Legal

Data processing addendum

The UK GDPR Article 28 terms under which Usertick processes personal data on behalf of its customers. They apply automatically as part of the Terms of Service.

Last updated: November 1, 2026

This Data Processing Addendum (the “DPA”) forms part of the Terms of Service (the “Terms”) between Usertick Ltd (“Usertick”), a company registered in England and Wales under company number 17517933, and the Customer. It sets out the terms that Article 28 of the UK GDPR requires for the personal data Usertick processes on the Customer’s behalf. The DPA applies automatically when the Customer accepts the Terms, and it does not need a signature. A Customer that needs a signed copy for its records can request one.

Request a signed copy

1. Definitions

Terms defined in the Terms have the same meaning in this DPA. In addition:

“Data Protection Law” means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, each as amended, including by the Data (Use and Access) Act 2025, and, where they apply to the processing, the EU GDPR and other data protection laws, including US state privacy laws. Where the EU GDPR applies to the processing, references in this DPA to an article of the UK GDPR include the corresponding article of the EU GDPR, and references to the Information Commission include the competent supervisory authority.
“Controller”, “processor”, “data subject”, “personal data”, “personal data breach”, “processing” and “special category data” have the meanings given in Data Protection Law.
“Customer Personal Data” means the personal data within Customer Data that Usertick processes on the Customer’s behalf.
“Sub-processor” means a third party that Usertick engages to process Customer Personal Data.

2. Roles of the parties

For Customer Personal Data, the Customer is the controller and Usertick is the processor. Where the Customer is itself a processor for another controller, Usertick is the Customer’s sub-processor. In that case the Customer confirms that the controller has authorized the Customer’s instructions and the authorizations in this DPA, including the use of Sub-processors, and the Customer remains Usertick’s only point of contact.

Usertick is a controller, not a processor, only for: the personal data of its own account holders, billing contacts, support contacts and website visitors; the security and access records of the Service; Customer Data that it reviews to investigate a report, a breach of the Terms or a threat to the security of the Service, and to act under sections 6 and 17 of the Terms; and personal data that it must process to comply with the law or with a lawful request from a public authority. It processes that data only for those purposes, as its privacy notice describes.

Each party complies with the obligations that Data Protection Law places on it.

3. Scope and duration

Usertick processes Customer Personal Data to provide the Service to the Customer. The subject matter, nature and purpose of the processing, the types of personal data and the categories of data subjects are described in Annex 1. The processing lasts for the term of the agreement and until Usertick deletes the Customer Personal Data under section 11.

4. Instructions

Usertick processes Customer Personal Data only on the Customer’s documented instructions, including with regard to transfers outside the United Kingdom. The Customer’s instructions are the Terms and this DPA, the Customer’s configuration and use of the Service (for example, the surveys it publishes, the sites, targeting and identity settings it chooses, the integrations it connects and the emails it sends), and any other written instructions that the parties agree.

The Customer also instructs Usertick to create anonymized, aggregate statistics from the use of the Service, such as benchmarks and product metrics, that identify no person and no customer. Once anonymized, they are not Customer Personal Data. Usertick does not train AI models on Customer Personal Data, and its contracts with its AI Sub-processors don’t allow them to.

If the law requires Usertick to process Customer Personal Data in another way, Usertick tells the Customer before it does so, unless the law prohibits that on important grounds of public interest. Usertick tells the Customer immediately if, in its opinion, an instruction infringes Data Protection Law, and may suspend the processing concerned until the instruction is changed.

The Customer is responsible for the lawfulness of its instructions and of the Customer Personal Data, and for the notices and consents described in section 8 of the Terms. Data that the Service sends to a service the Customer connects, such as a chat tool, a CRM, a spreadsheet, a webhook, an automation platform or the Customer’s own email provider, is sent on the Customer’s instruction. Those services are not Usertick’s Sub-processors, and the Customer’s own terms with them apply.

5. Confidentiality of personnel

Usertick ensures that every person it authorizes to process Customer Personal Data is bound by a contractual or statutory duty of confidentiality, and gives access only to people who need it to provide, secure or support the Service.

6. Security

Usertick implements the technical and organizational measures in Annex 2 to protect Customer Personal Data, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing and its risks, as Article 32 of the UK GDPR requires. Usertick may update these measures over time, provided that it does not lower the overall level of protection. The Customer is responsible for the security settings it controls, such as the roles it gives its Users, two-factor authentication, the protection of its API keys and the identity verification of its sites.

7. Sub-processors

The Customer gives Usertick general written authorization to engage Sub-processors. The current Sub-processors are listed on the Sub-processors page (Annex 3). Usertick imposes on each Sub-processor, by written contract, data protection obligations that are no less protective than those in this DPA, and remains fully liable to the Customer for each Sub-processor’s performance of those obligations.

Usertick gives reasonable notice before a new or replacement Sub-processor begins to process Customer Personal Data, or before an existing Sub-processor begins to process it in a new country, by email to the Organization’s owner and by updating the Sub-processors page. Where Usertick must replace a Sub-processor urgently to protect the security or continuity of the Service, it may give shorter notice and tells the Customer as soon as it can. The Customer may object on reasonable data protection grounds by writing to legal@usertick.com within that notice period. The parties then discuss the objection in good faith, and Usertick may offer a reasonable alternative. If Usertick cannot reasonably accommodate the objection, the Customer may end the affected part of the Service by notice before the change takes effect.

8. Data subject requests

The Service gives the Customer the means to respond to requests from data subjects. The Customer can read responses in the Service and, through the REST API on the Plans that include it, find, export and erase the responses of one person, together with the files, notes and AI readings that belong to them. Deleting the Organization deletes all of its Customer Personal Data.

If Usertick receives a request directly from a data subject about Customer Personal Data, Usertick does not answer it itself. Where it can identify the Customer, it passes the request to the Customer without undue delay and tells the person that it has done so; otherwise it asks the person to contact the Customer directly. Where the Customer cannot respond to a request with the Service’s features, Usertick gives reasonable assistance, taking into account the nature of the processing, when the Customer asks in writing at privacy@usertick.com.

9. Impact assessments and prior consultation

Taking into account the nature of the processing and the information available to it, Usertick gives the Customer reasonable assistance with data protection impact assessments and with prior consultation of the Information Commission (ICO) or another supervisory authority, to the extent they concern Usertick’s processing of Customer Personal Data. This assistance includes this DPA, its annexes and answers to reasonable questions about the Service.

10. Personal data breaches

Usertick notifies the Customer of a personal data breach affecting Customer Personal Data without undue delay after becoming aware of it, by email to the Organization’s owner. As the information becomes available, Usertick gives the Customer the information the Customer needs to meet its own obligations under Article 33(3) of the UK GDPR:

the nature of the breach, including, where possible, the categories and approximate number of data subjects and records concerned;
the name and contact details of Usertick’s contact point, security@usertick.com;
the likely consequences of the breach; and
the measures Usertick has taken or proposes to take to address the breach, including measures to mitigate its possible effects.

Usertick takes reasonable steps to contain, investigate and remedy the breach, and cooperates with the Customer. The Customer decides whether to notify supervisory authorities and data subjects. Usertick does not notify them about Customer Personal Data on the Customer’s behalf unless the law requires it or the Customer asks it to. A notification under this section is not an acknowledgement of fault or liability.

11. Deletion and return

During the agreement. The Customer returns Customer Personal Data to itself with the Service’s export features and the REST API that its Plan includes, and deletes it with the features described in section 8. The response history of a Plan limits which responses the Service shows: older responses are hidden, not deleted, until the Customer deletes them or the Organization is deleted.

Switching to another provider. When the Customer makes a switching request under section 19 of the Terms, that section also applies: Usertick exports on request the data that the Plan’s features don’t export, keeps the data for a retrieval period, and then deletes the Organization as described below.

Deleting the Organization. When the Customer deletes its Organization, or the Organization’s only member deletes their user account, that is the Customer’s instruction to delete all of the Organization’s Customer Personal Data. Usertick stops collecting responses for the Organization as soon as the deletion is scheduled. The deletion takes effect 14 days after it is confirmed, and the owner can cancel it until then. Usertick then deletes the Organization’s data from its live systems, including its responses and files.

Backups. Copies of Customer Personal Data in the hosting providers’ backups are overwritten on a rolling schedule, and Usertick uses backups only to recover the Service.

When the agreement ends in another way. If the agreement ends while the Organization still exists, for example because Usertick ends it, Usertick processes the Customer Personal Data only to store it. At the Customer’s written choice, Usertick then either restores the owner’s access for long enough to export the data or delete the Organization, or deletes the Organization and its data as described above.

Usertick keeps Customer Personal Data after these points only where the law requires it to, and then protects it and processes it only for the purpose the law requires.

12. Information and audits

Usertick makes available to the Customer the information needed to demonstrate compliance with Article 28 of the UK GDPR. Usertick first provides this DPA and its annexes, written answers to reasonable security and privacy questionnaires, and the certifications or audit reports of its hosting providers where those providers allow Usertick to share them.

If that information is not enough to demonstrate compliance, the Customer, or an independent auditor that the Customer appoints and that is bound by confidentiality and is not a competitor of Usertick, may audit Usertick’s compliance with this DPA, on site or remotely. An audit takes place at most once in any 12 months, with at least 30 days’ written notice, during business hours, on a scope agreed in advance, at the Customer’s cost, and without access to other customers’ data. The Customer may also audit after a personal data breach affecting Customer Personal Data, or when a supervisory authority requests it, and these audits do not count toward the limit of once in 12 months.

13. International transfers

Usertick stores Customer Personal Data in the United Kingdom, except files, such as uploads, screenshots and signatures, which it stores in the European Union. Cloudflare’s global network carries traffic to and from the Service, and processes it at the edge of that network, usually in a data center near the person using the Service.

For a Customer in the European Union or the European Economic Area, transfers of personal data to Usertick in the United Kingdom rely on the European Commission’s adequacy decision for the United Kingdom.

Usertick transfers Customer Personal Data outside the United Kingdom and the European Union in these cases:

TypeSafe (United States). For the AI reading of written answers, Usertick sends TypeSafe AI, Inc. the answers of a response with the texts of its questions and the survey’s name, without the respondent’s identifiers, the identity a website sends or the contact details a contact question collects; written answers are sent as the respondent wrote them. This transfer relies on TypeSafe’s data processing addendum, which includes the EU Standard Contractual Clauses (Module 3, processor to processor) and the UK Addendum to them.
Other Sub-processors. Where another Sub-processor processes Customer Personal Data outside the United Kingdom and the European Union, such as Cloudflare at the edge of its network, the transfer relies on a mechanism that Data Protection Law recognizes, such as UK adequacy regulations, the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, in that Sub-processor’s terms.

If a model that Usertick uses for AI features is not offered in a Microsoft Azure region in the United Kingdom, Usertick may run it in a Microsoft Azure region in the European Union. Usertick keeps a transfer risk assessment for each transfer outside the United Kingdom and the European Union. The Customer authorizes the transfers described in this section.

Requests from public authorities. If a court, government or other public authority asks Usertick for Customer Data, whether personal or non-personal, Usertick checks whether the request is lawful and challenges it where there are reasonable grounds to consider it unlawful, including where it would conflict with the law that applies to the Customer. Usertick tells the Customer about the request before it answers, unless the law prohibits that, discloses only the minimum the request requires, and keeps a record of the request and its answer. Usertick gives no public authority direct access to its systems. Customer Data is encrypted in transit and at rest, as Annex 2 describes.

14. US state privacy laws

This section applies where the California Consumer Privacy Act, with its regulations (California Code of Regulations, title 11, section 7000 and following) (the “CCPA”), or another US state privacy law, such as the laws of Virginia, Colorado and Connecticut (together, “US State Privacy Laws”), applies to Customer Personal Data. Terms such as “business”, “service provider”, “controller”, “processor”, “consumer”, “sell”, “share”, “business purpose” and “deidentified” have the meanings those laws give them. For Customer Personal Data, the Customer is the business or controller, and Usertick is its service provider or processor. For data that US State Privacy Laws cover, this section prevails over the rest of this DPA if they conflict.

14.1 Business purposes

The Customer discloses Customer Personal Data to Usertick only for the following limited and specified business purposes, and Usertick processes it only for them:

hosting and storing the Customer’s surveys, responses, contacts and files;
showing the Customer’s surveys to the people it targets, on its websites, at survey links and in emails, and collecting their responses;
analyzing responses for the Customer, including the AI reading of written answers, and producing the results, reports and exports the Customer asks for;
sending emails to the Customer’s contacts on its instructions, and handling bounces, complaints and unsubscribes;
sending data to the tools the Customer connects;
helping the Customer respond to consumer requests;
keeping the Service secure, detecting and preventing fraud and abuse, and fixing errors; and
supporting the Customer’s use of the Service.

14.2 Restrictions

Usertick does not:

sell or share Customer Personal Data;
retain, use or disclose it for any purpose, including any commercial purpose, other than the business purposes in section 14.1, unless US State Privacy Laws expressly permit it;
retain, use or disclose it outside the direct business relationship between Usertick and the Customer; or
combine it with personal information that Usertick receives from or on behalf of another person, or collects from its own interactions with the consumer, except to perform a business purpose that US State Privacy Laws permit.

The anonymized aggregate statistics described in section 4 are deidentified information. Usertick takes reasonable measures to ensure that they can’t be associated with a consumer or household, keeps and uses them only in deidentified form, does not attempt to reidentify them, and requires anyone who receives them to meet the same commitments. Usertick certifies that it understands the restrictions in this section and will comply with them.

14.3 Level of protection

Usertick complies with the obligations that US State Privacy Laws place on service providers and processors, and gives Customer Personal Data the same level of privacy protection that those laws require of the Customer, including the security measures in Annex 2, the help with consumer requests in section 8 and the breach notices in section 10. Usertick also gives the Customer the information it needs for the cybersecurity audits and risk assessments that the CCPA requires of the Customer. Where the Customer can’t act on a consumer request itself with the features in section 8, it tells Usertick about the request and gives Usertick the information it needs to comply.

14.4 The Customer’s rights

The Customer may take reasonable and appropriate steps to ensure that Usertick uses Customer Personal Data in a manner consistent with the Customer’s obligations under US State Privacy Laws, including through the information and audits in section 12.
Usertick tells the Customer if it determines that it can no longer meet its obligations under US State Privacy Laws.
After notice, including a notice from Usertick under the previous point, the Customer may take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data, for example by asking Usertick to stop the processing concerned or to show that it no longer keeps the data of a consumer whose deletion request the Customer granted.

14.5 Processor terms

Where US State Privacy Laws require it, as the laws of Virginia, Colorado and Connecticut do, Usertick as processor:

processes Customer Personal Data only on the Customer’s documented instructions (section 4), for the nature, purposes, types of data and duration in Annex 1;
ensures that each person who processes it is subject to a duty of confidentiality (section 5);
at the end of the Service, deletes it or returns it at the Customer’s direction, unless the law requires Usertick to keep it (section 11);
makes available, on reasonable request, the information in its possession necessary to demonstrate its compliance with those laws, and allows and cooperates with reasonable assessments by the Customer or an assessor the Customer appoints (section 12);
assists the Customer with consumer requests, the security of processing, breach notices and data protection assessments, taking into account the nature of the processing (sections 6, 8, 9 and 10); and
engages a Sub-processor only under a written contract that requires it to meet Usertick’s obligations under this section, including the restrictions in section 14.2, and only after notice to the Customer and an opportunity to object (section 7). This also applies to Sub-processors under the CCPA.

15. Liability

Each party’s liability under this DPA is subject to the exclusions and limits in section 15 of the Terms. This DPA has no separate limit: liability under it counts toward the limit in the Terms.

16. Duration, order of precedence and changes

This DPA applies for as long as Usertick processes Customer Personal Data. If documents conflict, an Order prevails, then this DPA for anything about personal data, then the Terms. Usertick may update this DPA in the way section 21 of the Terms describes, and may also update it where Data Protection Law requires.

17. Contact

Questions about this DPA, and requests for a signed copy, can be sent to legal@usertick.com. Requests for assistance with data protection matters can be sent to privacy@usertick.com, and security questions to security@usertick.com.

Annex 1: Details of the processing

Subject matter	The provision of the Service to the Customer.
Duration	The term of the agreement, and the period until deletion under section 11.
Nature of the processing	Collection, recording, storage, organization, analysis (including automated AI reading of written answers), retrieval, display, transmission to the tools the Customer connects, email delivery, and erasure.
Purpose	To provide, secure and support the Service for the Customer: to show surveys to the people the Customer targets, to collect responses through the website widget, hosted survey pages and emails, to store, analyze and display results, to send emails to the Customer’s contacts on its instructions, including the handling of bounces, complaints and unsubscribes, to send data to the tools the Customer connects, and to create anonymized aggregate statistics on the Customer’s instructions under section 4.
Data subjects	People who answer the Customer’s surveys and visitors to the websites where the Customer runs the widget; the Customer’s email contacts; and the Customer’s Users, to the extent their data appears in Customer Data, for example in notes, comments, assignments and the activity log.
Categories of personal data	answers to surveys, including written answers and the time taken to answer; identifiers: the random visitor ID the widget creates, the user ID and traits the Customer’s site sends with `identify()`, and the email address and name that a person gives or the Customer sends; technical data: page URL, user agent, browser language, screen size, device type, country, and a hashed IP address (the IP address itself is not stored with responses); files that people upload, screenshots they choose to send, and signatures; AI readings of answers, such as category, theme, sentiment and urgency; contact records: email address, name, the attributes the Customer imports, email delivery status, unsubscribes and complaints; and the names and email addresses of Users, and the content they add.
Special category data	The Service does not require special category data. It is processed only if the Customer chooses to collect it, in which case the Customer is responsible for the lawful basis and the conditions the law sets for it.
Frequency	Continuous, for as long as the Customer uses the Service.
Retention	As long as the Customer keeps the data in the Service, and until deletion under section 11. The response history of a Plan hides older responses and does not delete them.

Annex 2: Technical and organizational measures

Access control. Roles and permissions decide what each User can see and do, every request is checked against the Organization it belongs to, and each Organization’s data is kept separate from other customers’ data. Two-factor authentication is available to Users. Access by Usertick staff is limited to those who need it, protected by two-factor authentication and recorded.
Encryption. Customer Personal Data is encrypted in transit and at rest. Passwords and other secrets are stored in hashed or encrypted form.
Logging and monitoring. Changes in each Organization and actions by Usertick staff are logged, and the Service’s network is protected against attacks and abuse.
Backups and recovery. Production databases are backed up, and backups are overwritten on a rolling schedule.
Staff confidentiality. Staff and contractors are bound by confidentiality and follow Usertick’s security policies.
Supplier management. Each Sub-processor is bound by a written contract under section 7 and is reviewed for the protection it gives.
Incident response. Usertick handles security incidents and personal data breaches as section 10 describes. Security reports can be sent to security@usertick.com.
Secure development. Changes to the Service are reviewed before release, and known vulnerabilities are fixed in order of risk.
Review. Usertick reviews these measures regularly and after significant changes to the Service.

Annex 3: Sub-processors

The Sub-processors, with what each one does, the personal data it processes and where it processes it, are listed on the Sub-processors page at usertick.com/subprocessors, which forms part of this DPA. Section 7 describes how Usertick changes the list.

The following are not Sub-processors of Customer Personal Data. Stripe’s affiliate Sold through Link, LLC (“Link”) is the merchant of record for the payments for paid Plans, Extra responses and Extra emails and processes them for Usertick, and Stripe and Link are independent controllers of payment data. Services the Customer connects itself, such as integrations and its own email provider, receive data on the Customer’s instruction under section 4.