security Statement is governed by and interpreted according to the law of European Union. All disputes arising out of this Privacy Policy & Security Statement will be subject to the exclusive jurisdiction of the European Union courts.
Transfer of Rights
You may not transfer any of your rights under this Privacy Policy & Security Statement to any other person. We may transfer our rights under this privacy notice where we reasonably believe your rights will not be affected.
Invalid provisions
If any court or competent authority finds that any provision of this Privacy Policy & Security Statement (or part of any provision) is invalid, illegal or unenforceable, that provision or part-provision will, to the extent required, be deemed to be deleted, and the validity and enforceability of the other provisions of this Privacy Policy & Security Statement will not be affected.
|