Privacy Policy

1. General Provisions

We invite you to read the Privacy Policy. We describe how personal data is processed in Survicate.

The Privacy Policy has been in force since 28.02.2025.

It is stipulated that capitalized terms utilized herein shall be interpreted in accordance with the definitions provided within Terms of Service.

In the event of inaccuracies between the wording of the Privacy Policy and the Terms of Service, the Terms of Service and its provisions shall prevail.

We want you to know how we process personal data. We reserve that all personal data that We process as a data controller are obtained directly from the data subject or personal data of an employee/associate is provided by an employer associated company, e.g. at the stage of adding a person in the system. These are the Users' data. With regard to the respondents' data or any data entered as part of the Account Data, We are not their Data Controller, but the Processor.

2. Data controller

Survicate S.A. with its registered office in Warsaw (postal code 02 – 786) at Zamiany 8 LU2 Street, entered into the register of entrepreneurs of the National Court Register kept by the District Court for the capital city of Warsaw in Warsaw, 13th Commercial Division of the National Court Register under KRS number: 0001021023, NIP number: 9512390641, fully paid-up share capital: PLN 300,000.00, contact e-mail address: support@survicate.com (“Survicate”, “Service Provider” , “We”, “Our” or “Us”) is a data controller within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to with the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as "GDPR") in the cases described below.

1. Persons who have consented to the processing of data

   Purpose of processing: The data is processed in order to implement the consent given by the person (the purpose results directly from the consent form).

   Legal basis: art. 6 sec. 1 point a) of the GDPR. Consent is given voluntarily and can be withdrawn at any time (please send request to: gdpr@survicate.com). Granting consent is necessary in order to implement the conditions for which consent has been granted (it results directly from the content of the consent message). Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

   Time of processing: The data is processed until the consent is withdrawn or after this period for the purposes of establishing, pursuing or defending legal claims within the period provided for by law.

   Data recipients: Data may be made available to data recipients providing IT solutions, customer service, accounting or legal services to the Service Provider, when it is related to the implementation of consent.

2. User

   Purpose of processing: The data is processed in order to conclude and perform the Agreement. Legal basis: art. 6 sec. 1 point b) of the GDPR. Processing time: The data is processed from the moment of entering into force of the Agreement, i.e. the creation of the Account and after removing the Account for the period required by law to establish, pursue or defend legal claims and/or accounting regulations.

   Data recipients: Data may be made available to data recipients providing IT, customer service, accounting or legal services to the Service Provider, who are entitled to view Users' data.

3. Persons who contact Survicate in relation to support issues or consider a complaint in connection with the use of the Service

   Purpose of processing: The data is processed as part of the legitimate interest of the Service Provider, which consists in providing answers and support and settling the complaint process.

   Legal basis: art. 6 sec. 1 point f) of the GDPR.

   Time of processing: We process the data for a period of 12 months from the date of consideration of the complaint, and after removing the Account for the period required by law to establish, pursue or defend legal claims and/or to meet requirements arising out of accounting regulations.

   Data recipients: Data may be made available to data recipients providing IT, customer service, accounting or legal services to the Service Provider, when it is related to the implementation of the purpose of processing.

4. Persons who take part in the survey of satisfaction and evaluation of the Services

   Purpose of processing: The data is processed as part of the legitimate interest of the Service Provider, which consists in assessing the quality of the Services provided and user experience.

   Legal basis: art. 6 sec. 1 point f) of the GDPR.

   Time of processing: We process the data for a period of 12 months from the date of consideration of the complaint, and after this period, if it is necessary for the purposes of establishing, pursuing or defending legal claims.

   Data recipients: Data may be made available to data recipients providing IT, customer service, accounting or legal services to the Service Provider, when it is related to the implementation of the purpose of processing.

5. People who receive notifications or system messages

   Purpose of processing: The data is processed as part of the legitimate interest of the Service Provider, which consists in sending notifications or e-mails in accordance with the Privacy Policy. The detailed list of notifications sent is described in point 8 below.

   Legal basis: art. 6 sec. 1 point f) of the GDPR.

   Processing time: The data is processed for the period in which the User has an Account, and after this period the Service Provider has the right to process only information about to whom, when and what messages or notifications were sent as long as it is necessary for the purpose of determining, pursuing or defending legal claims or services settlement after the end of the cooperation.

   Data recipients: Data may be made available to data recipients providing IT, customer service, accounting or legal services to the Service Provider, when it is related to the implementation of the purpose of processing.

6. Persons who contact support in connection with the provision of the Services

   Purpose of processing: The data is processed as part of the legitimate interest of the Service Provider, which consists in providing support.

   Legal basis: art. 6 sec. 1 point f) of the GDPR.

   Processing time: The data is processed for a period of 12 months from solving the problem, and after this period, if it is necessary for the purposes of establishing, pursuing or defending legal claims.

   Data recipients: Data may be made available to data recipients providing IT, customer service, accounting or legal services to the Service Provider, when it is related to the implementation of the purpose of processing.

7. People who contact with Survicate

   Purpose of processing: The data is processed as part of the legitimate interest of the Service Provider, which consists in answering or considering the request.

   Legal basis: art. 6 sec. 1 point f) of the GDPR.

   Time of processing: The data is processed for a period of 12 months from solving the problem, and after this period, if it is necessary for the purposes of establishing, pursuing or defending legal claims.

   Data recipients: Data may be made available to data recipients providing IT, customer service, accounting or legal services to the Service Provider, when it is related to the implementation of consent.

8. Website visitors

   Purpose of processing: We collect data on the basis of your consent to the processing of cookies or in scope of some cookie files - legitimate interest of the Service Provider, which consists in marketing activities, creating statistics of visits and the way of using the website.

   Legal basis: art. 6 sec. 1 point f) of the GDPR

   Time of processing: The data is processed until the consent is withdrawn or after this period for the purposes of establishing, pursuing or defending legal claims within the period provided for by law.

   Data recipients: Data may be made available to data recipients providing IT, customer service, accounting or legal services to the Service Provider, when it is related to the implementation of consent.

3. How long data is kept

3.1. Survey Data and Feedback Analysis

Survicate does not determine the retention period for data related to surveys and feedback analysis, including respondent information. The user has full control over the data and can manage its retention by either deleting specific records or removing the entire account. Until such actions are taken, the data remains stored in the system. Users also have the ability to search for and retrieve specific data as needed.

3.2. Application Users' Data

For users of the application, data is processed from the moment of account creation (i.e., when the Agreement enters into force). After an account is deleted, data is retained for the period required by applicable law for the purpose of establishing, pursuing, or defending legal claims and/or to comply with accounting regulations.

4. Your rights related to the protection of personal data

You have the right to access your data, rectify, transfer (if the basis for processing is consent - art. 6 section 1 lit. a GDPR), delete or limit processing, the right to object (if the basis for processing is art. 6 section 1 lit. f GDPR), the right to lodge a complaint to the supervisory body (in Poland to the President of the Office for Personal Data Protection). A request related to personal data can be submitted by emailing gdpr@survicate.com.

5. Is the data shared with third parties and or transferred outside the European Economic Area?

The transfer of data to third countries takes place on the basis of the agreements we have signed. Entrusting data processing is related to the performance of the Agreement. Here is the full list of providers:

In the case of above-mentioned providers, data is transferred to a third country. Please be aware, that the USA does not have an adequacy decision issued by the European Commission and European regulations on the protection of personal data do not apply there. It is our duty to inform you that the transfer of data to the US involves the risk of access to data by US intelligence services on the basis of applicable law. As we informed above, we have concluded a data processing agreement with each of the entities.

Categories of Third-parties engaged by the Survicate

1. Transfer to Third Parties Requiring Consent: For some third-party tools, particularly those involving cookies and similar tracking technologies, we obtain your consent through a cookie banner displayed on the login page of panel.survicate.com. You have the freedom to choose whether to accept or reject these cookies both at the point of entry and later through our Survicate Privacy Center, where you can also modify your consent choices at any time.
2. Transfer to Third Parties Based on Legitimate Interests: We engage with certain third parties whose services are integrated based on our legitimate interest, such as significant improvements to our service provision or additional product features. You have the right to object to the processing of your data by these third parties. Objections can be made through our Survicate Privacy Center.
3. Essential Survicate’s Service Providers: There are third parties whose involvement is essential for the providing of our services. Accepting our services implicitly requires acceptance of these third parties, as their role is crucial for the functionality of Survicate. An example of such essential services is cloud infrastructure provided by AWS, which forms the backbone of the Survicate tool. Any changes in this regard are not possible, and the only way to prevent data transfer to these third parties is to discontinue using Survicate's services.

Consent and Your Choices

Your privacy is of utmost importance to us. We provide mechanisms for you to manage your consent/ opt-out and make informed decisions about the sharing of your data:

• At Entry: You are presented with options to consent to or reject the use of third-party tools that require your explicit consent via a cookie banner.
• Privacy Center: For ongoing consent management, including the ability to change your preferences or object to data processing based on legitimate interests, you can visit our Privacy Center at Survicate Privacy Center.

Your choices regarding the use of your data are respected, and we strive to provide you with control over your information. However, please note that the rejection of certain third parties may impact the functionality of our services. For any further questions or concerns regarding our data sharing practices, please contact our privacy team at gdpr@survicate.com.

6. Use of Google APIs

Use of Google APIs

Survicate leverages various Google APIs to enhance our offerings. This approach is applied in two main contexts: for secure login to our panel and for facilitating OAuth-based integrations with our services. This ensures that we manage the information sourced from and sent to Google APIs with the highest level of care and responsibility, particularly emphasizing the secure management of authentication data.

Adherence to Google API Services User Data Policy

We strictly comply with the Google API Services User Data Policy, including adhering to the Limited Use requirements. This compliance ensures that the processing, use, and transfer of data received from or sent to Google APIs by our application are conducted in a manner that respects both the policy's stipulations and your privacy.

Limited Application of Google API Data through OAuth

The information obtained from and sent to Google APIs is exclusively utilized for the intended purposes of the specific APIs and within the context of our services to You. We ensure that:

1. The data is not employed for advertising objectives.
2. The data sent to or received from Google is not disclosed to any third parties, unless such disclosure is necessary for the provision of our services.
3. The data is stored securely and is accessible solely to authorized personnel.

In addition to receiving data from Google APIs, our application also transmits data to Google for various purposes, such as updating records or retrieving information. This process is conducted in strict compliance with Google's policies and with a focus on protecting your data privacy and ensuring secure access.

Your Rights and Choices

As a user, you possess rights and options concerning the information sent to and received from Google APIs. You can adjust your preferences and settings to manage the data shared with our services.

7. Do we profile personal data?

No.

8. How can you get in touch with us?

We will be happy to answer any questions by e-mail. We encourage you to contact us by e-mail: gdpr@survicate.com Alternatively, you can use the address: Zamiany 8 LU2 Street, 02-786 Warsaw, Poland

9. In what cases is the Survicate a processor?

We are a processor within the meaning of the GDPR at the moment of concluding a Data Processing Agreement (to entrust the processing of personal data in relation to Account Data). The User decides what data is processed by means of surveys. The rules of processing are set out in a separate Data Processing Agreement (DPA). We are the processor of respondents' data and Account Data that are stored in the User's Account. If you have questions about how your personal data is processed, please contact the creator of the survey.

Scope of data related to respondents:

1. Visitor ID,
2. Visitor attributes passed using traits or survey URLs,
3. IP,
4. browser language,
5. email address in link surveys (sending through client’s e-mail),
6. operating system version, device type, device,

whereby, in the scope of Visitor ID and Visitor attributes passed using traits or survey URLs, the data is stored in Local Storage.

Survicate does not use cookies for the respondents, does not use cookies placed on the respondent's device, nor does it initiate their installation. We do not create/use any cookies for the purpose of targeting, showing or marketing activities. We do not use them in completing survey purposes as well. However we can deliver a product feature that allows us to show a survey based on visitor cookies.

Survicate uses the geographic location of respondents based on IP address. We do not collect precise GPS co-ordinate locations. We just infer location from IP address. What is important, we do not store this information, i.e. it is processed live for the purposes of technical delivery of the service (CDN).

The respondent's IP could be processed for the purpose of IP blacklisting. The Firewall has the functionality of permanently blocking connections from specific IP addresses and integrating user identity management. To use this functionality, it is necessary to engage the IP addresses of individual respondents.

10. What notifications does the Service Provider send and why?

We send system notifications that are visible after logging in. This is due to ensuring a better flow of information.

• Notification about the purchase of the Service — You will receive information about the purchase of the Service.
• Notification about the approaching end of the subscription — You have the option not to extend the Services, and if you do not perform any action, they will automatically be extended for the next period.
• Notification about product functionalities — You will receive information about the product updates and new features.
• Notification of service interruption/update — You will receive information about the planned maintenance break, its duration and reasons. Please note these changes are made from time to time to ensure the security of the Services.
• Notification of changes to the Terms of Service or Price List — We will notify you of changes to the Regulations or the Price List so that you can familiarize yourself with them.

11. What reports can Survicate generate based on anonymous data?

We have the right to generate anonymous and static reports. These reports may later be presented by the Service Provider for promotional or advertising purposes or for the development or provision of its own services. Reports are based on numbers or other statistical data, so they present quantitative summaries. For example, how many users from a given country used our Services in month X, how many surveys were created in month X, etc. Personal data is neither processed nor presented.

12. Security

1. The principles we follow:
   1. We respect the right to privacy.
   2. We take care of data, including personal data.
   3. Connection with our Website is encrypted.
   4. We do not request you to log on to the Account when we send invoices or any e-mail correspondence.
   5. We do not request you to provide data by e-mail. We always conduct verification after logging on to the Account. We would like to ask you for understanding if certain actions require confirmation and verification. In such a case we may ask you to log on to the Account or additional formal representatives of your organization involvement.
2. When using the Internet, choose only safe devices and networks. If you use the Website for work purposes, follow the security recommendations at your organization.

13. Cookies

1. Cookies are sent to Internet browsers, then stored in the memory of devices, and read by the server at each connection with the Website.
2. You can obtain information about cookies processed by Survicate and manage the consent to cookies by clicking here: https://survicate.com/#cookie-settings
3. If you don’t want to store some cookies on your device, you can manage them through your device browser settings, giving you more control over your privacy and preferences. This means that you may disable cookies from all sites except those that you trust.
   • Google Chrome
   • Microsoft Edge
   • Mozilla Firefox
   • Opera
   • Safari (macOS), Safari (iOS)