English
NorskDanskSvenskaEnglish

← SRVY

Privacy Policy

Last updated July 2026

1. Introduction

This Privacy Policy describes how HR Cluster AS, the operator of the SRVY platform, handles personal data. We are committed to protecting the privacy of the people whose data is processed through SRVY, and to operating in line with the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act.

SRVY serves two groups of people: workspace users, who sign in to build surveys and read analytics, and respondents, who receive invitations and answer surveys. This policy covers both, and notes respondent-specific considerations where they differ.

2. Roles and responsibilities

SRVY is used by customer workspaces to run their own surveys. In most cases:

  • The customer workspace is the data controller. It decides which surveys to run, who to invite, and why, and so determines the purposes and means of processing respondent data.
  • HR Cluster AS is the data processor. It processes that data on the customer's behalf to provide the platform.

The terms of that processing are set out in our Data Processing Agreement. Where HR Cluster AS decides the purposes and means itself (including account administration, billing, platform security, and access logging for workspace users), it acts as a controller, and this Privacy Policy applies directly.

3. Data we process about workspace users

For the people who sign in to administer a customer workspace, we process:

  • Identity and contact data: name, work email, and the workspace they belong to.
  • Account and access data: password hashes, role, permissions, and preferred language.
  • Usage and technical data: sign-in events, IP address, browser and device type, and audit timestamps of administrative actions.

4. Data we process about respondents

What we process about a respondent depends on how the customer workspace configures its survey:

  • Contact data. Where a survey is distributed by managed email, we process the respondent's email address, and any name or attributes the workspace has added, to send the invitation and any reminders.
  • Response data. The answers a respondent gives, together with the survey and page structure needed to interpret them.
  • Subscription and consent data. Subscription status for a pool or list, and a record of opt-in or unsubscribe actions, including a timestamp and IP address kept as proof of consent.
  • Technical data. Our servers process standard request metadata, including an IP address, transiently for security and abuse prevention. This is not stored against a survey response.

Email addresses used for invitations, tokenised links, and suppression are also stored as a keyed hash (HMAC-SHA256), so that unsubscribe and bounce suppression can be enforced without keeping the plain address where it is not needed.

5. Anonymous responses

SRVY is built so that survey responses are unlinkable to the people who give them. We do not store names, email addresses, or invitation identifiers against a survey response, and there is no stored link from a response to an invitation, a recipient, or an email subscriber. When an invited recipient completes a survey, we record that only on the invitation side, at day-level granularity, with no reference back to their response. The platform provides no way to determine which response belongs to which person. Answering a survey is also session-free, and no identifying login cookie is set on respondents.

This is unlinkability by design, not a promise of absolute anonymity. It has limits:

  • A survey question written by the customer workspace can ask for identifying information, and free-text answers may contain personal data a respondent chooses to share.
  • For a small invited group, the set of possible authors is correspondingly small. SRVY does not enforce a minimum group size.
  • A response collected through a company-specific link, used when a survey is distributed per participating company, is attributed to that company rather than to a named individual. A response from an external panel may carry an opaque provider reference that SRVY itself cannot resolve to a person.
  • If a respondent subscribes to email after a survey, we store that subscription separately, keyed to their email address and with the survey only as provenance. It records the subscriber's own IP address and the date as proof of consent, and is not linked to their response.

6. How data is used

Personal data processed through SRVY is used to:

  • Provide and operate the platform
  • Manage workspaces, workspace users, roles, and permissions
  • Distribute survey invitations and reminders, and manage subscriptions
  • Collect and store responses and produce analytics for the customer workspace
  • Maintain security, prevent abuse, and keep audit and delivery logs
  • Provide support and improve the reliability of the platform

We do not sell personal data, and we do not use respondent data or survey responses for advertising or profiling.

7. Legal basis for processing

Where HR Cluster AS processes personal data as a controller, we rely on the following bases under GDPR Article 6:

  • Contract (Art. 6(1)(b)), to provide the platform to the customer and its workspace users.
  • Legitimate interests (Art. 6(1)(f)), to keep the platform secure, prevent abuse, maintain audit logs, and improve the service, balanced against the rights of the individuals concerned.
  • Legal obligation (Art. 6(1)(c)), to comply with applicable accounting, tax, and information-security law.
  • Consent (Art. 6(1)(a)), for optional analytics cookies, and for email subscriptions where consent is the chosen basis.

Where HR Cluster AS acts as a processor, the customer is responsible for identifying the legal basis for the underlying processing of respondent data.

8. Subprocessors

To operate SRVY, we use a small number of subprocessors, each bound by a written data-processing agreement. The current list, with the data categories, locations, and safeguards for each, is published in the annex to our Data Processing Agreement. In summary:

  • Hetzner Online GmbH, for hosting, compute, storage, and backups.
  • Postmark (ActiveCampaign, LLC), in the United States, for delivery of transactional and survey email, including invitations, reminders, and subscription messages.
  • Google Analytics (Google Ireland Ltd.), for privacy-friendly, consent-gated usage analytics on our public pages.

Within the customer workspace, respondent data may also be visible to the workspace users the workspace has authorised, according to the roles it has configured.

9. Hosting

SRVY runs on dedicated infrastructure provided by Hetzner Online GmbH. Our current hosting location is documented operationally. Application servers, the database, uploaded files, and backups run in this environment. Some ancillary services, in particular transactional email delivery and analytics, are provided by subprocessors that process personal data in the United States, under the safeguards described below.

10. International transfers

Some subprocessors process personal data outside the EEA, including our email and analytics providers in the United States. Those transfers are made under the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. We transfer only the data necessary for the specific service, for example a recipient's email address to deliver a survey invitation.

11. Data retention

We retain personal data for as long as needed to provide the platform, comply with legal obligations, resolve disputes, and enforce agreements, or as instructed by the customer workspace. As a general guide:

  • Workspace account data is retained for the duration of the service agreement.
  • Responses and survey data are retained for the customer workspace, and deleted or returned at the end of the agreement or earlier on the workspace's instruction.
  • Subscription and suppression records are retained while needed to honour a respondent's choice. A suppression record is kept so that an unsubscribe stays effective.
  • Security, audit, and delivery logs are retained for a limited period for accountability.
  • Backups are retained on a rolling schedule before being overwritten.

12. Your rights

Under the GDPR, you have the right to request access to your data, rectification of inaccurate data, erasure, restriction of processing, to object to processing based on legitimate interests, and portability of data you have provided. Where processing is based on consent, you can withdraw it at any time. These rights are subject to the conditions and exemptions in the law.

Because the customer workspace is usually the controller for respondent data, requests about survey responses or subscriptions should in most cases go to the workspace that ran the survey. HR Cluster AS will support the workspace in responding. Every survey email also carries an unsubscribe link that a respondent can use directly.

13. Security

HR Cluster AS applies technical and organisational measures appropriate to the risk. These include encryption in transit, hashed credentials, per-workspace data isolation, and daily off-site backups, and are described in full on our Security page. We will notify affected customers without undue delay of any personal data breach likely to result in a risk to individuals, in line with GDPR Articles 33 and 34.

14. Cookies

SRVY uses cookies and similar technologies as described in our Cookie Policy.

15. Contact and supervisory authority

For questions about this Privacy Policy or our data practices, contact:

HR Cluster AS
Email: privacy@srvy.app

If you are in Norway or the EEA and believe your data protection rights have been infringed, you may lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no, or with the supervisory authority in your country of residence.