Privacy Policy

Introduction

FlexiSurvey is a product of Spancorp Limited, a company registered in New Zealand ("Spancorp," "FlexiSurvey," "we," "our," or "us"). We are committed to protecting your privacy and handling your information responsibly. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our survey platform, or otherwise interact with our services (collectively, the "Services"). It applies to account holders, their team members, and survey respondents alike.

Our Role: Controller and Processor

Depending on the data involved, we act in different capacities under data protection law:

• As a controller: For information about our account holders, website visitors, and prospective customers, such as account, billing, and marketing data, we determine how and why the data is processed.
• As a processor: For the survey responses and respondent data that our customers collect using the Services, our customer is the controller and we process that data on their behalf, under their instructions and their own privacy notice. If you are a respondent with questions about a particular survey, please contact the organisation that invited you.

Information We Collect

Personal Information

We collect information that you provide directly to us, including:

• Name and contact information (email address, phone number)
• Account credentials (username and password)
• Payment and billing information
• Survey data and responses
• Communications with our support team

Automatically Collected Information

When you use our services, we automatically collect:

• Device and browser information
• IP address and location data
• Usage statistics and analytics
• Cookies and similar tracking technologies

Survey and Respondent Data

When our customers create and distribute surveys, we process the questions, responses, and any contact details they choose to upload on their behalf. Our customers are responsible for obtaining any consents required from their respondents and for the lawfulness of the data they collect through the Services.

Cookies and Tracking Technologies

We and our service providers use cookies and similar technologies to operate, secure, and improve the Services. The main categories we use are:

• Strictly necessary: Required for authentication, security, and core functionality. These cannot be switched off.
• Functional: Remember your preferences, such as language and display settings.
• Analytics: Help us understand how the Services are used so we can improve them.

You can control non-essential cookies through your browser settings. Disabling some cookies may affect how the Services function.

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process transactions and send related information
• Send technical notices, updates, and support messages
• Respond to your comments and questions
• Analyze usage patterns and optimize user experience
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations

Data Sharing and Disclosure

We may share your information in the following circumstances:

• With your consent: We may share your information when you give us permission
• Service providers: Third-party vendors who perform services on our behalf
• Legal requirements: When required by law or to protect our rights
• Business transfers: In connection with a merger, sale, or acquisition

We do not sell your personal information to third parties.

Service Providers and Sub-processors

We rely on a small number of trusted third-party providers to deliver the Services. These providers process data only as needed to perform their functions and are bound by confidentiality and data protection obligations. Our key providers include:

• Cloud hosting: Amazon Web Services (AWS) for application hosting and data storage.
• Frontend delivery: Vercel for hosting and delivering our web application.
• Payments: Stripe for processing subscription payments and billing.
• Email delivery: Resend for sending transactional and survey-related emails.
• Mobile money: Regional providers such as M-Pesa, MTN, and Airtel where customers choose those payment methods.

We review our sub-processors regularly and require each to maintain appropriate safeguards.

Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit and at rest (AES-256)
• Regular security assessments and penetration testing
• Access controls and authentication mechanisms
• Employee training on data protection
• Incident response and breach notification procedures

Your Rights and Choices

You have the following rights regarding your personal information:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your personal data ("right to be forgotten")
• Portability: Request a copy of your data in a portable format
• Objection: Object to certain processing of your data
• Opt-out: Unsubscribe from marketing communications

Complaints and Supervisory Authorities

If you believe we have not handled your personal information in accordance with applicable law, please contact us first so we can try to resolve your concern. You also have the right to lodge a complaint with a supervisory authority, in New Zealand, the Office of the Privacy Commissioner (privacy.org.nz); in the European Economic Area or the United Kingdom, your local data protection authority.

Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes described in this Privacy Policy. When you delete your account, we will delete or anonymize your personal information within 30 days, unless we are required by law to retain it longer.

Email delivery records

When you send invitations, survey campaigns, or other notifications through FlexiSurvey, we retain a record of each email delivery for 90 days from the date of sending. This record includes the recipient address, subject line, send timestamp, delivery status (sent / delivered / bounced / failed / opened / clicked), and the email body. After 90 days, these records are automatically and permanently deleted.

The email transport provider, Resend , also retains its own delivery records. Please see Resend's privacy policy for details on third-party retention.

International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure that such transfers comply with applicable data protection laws and implement appropriate safeguards, such as Standard Contractual Clauses.

GDPR Compliance

For users in the European Economic Area (EEA), we comply with the General Data Protection Regulation (GDPR). Our lawful bases for processing your data include:

• Performance of a contract with you
• Compliance with legal obligations
• Your consent (which you may withdraw at any time)
• Our legitimate business interests

New Zealand Privacy Act 2020

As a New Zealand company, we comply with the Privacy Act 2020 and its Information Privacy Principles. You may ask us to access or correct the personal information we hold about you, and you may raise concerns with the Office of the Privacy Commissioner.

California Privacy Rights

If you are a California resident, you have the right to know what personal information we collect, to request its deletion, and to opt out of any sale of personal information. We do not sell your personal information, and you will not be treated differently for exercising your rights.

Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal information, we will take steps to delete such information.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Your continued use of our services after such modifications constitutes your acknowledgment and acceptance of the updated policy.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: