Data Handling & GDPR Compliance
Effective Date: 20 June 2026
This Data Handling Policy explains how Surventrics processes personal data in compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws. We are committed to protecting the privacy and security of all data processed through our platform.
1. Data Processing Roles
1.1 When We Act as Data Controller
Surventrics acts as the data controller for personal data related to:
- Account registration and management
- Billing and payment information
- Customer support communications
- Marketing communications (with consent)
- Website analytics and usage data
1.2 When We Act as Data Processor
Surventrics acts as a data processor when processing survey response data on behalf of our customers (the data controllers). Our customers determine the purposes and means of processing this data.
When you share a study's results or a report with your client through a link, that disclosure is yours: you are the controller of what you publish, and we process it on your behalf. We log a hashed IP address and browser type for each visit to the link for 12 months, so you can see when it was opened.
2. Legal Basis for Processing
We process personal data based on the following legal grounds:
- Contract Performance: Processing necessary to provide our services
- Legitimate Interests: Processing for business operations, security, and service improvement
- Consent: Processing for marketing and optional features
- Legal Obligation: Processing required by law
3. Data Collection and Purpose
3.1 Account Data
| Data Type | Purpose | Retention |
|---|---|---|
| Name, Email | Account management, communications | Duration of account + 30 days |
| Payment details | Billing and invoicing | 7 years (legal requirement) |
| Activity and security logs (account audit log, administrator audit log, BI connector access log) | Security, support | 12 months |
| Log entries recording a data protection request | Evidence that the request was handled | 6 years |
| Requests handled by our team (contact details, request, notes) | Answering and evidencing the request | No end date yet: not deleted automatically |
| Usage events (features, integrations, API calls used) | Support, improvements | 90 days |
| Contact-form messages | Answering your message | 12 months |
| Support sessions (staff access to an account: who, why, and the staff member's IP address and browser type) | Security, accountability | No end date yet: not deleted automatically |
| Policy acceptances (version accepted, IP address, browser type) | Evidence of acceptance | Until the account is deleted |
| Sign-up source (referrer, landing page, campaign) | Understanding how people find us | Until the account is deleted |
3.2 Survey Response Data
Survey response data is processed on behalf of our customers. There is no default retention period: responses are kept until the survey or organisation is deleted, unless the organisation sets a retention period. Customers can export and delete their data at any time.
4. Data Security Measures
We implement comprehensive security measures to protect personal data:
- Encryption: TLS 1.2 or better for data in transit, AES-256 for data at rest. Credentials you supply for third-party integrations are separately encrypted by Surventrics before storage
- Access Control: Role-based access, multi-factor authentication
- Infrastructure: hosted with SOC 2 Type II certified cloud providers, with survey data held in the United Kingdom
- Monitoring: 24/7 security monitoring and incident response
- Audits: Regular security assessments and penetration testing
5. International Data Transfers
When personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place:
- Standard Contractual Clauses (SCCs) approved by the EU Commission
- Adequacy decisions where applicable
- Supplementary measures as recommended by regulatory guidance
6. Sub-processors
We engage 9 sub-processors. Survey responses are held in the United Kingdom; the providers that may process data outside the UK and EEA handle authentication, application hosting, video processing and delivery, AI analysis of text with identifying information already removed, payments, and error monitoring.
| Provider | Purpose | Location |
|---|---|---|
| Neon | PostgreSQL database hosting for all platform data | United Kingdom (London) |
| Clerk | User authentication, session management, and identity services | United States |
| Vercel | Application hosting, serverless function execution, and edge network delivery | Global edge network with UK primary region (London) |
| Cloudflare | Object storage for uploaded files (R2) | European Union |
| Cloudflare Stream | Video processing and delivery for author-uploaded video (Stream) | Global (not restricted to the EU) |
| AI processing provider | Survey quality analysis, response quality review, theme extraction, and insight generation | United States |
| Stripe | Payment processing, subscription management, and invoice generation | United States (with EU processing available) |
| Resend | Transactional and marketing email delivery | European Union (Ireland, eu-west-1) |
| Sentry | Error monitoring: application error reports | [CONFIRM REGION] |
Full detail — what each one processes, retention, certifications, and the transfer mechanism relied on — is published at Sub-processors, along with the notice period for changes.
7. Data Subject Rights
Under GDPR, individuals have the following rights regarding their personal data:
- Right of Access: Request a copy of your personal data
- Right to Rectification: Request correction of inaccurate data
- Right to Erasure: Request deletion of your data ("right to be forgotten"). Survey responses are not linked to a Surventrics account, so deleting an account does not change them: a respondent asks the survey's owner (the controller) to erase their responses, or contacts us and we pass the request on.
- Right to Restriction: Request limited processing of your data
- Right to Portability: Receive your data in a structured format. A copy you export from your account can be downloaded for 7 days, then we delete it.
- Right to Object: Object to certain types of processing
To exercise these rights, contact us at dpo@surventrics.ai. We will respond within 30 days.
8. Data Protection Officer
For questions about data protection or to exercise your rights, contact our Data Protection Officer:
- Email: dpo@surventrics.ai
- Address: 22 The Hill, Blunham, Bedfordshire, MK44 3NG, United Kingdom
9. Supervisory Authority
If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority, particularly in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.
10. Data Processing Agreement
For customers who require a Data Processing Agreement (DPA) for GDPR compliance, please contact legal@surventrics.ai. We provide DPAs as part of our Business and Enterprise plans.