Business customers
Data Processing Addendum
Effective October 18, 2026
At a glance
- This addendum applies automatically when you use SurveyHood to collect personal data in survey responses.
- You decide what data to collect and why; we process it only to provide the service to you.
- We help you answer data-subject requests, tell you about breaches without undue delay and delete data when you delete it.
- Enterprise customers can sign a countersigned version: contact sales@surveyhood.com.
This summary is for convenience. The full text below is what applies.
1. Scope and roles
This Data Processing Addendum (“DPA”) forms part of the Terms of Service between SurveyHood and the customer. It applies to personal data that the customer collects through surveys and forms, invitation lists it uploads, and its team members’ data (“Customer Personal Data”). For that data the customer is the controller (or “business”) and SurveyHood is the processor (or “service provider”).
It does not cover data SurveyHood controls itself, such as panel participants’ profiles and our own billing records, which are covered by our Privacy Notice.
2. Processing on instructions
SurveyHood processes Customer Personal Data only to provide, secure and support the service, as described in the Terms and the customer’s use of product settings, which together are the customer’s documented instructions. We will tell the customer if we believe an instruction breaks data-protection law.
SurveyHood will not sell or share Customer Personal Data, retain, use or disclose it for any purpose other than providing the service, or combine it with data from other sources except as the law allows for a service provider.
| Item | Description |
|---|---|
| Subject matter | Hosting and processing of survey responses, invitation lists and workspace data |
| Duration | For the term of the agreement and until deletion under section 8 |
| Data subjects | Survey respondents, people on invitation lists, and the customer’s team members |
| Categories of data | As chosen by the customer in its surveys; typically contact details, opinions, demographics and free-text answers |
| Special categories | Only if the customer chooses to collect them, at the customer’s responsibility |
3. Customer responsibilities
The customer is responsible for having a lawful basis and any required notices or consents for the data it collects, for not collecting more than it needs, for using anonymous mode where it promises respondents anonymity, and for following our Acceptable Use Policy.
4. Confidentiality
SurveyHood personnel with access to Customer Personal Data are bound by confidentiality obligations and access it only as needed to provide support, investigate abuse or keep the service secure. Privileged access is recorded in an audit log.
5. Security
SurveyHood maintains the technical and organisational measures described on our Security page, including encryption in transit and at rest, database-level tenant isolation, least-privilege access, and audit logging, and may improve them over time without reducing overall protection.
6. Subprocessors
The customer authorises the subprocessors listed on our Subprocessors page. SurveyHood imposes data-protection obligations on each subprocessor that are no less protective than this DPA and remains responsible for their performance. We will give at least 14 days’ notice of a new subprocessor; the customer may object on reasonable grounds, and if we cannot address the objection the customer may terminate the affected service and receive a refund of prepaid fees for it.
7. Assistance and breaches
SurveyHood provides tools to export and delete responses and will help the customer, taking into account the nature of the processing, to respond to data-subject requests, carry out data-protection impact assessments and consult regulators where required. Requests we receive directly about Customer Personal Data are passed to the customer.
SurveyHood will notify the customer without undue delay, and in any case within 72 hours of becoming aware, of a personal-data breach affecting Customer Personal Data, with the information reasonably available to help the customer meet its own obligations.
8. Deletion and return
The customer can export its data at any time. When the customer deletes a survey, its responses are deleted. When the customer’s account is deleted, Customer Personal Data is deleted after the 30-day cooling-off period, except where the law requires us to keep it. Invitation email addresses are cleared automatically when a survey closes, and at the latest 90 days after.
9. Audits
On written request, no more than once a year, SurveyHood will answer a reasonable security questionnaire and provide information needed to demonstrate compliance with this DPA. Further audits can be agreed in an enterprise agreement.
10. International transfers
Customer Personal Data is processed in the United States. Where data-protection law requires a transfer mechanism for data from the European Economic Area, the United Kingdom or Switzerland, the parties agree to the applicable Standard Contractual Clauses (Module 2 or 3, as relevant), which are incorporated by reference, with SurveyHood as data importer.
Questions about this document? Email support@surveyhood.com, or privacy@surveyhood.com for privacy matters.