Privacy

The operator of this wrkflow deployment runs wrkflow and is responsible for the data described here as controller: the account and billing data of the people who sign in, and the technical data needed to run and secure the service.

For everything an organization puts into wrkflow, such as its surveys, contacts, participants and responses, the organization is the controller and the operator of this wrkflow deployment is its processor. If you answered someone else’s survey, they decide what happens to your answers; ask them first. The terms for that role are in the data processing summary.

Questions about this page or your rights: the contact address of the operator, once set.

• Account data: your name, email address, photo (if you add one), language and the organizations you belong to with your role. Passwords are handled by the sign-in service and are never readable by us. Why: to give you an account, which is the contract between us.
• What your organization stores: surveys and their answers, contacts and their attributes, participants and their personal links, follow-ups, files respondents upload, and the audit log of what members did. Why: to provide the service the organization asked for. Answers to questions marked sensitive are encrypted before they are stored.
• Billing data: the billing contact, plan and payment status. Card numbers go to our payment provider directly and never reach wrkflow. Why: to charge for paid plans and meet accounting duties.
• Technical data: the network address and browser of requests, kept in the audit log for sign-ins and changes, and used to limit abuse (rate limits) and to enforce an organization’s network allowlist. Why: security of the service, our legitimate interest.
• Email delivery data: whether an email was delivered, bounced or marked as spam, so we stop writing to addresses that cannot receive it. Why: to run the service and protect the sender’s reputation.

We do not sell personal data, and we do not use it for advertising.

A survey page shows who sent it. A personal link connects your answers to you unless the survey says it is anonymous. In an anonymous survey your answers are stored without a link to you, times are rounded to the day, and results never show a group smaller than the threshold the survey states, so no one can pick you out.

You can stop at any time. If you ask to be removed from further emails there is an unsubscribe link in every survey email; one press stops them.

wrkflow uses only what it needs to work. There are no advertising or analytics cookies and no tracking scripts, so there is no cookie banner to dismiss.

• Your sign-in session, while you are signed in.
• Your interface language, and your light or dark choice.
• On a survey: a marker that you already answered, and a saved draft so you can continue later, if the survey allows it.
• On a live poll: a random identifier so one browser casts one vote.
• While connecting an outside account: a short-lived value that proves the return trip is yours.

Companies that help us run wrkflow handle data on our behalf, only for that purpose. The current list, what each does and what it receives, is on the security page; it is kept in step with how this deployment is set up.

We share data with authorities only when the law requires it, and we tell the organization concerned when we are allowed to.

Organizations choose how long responses are kept, from 90 days to three years, and wrkflow applies the choice every night. Account data stays while your account does. Audit entries stay as long as the organization’s own retention allows. When an organization or an account is deleted, its data is deleted with it; backups age out on their own schedule.

Under the GDPR and similar laws you can ask to see your data, correct it, have it erased, restrict or object to its use, and receive it in a portable form. You can also complain to your data protection authority.

For your own account, write to the operator. For answers or contact details held by an organization, write to that organization; its administrators can look up, export and erase a person’s data from within wrkflow, and we help them do it.

Access is limited by organization and role, two-factor authentication and single sign-on are available, changes are logged, and sensitive answers are encrypted. What is in place, described as it is built, is on the security page. No system is perfectly safe; if something goes wrong that affects you, we say so and what to do.

When this page changes in a way that matters, signed-in organizations are told before it takes effect. The date at the top is the date of the latest change.