NUVOPOLL DATA PROCESSING ADDENDUM
Version date: 4 October 2026
Effective date: The date on which the Customer accepts this DPA, enters into an Agreement incorporating this version, or separately executes it. An existing Customer's agreement is amended only through the applicable contractual amendment procedure.
Parties
Customer: The person or organisation identified in the relevant account, Order or signature record, acting as Controller or, where applicable, as a Processor authorised by its Controller.
Seamlexly: Seamlexly OÜ, an Estonian private limited company, registry code 17021816, VAT number EE102783597, registered at Harju maakond, Tallinn, Kesklinna linnaosa, Sakala tn 7-2, 10141 Estonia, providing Nuvopoll.
Data protection contact: contact@nuvopoll.com.
The Customer and Seamlexly are the “Parties”.
1. Purpose, scope and precedence
1.1 This DPA governs Customer Personal Data Processed by Seamlexly on behalf of the Customer through the Nuvopoll research, survey, data-collection and reporting Services. It supplements the applicable terms of service, subscription agreement, Order or other service agreement (“Agreement”).
1.2 Mandatory law prevails. Mandatory transfer instruments prevail for the transfers they govern. Subject to those requirements, this DPA prevails over inconsistent provisions of the Agreement concerning Processing of Customer Personal Data. No general liability clause, indemnity, website policy or later product notice displaces mandatory obligations or data-subject rights.
1.3 This DPA may be accepted electronically or executed separately. Acceptance records shall identify the Customer, accepting representative, version and date. Authorised Users do not become separate contracting Customers merely by joining a workspace.
1.4 Seamlexly's genuinely independent Controller activities, such as its own billing and business administration, are governed by its Privacy Policy and applicable law. Classification depends on the actual purpose of each activity. Authentication, security, audit or retention operations performed on behalf of the Customer remain subject to this DPA even where the same systems support Seamlexly's own activities.
1.5 This DPA applies regardless of participant nationality or residence, subject to the territorial and material scope of applicable law. Establishment in Estonia is relevant to Seamlexly's GDPR obligations; those obligations are not limited to data about EU residents.
2. Definitions
Services means the Nuvopoll services and enabled functions supplied under the Agreement.
Order means an order, subscription record or separately agreed service schedule identifying the Customer and relevant Services.
GDPR means Regulation (EU) 2016/679. EEA means the European Economic Area.
Applicable Data Protection Law means mandatory privacy and data-protection law applicable to the relevant Processing, including GDPR, applicable Estonian and other national supplementary law, and, where applicable, Türkiye's Law No. 6698 (“KVKK”) and UK data-protection law.
Authorised User means a person the Customer authorises to use its workspace and issue instructions within assigned permissions.
Customer Personal Data means Personal Data submitted to, collected through, generated through or otherwise Processed in the Services on the Customer's behalf, including research records, participant-access records, audio, transcripts and related Compliance Evidence.
Compliance Evidence means minimised records supporting accountability, such as notice versions, consent events, instruction records, deletion evidence and relevant audit metadata. Such records may contain Personal Data and remain subject to the Customer’s instructions. Hashing does not automatically make such records anonymous.
Documented Instructions means this DPA, applicable Orders, authenticated written instructions and authorised platform actions or configurations identifying the relevant Processing.
Personal Data, Controller, Processor, Data Subject, Processing, Personal Data Breach and Supervisory Authority have their applicable statutory meanings; under GDPR, Personal Data concerns identified or identifiable natural persons.
Special Categories means GDPR Article 9 data and equivalent protected categories under applicable law. Criminal-conviction and offence data is separately subject to Article 10 GDPR where applicable.
Sub-processor means another entity engaged by Seamlexly to Process Customer Personal Data on behalf of the Customer. Personnel acting under Seamlexly's direct authority are distinct from separate supplier entities.
TOMs means technical and organisational measures described in Annex II.
3. Roles and Customer responsibilities
3.1 Where the Customer determines the research purposes and essential means, the Customer is Controller and Seamlexly is Processor. Where the Customer acts for another Controller, Seamlexly acts as its Sub-processor, and the Customer shall obtain the necessary authorisation and communicate lawful upstream instructions. References to Customer rights and duties apply as appropriate to that role.
3.2 The Customer determines the research purpose, participant groups, questions, categories of data, Article 6 legal basis, any additional sensitive-data condition, notices, retention periods, access permissions, publication settings and required ethics approvals or local filings.
3.3 The Customer shall provide accurate notices, collect only necessary data, manage user permissions and maintain required consents or other legal grounds. Consent is not invariably required; the Customer must identify the legally appropriate basis for each activity.
3.4 For children, Special Categories and criminal-conviction data, the Customer shall implement legally required additional conditions and safeguards before collection. Research functionality does not itself establish an exemption or authorisation.
3.5 The Customer remains responsible for the substantive assessment and fulfilment of its Controller obligations, including the lawfulness of its research, the content of notices, decisions on Data Subject requests, retention choices and any required impact assessment or authority notification. Seamlexly supplies technical processing and assistance; it does not undertake to act as the Customer's privacy officer, legal adviser or compliance decision-maker. Platform-generated templates, reminders and records do not constitute legal approval.
3.6 Nuvopoll's privacy-first design includes tools intended to help the Customer perform those responsibilities. Applicable law does not necessarily require a particular portal, reminder, template, certificate-management interface or automated workflow. Such features are supplied to the extent described in the Agreement and enabled configuration. Making them available neither transfers Controller responsibilities to Seamlexly nor guarantees the Customer's compliance. Once a specific function or service level is agreed, Seamlexly remains responsible for performing that contractual commitment.
3.7 Customer obligations do not relieve Seamlexly of its own statutory or contractual obligations. Seamlexly may choose non-essential technical means without changing the Customer's purposes.
4. Instructions and permitted Processing
4.1 Seamlexly shall Process Customer Personal Data only on Documented Instructions, including instructions relating to transfers, unless required by Union or Member State law to which it is subject. It shall inform the Customer before legally required Processing unless that law prohibits notification on important public-interest grounds. Other legal demands shall be assessed consistently with applicable law and mandatory transfer instruments.
4.2 Instructions include creating studies, managing invited-participant access, configuring notices and consent, enabling transcription, assigning permissions, analysing records, exporting selected data, publishing configured reports and initiating deletion.
4.3 If Seamlexly considers an instruction to infringe GDPR or other applicable Union or Member State data-protection provisions, it shall immediately inform the Customer. It shall similarly raise concerns under other applicable law and may suspend the affected operation pending clarification. This does not require Seamlexly to approve the legality of every research design.
4.4 A sharing instruction authorises only the selected data, recipients, purpose and access configuration. Connecting an integration does not authorise access to all workspace data. Public-reporting instructions remain subject to minimisation and lawful disclosure requirements.
4.5 Seamlexly shall not sell Customer Personal Data, use it for unrelated advertising or independent profiling, or use it to train general-purpose AI models for its own purposes. Anonymisation of Customer Personal Data shall itself require a lawful instruction; information may be treated as anonymous only where re-identification is not reasonably possible.
5. Personnel and confidentiality
5.1 Persons authorised to Process Customer Personal Data shall be subject to enforceable confidentiality obligations or an appropriate statutory duty, receive suitable training and access only data necessary for their assigned functions.
5.2 Seamlexly shall manage access grants, changes and revocations, including personnel departure and role changes. Privileged access shall be restricted and recorded. Confidentiality obligations survive the relevant engagement and termination of the Agreement.
5.3 Separate support and development companies with access to Customer Personal Data are subject to the Sub-processor provisions; describing them as personnel does not avoid those provisions.
6. Security and records
6.1 Seamlexly shall implement Article 32-appropriate TOMs, considering the state of the art, implementation costs, nature, scope, context and purposes of Processing, and risks to individuals. Its obligations cover confidentiality, integrity, availability, resilience, timely restoration and regular evaluation of security measures.
6.2 Annex II shall identify implemented measures and any additional agreed measures. Seamlexly shall not materially reduce the overall level of protection. Material changes affecting agreed data locations, access or transfers shall be addressed through the applicable notice, authorisation and transfer procedures.
6.3 Seamlexly shall maintain required Processor records and make information available to the competent authority as required by law. Necessary security and compliance metadata shall be minimised; access to logs shall be restricted.
7. Assistance and Data Subject requests
7.1 Taking into account the nature of Processing, Seamlexly shall assist the Customer through appropriate TOMs, insofar as possible, in responding to Data Subject requests, including access, rectification, restriction, erasure, portability and objection.
7.2 Seamlexly shall notify the Customer without undue delay of relevant requests received directly and shall not decide their substance except on Documented Instructions or where legally required. It may acknowledge receipt and direct the individual to the appropriate Customer.
7.3 The Customer determines whether an impact assessment, prior consultation or notification is required and is responsible for its content and submission. Seamlexly shall assist with obligations under GDPR Articles 32–36, taking into account the nature of Processing and information available to it, including security, breach assessment, impact assessments and prior consultation. Availability of self-service tools does not exhaust this assistance obligation.
7.4 Routine assistance included in the Services is provided under the Agreement. Exceptional additional work may be charged on a reasonable, disclosed basis agreed where practicable. Disagreement over fees shall not delay urgent mandatory cooperation. No additional charge applies to rectifying Seamlexly's own breach of this DPA.
7.5 Subject to the Agreement and enabled configuration, optional self-service tools supporting the Customer include a study-specific participant application channel where enabled, a request-management interface, authenticated lookup/export/deletion operations, request-status and resolution records, retention reminders and Customer-initiated study-data deletion. Their available scope depends on plan, role and study configuration and shall be described accurately. These tools are a delivery method for assistance and may offer additional functionality beyond the statutory minimum; each listed feature is not a separate universally required statutory product feature. Rectification, restriction and objection may require a separate manual workflow; recording a request as resolved does not itself implement the requested operation.
7.6 Where enabled, the participant application channel may collect applicant name, national/passport identifier, address, contact details, request categories and explanation. These are Personal Data separate from substantive survey answers. The Customer determines the information proportionately needed to identify the applicant and resolve the request, assesses the suitability of the enabled form and provides an appropriate Customer contact route where needed. Seamlexly remains responsible for appropriate design of the processing it supplies and the assistance required under clauses 7.1–7.3; it does not decide whether the applicant is legally entitled to the requested remedy. Submission through the channel does not by itself establish the applicant’s identity. The Customer determines any necessary, proportionate verification before deciding the request.
7.7 A study's “anonymous” setting does not itself establish that every answer, audio file or technical record is anonymous. Any restriction of the online application channel shall not be represented as a blanket loss of statutory rights. The Customer shall determine the applicable rights and any lawful identification requirements and make its contact route available where relevant Personal Data remains identifiable; Seamlexly shall provide the assistance required by clauses 7.1–7.3.
8. Personal Data Breaches
8.1 Seamlexly shall notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. Any additional contractual notification deadline applies only where expressly agreed in an Order and does not replace the requirement to notify without undue delay.
8.2 Initial notification shall contain available information about the nature of the breach, affected data and Data Subjects, approximate numbers where ascertainable, likely consequences, measures taken or proposed and a contact point. Missing information shall follow in phases without undue further delay; Seamlexly shall not wait for a completed investigation before notifying.
8.3 Seamlexly shall investigate, contain and remediate matters within its responsibility, preserve relevant evidence and assist the Customer with required notifications and risk assessment. It shall provide material updates and an available closure summary.
8.4 Notification is not an admission of fault. The duty is not excluded merely because the Customer, a user or a third party contributed to the incident. Responsibility and notification are separate questions.
8.5 The Customer controls notifications concerning its Processing, except where Seamlexly has an independent legal duty or an applicable transfer instrument requires otherwise.
9. Public-authority requests
9.1 Seamlexly shall assess the validity, scope and legal basis of requests for Customer Personal Data. Where permitted, it shall notify the Customer before disclosure and seek appropriate clarification or challenge where warranted. Disclosure shall be limited to what is legally required.
9.2 Foreign authority requests shall not automatically be treated as a sufficient basis for disclosure. Applicable GDPR Article 48, Chapter V and mandatory transfer-instrument requirements remain controlling. Seamlexly shall preserve permissible records and provide available assistance to the Customer.
10. Retention, return and deletion
10.1 The Customer determines retention periods for its responses, audio, transcripts, certificates, exports and Compliance Evidence, including justified retention for establishing, exercising or defending legal claims. Retention need not be based exclusively on a period expressly prescribed by statute. The Customer shall document its choices and explain them in its notices where required. Seamlexly does not independently determine the Customer’s substantive retention policy.
10.2 The Customer shall configure available retention settings and issue appropriate deletion instructions. Retention monitoring and reminders support the Customer’s management of its studies; a configured expiry date does not itself automatically delete research responses. An available automatic deletion function operates only when expressly selected and described as such. The Customer remains responsible for initiating deletion where the selected function is reminder-only. Seamlexly remains responsible for performing the agreed monitoring and lawful deletion instructions.
10.3 Server-side export files are subject to scheduled cleanup after seven days unless the Customer selects the available preservation setting. Cleanup is performed periodically rather than at an exact seven-day instant. Preserved exports remain subject to the Customer’s retention and deletion instructions. Copies downloaded or transferred to systems outside Seamlexly’s control are managed by the Customer and its recipients.
10.4 Upon completion of the relevant Processing or termination of the Services, Seamlexly shall, at the Customer’s choice, return or delete Customer Personal Data and delete existing copies unless Union or Member State law requires further storage. The Customer shall communicate its choice through an authorised administrative instruction. The Parties shall coordinate the return format, access arrangements and deletion schedule using available export functions or an agreed assisted process, consistently with applicable law. This DPA does not create an additional fixed export-access window or deletion-completion SLA.
10.5 Individual user-account deletion, closure of a Customer workspace, deletion of study data and termination of the Agreement are distinct instructions. A user’s request to delete their own account is not, by itself, the Customer’s authorisation to destroy its workspace. Any product grace period for account deletion is not a statutory retention period or a guarantee of export access following termination.
10.6 A deletion instruction shall identify the relevant study, records or other scope with sufficient information to locate the data. Seamlexly shall apply the instruction to relevant Customer Personal Data within its control, including associated audio, transcripts and linked records where covered by the instruction. A self-service action may address only the records selected in that action. The Customer may request assistance for related records not addressed through self-service functionality. An unresolved processing or file-deletion failure shall not be represented as completed deletion.
10.7 Backup and soft-deleted copies may remain for the bounded periods in Annex V. Seamlexly shall restrict their use to recovery and necessary system administration, protect them and allow their scheduled expiry or perform required removal. Where restoration reintroduces previously deleted records, applicable deletion instructions shall be reapplied before those records are returned to ordinary use. The residual-copy schedule does not override a legally required earlier deletion deadline.
10.8 On request, Seamlexly shall provide available information about deletion status and scope, known failures, retained categories and residual-copy schedules. It shall not confirm completed deletion beyond what has been verified. Name replacement, certificate revocation or a changed status field does not necessarily erase or anonymise every related record.
10.9 The Customer determines retention of Compliance Evidence Processed on its behalf and issues corresponding Documented Instructions. Seamlexly does not select or legally validate that period for the Customer. Applicable storage arrangements shall support the agreed instructions, and any material technical constraint shall be communicated to the Customer. End-of-service handling remains subject to clause 10.4.
10.10 Retention periods for records Processed by Seamlexly as an independent Controller are outside this DPA and are addressed in its Privacy Policy. They shall not be applied to Customer Personal Data merely because both categories are stored in the same technical environment.
11. Audits and accountability
11.1 Seamlexly shall make available all information necessary to demonstrate compliance with GDPR Article 28 and shall allow and contribute to audits, including inspections, conducted by the Customer or an independent auditor mandated by it.
11.2 A reasonable document review may precede an ordinary inspection. Ordinary inspections should generally use 30 days' notice and occur no more than once per 12 months. These arrangements shall not prevent a necessary audit where there is a suspected material breach, a material change in Processing or safeguards, a Personal Data Breach requiring assessment, a regulatory request, or another mandatory legal or transfer-instrument requirement. Urgent circumstances permit proportionately shorter notice.
11.3 Audits shall protect other customers, system security and confidential information through proportionate safeguards. Those protections shall not be used to withhold necessary compliance information. Seamlexly may object to a proposed auditor on substantiated independence, qualification or conflict grounds and shall cooperate in appointing an alternative.
11.4 Ordinary audit costs are borne by the Customer on reasonable terms. Where an audit establishes Seamlexly's material non-compliance, Seamlexly shall bear reasonable attributable costs and remediate. Cost arrangements shall not frustrate mandatory audit or authority access rights.
12. Sub-processors
12.1 The Customer grants general written authorisation for the Sub-processors and Processing listed in Annex III. Unlisted affiliates are not automatically authorised. Seamlexly shall keep the list current under the notice and objection procedure below.
12.2 Before a new or replacement Sub-processor starts Processing, Seamlexly shall give written notice identifying its legal identity, service, data categories, locations, access and transfer safeguards sufficiently in advance to allow the Customer a reasonable opportunity to object on data-protection grounds. Notice may be provided to the Customer’s registered administrative email or through a recorded account notification. Any specific notice period agreed in the Agreement applies.
12.3 The Parties shall seek a reasonable alternative. Pending resolution, Seamlexly shall not introduce the objected-to Processing for that Customer without a lawful agreed arrangement. If no solution is feasible, the Parties shall address discontinuation of the affected Processing under the Agreement and applicable law. This DPA does not add an automatic refund or a new commercial termination remedy; mandatory rights and transfer-instrument remedies remain unaffected.
12.4 Seamlexly shall perform appropriate due diligence and bind each Sub-processor by a written agreement imposing the same relevant data-protection obligations as required by GDPR Article 28(4), including sufficient guarantees for appropriate TOMs. Standard supplier terms may be used only if they satisfy these requirements.
12.5 Seamlexly remains fully liable to the Customer for performance of the Sub-processor's obligations as required by Article 28(4). Supplier size, bargaining imbalance or use of standard terms does not reduce this obligation to due diligence alone.
12.6 A Customer-selected third-party integration may involve an independent Controller, the Customer's own Processor or Seamlexly's Sub-processor depending on the actual arrangement. Role allocation shall be documented; it is not determined solely by who clicked the integration button. Providers used solely for Seamlexly's independent Controller activities are outside Annex III.
13. Locations and international transfers
13.1 Core hosting locations are described in Annex I and Annex III. Core EU hosting does not imply that every service, support access or AI operation is confined to the EU.
13.2 Seamlexly shall not make Customer Personal Data available to a separate recipient outside the EEA without a lawful instruction or authorisation, required Sub-processor authorisation and an applicable Chapter V mechanism. Remote access is included where it constitutes a transfer.
13.3 For each restricted transfer, the Parties shall identify the actual exporter and importer, their roles, destination, purpose, data and applicable mechanism. Where SCCs are relied upon, the correct modules, options and annexes shall be completed, the relevant instrument executed or validly incorporated, and required assessments and supplementary measures implemented before transfer.
13.4 A generic statement that data is “secured under SCCs” does not replace the applicable instrument. Annex IV records the necessary schedules and priorities. Mandatory SCC terms, including data-subject rights, authority powers and suspension requirements, shall not be amended by inconsistent DPA or Agreement provisions.
13.5 The Customer is responsible for its own export-law requirements; Seamlexly shall fulfil obligations imposed on it and provide necessary cooperation. Applicable Turkish and UK mechanisms are addressed in Annex IV. Local-law obligations shall not be shifted indiscriminately to the Customer.
13.6 Material changes to a supplier's location, product, endpoint, legal entity or transfer safeguards require reassessment and applicable notice/authorisation. If no lawful mechanism remains available, affected transfers shall be suspended and the Parties shall implement required remedies.
14. Audio, AI and participant authentication
14.1 Audio collection and transcription are distinct operations enabled on the Customer’s instructions. The Customer determines whether recording is appropriate and provides required notices and legal grounds. When transcription is enabled, audio is sent to Google Cloud Speech-to-Text through the configured EU endpoint. Nuvopoll does not use the recordings for biometric identification. Written-input options depend on the Customer’s survey design and configuration.
14.2 Gemini Developer API functions are used for survey design, survey-question and privacy-notice translation, and conversion of supplied draft documents into survey scripts. Participant response databases, free-text answers and audio recordings are not automatically transmitted to the Gemini API for model analysis. The Customer, as Controller, is responsible for the information and Personal Data that it or its Authorised Users choose to include in prompts or uploaded documents, including the lawfulness of that disclosure, required notices and any applicable legal grounds. Such input is transmitted to Google LLC to perform the requested function. This allocation does not exclude Seamlexly’s own obligations as Processor.
14.3 The Gemini service is used under Google LLC’s Developer API terms, separately from the Google Cloud infrastructure arrangement. Google may retain submitted input and generated output for up to 55 days for abuse monitoring under the applicable service terms. Provider data-use, review, retention and transfer conditions are governed by the applicable Google AI terms and data-protection arrangement. Seamlexly’s own use remains restricted by clause 4.5. Where the provider terms do not permit the intended lawful Processing, the affected Personal Data shall not be submitted through that function.
14.4 New AI processing of response datasets, audio or transcripts requires a specifically described function, lawful Documented Instructions and applicable supplier and transfer arrangements. Broad references to AI assistance do not constitute that authorisation.
14.5 Invited-participant access may involve an email allowlist, verification message, one-time sign-in link, verification timestamp and session record. These records are Processed for the Customer’s access-control purposes. Control of an email account does not prove personal identity. Providers handling the authentication or message-delivery data on Seamlexly’s behalf are subject to clause 12.
15. Liability and mandatory rights
15.1 Contractual liability between the Parties is governed by the Agreement insofar as lawful. Nothing excludes or limits obligations or liability that cannot lawfully be restricted, including applicable GDPR Article 82 rights, Sub-processor responsibility, mandatory transfer-instrument provisions or authority powers.
15.2 Indemnities do not excuse either Party's own unlawful conduct or statutory duties. This DPA does not create an additional limitation solely because a large supplier is involved.
16. Term, amendments and law
16.1 This DPA remains effective while Seamlexly Processes Customer Personal Data. Confidentiality, lawful restricted retention, deletion/return, audit and liability provisions survive to the extent necessary.
16.2 Amendments shall follow the Agreement's valid amendment process and preserve mandatory law. Material changes to Processing are not retrospectively authorised by editing a website.
16.3 Governing law and ordinary contractual jurisdiction follow the Agreement, subject to mandatory law, required SCC law/jurisdiction and data-subject and authority rights.
Annex I — Description of Processing
| Item | Description |
|---|---|
| Customer and role | The Customer identified in the account or Order, acting as Controller or as an authorised Processor. Where acting for another Controller, the Customer shall identify that Controller in the applicable instruction or Order. |
| Processor | Seamlexly OÜ, providing Nuvopoll; identity and contact above. |
| Subject matter and purpose | Provision of the Customer’s configured research, survey collection, management, reporting, transcription and related support functions. No unrelated independent use of Customer Personal Data. |
| Data Subjects | Participants, prospective or invited participants, respondent contacts, researchers, interviewers and Authorised Users insofar as their data is Processed for the Customer. |
| Data categories | Customer-selected identifiers/contact details, demographics, opinions, free-text responses, scores, audio, transcripts, certificate records, invitation and authentication records; request-applicant details; technical/session metadata; notice, consent, instruction and audit evidence. Categories apply only insofar as used or generated through the relevant Services. |
| Sensitive data | Customer-instructed Special Categories or criminal-conviction/offence data only where applicable legal conditions and safeguards are satisfied. Examples include health information, political opinions, religion and ethnicity. |
| Operations | Collection, storage, organisation, retrieval, configured access and disclosure, analysis/reporting, export, transcription, evidence recording, retention monitoring and instructed deletion or return. |
| Frequency and duration | Continuous or event-driven according to use, for the provision of the Services and applicable instructed retention, subject to end-of-service handling and the residual-copy schedule. |
| Core hosting | Firestore eur3 multi-region: Belgium and Netherlands read/write regions with a Finland witness region. Core compute, main audio storage and compliance archive: europe-west1, Belgium. |
| Other Processing | Authentication, message delivery, AI and supplier support may involve other locations identified in the Sub-processor list in Annex III. No all-services EU-only assurance is given. |
| Retention decisions | Determined by the Customer for its data; technical residual-copy and archive arrangements are described in Annex V. |
| Sensitive-data safeguards | Appropriate access restrictions, encryption, minimised disclosure, Customer-selected collection settings, confidentiality, necessary assistance and instructed retention/deletion, taking account of the actual Processing risks. |
Annex II — Security measures and Customer-support functions
A. Security obligations and technical arrangements
Seamlexly shall apply appropriate measures under clause 6. The following describes the technical arrangements relevant to the Services and the scope of the agreed protection; it is not a guarantee that incidents or interruptions cannot occur.
- Hosting and encryption. Core hosting as described in Annex I; provider-managed encryption at rest for Firestore and Cloud Storage and HTTPS/TLS for service communications. Physical infrastructure is operated by the cloud provider.
- Authentication and access. Firebase Authentication supports account access. Seamlexly shall apply appropriate server-side permissions and Customer-data access restrictions. The Customer assigns its users and permissions. An authenticated session alone shall not be treated as authority to access another Customer’s records or close another Customer’s workspace.
- Audio links. The platform uses read links with a fifteen-minute validity period. A signed link is a temporary bearer credential: a person holding it may access the file during that period. It is not an additional identity check, and forwarding a link can disclose the file. Seamlexly shall apply appropriate authorisation before issuing access credentials; the Customer shall manage its authorised recipients and handling of links.
- Confidentiality and administration. Access by personnel shall be limited to authorised functions and subject to confidentiality. Privileged access grants and revocations are managed under clause 5.
- Technical metadata. Depending on study mode, records may include masked IP addresses, raw user-agent information and, outside anonymous mode, raw IP addresses and derived hashes. Hashing or an “anonymous” setting does not guarantee that records are legally anonymous. The Customer shall take account of these records in its notices and retention decisions.
- Evidence and audit records. Notice, consent, instruction and audit functionality supports traceability. Evidence integrity may use cryptographic hashes and archived records. Evidence may contain identifiers, including actor email addresses, and is subject to appropriate access and retention controls.
- Recovery. Firestore point-in-time recovery, daily backup scheduling and storage soft-delete arrangements are described in Annex V. Their availability is not a separately agreed recovery-time, recovery-point or uninterrupted-availability guarantee.
- Security management. Seamlexly shall apply risk-appropriate security evaluation, vulnerability handling, incident response and recovery measures under clause 6. Specific certifications, testing frequencies, universal MFA coverage, dedicated support hours and recovery targets apply only if separately agreed and accurately documented.
B. Assistance and optional privacy functions
Depending on the enabled configuration, Customer-support functions include study-specific request channels, request-management records, lookup/export/deletion tools, retention reminders, notice versioning, consent-evidence tools and privacy-related study settings. The Customer uses them to implement its own decisions.
The Customer may send an assistance request to contact@nuvopoll.com identifying its account, affected study, requested action and sufficient locating information without disclosing unnecessary Personal Data. Seamlexly shall provide the assistance required by section 7, using available technical functions and, where appropriate, coordinated manual work. It may ask for clarification necessary to execute an instruction accurately.
No general legal review, outsourced data-protection-officer service, automatic fulfilment of every Data Subject right or automatic deletion upon a retention reminder is included. The availability of optional tools does not remove Seamlexly’s statutory assistance duties or its responsibility for functions expressly agreed under the Agreement.
Annex III — Approved Sub-processors
The Customer authorises the Sub-processors listed below for the relevant Services. Changes are subject to clause 12. The core hosting location does not determine every provider support or onward-processing location. An EEA contracting entity is not itself a US Data Privacy Framework recipient: any reliance on that framework concerns a qualifying transfer to an eligible certified US recipient. SCCs and other transfer instruments apply to the transfers they actually govern.
| Sub-processor | Service and purpose | Data categories | Processing / storage location | Data-protection and transfer arrangements |
|---|---|---|---|---|
| Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | Core cloud infrastructure: Firestore Native, Cloud Storage, Cloud Functions v2 and Cloud Run. | Survey structures, participant responses, audio, Customer instruction/consent/audit records and Authorised User profiles. Seamlexly’s own independent Controller records are outside this DPA. | EU: Firestore eur3 in Belgium and Netherlands with Finland witness region; core files, archive and compute in Belgium, europe-west1. | Applicable Google Cloud data-processing terms; applicable SCCs, including Processor-to-Processor provisions where relevant, and DPF for eligible onward US transfers where applicable. |
| Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | Firebase Authentication: account authentication and session management. | User/researcher email addresses, UID, authentication and session records. | EU and global Google authentication infrastructure. | Firebase Data Processing and Security Terms; applicable SCCs and DPF for eligible US transfers where applicable. |
| Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | Google Cloud Speech-to-Text v2 (Chirp 3): transcription of recorded answers when enabled. | Participant audio and generated transcripts. | EU multi-region endpoint, eu-speech.googleapis.com. | Applicable Google Cloud data-processing terms and applicable transfer safeguards for any relevant onward Processing. |
| Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA | Google AI Developer API (Gemini 2.5 Pro): survey design, question/privacy-notice translation and draft-document conversion. | Researcher prompts, draft questions and uploaded template/document text. Participant response databases, free-text answers and audio are not automatically submitted for analysis. User-selected input may contain Personal Data under clause 14.2. | USA / global; generativelanguage.googleapis.com. | Google AI Developer API terms and applicable data-protection/transfer arrangements. Abuse-monitoring retention of up to 55 days is a retention condition, not itself a transfer mechanism. |
| Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA | Default transactional email delivery: invitations, verification links, request-related messages and system/retention notifications. | Recipient email addresses, delivery metadata, message content and notification links, to the extent included in the relevant message. | USA; smtp.resend.com. | Resend Data Processing Addendum and applicable SCCs; DPF where applicable to an eligible certified recipient and covered transfer. |
Customer-configured SMTP
Where the Customer configures and enables its own SMTP server for an applicable message flow, those messages are routed through the Customer-selected provider rather than the default Resend relay. The Customer is responsible for engaging that provider and establishing the applicable privacy, security and transfer arrangements for its own provider relationship. That provider is not Seamlexly’s Sub-processor merely because the Customer connects it to Nuvopoll. Seamlexly remains responsible for its own Processing and routing of the messages and credentials. Messages outside the scope of the configured custom route remain subject to the applicable platform delivery arrangement.
Providers handling only Seamlexly’s own billing or business records are not automatically Sub-processors for Customer Personal Data. Other Customer-selected integrations are assessed under clause 12.6.
Annex IV — International transfer arrangements
A. EEA outward transfers
For each restricted transfer, the Parties shall document the actual exporter and importer, roles, destination, purpose, data categories, retention, safeguards and applicable mechanism. Where EU Standard Contractual Clauses are used, the appropriate modules, options and schedules shall be completed and the instrument validly executed or incorporated. Processor-to-Processor Module 3 may apply to Seamlexly’s relevant Sub-processor transfers, depending on the actual chain and legal scope. Required assessments and supplementary measures shall be addressed before the transfer.
This DPA does not itself deem unidentified recipients authorised or unexecuted SCCs signed. Mandatory transfer instruments prevail for the transfers they govern.
B. Türkiye-origin transfers
Where KVKK applies, the relevant Parties shall implement a valid Article 9 route for the actual transfer. If using the official Turkish standard contract, they shall execute the appropriate Controller-to-Processor or Processor-to-Processor form, complete required information and fulfil the applicable notification requirement within five business days of signature. The Parties shall document the responsible filing party and evidence of filing. The official text shall be preserved except for permitted choices or alternatives.
Derogations for occasional transfers shall not be treated as a general authorisation for routine, ongoing hosting. The Customer fulfils obligations attaching to its exporter role; Seamlexly fulfils obligations attaching to its own role and provides required cooperation.
C. UK-origin transfers
Where a transfer is covered by applicable UK adequacy arrangements, an IDTA or UK Addendum is not required merely because the exporter is in the UK. Where a relevant restricted transfer is not covered by adequacy, the Parties shall implement an appropriate lawful mechanism and complete any required instrument and assessment.
D. Other applicable local requirements
The Customer shall identify requirements applicable to its intended use, and the Parties shall address any required additional transfer instrument or arrangement before commencing affected Processing. This DPA does not promise compliance with every jurisdiction’s localisation requirements through the standard hosting configuration.
Annex V — Retention and residual-copy arrangements
| Category or process | Arrangement |
|---|---|
| Research responses, audio and transcripts | Customer-determined retention and deletion instructions. A configured retention date supports monitoring; it does not alone trigger automatic research-data deletion. |
| Retention reminders | Threshold and overdue reminders where enabled and a valid retention date is configured. The Customer remains responsible for acting on reminders and its declared retention period. |
| Certificates | Retention, required identifying fields and deletion are determined by the Customer and reflected in its notices as required. No independent indefinite certificate-retention policy is established by this DPA. |
| Server-side exports | Scheduled cleanup of files older than seven days unless the Customer selects preservation. Preserved files remain subject to Customer instructions. Downloaded copies are outside Seamlexly’s server-side cleanup. |
| Point-in-time recovery | Firestore PITR provides up to seven days of version history. |
| Daily database backups | The configured daily schedule retains backups for 98 days from backup creation. Data deleted from the active system may remain in pre-deletion backups until their expiry. This period does not extend the Customer’s permitted ordinary use of deleted data. |
| Audio storage soft delete | Deleted objects may remain recoverable for seven days under the storage soft-delete policy. This period starts on successful object deletion; an unsuccessful deletion must be addressed separately. |
| Customer Compliance Evidence | Retained and deleted under the Customer’s Documented Instructions. No Seamlexly independent-Controller retention period is prescribed for this category by this DPA. |
| Completion of the Services | Customer choice of return or deletion under clause 10.4, with coordinated export and deletion arrangements. Individual account deletion is distinct from authorised workspace closure and contractual termination. |
| Provider-held operational or abuse records | Governed by the identified provider arrangement, applicable data-protection obligations and documented instructions. Annex III and the applicable service information shall explain any material retention constraints before the affected Processing is authorised. Instant removal of every provider-held operational record is not guaranteed by this DPA. |
| Status information | On request, available deletion status, scope, known failures and residual-copy schedules under clause 10.8. |
Residual copies shall be restricted and handled under clause 10.7. Any material change to these arrangements shall be addressed under the applicable amendment, location, supplier and instruction procedures. Backup restoration or creation of additional exports shall not be used to evade a deletion instruction.
Acceptance
This DPA may be incorporated into the Agreement and accepted electronically by the Customer’s authorised representative. The applicable account or Order and acceptance record identify the Customer, representative, version and acceptance date. Separate signatures are not required where valid electronic acceptance or incorporation applies.