Data Processing Agreement

This agreement is between SurveyDock (“processor”, “we”) and the practice holding a SurveyDock account (“controller”, “you”).

It applies to personal data we process on your behalf through the service — described in Annex A. It does not apply to data for which we are ourselves the controller, such as your account administrators’ contact details or enquiries made through our website; those are covered by our Privacy Policy.

You remain responsible for having a lawful basis to hold the personal data you put into the service, and for the accuracy and relevance of that data.

“Personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” carry the meanings given in the UK GDPR.

We process personal data only on your documented instructions. Your use of the service, together with the Terms of Service and this agreement, constitutes those instructions.

We will tell you if, in our opinion, an instruction infringes data protection law, and we may decline to act on it.

If the law requires us to process personal data other than on your instructions, we will tell you before doing so unless the law forbids us from telling you.

We will not sell personal data, use it for our own purposes, use it to train machine learning models, or use it to market to your clients.

You give us general authorisation to engage sub-processors. Those engaged today are listed in Annex C.

We will give you at least 30days’ notice by email to your account administrators before a new sub-processor begins processing your personal data. If you object on reasonable data protection grounds we will work with you to find a solution, and if we cannot, you may terminate without penalty and with the export rights in clause 7 of the Terms of Service intact.

Each sub-processor is engaged under a written contract imposing obligations no less protective than these, and we remain fully liable to you for their performance.

Data subject requests. The service is built so that you can answer most requests yourself: you can search, correct, export and delete records directly. Where you need more, we will help. If a data subject contacts us about data we hold for you, we will refer them to you rather than respond ourselves.

Portability. The account export produces every record in a documented, machine-readable format — see the export format documentation. That is the mechanism by which we help you meet Article 20.

Assessments. We will give you the information you reasonably need for a data protection impact assessment or a prior consultation with the ICO, taking into account what we know about how the service works.

We will notify you without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting personal data we process for you.

The notification will describe what happened, the categories and approximate number of data subjects and records involved, the likely consequences, the measures we have taken or propose, and a contact point for more information — to the extent we know it at the time. We will follow up as we learn more rather than waiting until the picture is complete.

Reporting to the ICO and to affected individuals is your decision as controller. We will give you the information you need to make it and to meet your own deadlines.

Throughout the agreement you can export all personal data we process for you, yourself, at any time and at no charge.

On termination your account stays reachable for the purpose of export for 30 days. After that we permanently delete the personal data from our live systems, and backups containing it are overwritten within a further 30 days.

We will confirm deletion in writing on request. We will retain personal data beyond these periods only where the law requires it, and only for as long as it requires.

We will make available the information reasonably needed to demonstrate our compliance with Article 28, including answering a security questionnaire from your IT or infosec team.

You may audit our compliance no more than once a year, on 30 days’ written notice, at your cost, during business hours and without unreasonably disrupting the service. We may require an independent auditor to be bound by confidentiality. Where a recent audit or certification answers your questions, we may offer that instead.

If this agreement conflicts with the Terms of Service on the processing of personal data, this agreement prevails.

This agreement takes effect when you open an account and continues for as long as we process personal data for you.

It is governed by the law of England and Wales. Liability is subject to the limits in clause 12 of the Terms of Service, except where data protection law does not permit that.

Questions about this agreement, and requests for a countersigned copy if your procurement process needs one, go to support@surveydock.co.uk.