Privacy Policy
Last updated: April 18, 2026
1. Introduction
This privacy policy describes how SurveyGauge ApS ("SurveyGauge", "we", "us") collects, processes, stores, and protects personal data when you visit our websites (surveygauge.com and surveygauge.dk), use our platform (app.surveygauge.com), or participate in surveys distributed through our services.
Data controller:
SurveyGauge ApS
CVR: DK42540641
Birkemose Allé 39
6000 Kolding, Denmark
Phone: +45 32 35 11 01
Email: hello@surveygauge.com
Data Protection Officer (DPO):
Daniel Lapp, CEO
Email: hello@surveygauge.com
Phone: +45 32 35 11 01
2. Roles and responsibilities - data controller vs. data processor
SurveyGauge acts in two distinct roles depending on the context:
2.1 SurveyGauge as data controller
SurveyGauge is the data controller for personal data where we determine the purpose and means of processing. This includes:
- Account information for users of the SurveyGauge platform (name, email, password, job title, IP address upon login).
- Company information about our customers (company name, industry, revenue, number of employees, country).
- Visitor data from our websites (page views, cookies, analytics data).
- Communication with us via email, phone, or contact forms.
- Error reporting and technical logs from the platform.
2.2 SurveyGauge as data processor
SurveyGauge is a data processor when we process personal data on behalf of our customers. This includes:
- Contact lists and respondent data uploaded or imported by the customer (names, email addresses, job titles, country, CRM IDs).
- Survey responses, including scores, comments, and free-text answers collected from respondents.
- Email distribution of survey invitations and reminders on the customer's behalf.
- CRM data synchronised from the customer's own systems via API integrations.
- Aggregated analyses and reports generated from the customer's survey data.
When SurveyGauge acts as a data processor, the processing is governed by the data processing agreement (DPA) entered into between SurveyGauge and the customer. The customer, as data controller, is responsible for ensuring a valid legal basis for the collection of respondents' personal data.
3. What personal data we collect
3.1 Platform users (our customers' employees)
When you create an account on the SurveyGauge platform, we collect:
- First name and last name (required)
- Email address (required)
- Password (required, stored as a bcrypt hash - never in plain text)
- Job title (optional)
- Country (optional)
- Language preference (default: en_GB)
- IP address (recorded automatically upon login)
- Time zone (recorded automatically upon login)
- Last login timestamp
- Profile picture (optional)
3.2 Survey respondents
When you participate in a survey distributed through SurveyGauge, the following data may be collected:
- Email address
- First name and last name
- Company name
- Country and language preference
- IP address (recorded upon responding)
- Survey responses: scores, weightings, selections, and free-text comments
- Timestamps for starting and completing the survey
- Email delivery status (sent, opened, bounced)
Note: Free-text comments may potentially contain additional personal data that the respondent chooses to share.
3.3 Website visitors
When you visit surveygauge.com or surveygauge.dk, we collect:
- Page views and navigation (via Google Analytics)
- IP address (transmitted to Google Analytics and Google Fonts)
- Browser and device information (User-Agent)
- Cookie consent choices (via CookieYes)
3.4 Data we do NOT collect
We do not collect national identification numbers, health information, payment card details, or other sensitive personal data as defined in GDPR Article 9. Payment is made exclusively by invoice and bank transfer.
4. Legal basis for processing
We process personal data based on the following legal grounds (GDPR Article 6):
| Processing activity | Legal basis | GDPR article |
|---|---|---|
| Creation and administration of user accounts | Performance of contract | Art. 6(1)(b) |
| Distribution of surveys on the customer's behalf | Legitimate interest / contract | Art. 6(1)(b) and (f) |
| Transactional emails (invitations, reminders, verification) | Performance of contract | Art. 6(1)(b) |
| Web analytics via Google Analytics | Consent (via CookieYes) | Art. 6(1)(a) |
| Error reporting via Sentry | Legitimate interest | Art. 6(1)(f) |
| Security logging (IP address upon login) | Legitimate interest | Art. 6(1)(f) |
| Invoicing and bookkeeping | Legal obligation | Art. 6(1)(c) |
| Translations via AI services | Performance of contract | Art. 6(1)(b) |
5. Cookies and tracking technologies
5.1 Cookie consent
We use CookieYes to manage cookie consent. Upon your first visit, a cookie banner is displayed where you can choose which categories of cookies to accept. You can change your preferences at any time via the consent settings. For full details, see our Cookie Policy.
5.2 Necessary cookies (first-party)
| Cookie | Purpose | Expiry |
|---|---|---|
| survey_participant_keys | Maps survey hash to participant ID so a started response can be resumed | Session |
| CookieYes consent | Stores your cookie preferences | 1 year |
5.3 Functional cookies (first-party)
The platform (app.surveygauge.com) uses encrypted localStorage to store session data:
- User and company data (AES-encrypted)
- Authentication tokens (JWT)
- Language preferences
This data is cleared upon logout.
5.4 Analytics cookies (consent required)
| Service | Purpose | Data collected | Provider |
|---|---|---|---|
| Google Analytics (G-Y2R2RL46WD) | Web analytics of website visits | Page views, page navigation, IP address, browser data | Google LLC, USA |
Google Analytics is only active in the production environment and requires consent via CookieYes.
5.5 Third-party requests
| Service | Purpose | Data shared |
|---|---|---|
| Google Fonts | Loading of typefaces (Poppins, Roboto, Inter) | IP address, User-Agent |
6. Third-party services and sub-processors
We share personal data with the following third parties that process data on our behalf:
6.1 Infrastructure and hosting
| Service | Purpose | Data location | Data processed |
|---|---|---|---|
| Amazon Web Services (AWS) - Lambda, RDS, S3, CloudFront, SNS, SQS | Serverless compute, database, file storage, CDN, message queues | eu-west-1 (Ireland), EU/EEA | All platform data |
| Vercel | Hosting of websites (surveygauge.com, surveygauge.dk) | EU/Global CDN | Website traffic |
6.2 Communication
| Service | Purpose | Data location | Data processed |
|---|---|---|---|
| Postmark (ActiveCampaign Inc.) | Distribution of transactional emails (survey invitations, reminders, verification, password reset) | USA | Recipient email, sender email, names, survey links, bounce data |
Transfer to the USA is carried out pursuant to EU Standard Contractual Clauses (SCCs).
6.3 Integrations
| Service | Purpose | Data location | Data processed |
|---|---|---|---|
| APIDecK (Apideck BV) | CRM integration - synchronisation of contact data from the customer's CRM | EU / depends on the customer's CRM | Names, emails, phone numbers, addresses, job titles, company data |
6.4 Analytics and error handling
| Service | Purpose | Data location | Data processed |
|---|---|---|---|
| Google Analytics (Google LLC) | Web analytics | USA | Page views, IP address, browser data |
| Sentry (Functional Software Inc.) | Error reporting and performance monitoring | USA | Exceptions, browser traces, request payloads (may contain personal data) |
| Google Fonts (Google LLC) | Typeface loading | USA | IP address, User-Agent |
6.5 AI services
| Service | Purpose | Data location | Data processed |
|---|---|---|---|
| OpenAI (OpenAI Inc.) | Translation of content within the platform | USA | Text content being translated (may include names and context from surveys) |
| Google Cloud APIs (Google LLC) | Translation and activity tracking | USA | Text content and analytics data |
For all services located in the USA, transfers are carried out pursuant to EU Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework where applicable.
6.6 Cookie consent
| Service | Purpose | Data location | Data processed |
|---|---|---|---|
| CookieYes | Cookie consent management | EU/USA | Consent choices, cookie preferences |
7. Data security
We have implemented the following technical and organisational measures:
7.1 Encryption
- All data transmission occurs via HTTPS/TLS.
- Database connections are SSL-encrypted.
- Passwords are hashed with bcrypt (salt rounds: 10) and are never stored in plain text.
- API keys are hashed with SHA-256 before storage.
- Client-side data in the browser is encrypted with AES.
- Database at-rest encryption via AWS RDS (AES-256).
7.2 Access control
- Role-based access control with four levels: Super Admin, Owner, Administrator, and Standard.
- Individual permissions can be assigned per user.
- JWT-based authentication with token expiry of 24 hours (90 days with "remember me").
- API keys are scoped to the individual company account with configurable expiry dates.
7.3 Database protection
- Parameterised database queries via Knex.js (protection against SQL injection).
- Input validation via the Joi library on all API endpoints.
- Database hosted in AWS eu-west-1 (Ireland) with automatic backups via AWS RDS.
7.4 Breach notification
In the event of a personal data breach, SurveyGauge will:
- Notify the relevant supervisory authority (Datatilsynet) within 72 hours.
- Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
- Notify affected customers (in the data processor role) as soon as possible so they can fulfil their own notification obligations.
8. Email communication
8.1 Email types
SurveyGauge sends transactional emails only. We do not send marketing emails. The email types we send:
| Type | Purpose | Recipient |
|---|---|---|
| Survey invitation | Invitation to participate in a customer satisfaction survey | Respondents (on the customer's behalf) |
| Reminders (1st and 2nd) | Follow-up on unanswered survey invitations | Respondents (on the customer's behalf) |
| Thank you email | Confirmation after completing a response | Respondents (on the customer's behalf) |
| Verification code | Email verification upon account creation | Platform users |
| Password reset | Password reset | Platform users |
| User invitation | Invitation to the SurveyGauge platform | New platform users |
8.2 Email tracking
Survey emails may include open tracking via Postmark. This tracking records whether an email has been opened and helps the customer assess response rates. Survey links contain unique participant IDs that enable traceable linking between invitation and response.
8.3 Sender configuration
Customers can configure their own sender domains and email addresses with DKIM verification, so survey emails are sent from the customer's own domain.
8.4 Bounce handling
Emails that cannot be delivered (hard bounces) are recorded and synchronised daily from Postmark. Hard-bounced email addresses are flagged to avoid repeated failed delivery attempts.
9. Data retention and deletion
9.1 Retention periods
| Data category | Retention period | Justification |
|---|---|---|
| User accounts (platform users) | Until the account is deleted or the company agreement terminates | Performance of contract |
| Survey responses | During the subscription period + 30 days after termination | Performance of contract |
| Respondent contact data | During the subscription period + 30 days after termination | Performance of contract |
| Website analytics data | Per Google Analytics default settings | Consent |
| Error reports (Sentry) | Up to 90 days | Legitimate interest |
| Invoices and bookkeeping | 5 years (Danish Bookkeeping Act) | Legal obligation |
| Bounce data | During the subscription period | Performance of contract |
9.2 Deletion
User accounts are deleted via soft delete, where the account is deactivated and personal data is removed from active systems. Upon termination of the customer relationship, data is made available for export for 30 days, after which data is deleted.
10. Your rights
Under the GDPR, you have the following rights:
Right of access (Art. 15): You may request confirmation of whether we process your personal data, and if so, access to the data as well as information about the processing.
Right to rectification (Art. 16): You may request correction of inaccurate personal data or supplementation of incomplete data.
Right to erasure (Art. 17): You may request deletion of your personal data when the data is no longer necessary for the purpose for which it was collected, or when you withdraw your consent.
Right to restriction (Art. 18): You may request restriction of processing under certain circumstances, for example if you contest the accuracy of the data.
Right to data portability (Art. 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
Right to object (Art. 21): You may object to processing based on legitimate interests.
Right to withdraw consent: Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.
10.1 For survey respondents
If you have responded to a survey distributed through SurveyGauge, it is the company that distributed the survey that is the data controller for your responses. Please contact that company directly to exercise your rights. SurveyGauge will assist the company in fulfilling requests in accordance with the data processing agreement.
10.2 How to exercise your rights
Enquiries can be directed to:
Email: hello@surveygauge.com
Phone: +45 32 35 11 01
We respond to requests within 30 days. In complex cases, the deadline may be extended by an additional 60 days with notice.
11. Right to lodge a complaint
You have the right to lodge a complaint with the relevant supervisory authority if you believe that our processing of your personal data violates the GDPR. In Denmark, the supervisory authority is:
Datatilsynet (Danish Data Protection Agency)
Carl Jacobsens Vej 35
2500 Valby, Denmark
Phone: +45 33 19 32 00
Email: dt@datatilsynet.dk
Website: www.datatilsynet.dk
12. Transfer of data to third countries
Certain of our sub-processors are located in the USA (see Section 6). Transfer of personal data to the USA is carried out on the basis of:
- EU Standard Contractual Clauses (SCCs) pursuant to GDPR Article 46(2)(c).
- EU-US Data Privacy Framework, where the relevant recipient is certified.
We continuously assess whether the chosen transfer mechanism provides adequate protection and implement supplementary measures where required.
13. Data Processing Agreement (DPA)
SurveyGauge offers a data processing agreement to all customers using the platform. The agreement covers:
- The purpose and means of the data processing.
- Categories of personal data and data subjects.
- Security measures and technical requirements.
- Use of sub-processors (with prior written approval).
- Allocation of responsibility in the event of a data breach.
- Deletion and return of data upon termination of the agreement.
Contact hello@surveygauge.com to request a copy of our data processing agreement.
14. Changes to this policy
We may update this privacy policy from time to time to reflect changes to our services or applicable legislation. In the event of material changes, we will notify registered users via email. The latest version is always available on our website.
15. Contact information
SurveyGauge ApS
Birkemose Allé 39
6000 Kolding, Denmark
CVR: DK42540641
Phone: +45 32 35 11 01
Email: hello@surveygauge.com
Data Protection Officer: Daniel Lapp, CEO
Email: hello@surveygauge.com