1. Who is responsible for what
- For respondent data, you (the research company) are the controller and Requesk is your processor. We process respondent data only on your documented instructions: to screen, route, de-duplicate and report on your traffic.
- For account data (your team’s names, emails and billing details), Requesk is the controller. See our Privacy policy for details.
2. Data Processing Agreement
If you route respondents from the EU or UK, you can request a Data Processing Agreement (DPA) covering Article 28 GDPR by emailing reach@requesk.com.
3. Your responsibilities as controller
- Have a lawful basis (usually consent) for collecting respondent data in your surveys.
- Tell respondents in your own privacy notice that a traffic-routing and fraud-screening provider is used.
- Only send Requesk the respondent data your project needs.
4. Respondent rights requests
Respondents should send access, correction or deletion requests to the research company that invited them. If you need our help to find or delete a respondent’s data (for example, by click ID or IP address), email us and we will assist without undue delay.
5. Sub-processors
We use the following service providers to run Requesk:
- Hosting and infrastructure: [Hosting provider and region, e.g. AWS, Mumbai (ap-south-1)]
- Email delivery: [Email delivery provider, e.g. Amazon SES]
- Payments (account data only): [Payment processor, e.g. Razorpay]
6. International transfers
Where EU or UK personal data is transferred outside those regions, we rely on safeguards recognised by the GDPR, such as the European Commission’s Standard Contractual Clauses and the UK Addendum.
7. Security and breach notification
We protect data with encryption in transit, workspace isolation, role-based access and an activity log (see our Security page). If a personal data breach affects your workspace, we will notify you without undue delay so you can meet your own reporting obligations.
8. Retention and deletion
Respondent data is kept while you need it for your projects. When you close your workspace, your data is deleted or anonymised within [90] days, unless the law requires us to keep it.