Data Processing Agreement

1. About this page

This page contains the standard Data Processing Agreement (DPA) between HR Cluster AS, as processor, and each customer workspace, as controller, that uses SRVY. It forms part of the contract between us and supplements our Terms of Service and Privacy Policy.

This version is our pre-approved template. If you need a countersigned copy for your records, email legal@srvy.app, and we will return a signed PDF, typically within two business days.

2. Parties

Processor: HR Cluster AS, operator of SRVY.

Controller: the legal entity whose customer workspace uses SRVY under an agreement with HR Cluster AS.

3. Subject matter and duration

This DPA governs the processing of personal data that takes place when the controller uses SRVY. It takes effect at the start of the service and continues for as long as HR Cluster AS processes personal data on the controller's behalf, even if the service agreement is amended or renewed.

4. Nature and purpose of processing

HR Cluster AS processes personal data solely to provide the SRVY survey and feedback platform. This includes survey design, distribution of invitations and reminders, response collection (including anonymous responses), subscription and audience management, analytics, and related services. HR Cluster AS acts strictly on the controller's documented instructions, including the configuration of its surveys and audiences.

5. Categories of data subjects

• Respondents invited to or answering the controller's surveys
• Subscribers to the controller's pools and lists
• Workspace users and administrators of the controller
• Other individuals whose personal data the controller enters or uploads into the platform

6. Categories of personal data

• Contact data (respondent and subscriber name, email address, and attributes added by the controller)
• Response data (survey answers, not linked to respondent identities; see our Privacy Policy for scope and limits)
• Subscription and consent data (subscription status, opt-in and unsubscribe records with timestamp and IP)
• Workspace-user data (name, work email, role, permissions, hashed credentials)
• Technical data (IP address, browser and device metadata, audit and delivery timestamps)

The controller must not use the platform to process special categories of personal data unless it has ensured an appropriate legal basis and additional safeguards for doing so.

7. Obligations of the processor

HR Cluster AS undertakes to:

1. Process only on instruction. Process personal data only on the controller's documented instructions, as set out in the service agreement, this DPA, and the controller's configuration of the platform. If required by law to process without instruction, HR Cluster AS will inform the controller first, unless the law forbids such notice.
2. Confidentiality. Ensure that persons authorised to process personal data are bound by confidentiality.
3. Security. Implement appropriate technical and organisational measures, as described on our Security page, reflecting Article 32 of the GDPR.
4. Sub-processing. Engage subprocessors only under a written agreement imposing data-protection obligations equivalent to those in this DPA. The current subprocessors are listed in the annex below. HR Cluster AS will notify the controller of any intended material change and give a reasonable opportunity to object.
5. Respondent and data-subject rights. Assist the controller, by appropriate technical and organisational measures, in responding to requests from data subjects exercising their rights under GDPR Chapter III, including honouring unsubscribe requests through the platform.
6. Assistance with compliance. Assist the controller in meeting its obligations under GDPR Articles 32 to 36 (security, breach notification, impact assessments, and prior consultation), taking into account the nature of processing and the information available.
7. Breach notification. Notify the controller without undue delay after becoming aware of a personal data breach affecting the controller's data, and provide the information reasonably needed for the controller to meet its own obligations.
8. Audit. Make available the information necessary to demonstrate compliance with this DPA, and allow for reasonable audits at the controller's cost, on reasonable notice and under agreed confidentiality terms.
9. Return or deletion. At the controller's choice, delete or return all personal data at the end of the service, and delete existing copies unless retention is required by law.

8. International transfers

Where a subprocessor processes personal data outside the EEA, the transfer is made under the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework, together with any supplementary measures indicated by the subprocessor.

9. Return or deletion of data

On termination of the service, or on the controller's earlier instruction, HR Cluster AS will delete or return the controller's personal data within a reasonable period, and delete remaining copies except where retention is required by applicable law. Suppression records needed to keep an unsubscribe effective may be retained in hashed form for that purpose.

10. Governing law

This DPA is governed by the laws of Norway, and disputes are subject to the Norwegian courts, consistent with our Terms of Service.

11. Annex: subprocessors

The following subprocessors process personal data on behalf of HR Cluster AS as of the date below. Each is bound by a written data-processing agreement.

Provider	Purpose	Data categories	Location	Safeguards
Hetzner Online GmbH	Hosting, compute, storage, backups	All workspace data in the application database, uploaded files, and backups	Documented operationally	ISO 27001-certified data centres
Postmark(ActiveCampaign, LLC)	Transactional and survey email delivery	Recipient name and email address, and message content for invitations, reminders, and subscription and account email	United States	Standard Contractual Clauses; EU–US Data Privacy Framework where applicable
Google Ireland Ltd.(Google Analytics)	Privacy-friendly usage analytics on public pages	IP address (anonymised where supported), device and browser metadata, page interaction events	United States / global Google infrastructure	Loaded only after consent; Standard Contractual Clauses; IP anonymisation

We notify customers in advance of any material change to this list, typically by email to the workspace administrator. A customer with a signed DPA may object to a new subprocessor in line with that agreement.

12. Requesting a signed copy

Email legal@srvy.app with your organisation name and registered address. We will return a countersigned PDF for your records, typically within two business days. No changes to the text are required. The version on this page is the same as the signed copy.

13. Contact

HR Cluster AS
Email: legal@srvy.app