Data Processing Agreement

1. Scope and roles

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Evaryn LLC (“Processor”) and the customer (“Controller”). It applies to personal data that the Controller collects or submits through the service, mainly survey responses and the contact lists used to send surveys (“Customer Personal Data”).

The Controller determines the purposes and means of processing. The Processor acts as a processor, or service provider, on the Controller’s behalf.

2. Details of the processing

• Subject matter: hosting and processing of surveys and responses to provide the Evaryn service.
• Duration: the subscription term, plus the export and deletion period described in section 9.
• Nature and purpose: storing, organizing, displaying, grouping by tags and keyword rules, sending surveys by email on the Controller’s instruction, and exporting data.
• Categories of data subjects: the Controller’s customers and other survey respondents; people on contact lists the Controller uploads; the Controller’s users.
• Types of personal data: ratings and choices, free-text comments, and, where the Controller asks for them, names, email addresses and phone numbers; location or team identifiers; technical metadata such as response time and channel.
• Special categories: none are intended. The Controller must not collect sensitive data through the service without a clear legal basis and a genuine need (see the Acceptable Use Policy).

3. Instructions

The Processor processes Customer Personal Data only on the Controller’s documented instructions, which consist of the Terms, this DPA and the Controller’s configuration and use of the service. The Processor will inform the Controller if it believes an instruction violates applicable law. The Processor will not sell Customer Personal Data, retain, use or disclose it outside the direct business relationship with the Controller, or combine it with other data except as allowed by law.

4. Confidentiality

The Processor ensures that people authorized to process Customer Personal Data are bound by confidentiality obligations and access it only as needed to provide the service or support.

5. Security measures

The Processor implements appropriate technical and organizational measures, including:

• encryption of data in transit (HTTPS);
• password-protected accounts and role-based access limited to the locations or teams assigned;
• restriction of internal access to authorized personnel;
• an anonymous mode that, when enabled, does not store a name or email address with responses;
• hosting with a professional hosting provider.

6. Subprocessors

The Controller authorizes the Processor to use subprocessors for hosting and email delivery. A current list is available on request at contact@evarynllc.com. The Processor will give notice of a new subprocessor before it starts processing Customer Personal Data, so that the Controller may object on reasonable grounds. The Processor imposes data protection obligations on its subprocessors that are no less protective than this DPA and remains responsible for their performance.

7. Assistance

Taking into account the nature of the processing, the Processor assists the Controller in responding to requests from data subjects (for example, by allowing responses to be found, exported and deleted), and in meeting its obligations regarding security, breach notification and data protection assessments. The Processor will forward to the Controller any request it receives directly from a respondent about Customer Personal Data.

8. Security incidents

The Processor will notify the Controller without undue delay after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data, and will provide the information reasonably available to help the Controller meet its own obligations.

9. Return and deletion

The Controller may export Customer Personal Data as CSV at any time during the subscription. After the subscription ends, the Processor keeps the data for thirty days so the Controller can export it, then deletes it, unless the law requires it to be kept. Residual copies in backups are deleted in the normal backup cycle.

10. Information and audits

The Processor makes available the information reasonably necessary to demonstrate compliance with this DPA and allows for reasonable audits by the Controller or an auditor it mandates, on reasonable notice, no more than once a year unless required by a regulator or following a security incident.

11. Location and transfers

Customer Personal Data may be processed in the United States. If the Controller is subject to laws that restrict transfers of personal data outside its jurisdiction, the parties will cooperate in good faith to put in place an appropriate transfer mechanism before such data is submitted to the service.

12. General

If this DPA and the Terms conflict regarding the processing of Customer Personal Data, this DPA prevails. The limitation of liability in the Terms applies to this DPA to the extent permitted by law.

Evaryn LLC, 2240 S Xapary Way, Aurora, CO 80014, USA. Email: contact@evarynllc.com. Phone: +1 720 778 9852.