Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service ("Agreement") between Mindshare Studio LLC ("Processor," "we") and the subscriber that uses AutoSurvey ("Controller," "you"), and governs our processing of personal data on your behalf. Where the Agreement and this DPA conflict regarding personal data processed on your behalf, this DPA controls.

1. Roles and scope

• You are the controller (GDPR) / business (CCPA/CPRA) for personal data of survey respondents collected through AutoSurvey. We are the processor / service provider, acting only on your documented instructions.
• Your use of AutoSurvey as configured (designing surveys, collecting and storing responses, reporting, export, and the optional AI authoring features) constitutes your documented instructions. You may give additional reasonable instructions consistent with the Agreement.
• This DPA does not apply to data for which we are an independent controller (e.g., your account, billing, and service-usage data), which is governed by the Privacy Policy.

2. Subject matter, nature, and purpose of processing

• Subject matter: provision of the AutoSurvey survey-building and survey-runtime service.
• Nature and purpose: hosting survey design content; generating and running surveys; storing survey responses within your own Salesforce org; aggregating responses for in-product analytics; enabling subscriber-initiated export; and, where you enable them, AI authoring features operating on survey design content only.
• Duration: for the term of the Agreement, plus the limited periods in §9.

3. Categories of data subjects and personal data

• Data subjects: your survey respondents (and any individuals identified in survey content).
• Categories of personal data: as determined by you when you design each survey. These may include identifiers and contact details, free-text answers, and any other data your survey collects. You are responsible for not collecting special-category/regulated data unless lawfully entitled and appropriately safeguarded.

4. Our obligations

We will:

1. process personal data only on your documented instructions, including for international transfers, unless required by law (in which case we will inform you unless legally prohibited);
2. ensure persons authorized to process the data are bound by confidentiality;
3. implement appropriate technical and organizational security measures (§7);
4. respect the conditions in §5 for engaging sub-processors;
5. assist you, taking into account the nature of processing, with data-subject requests (§6) and with your obligations regarding security, breach notification, and data-protection impact assessments;
6. at your choice, delete or return personal data per §9;
7. make available information reasonably necessary to demonstrate compliance and allow for audits as described in §8.

5. Sub-processors

You provide general authorization for us to engage the sub-processors listed below to deliver the service. We impose data-protection obligations on each sub-processor substantially similar to those in this DPA and remain responsible for their performance. We will give notice of intended changes (additions/replacements) by updating this list and notifying the subscriber's admin contact by email at least 30 days before the new sub-processor begins processing, giving you a reasonable period to object on reasonable data-protection grounds.

Sub-processors

Notes:

• The subscriber's own Salesforce org, where responses are stored, is the Controller's infrastructure and is not our sub-processor.
• BYOK AI: when you use your own AI key, AI requests go directly from your org to your AI provider under your own agreement with that provider; in that configuration the AI provider is not engaged by us as a sub-processor for those calls.
• Services you choose: survey import sources (SurveyMonkey, GetFeedback, Typeform, Google Forms), Google reCAPTCHA with your own keys, and Google Fonts or Google Cloud Storage images in a survey theme are contacted only when you turn on the feature that uses them. Your org, or the respondent's browser, contacts them directly; we do not receive that data, and they are not our sub-processors. None of them receives survey answers. The Privacy Policy §5 describes each one.
• If we introduce a feature that sends respondent responses to a sub-processor, we will update this list and notify you before it takes effect.

6. Data-subject requests

Taking into account the nature of the processing, we will assist you by appropriate technical and organizational measures, insofar as possible, to fulfill your obligation to respond to data-subject requests. Because responses are stored in your own Salesforce org, you can directly access, correct, export, and delete respondent data. If we receive a request directly from a respondent, we will not respond except to direct them to you, and will inform you where appropriate.

7. Security measures

We maintain technical and organizational measures appropriate to the risk, including:

• Least-privilege, private-by-default access to response objects (Private sharing; admin/reporting access only via explicit, scoped permission sets);
• Token-gated runtime sessions (unguessable, server-validated tokens; no record IDs in URLs; hashed resume secrets);
• Secrets management: in the subscriber's org, credentials are held in Salesforce Named/External Credentials or protected settings; our control plane releases AI keys only on signed, authenticated requests over TLS; no secret is returned to the browser;
• Logging hygiene: secrets/tokens redacted from logs; security events recorded;
• Input/output handling: auto-escaped rendering and formula-injection neutralization on export.

A fuller description is maintained in our security documentation and is available on request.

8. Audits

We will make available information reasonably necessary to demonstrate compliance with this DPA and, on reasonable prior notice and subject to confidentiality, allow you (or a mutually agreed auditor) to verify compliance no more than once in any 12-month period (unless required more frequently by a supervisory authority or following a confirmed personal-data breach).

9. Return and deletion of data

• Responses in your org: You control retention and deletion of responses in your own Salesforce org. On uninstall of the managed package, AutoSurvey's managed objects and the response data they hold are removed per Salesforce's standard uninstall behavior; a customer-owned mapped reporting object and its data remain. Export any data you wish to retain before uninstalling.
• Control-plane / account data: On termination, we will delete or return personal data we hold as processor within 90 days of termination, except where retention is required by law or for ordinary back-up cycles.

10. International transfers

Where processing involves transfer of personal data across borders, the parties will rely on an appropriate transfer mechanism (e.g., Standard Contractual Clauses or an applicable data-transfer framework), as reflected in §5.

11. Breach notification

We will notify you without undue delay, and in any event within 72 hours of confirming a personal-data breach affecting personal data processed on your behalf, and will provide information reasonably available to assist you in meeting your own notification obligations.

12. Liability; order of precedence

Liability under this DPA is subject to the limitations in the Agreement. This DPA, the Privacy Policy, and the Terms of Service together state the parties' agreement on these matters; for respondent personal data processed on your behalf, this DPA prevails over conflicting terms.

13. Contact

Data-protection contact: support@mindsharestudio.com · Mindshare Studio LLC, 3916 N Potsdam Ave #2392, Sioux Falls, SD 57104.