GDPR & data processing
Who controls what, where data lives, and how to handle a data subject request.
Who is the controller
Two different relationships, and it matters which one you are in:
- Your account data: your email address, billing details, and usage. We are the controller. See our Privacy Policy.
- The responses your forms collect: you decide what is asked and why, so you are the controller and we act as your processor. We process those answers only to run the service for you.
That second one carries obligations you cannot delegate to us: having a lawful basis for what you ask, telling your respondents who you are and how their answers will be used, and answering their data subject requests.
Data processing agreement
A DPA is available on request at info@questionful.org.
Where data lives
The application and its database are hosted in the European Union. Some sub-processors may process data outside the EU; where they do, transfers are covered by Standard Contractual Clauses or an adequacy decision. The current list of sub-processors is in the Privacy Policy.
Handling a data subject request
If one of your respondents asks you to delete or produce their data:
- Find it: search the form’s responses list.
- Produce it: open the individual response, or export the form’s responses to CSV and extract the row.
- Delete it: delete the response. That removes its uploaded files too.
If the request concerns your account rather than a respondent, use the data deletion page.
Retention
- Forms, responses, and files stay for as long as your account holds them. Deleting a form deletes its responses and their files, rows and blobs alike.
- Deleted data is removed from live systems immediately and from encrypted backups within 30 days.
- The activity log is kept for a configurable retention period, 30 days by default.
- Invoices are kept for the period German tax law requires: up to 10 years.
Minimising what you collect
The cheapest compliance measure is not collecting the data in the first place:
- Ask only the questions you will act on.
- Leave a question optional unless the form genuinely cannot be processed without it.
- Public forms are answered anonymously unless you ask who someone is: do not add a name or email question to a survey you do not need to attribute.