- Overview
- Data Rights & Roles
- Administrator Responsibilities
- Administrators as Data Subjects
- Applicants, Reviewers, and Recommenders as Data Subjects
Overview
SurveyMonkey takes the privacy and security of your data very seriously. As part of our ongoing commitment to ensuring your information is secure within SurveyMonkey Apply, we have updated our policies and capabilities to meet the requirements of applicable privacy regulations the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
Depending on your location, as a SurveyMonkey Apply site administrator, you may be required to respond to requests from data subjects who ask to exercise their privacy rights.
Organizations using our services the controller/business owner of the data they collect through their site and have the ability to access, modify, and delete data on behalf of their users when requested. For more information, see Administrator Responsibilities.
SurveyMonkey Apply also collects information on users as part of daily business activities - for instance, when we receive a support request, sign a contract, or send newsletters and other marketing information. We are the controller/business owner of this data and any requests that are made we will handle and fulfill.
Data Rights & Roles
Data Rights
Depending on your location and/or the location of your users, your users may be entitled to exercise the following rights:
| Term | Definition |
| Right of Access |
Find out what kind of personal information is held about you and receive a copy of this information. |
| Right of Rectification |
Ask for your information to be updated or corrected. |
| Right to Data Portability |
Receive a copy of the information which you have provided under contract so that you can provide that information to another organization. |
| Right to Restrict Use |
Ask for your personal information to stop being used in certain cases, including if you believe that the personal information about you is incorrect or the use is unlawful. |
| Right to Object |
Objecting to use of your information (where a party is processing it on a legitimate interest basis) and to have your personal information deleted. |
| Right to Erasure/Deletion |
In certain circumstances, you may request to have your personal information deleted. |
Data Roles
- Organizations using our services may be data controllers under GDPR or businesses under CCPA for the data they collect, while SurveyMonkey, as a service provider just processes that data for you.
- SurveyMonkey controls/is the business owner of very limited data about users—we may use personal data like cookie data and IP address for specific purposes as described in our Privacy Policy.
- For individuals like applicants, reviewers, recommenders, and site visitors, SurveyMonkey is the data controller/business owner of personal data like name, email address, and digital identifiers like a cookie data or IP address, among other things. We describe in detail the data we collect and how we use it in our Privacy Policy.
- For further information on identifying your data controller see our Privacy Policy under the section “Who is my data controller”?.
Administrator Responsibilities
Site administrators are responsible for the data they collect through their site and have the ability to access, modify, and delete data on behalf of their users when requested.
Depending on your location and the location of your users, you may receive and need to fulfill the requests below.
Below are ways that site administrators can fulfill these types of requests made by their users:
- "Right of Access" requests
- "Right of Rectification" requests
- "Right to Data Portability" requests
- "Right to Restrict Use" requests
- "Right to Object" requests
- "Right to Erasure" / Data Deletion requests
1. "Right of Access" requests
Site users have the ability to request to see all the information available on them within the site. Users may contact the administrator directly or may submit a request through SurveyMonkey Apply’s form. In either scenario, Site administrators can export a user’s data from the User Profile:
- Go to the User Profile
- Click on Data Access Export
This file will contain all information submitted by the user on the site in JSON format. We would recommend that after providing the JSON file for the user, the administrator delete the file from their records.
This will only contain personal information that has been submitted directly to SurveyMonkey Apply by the user. Any additional information stored on systems outside of SurveyMonkey Apply will need to be sent to the user as well.
NOTE: When a request is submitted through SurveyMonkey Apply, SurveyMonkey Apply will review our records for any data we are the controller of and send this separately to the subject within 30 days.
2. "Right of Rectification" requests
Administrators have full control over the information they collect from their administrator portal (for example user data, applications, reviews, recommendations.) and can modify the information on behalf of the user who requested the change.
3. "Right to Data Portability" requests
As discussed in "Right of Access", when requested, administrators can provide users with a JSON file of all collected data within the site so the user can provide the data to another data controller.
4. "Right to Restrict Use" requests
Users may not want their data to be deleted but can object to anything being used in the processing of their data (for example they believe something to be inaccurate). Administrators may be contacted to prevent their data from being used for decision making.
| Data Subject | Potential methods for Data Controllers to Restrict use |
| Applicants | |
| Reviewers | |
| Recommenders |
5. "Right to Object" requests
This will vary depending on the nature of the objection and the information that is being objected to. Administrators have full control over the information stored on their sites and will have the ability to make modifications or delete data to address the request.
6. "Right to Erasure" / Data Deletion requests
Users may contact a site administrator directly to ask to be deleted from their site.
Administrators can find the user through the Manage Users area of the administrator portal and can remove the user from their site which will permanently delete any information associated with that user on that site. Please see, How to Delete a User from a Site. This will remove the user from the specific site.
What SurveyMonkey Apply will do:
When such a request is made, SurveyMonkey Apply will automatically redact any identifiable information from the user after 14 days. The User will appear on the site as a "Removed User."
An email notification will be sent to the organization of the site as the data controller and to SurveyMonkey Apply to review and delete any additional information stored on the user outside of the SurveyMonkey Apply Platform.
What a Site Administrator should do:
Review the site and ensure that if any additional data not provided by the user was added and contains personal data, for example, data entered by co-applicants/administrators, metadata fields, reviewer comments that you capture this in the request - SurveyMonkey Apply is not responsible for this.
NOTE: If you wish for us to suspend deletion while you communicate with this user regarding this request please contact our support team within 14 days of the date of the request and you can then take over communications with this user directly. If you do not contact our support team within 14 days we will initiate the deletion process and this user’s data will be deleted thereafter.
WARNING! Once SurveyMonkey Apply begins the process of deleting a user’s account, this cannot be undone.
What happens in SurveyMonkey Apply when an Erasure /Data Deletion request is fulfilled:
| Data Subjects | What happens |
| Applicants |
|
| Reviewers |
|
| Recommenders |
|
Administrators as Data Subjects
Site Administrators are data subjects for any personal data they submit to SurveyMonkey Apply, including Account Information and any requests sent to the Support & Services team for assistance. Depending on the location of the Site Administrator, you may have certain rights to make the privacy requests below.
- Making a "Right of Access" request
- Making a "Right of Rectification" request
- Making a "Right to Data Portability" request
- Making a "Right to Restrict Use" request
- Making a "Right to Object" request
- Making a "Right to Erasure" / Data Deletion request
1. Making a "Right of Access" request
Administrators can make a request for their data from SurveyMonkey Apply by submitting this form.
SurveyMonkey Apply will review our records and any personal data we have stored will be forwarded to the administrator within 30 days.
The primary administrator of the site, if different than the one making the request, will be notified in the event they have data stored outside of the system. The primary administrator will be responsible for forwarding this information over to the administrator requesting access.
2. Making a "Right of Rectification" request
For any of the data that SurveyMonkey Apply provides to the administrator, the administrator can contact our SurveyMonkey Apply Support team directly for us to modify their data.
3. Making a "Right to Data Portability" request
When an administrator makes a request for their data, if SurveyMonkey has anything on the administrator, we will forward it to them in a format that will be portable. See “Making a Right of Access” request above.
4. Making a "Right to Restrict Use" request
In order to make a request to restrict the use of your data, please contact our SurveyMonkey Apply Support team.
5. Making a "Right to Object" request
In order to make a request to object the use of your data, please contact our SurveyMonkey Apply Support team.
6. Making a "Right to Erasure" / Data Deletion request
If you are a primary administrator on a SurveyMonkey Apply site, please contact our support team if you’d like to delete your account and data.
If you are not a primary administrator, you will need to complete the following form.
Applicants, Reviewers, and Recommenders as Data Subjects
If you are an Applicant, Reviewer, or Recommender on the site, and depending on your location, you may be able to exercise the rights as listed below:
- Making a "Right of Access" request
- Making a "Right of Rectification" request
- Making a "Right to Data Portability" request
- Making a "Right to Restrict Use" request
- Making a "Right to Object" request
- Making a "Right to Erasure" request
1. Making a "Right of Access" request
In order to make a "Right of Access" request, you will need to fill out the following form.
Upon filling out this form, the administrators for the sites you have been a member of will be contacted. We will recommend that they review their records and forward any personal identifiable data they have stored on you, but SurveyMonkey is not responsible for requiring that the sites deliver any data for which they are the controller.
The SurveyMonkey Apply team will also receive a request and will review our records and any personal information for which we are your data controller, will be sent to you.
Requests sent by email will be directed to filling out this form as we need to ensure the person making the request is a valid user in our system.
2. Making a "Right of Rectification" request
If you would like to make a "Right of Rectification" request, you will need to contact the specific data controller with the change you would like to make.
Any change related to your application, review, or recommendation within the SurveyMonkey Apply site, you will need to contact the administrator.
For any data SurveyMonkey is the controller of, for example, help requests sent to support, you can contact our SurveyMonkey Apply Support team.
3. Making a "Right to Data Portability" request
Similar to making a "Right of Access" request, you can complete the form to request your data. The site administrators and SurveyMonkey Apply will compile any data stored on you and provide it in a format that will be portable.
4. Making a "Right to Restrict Use" request
If you would like to make a "Right to Restrict Use" request, you will need to contact the specific data controller. For example, any request related to your application, review, or recommendation within the SurveyMonkey Apply site, you will need to contact the administrator.
For any data SurveyMonkey is the controller of, for example, help requests sent to our support team, you can contact our SurveyMonkey Apply Support team.
5. Making a "Right to Object" request
If you would like to make a "Right to Object" request, you will need to contact the specific data controller.
Any request related to your application, review, or recommendation within the SurveyMonkey Apply site, you will need to contact the administrator.
For any data SurveyMonkey is the controller of, for example, help requests sent to support, you can contact our SurveyMonkey Apply Support team.
6. Making a "Right to Erasure"/ Data Deletion request
If you wish to remove yourself and permanently delete your data from a specific site you will need to contact the site administrator. They will be able to remove all data stored on you within the site they own.
If you are a member of multiple SurveyMonkey sites and wish to delete your SurveyMonkey Apply account and all of your data, you will need to complete the following form.