Data processing agreement

About this agreement

When your customers answer your surveys, you decide what to collect and why, so you are the controller of their responses and David Mitchell, trading as Tinysurv (“we”, “us”), processes them on your behalf as your processor. This agreement sets out how we do that, as Article 28 of the UK GDPR requires.

It forms part of our terms of service and applies for as long as you have a Tinysurv account. You accept it when you create an account or use Tinysurv to collect responses; no signature is needed. If this agreement and the terms disagree about personal data, this agreement wins.

“UK GDPR” means the UK General Data Protection Regulation and the Data Protection Act 2018. Where the EU GDPR applies to your use of Tinysurv, read references to the UK GDPR as including it. Words such as “controller”, “processor”, “personal data” and “personal data breach” mean what they mean in the UK GDPR.

This agreement covers your customers’ responses. For your own account details (your email address, sign-in and billing), we are the controller, and our privacy notice explains what we do.

What we process

• Subject matter and purpose: running Tinysurv for you: showing your surveys, collecting the answers, checking them for spam, keeping them, and showing them to you in your results, exports and charts.
• Duration: for as long as you have an account, then until deletion as described under “When you delete data or leave”.
• Nature of the processing: collecting, storing, organising, counting, displaying, exporting, backing up and deleting.
• People whose data it is: the people who answer your surveys, usually your customers.
• Types of personal data: the answer they tap and when they gave it; any comment they write; a per-survey code made from a random number on their device, used to accept one answer per device per day; and, for answers given in the website pop-up, the address of the page they were on (without anything after a “?”). We don’t ask for names, email addresses or phone numbers, and we don’t store IP addresses with answers, but a comment can still identify someone.
• Special category data: none is intended. Our terms ask you not to collect sensitive information, such as health details, or answers from children.

Your instructions

We process your customers’ responses only on your documented instructions. Your instructions are our terms and this agreement, plus what you choose in Tinysurv: the surveys you create, the settings you pick, and what you export or delete. That includes where the data is sent, so we only transfer it outside the UK as set out below.

We don’t sell responses, use them for advertising, or use them for our own purposes, except to count them for fair use. If the law requires us to process them in some other way, we’ll tell you first, unless the law forbids that. If we think an instruction of yours breaks data protection law, we’ll tell you.

You’re responsible for having a lawful basis for your surveys and for telling your customers about them. Every survey links to our privacy notice, which explains the processing to them.

Confidentiality

Tinysurv is run by one person. Only David Mitchell can see your customers’ responses, and only when needed to run or support the service, investigate a problem or a report of misuse, or meet a legal duty. If anyone else ever helps run Tinysurv, they will be bound by a duty of confidentiality first. Our sub-processors’ staff are bound by confidentiality under their own terms.

Security

We take appropriate technical and organisational measures to keep responses safe, including:

• Every connection uses HTTPS, and browsers are told to use nothing else.
• The database is held on an encrypted disk on Fly.io’s servers in London.
• Passwords are stored only in scrambled form (scrypt, with a random salt). Owners can add two-step verification or passkeys, and our own admin access requires one of them.
• Each account can only see its own surveys and responses.
• We store as little as we can: no IP addresses with answers, and no names or contact details asked for.
• The database is backed up daily, with copies kept for a limited time, so data can be recovered if something goes wrong.
• Sign-in, password resets and survey answers are rate-limited to slow down abuse.

Sub-processors

You give us general permission to use sub-processors. These are the ones that handle your customers’ responses today:

• Fly.io, Inc. (United States): hosts Tinysurv and its database, on servers in London, and keeps daily snapshots of the database disk for 14 days.
• Tigris Data, Inc. (United States), provided through Fly.io: stores a daily off-site backup copy of the database. Each copy is replaced after about a month.
• Resend, Inc. (United States): sends our emails to you. On a paid plan, that includes the weekly summary and low-rating alerts, which carry answers, scores and comments from your customers’ responses (and, for the website pop-up, the page an answer came from). You can turn either email off.

Other services we use don’t receive your customers’ responses: Paddle handles payments as our merchant of record, and Google is used only if you choose to sign in with Google. Our privacy notice covers those.

Before we add or replace a sub-processor, we’ll email you at least 30 days ahead and update this list. If you object on reasonable data protection grounds, tell us within that time. We’ll try to address your concern; if we can’t, you can close your account before the change, and if you’ve paid in advance we’ll refund the unused part of your plan.

Each sub-processor is bound by a written contract with data protection obligations that give the same level of protection as this agreement. We remain responsible to you for what they do.

Transfers outside the UK

The live database is in London. All three sub-processors are US companies, so their staff or systems may access data from outside the UK, off-site backup copies may be stored outside the UK, and emails to you pass through Resend’s systems. Where personal data is transferred outside the UK, we make sure it is covered by a safeguard the UK GDPR recognises: UK adequacy regulations (including the UK–US data bridge, where the provider is certified), or the UK International Data Transfer Addendum to the EU standard contractual clauses in that provider’s data processing terms.

Helping you

• Requests from your customers: you can find, export and delete responses yourself from each survey’s results page. If one of your customers contacts us directly, we’ll pass the request to you and won’t answer it ourselves unless you ask us to. If you need more help, we’ll give it where we reasonably can.
• Personal data breaches: if we become aware of a personal data breach affecting your customers’ responses, we’ll email you without undue delay, telling you what we know, what data and how many responses are affected, and what we’re doing about it, and we’ll keep you updated as we learn more. This lets you decide whether to report it to the ICO or tell your customers.
• Security and impact assessments: we’ll give you the information you reasonably need for your own security, data protection impact assessments, or consultation with the ICO, taking into account what Tinysurv does and the information we have.

When you delete data or leave

When you delete a response, a survey or your account, it is removed from the live service straight away. Copies in our backups are deleted as the backups are replaced: within 14 days for disk snapshots and about a month for off-site copies. We don’t restore deleted data from a backup unless you ask us to, or to recover from a failure.

You can export each survey’s responses as a CSV file at any time, so please export anything you want to keep before you delete it. We don’t keep other copies, unless the law requires us to.

Showing that we comply

We’ll give you the information you reasonably need to show that we meet the obligations in this agreement. We answer any audit request first in writing: a security overview, our sub-processor list, our hosting providers’ certifications and reports (such as Fly.io’s SOC 2 report), and answers to reasonable written questions.

If that isn’t enough, or the ICO or another regulator requires it, we’ll allow and contribute to an audit or inspection by you or an auditor you appoint who is bound by confidentiality. You need to ask in writing, giving at least 30 days’ notice. Audits happen during UK business hours, no more than once a year unless there has been a personal data breach or a regulator requires one, and are at your cost. Audits of our sub-processors are carried out through the reports and terms they offer.

If you still need more than this, either of us can end your use of Tinysurv by telling the other in writing. If you’ve paid in advance, we’ll refund the unused part of your plan.

Liability and changes

The liability section of our terms applies to this agreement too, except where the law doesn’t allow it. If we change this agreement in a way that matters, we’ll email you before the change takes effect, as with the terms. It is governed by the law of England and Wales.

Contact

Tinysurv is run by David Mitchell, a sole trader trading as Tinysurv. Postal address: Show postal address. Email: info@tinysurv.com.