Data Processing Addendum

This Addendum applies where Tickbox processes personal data on behalf of a business customer. It forms part of, and is governed by, our Terms of Service. Where you process personal data through Tickbox, you are the controller and Tickbox is the processor.

1. Subject matter and duration

We process personal data to provide Tickbox to you, for as long as your account is active and until deletion as described below.

2. Nature and purpose

Extracting questions from questionnaires you upload, drafting answers, storing your approved answers and uploaded policies, and operating and securing the service.

3. Types of data and data subjects

The personal data is whatever you choose to include in your uploads, answers, and policies, plus your account and billing details. Data subjects may include your staff and any individuals referenced in the content you upload. You are responsible for ensuring you are entitled to process that content.

4. Our obligations as processor

• Process personal data only on your documented instructions, including for transfers, unless required by law.
• Ensure people authorised to process the data are bound by confidentiality.
• Implement appropriate technical and organisational security measures (see our Security page).
• Assist you, taking into account the nature of processing, with data subject requests and with your security, breach, and impact-assessment obligations.
• Make available the information needed to demonstrate compliance and allow for reasonable audits.

5. Sub-processors

You give general authorisation for us to use the sub-processors listed on our Sub-processors page. We impose data protection terms on each of them, and remain responsible for their performance. We will give you a way to be informed of changes and a reasonable opportunity to object.

6. International transfers

Where personal data is transferred outside the UK, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or Standard Contractual Clauses with the UK Addendum.

7. Data subject requests and breaches

We will promptly notify you if we receive a request directly from one of your data subjects, and will assist you in responding. We will notify you without undue delay after becoming aware of a personal data breach affecting your data.

8. Return and deletion

On deletion of your account, or on request, we delete your personal data (including uploaded content, saved answers, and the search vectors built from your policies), except where retention is required by law.

9. Liability and precedence

This Addendum is subject to the liability provisions of the Terms of Service. If there is a conflict on data protection matters, this Addendum takes precedence over the Terms.

Requesting a signed copy

Business customers who need a countersigned Addendum can request one at hello@usetickbox.com.