GDPR

Scope

This page supplements our Privacy Policy for visitors located in the European Economic Area (EEA), the United Kingdom, and Switzerland, where the General Data Protection Regulation (GDPR), the UK GDPR, and equivalent Swiss law apply. Where a term used here is not defined, it has the meaning given to it under the GDPR.

Legal bases for processing

• Performance of a service when you request pages, calculators, exports, or support that requires processing your data to deliver.
• Legitimate interests, appropriately balanced against your rights, for site security, debugging, reliability, abuse prevention, and general product improvement.
• Consent, which you can withdraw at any time through our cookie preference control, for optional analytics, advertising, and preference cookies.
• Legal obligation, where we must preserve or disclose information to comply with applicable law, a court order, or a valid legal request.

Your rights under the GDPR

• Right of access - to obtain confirmation of whether we process your personal data and, where we do, a copy of it.
• Right to rectification - to have inaccurate personal data corrected or incomplete data completed.
• Right to erasure ("right to be forgotten") - to request deletion of your personal data in certain circumstances.
• Right to restriction of processing - to request that we limit how we use your data in certain circumstances.
• Right to data portability - to receive personal data you provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
• Right to object - to object to processing based on legitimate interests or for direct marketing purposes, including profiling related to such marketing.
• Rights related to automated decision-making - AnswerCanvas does not use automated decision-making that produces legal or similarly significant effects about individuals.

Data retention

We retain personal data only for as long as necessary for the purposes described in our Privacy Policy, taking into account the nature of the data, the purpose of processing, and any applicable legal retention obligations. See the Data Retention section of our Privacy Policy for typical retention periods.

International transfers

Where personal data is transferred outside the EEA, UK, or Switzerland - for example, to a service provider located in the United States - we rely on appropriate safeguards recognized under the GDPR, such as the European Commission's standard contractual clauses, the UK's International Data Transfer Agreement or Addendum, or an adequacy decision, as applicable to the specific transfer.

Exercising your rights

To make a privacy request, use the Contact Us page and include your country of residence, the specific right you wish to exercise, and enough information for us to locate the relevant interaction (for example, the approximate date and nature of your visit or correspondence). We may need to verify your request before acting on it, and we will respond within the timeframe required by applicable law, generally within one month, which may be extended by a further two months for complex requests with notice to you.

Right to lodge a complaint

If you believe our processing of your personal data does not comply with applicable data protection law, you have the right to lodge a complaint with a supervisory authority, in particular in the EU member state, UK, or Swiss canton of your habitual residence, place of work, or the place of the alleged infringement. We encourage you to contact us first so we can try to address your concern directly.