Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Earth Wide Service Limited (“Askwise”, “we”) and the customer who holds an Askwise account (“Customer”, “you”). It applies automatically to every customer, on every plan, whenever Askwise processes Respondent Personal Data for you. No signature is needed.

Legal entity

Earth Wide Service Limited

Incorporated in

Hong Kong

Company Registry No.

79877575

Registered address

Room 511, 5/F, Ming Sang Industrial Building, 19-21 Hing Yip Street, Kwun Tong, Hong Kong

If this DPA conflicts with the Terms, this DPA prevails for the processing of Respondent Personal Data. If you need a countersigned copy for your records, email [email protected].

• Data Protection Laws means all laws on privacy and personal data that apply to the processing, which may include the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the Hong Kong Personal Data (Privacy) Ordinance, and US state privacy laws such as the CCPA/CPRA.
• Respondent Personal Data means personal data contained in responses submitted to your surveys and forms, and the technical context Askwise records with them, as described in Annex 1.
• Controller, processor, data subject, personal data breach and processing have the meanings given in the GDPR. Where other Data Protection Laws use equivalent terms (such as “business” and “service provider”, or “data user” and “data processor”), those terms apply accordingly.
• Sub-processor means a third party engaged by Askwise that processes Respondent Personal Data.

For your own account data (your name, email, billing details and usage of Askwise), Askwise is an independent controller, and our Privacy Policy applies instead of this DPA.

You are responsible for:

• having a lawful basis for collecting Respondent Personal Data, including consent where required;
• giving respondents the information Data Protection Laws require, such as a privacy notice explaining who you are and how answers are used;
• complying with our Acceptable Use Policy, including its rules on sensitive data and children; and
• making sure your instructions to us comply with Data Protection Laws.

We process Respondent Personal Data only on your documented instructions. Your instructions are these Terms and this DPA, and the choices you make in the product, such as publishing a survey, setting up hidden fields, redirects, notifications or webhooks, exporting results, or deleting responses.

We will not sell Respondent Personal Data, use it for advertising, combine it with data from other customers, or use it for our own purposes, except where the law requires us to. If we believe an instruction breaks Data Protection Laws, we will tell you. If the law requires us to process data in a way you didn’t instruct, we will tell you first unless the law forbids it.

Where the CCPA applies, Askwise acts as your service provider and will not retain, use or disclose Respondent Personal Data outside the direct business relationship with you.

Access to Respondent Personal Data is limited to Askwise personnel who need it to operate, secure and support the Service, for example to investigate a support request you raise or a report of abuse. Everyone with access is bound by confidentiality obligations.

We maintain technical and organisational measures appropriate to the risk, including:

• encryption of all data in transit using HTTPS (TLS);
• data minimisation by design: respondents’ IP addresses are not stored with responses, and user-agent strings are reduced to a device type;
• hashed response tokens, so that partial responses can be resumed only by the browser that started them;
• bcrypt password hashing and hashed session tokens for customer accounts;
• rate limiting to protect surveys from automated abuse;
• signed webhook deliveries, so you can verify that data sent to your systems came from Askwise;
• access controls limiting production access to authorised personnel;
• regular backups, retained for up to 35 days, so data can be restored after an incident; and
• hosting with providers that maintain recognised security practices.

We may update these measures over time, provided the overall level of protection is not reduced.

You authorise us to use the following sub-processors:

We impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain responsible for their performance. We will notify you by email at least 14 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds, tell us at [email protected]; if we can’t address the objection, you may cancel and we will refund any prepaid fees for the remaining period.

Destinations you configure yourself, such as webhook endpoints or redirect URLs, are not our sub-processors. Data sent there is under your control.

Askwise is operated from Hong Kong, and our sub-processors operate in the United States and the European Union. Where Respondent Personal Data subject to the GDPR, UK GDPR or Swiss law is transferred to a country without an adequacy decision, the parties agree that the European Commission’s Standard Contractual Clauses (Module 2, controller to processor, or Module 3, processor to processor, as applicable), together with the UK International Data Transfer Addendum and the Swiss amendments where relevant, are incorporated into this DPA by reference. The details required by those clauses are set out in Annex 1, and the security measures in section 6.

If we become aware of a personal data breach affecting Respondent Personal Data, we will notify you without undue delay, and in any event within 48 hours, at the email address on your account. We will tell you what we know: the nature of the breach, the categories and approximate number of records affected, likely consequences, and the measures we have taken or propose.

We will take reasonable steps to contain and remedy the breach and give you the information you need to notify authorities or respondents where you are required to. Notifying you is not an admission of fault.

Askwise gives you the tools to respond to respondents’ requests yourself: you can find, export and delete individual responses at any time, and export all your data as JSON from Settings → Your data, or responses as CSV on Pro and Business plans.

If a respondent contacts us directly about a response to your survey, we will forward the request to you and won’t respond ourselves except to point them to you. Taking into account the nature of the processing, we will also give you reasonable help with data protection impact assessments and consultations with supervisory authorities.

You can delete responses, surveys or your whole account whenever you like. When you delete them, or when your account is closed, we delete Respondent Personal Data from our live systems within 30 days, and backup copies expire within 35 days, unless the law requires us to keep it.

Before closing your account, you can export your data at any time using the export tools described above.

We will make available the information reasonably necessary to demonstrate compliance with this DPA, including written answers to security questionnaires, once a year or after a personal data breach. If a supervisory authority requires an audit, or the information we provide is not sufficient for you to meet your obligations, we will cooperate with a reasonable audit on at least 30 days’ notice, during business hours, at your cost, and subject to confidentiality.

Each party’s liability under this DPA is subject to the limitations in the Terms, except where Data Protection Laws do not allow those limitations. This DPA lasts for as long as we process Respondent Personal Data for you and ends automatically once that data has been deleted. It is governed by the same law as the Terms, except where the Standard Contractual Clauses require otherwise.