Data Processing Agreement

1. Parties and Roles

This DPA is entered into between Tech Stack Simplified ("Processor", "we", "us"), which owns and operates Customer Feedback Simplified, and the registered business customer ("Customer", "Controller", "you").

• For feedback respondent data that you collect through questionnaires, you are the Data Controller / Data Fiduciary and we act as your Processor, processing that data only on your documented instructions.
• For your own account, billing, support, and usage data, Tech Stack Simplified is the Data Controller / Data Fiduciary, as described in our Privacy Policy.

2. Details of Processing

The subject matter, duration, nature, purpose, types of personal data, and categories of data subjects are set out below, as required by Article 28(3) GDPR.

3. Processor Obligations

• Process personal data only on your documented instructions, including with regard to international transfers, unless required otherwise by law (in which case we will inform you where legally permitted).
• Ensure that persons authorised to process the data are bound by confidentiality.
• Implement appropriate technical and organisational security measures (see Section 6).
• Respect the conditions for engaging sub-processors (see Section 4).
• Assist you, taking into account the nature of processing, in fulfilling your obligation to respond to data-subject requests (Section 5).
• Assist you in ensuring compliance with security, breach-notification, and data-protection-impact-assessment obligations (Articles 32–36 GDPR).
• At your choice, delete or return all personal data after the end of the provision of services, and delete existing copies unless retention is required by law (Section 8).
• Make available the information necessary to demonstrate compliance and allow for audits (Section 10).

4. Sub-processors

You provide general authorisation for us to engage the sub-processors listed below, each under a written contract imposing data-protection obligations no less protective than this DPA. We remain responsible for their performance.

We will give reasonable prior notice of any intended addition or replacement of a sub-processor, giving you the opportunity to object on reasonable data-protection grounds.

5. Assistance with Data-Subject Requests

We provide tools in the platform to help you respond to data-subject requests (access, rectification, erasure, restriction, portability, and objection). Where a request reaches us directly regarding respondent data, we will refer the individual to you as the responsible Controller and assist you as reasonably required.

6. Security Measures

• AES-256-GCM application-level encryption for sensitive tokens and identifiers
• HTTPS / TLS encryption for data in transit
• bcrypt password hashing
• Audit records for consent and legal acceptances
• Role-based access controls and periodic security reviews
• Backups with tested restoration procedures

7. Personal Data Breach Notification

We will notify you without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting your data, and provide the information reasonably needed for you to meet your own notification obligations.

8. Data Retention, Return and Deletion

Feedback responses are retained for as long as your account is active. You decide any shorter period: you may set a rolling anonymisation age, or anonymise everything submitted before a date of your choosing, each subject to a 12-month minimum, and you may instruct deletion or anonymisation of identified records at any time. Erasure requests from data subjects are actioned regardless of the age of the data. On termination we will delete or return personal data within 60 days, subject to any retention required by law. Full retention periods are set out in our Privacy Policy.

8a. Survey Invitations — Customer Obligations

Where you use the survey invitation feature, you supply the recipient email addresses and you remain the controller of them. You alone determine the lawful basis for contacting those people. We process them solely to deliver the invitations you instruct us to send.

You confirm and warrant, for every campaign, that:

• each recipient is an existing customer of your business, or has consented to receive email from you;
• the list was not purchased, rented, scraped, or otherwise obtained from a third party;
• you will honour unsubscribe requests, which we apply automatically and immediately on your behalf;
• the postal address you supply for the invitation footer is genuine and current.

We record your confirmation, the time it was given, and the account that gave it, as evidence of your instruction. We add an unsubscribe link and your postal address to every invitation; these cannot be removed.

We monitor bounce and spam-complaint rates for each Customer separately. Where those rates indicate that a list was not collected as warranted, we may pause invitation sending for your account without notice, in order to protect delivery for all customers. Pausing affects outbound invitations only: your feedback forms, links, QR codes and embeds continue to operate, and your data is unaffected.

Records of consent. You will retain, for as long as you send to a recipient and for two years afterwards, records evidencing the basis on which you contact each recipient — the form of consent or the transaction it arises from, the date, and how it was obtained. We do not hold those records and cannot produce them on your behalf. Where a regulator or a recipient challenges the basis for an invitation, you are responsible for responding.

Suppression is permanent. An unsubscribe applies permanently to that address within your account and cannot be reversed by re-uploading the address, by editing a list, or by a request to support. Re-adding a suppressed address through any route is a breach of the Terms and Conditions.

Sender of record. For every jurisdiction in which sender obligations attach to a person, you are the sender of record for invitations sent from your account and we act solely as your service provider in transmitting them. This includes the CAN-SPAM Act of 2003 in the United States and Canada's Anti-Spam Legislation, whose specific requirements are set out in §6.3 of the Terms and Conditions.

9. International Transfers

Personal data is stored on Hetzner servers within the European Union. Platform account emails and survey invitations are sent through Amazon Simple Email Service in the AWS Europe (Frankfurt) region, under the AWS GDPR Data Processing Addendum with Amazon Web Services EMEA SARL, so that processing also takes place within the European Union. Where limited technical data is processed by Cloudflare, Inc. or Amazon Web Services, Inc. in the United States for network security, bot prevention, or operational support, both are certified under the EU-U.S. Data Privacy Framework. Appropriate safeguards (such as Standard Contractual Clauses) are applied where required.

Personal data collected from individuals in the United States and Canada is stored on the same EU infrastructure. Neither US state privacy law nor Canada's PIPEDA requires storage within the country of collection; PIPEDA requires comparable protection by contract, which Sections 3, 4 and 6 of this DPA provide.

10. Audits and Inspections

We will make available information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by you or an auditor mandated by you, on reasonable prior notice and subject to confidentiality.

11. Order of Precedence and Term

This DPA forms part of and is subject to our Terms and Conditions. In the event of a conflict on data-protection matters, this DPA prevails. It remains in force for as long as we process personal data on your behalf.

12. How This DPA Is Accepted

For self-serve accounts, you accept this DPA electronically when you register and agree to our legal documents; your acceptance (document version, timestamp, IP, and user-agent) is recorded as evidence and viewable in Dashboard → Privacy. Enterprise customers may request a separately executed DPA via support@customerfeedbacksimplified.com.

13. Contact

Annex A — United States State Privacy Laws

This Annex applies only if it applies to you. It takes effect where, and to the extent that, you are a "business" under the California Consumer Privacy Act as amended ("CCPA"), or a "controller" under the comprehensive consumer privacy law of another US state, and you process personal information of residents of that state through the Service. Most customers are below the thresholds at which those laws apply and nothing in this Annex is engaged for them. Where it does apply, we act as your "service provider" under the CCPA and as your "processor" under the laws of other US states.

A.1 California

In respect of personal information you make available to us:

• we will not sell or share that personal information, as "sell" and "share" are defined in the CCPA;
• we will not retain, use or disclose that personal information for any purpose other than the business purposes specified in Section 2 of this DPA and in the Terms and Conditions, including any commercial purpose of our own;
• we will not retain, use or disclose that personal information outside the direct business relationship between you and us;
• we will not combine that personal information with personal information we receive from, or on behalf of, any other person, or collect from our own interactions with a consumer, except as permitted by the CCPA regulations;
• we certify that we understand the restrictions above and will comply with them;
• we will comply with the obligations applicable to a service provider under the CCPA, will provide the same level of privacy protection as the CCPA requires of you, and will implement reasonable security procedures and practices appropriate to the nature of the personal information;
• we will assist you in responding to verifiable consumer requests to know, delete, correct, opt out and limit, through the tools described in Section 5 of this DPA, or will notify you where such a request is directed to us;
• you may take reasonable and appropriate steps, including through the audit rights in Section 10 of this DPA, to confirm that we use the personal information consistently with your obligations under the CCPA, and — on notice — to stop and remediate any unauthorised use;
• we will notify you promptly, and in any event within five (5) business days, if we determine that we can no longer meet our obligations under the CCPA;
• we will impose these same obligations by written contract on any sub-processor engaged under Section 4 of this DPA.

A.2 Other states

Where you are a controller under the consumer privacy law of Virginia, Colorado, Connecticut, or another US state with a comprehensive consumer privacy law, we will: process personal data only on your documented instructions; ensure our personnel are bound by a duty of confidentiality; delete or return personal data at your direction at the end of the provision of services; make available to you the information reasonably necessary to demonstrate our compliance; allow and cooperate with reasonable assessments by you or your designated assessor, or arrange an independent assessment and provide a report on request; and engage sub-processors only under a written contract imposing obligations no less protective than those in this DPA.

A.3 Precedence

Where this Annex and the body of this DPA conflict in respect of personal information governed by a US state privacy law, this Annex prevails. In all other respects the body of this DPA applies.