1. Parties and scope
This agreement is between you - the workspace owner, referred to here as the customer - and A Plus Apps, registered with the Dutch Chamber of Commerce (KVK) under number 42096454 and established in the Netherlands, operating the PollsLive service. It governs our processing of personal data on your behalf and takes precedence over anything to the contrary in the Terms and Conditions on that subject. Nothing in it reduces a right you hold under the GDPR.
2. Who is controller, who is processor
For the content and responses inside your workspace - the questions you write, the votes and open-text answers your participants submit, the nicknames they choose, and any lead-capture fields you switch on - you are the controller and we are the processor. You decide what to ask, who to ask, and how long to keep it. This agreement covers that processing.
For your own account - your name, email, workspace, billing status and support history - we are the controller, and our Privacy Policy governs it rather than this agreement. The split is the same one set out in section 2 of that policy.
Where a school, employer or other institution runs sessions with PollsLive, that institution is the controller for the classroom or workplace activity and this agreement runs to it.
3. Subject matter, duration, nature and purpose
Subject matter and purpose. Providing the PollsLive service: hosting polls, surveys and live sessions, collecting and counting responses in real time, presenting results, and producing exports and summaries at your request.
Nature of processing. Collection, recording, storage, structuring, retrieval, display, export, and erasure, by automated means. Where you use our AI features, this also includes transmission to the AI processor named on our Sub-processors page - note that running an AI response digest sends your participants' open-text answers for that poll.
Duration. For as long as your workspace exists, and thereafter only for the period described in section 10.
Categories of data subject. Your participants and respondents, the members you invite to your workspace, and any people identified in the content you upload.
Types of personal data. Responses to your questions, including free-text answers; nicknames or display names participants enter; any contact or lead-capture fields you choose to collect; workspace member names and email addresses; and technical data used to prevent duplicate voting, which is a salted one-way hash and not a stored address. We do not ask you for special-category data under Article 9, and the service is not designed to hold it - if your questions elicit it, you remain the controller for that decision.
4. Processing on documented instructions
We process personal data only on your documented instructions, including as to international transfers. Your use of the service - the polls you create, the settings you choose, the exports you run - constitutes those instructions, together with this agreement and the Terms. If EU or member-state law requires us to process on some other basis, we will tell you before doing so unless that law forbids the notification. If we believe an instruction infringes data protection law, we will tell you.
5. Confidentiality
Access to production systems is limited to the people who need it to operate and support the service, and they are bound by confidentiality obligations that survive the end of their engagement. We do not read workspace content except where it is necessary to provide support you have asked for, to investigate an abuse report, or where the law requires it.
6. Security measures (Article 32)
The technical and organisational measures in place today. They are described in more depth on our Security page; this list is what we are contractually committing to, and we may change a specific measure provided the overall level of protection is not reduced.
- Encryption in transit. All traffic is served over TLS, terminated at our CDN, with HTTP Strict Transport Security enforced.
- Credential storage. Passwords are stored only as salted Argon2id hashes. We never hold a recoverable copy.
- Data minimisation for anti-abuse. Where an IP address is kept only to correlate activity, it is stored as a salted one-way hash, scoped per feature so the same visitor cannot be matched across them. The two places that keep a raw address, and why, are disclosed on our Security page.
- Network isolation. The application, database and cache run on infrastructure in the European Union. The primary database and cache accept no connections from the public internet.
- Access control. Role-based access within each workspace, so a member sees only what their role permits, with an audit log of administrative actions. Production access is restricted and key-based.
- Application hardening. A Content Security Policy, clickjacking and MIME-sniffing protections, per-address and per-fingerprint rate limits, bot challenges on sensitive submissions, and an edge ban list for abusive traffic.
- Upload safety. Images are re-encoded on ingest, which strips embedded metadata and any non-image payload; script-carrying vector files are refused; and outbound fetches are guarded against server-side request forgery.
- Resilience. Backups run on a schedule, are copied off the primary host, and are restore-tested rather than assumed. Retention limits are enforced by a scheduled job rather than left aspirational.
- Availability of your data to you. Workspace owners can export their data and erase their account without asking us, so neither depends on our response time.
7. Sub-processors
You give general authorisation for us to engage sub-processors. The current list, with each one's purpose, the data it handles and where it is located, is published and kept current at Sub-processors - that page is the schedule to this agreement rather than a copy of it, so the two cannot drift apart.
Each sub-processor is bound by a written agreement imposing data protection obligations no less protective than those in this agreement, and we remain fully liable to you for their performance. When we add or replace one, the page is updated with a new date; customers with a countersigned copy of this agreement can ask to be notified in advance and to object on reasonable data protection grounds.
8. Assisting with data subject rights
Taking account of the nature of the processing, we assist you by appropriate technical and organisational measures in meeting requests from your participants to access, correct, erase, restrict, port or object to processing of their data. In practice most of this is self-serve: workspace owners can view, export and delete responses directly. If a participant contacts us about a poll you ran, we will refer them to you as the controller and help you action the request. Where a request reaches us and the law requires us to act ourselves, we will.
9. Breach notification and assessments
We maintain procedures to detect, investigate and record personal data breaches. Where a breach affects personal data we process for you, we will notify you without undue delay after becoming aware of it, with the information you need to meet your own Article 33 obligation - what happened, the categories and approximate number of records concerned, the likely consequences, and the measures taken. Notifying your supervisory authority remains your decision as controller.
We assist you, taking account of the nature of processing and the information available to us, with data protection impact assessments and prior consultation under Articles 35 and 36.
10. Return and deletion
At any time during the service you can export your workspace data in a machine-readable form, so return does not depend on termination.
When you delete your account or close your workspace, we delete the personal data we process for you, except where EU or member-state law requires us to keep it - notably billing records, which are subject to a Dutch retention obligation and are disclosed in our Privacy Policy rather than deleted. Deletion propagates to backups as those backups age out of their own retention window.
11. Information and audit
We make available to you the information necessary to demonstrate compliance with Article 28, and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate.
In the first instance we will answer a written security questionnaire and provide a written overview of our controls, data residency and review practices - which for most customers settles the question without an on-site visit. Where that is genuinely not sufficient, an audit may be carried out on reasonable notice, no more than once a year unless a breach or a supervisory authority requires otherwise, during business hours, subject to confidentiality, and in a way that does not disrupt the service for other customers. We are a small company: we do not publish detailed audit reports on the public internet, and we say so rather than implying a certification we do not hold.
12. International transfers
Our core application and database are hosted in the European Union. Where a sub-processor may process personal data outside the EEA, that transfer is made under an appropriate Article 46 safeguard - in practice the European Commission's Standard Contractual Clauses, and where relevant the EU-US Data Privacy Framework. The Module Two (controller-to-processor) clauses are incorporated into this agreement by reference for any such transfer, with this agreement's Annexes supplied by sections 3, 6 and 7 above.
13. Getting a signed copy
This agreement is already in force for your workspace; no signature is needed for it to apply. If your procurement or legal team needs a countersigned PDF, or needs it executed on your own paper, email [email protected] or use our contact form and choose "Privacy / GDPR". Questions about anything above go to the same place.