Handling of respondents' personal data

Personal data provided by respondents

Normally, website visitors tracked by Extellio and respondents to Extellio surveys are completely anonymous. However, they can choose to waive their anonymity in the following ways.

In survey free-text responses

Despite being explicitly asked not to, some users provide personal data in a free text answer in a survey.

In survey contact requests

In a specific contact request question, users can provide their contact information with their own consent, because they want to be contacted by an Extellio customer.

In the registration for a client panel

Users are sometimes asked if they’d like to register for a client panel. If they do, their contact details are stored.

Responsibility for personal data

Depending on the agreement, either the customer or Extellio acts as the personal data controller for personal data.

When Extellio is the personal data controller

If there is no written personal data processor agreement between Extellio and the customer, Extellio is the personal data controller. This means that the Extellio privacy policy applies and is shown in the survey for the respondent. Extellio will not share any respondent’s personal data with the customer unless the respondent explicitly requests it. Any personal data will be deleted in accordance with the Extellio archiving policy. In short:

Personal data	Deletion
Submitted in free text answers	The personal data is automatically and immediately removed from the customer's account and is normally deleted within 7 days
Sign-up for Client panel	The respondent remains in the Client panel for 24 months, after which the personal data is deleted
Contact request	The respondent's personal data is automatically sent to the customer, where it is handled according to the customer's privacy policy. Extellio retains a backup for 60 days, after which the personal data is deleted from Extellio records.

When the customer is the personal data controller

If there is a written personal data processor agreement with the customer, the customer is the personal data controller and Extellio is the personal data processor. This means that the customer's privacy policy applies and is shown in the survey for the respondent. The customer has the right to see the respondents' personal data. The personal data processor agreement governs how the personal data is handled by Extellio. Unless otherwise stated, sign-up to the Client panel and contact requests are handled according to the same routines as if Extellio were responsible for personal data. However, personal data provided in free text responses will not be deleted on a regular basis unless the customer instructs Extellio to do so.