Data Handling & GDPR Compliance

Effective Date: 20 June 2026

This Data Handling Policy explains how Surventrics processes personal data in compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws. We are committed to protecting the privacy and security of all data processed through our platform.

1. Data Processing Roles

1.1 When We Act as Data Controller

Surventrics acts as the data controller for personal data related to:

• Account registration and management
• Billing and payment information
• Customer support communications
• Marketing communications (with consent)
• Website analytics and usage data

1.2 When We Act as Data Processor

Surventrics acts as a data processor when processing survey response data on behalf of our customers (the data controllers). Our customers determine the purposes and means of processing this data.

2. Legal Basis for Processing

We process personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide our services
• Legitimate Interests: Processing for business operations, security, and service improvement
• Consent: Processing for marketing and optional features
• Legal Obligation: Processing required by law

3. Data Collection and Purpose

3.1 Account Data

3.2 Survey Response Data

Survey response data is processed on behalf of our customers. Retention is determined by customer settings and our data retention policies. Customers can export and delete their data at any time.

4. Data Security Measures

We implement comprehensive security measures to protect personal data:

• Encryption: TLS 1.3 for data in transit, AES-256 for data at rest
• Access Control: Role-based access, multi-factor authentication
• Infrastructure: SOC 2 Type II compliant cloud providers
• Monitoring: 24/7 security monitoring and incident response
• Audits: Regular security assessments and penetration testing

5. International Data Transfers

When personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the EU Commission
• Adequacy decisions where applicable
• Supplementary measures as recommended by regulatory guidance

6. Sub-processors

We use the following categories of sub-processors to deliver our services:

A complete list of sub-processors is available upon request.

7. Data Subject Rights

Under GDPR, individuals have the following rights regarding their personal data:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure:Request deletion of your data ("right to be forgotten")
• Right to Restriction: Request limited processing of your data
• Right to Portability: Receive your data in a structured format
• Right to Object: Object to certain types of processing

To exercise these rights, contact us at dpo@surventrics.ai. We will respond within 30 days.

8. Data Protection Officer

For questions about data protection or to exercise your rights, contact our Data Protection Officer:

• Email: dpo@surventrics.ai
• Address: 22 The Hill, Blunham, Bedfordshire, MK44 3NG, United Kingdom

9. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority, particularly in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

10. Data Processing Agreement

For customers who require a Data Processing Agreement (DPA) for GDPR compliance, please contact legal@surventrics.ai. We provide DPAs as part of our Business and Enterprise plans.