Privacy policy

Introduction

1.1 Scope

This Privacy Notice applies to all the products, services, websites and apps offered by IAY Inc., IAY Europe UC, and other IAY affiliates (collectively “IAY”), except where otherwise noted. We refer to those IAY products, services, websites, and apps collectively as the “services” in this Privacy Notice. Unless otherwise noted in your contract, our services are provided by IAY Inc. inside of the United States, and by IAY Europe UC everywhere else.

This Privacy Notice does not apply to personal information we collect from our employees or job applicants in their capacity as employees or candidates.

1.2 Quick Links

If you want to identify your data controller please see the “Who is my data controller?” section below.

For a quick snapshot of how IAY treats personal information see our Privacy Basics.

Personal Data we collect and the sources

2.1 What do we mean by 'Personal Data'?

References in this Privacy Notice to data, personal information, or information, are all references to Personal Data. Personal Data means information relating to a living individual (a "Data Subject") who is, or can be, reasonably identified from the information, either alone or in conjunction with other information.

2.2 Who do we collect data about?

We group persons or businesses into the following categories:

Creator: the business or person that holds an account within a IAY service that either directly creates surveys, forms, applications, or questionnaires or that can collaborate, comment, or review surveys, forms, applications, or questionnaires within an account.

Respondent: the individual that receives a survey, form, application, or questionnaire powered by a IAY service.

2.3 Types of Personal Data We Collect

(a) Contact information.

You might provide us with your contact information (for example: name or email address), whether through use of our services, a form on our website, an interaction with our sales or customer support team, or a response to one of IAY’s own surveys or forms.

(b) Cookie information.

We use first party and third-party cookies and tracking services that employ cookies and page tags to collect data about visitors to our websites. This data includes usage and user statistics. Emails sent by IAY or by users through our services also include page tags that allow the sender to collect information about who opened those emails and clicked on links in them.

We collect information submitted through our Customer Support portal, such as name, email, and message text. We also record the content of Customer Support, Customer Success, and Sales calls.

(d) Usage information.

We collect usage information about you whenever you interact with our websites and services. This includes which webpages you visit, what you click on, when you perform those actions, what language preference you have, what you buy and so on.

(e) Device and browser data.

We collect information from the device and application you use to access our services. Device data mainly means your IP address, operating system version, device type, device ID/MAC address, system and performance information, browser type, and other device, network and browser signals. If you are on a mobile device we also collect the UUID for that device. We also infer your geographic location based on your IP address.

(f) Event data.

Like most websites today, our web servers keep log files that record data each time a device accesses those servers. The log files contain data about the nature of each access, including originating IP addresses, internet service providers, the files viewed on our site (e.g., HTML pages, graphics, etc.), operating system versions, device type and timestamps.

(g) Referral information.

If you arrive at a IAY website from an external source (such as a link on another website or in an email) or have been invited to review a survey as a guest, we record information about the source that referred you to us.

(h) Integration data.

We collect information from third parties with whom IAY enables integrations in order to allow you to use both services.

(i) Account information.

Registration information.

You need a IAY account before you can use IAY services. When you register for an account, we collect your first and last name, username, password and email address.

Billing information.

If you make a payment to IAY, we require you to provide your billing details, a name, address, email address and financial information corresponding to your selected method of payment (e.g., a credit card number and expiration date or a bank account number). If you provide a billing address, we will regard that as the location of the account holder to determine the IAY entity with whom you contract and the sales tax, if applicable, to be applied to your purchase.

Account settings.

You can set various preferences and personal details on pages like your account settings page (or on your account settings page for our other products as applicable). These may include, for example, your default language, time zone and communication preferences (e.g., opting in or out of receiving marketing communications from IAY).

(j) Address book information.

We may allow you to import email addresses and other contact information into an Address Book so you can easily invite people to take your surveys or fill in your form via our collectors. We do not use this data for our own purposes or to contact anyone, except at your direction.

(k) Survey/form/application data.

We store your survey/form/application data (questions and responses) for you and provide analysis tools for you to use with respect to this data.

(l) First party profile information.

When you sign up for our services you are asked to provide us with information about yourself and to give us more detailed insights into who you are. If you are in a IAY Enterprise account this may include providing your photo so your administrator(s) and colleagues can identify you.

(m) Third-party profile information.

We may combine information about you from third-party sources (such as LinkedIn, ZoomInfo, and other data brokers) with information we hold about you to create a user profile.

How we use the Personal Data we collect

3.1 Creator

We process Personal Data about you as a Creator where:

You have consented;
We need to fulfill our contractual responsibility;
We have a legitimate interest; and
We have a legal obligation.

3.1.1 Consent

We rely on your consent to process the following data elements:

(a) Cookies and similar technology.

We or third-party data and advertising platforms that we work with collect data from and advertising cookies, page tags, mobile identifiers and IP addresses. We use this data to infer users’ common identities across different services and multiple devices. We may do so, for instance, to tailor ads, personalize marketing, to enable us to determine the success of our advertising campaigns and to improve upon them. You can withdraw your consent at any time.

These third-party data and advertising platforms may sometimes use data that we provide to them in order to improve their technologies and their ability to match common devices to users.

To learn more about interest-based advertising and how to opt-out of it, please see our Cookies Notice in Section 6. By clearing your cookies in your browser settings, you will no longer see personalized messages in this way but you continue to see ads over the internet that are not based on the information you provided to IAY. Depending on your geographic location you can also withdraw your consent using our in-product cookie management tools.

(b) Contact information.

We use contact information to respond to your inquiries, send you information as part of the services, and send you marketing information. In jurisdictions where opt-in is required, we will only send you marketing materials based on your consent.

3.1.2 Contract

We collect and use the following data elements on the basis that we have to use this information in order to fulfill our contract with you:

(a) Account information.

We need to use your account information to run your account, provide you with services, bill you for our services, resolve disputes such as chargebacks and refund requests, provide you with customer support, and contact you or your organization about your service or account. These communications are of a transactional nature (e.g., service-related announcements, billing-related matters, changes to our services or policies, a welcome email when you first register). You cannot opt out of these communications since they are required to provide our services to you.

We may also use billing information in aggregate to adjust or manage pricing at the individual level or across all service users.

(b) Customer support information.

We will use information submitted through our Customer Support emails, chats, or phone calls, such as name, email, and message content, in order to provide you with customer support.

We use data about how you use our services and how our services are performing to ensure that we’re meeting our service-level agreements (SLAs) or other contractual obligations to you.

(d) Device and browser data.

We use device data both to troubleshoot problems with our service and to make improvements to it. We will also use this data to facilitate account verification and sign in and to enforce our password sharing and security policies. We collect this to help us improve your service experience through a specific device/browser by optimizing how the website looks in a particular browser, how your screen brightness affects your experience and to ensure the service operates optimally and as it should on different devices and browsers.

(e) Integration data.

We collect and use information from third parties and integration partners, where applicable to one of our services, to:

Ensure you can sign-up to our service from a third-party integration like SSO;
Ensure you can use our service in conjunction with other services.
See further information here on our API partners – for other IAY services see below or on the website for that service.

(f) Survey questions and survey responses.

We use machine learning techniques on survey data in order to provide users with useful statistics and more relevant insights from the data they have collected using our services. For example, if you have used open text questions in a survey, our machine learning may provide you with useful insights into sentiment and/or the trends in responses to that question in our Analyze survey tool.

(g) Aggregated or de-identified survey questions and responses.

We use aggregated or de-identified information to provide users with useful benchmarking statistics and more relevant insights from the data they have collected using our services.

We also use this data to enforce our agreements, where applicable.

3.1.3 Legitimate interests

We process your personal information in the following categories of data for legitimate interests pursued by us. We have undertaken to ensure that we place clear limitations on each of these uses so that your privacy is respected and only the information necessary to achieve these legitimate aims is used.

(a) Contact information.

Where consent is not required, we use contact information to send you marketing information based on our legitimate interests for as long as you do not opt out. You can opt out of marketing communications at any time by clicking on the “unsubscribe” link in emails or changing the relevant setting on your My Account page.

(b) Customer support information.

We may use information provided to our Customer Support, Customer Success, and Sales teams such as name, email, and message content to train machine learning models to better predict customer support question type, provide answers, generate insights about customer support trends, and to improve our Customer Support for you. This data is de-identified where possible.

We use information about how you use our services to improve our services for you and all users and to make recommendations to you and your organization about our other services.

For example: We collect information about the types of surveys/forms/applications you create (e.g., HR surveys), the types of plans you purchase and your account transactional behavior to build a profile about you so as to help direct you and your organization to other relevant features and services we offer and to optimize user experience, for example by making recommendations to you or your organization.

We may also use usage information such as levels and nature of activity in your account and number of responses you are receiving to personalize the features and services we highlight for you and your organization in our Sites, improve user experience and to make recommendations to you and your organization about our services through our sales and marketing efforts.

(d) Event data.

We use events contained in log data for many different business purposes to include:

To create new services, features, content or make recommendations.
To track behavior at the aggregate/de-identified level to identify and understand trends in the various interactions with our services.
To fix bugs and troubleshoot product functionality.
To investigate security issues.

For example: Your IP address is used to determine where an unknown/unauthorized access may have occurred in your account (abuse monitoring).

(e) First party information.

We process other aspects of your account information (like the personal information you provide about your job, your job title, and your marketing preferences) as well as information obtained from public sources, to provide you with a personalized experience and relevant and useful marketing information as well as to make other product, feature and service recommendations to you and your organization to optimize the use of the services we offer (where permitted by law).

You can object to us using your information as described above but in some cases, our ability to fully and properly provide our services to you may be impacted if you do not want us to collect or use the above data.

(f) Third-party information.

We combine information about you from third-party sources (such as LinkedIn and ZoomInfo) with information we hold about you to create a user profile, which will help us to make our sales and marketing efforts more relevant to you and to personalize and improve your service experience.

(g) Referral information.

We use referral information to track the success of our integrations and referral processes.

(h) End page data.

If you use our survey tool, depending on the package you are on and the settings you have selected, your Respondents may reach the standard survey end page on completion of a survey. The end page is part of the IAY website. We may include our own research surveys and polling on this end page. These surveys are optional for any Respondent to take or skip.

(i) De-identified Device Data.

We use aggregated or de-identified Device Data to extract usage patterns and to improve our services.

(j) De-identified Survey Data.

We use machine learning techniques on aggregated or de-identified survey questions and responses to understand usage and improve our services.

3.1.4 Legal obligation.

(a) To respond to legal requests, we may need to use and disclose information we hold about you. If we receive a subpoena or other legal request, we may need to inspect the data we hold to determine how to respond.

(b) We may also use usage data, event data, and aggregated or (where possible) de-identified survey questions and responses:

To enforce our agreements where applicable;
To investigate security issues;
To prevent or address potentially unlawful activities; and
To screen for and prevent undesirable or abusive activity. For example, we have automated systems that screen content for phishing activities, spam, and fraud under our Acceptable Uses Policy.

3.2 Respondent

We process Personal Data about you as a Respondent where:

We need to fulfill our contractual responsibility to deliver the services to the Creator of the survey;
We have a legitimate interest; and
We have a legal obligation.

3.2.1 Contract

(a) Contact information.

We only use contact information to respond to an inquiry on behalf of a Customer if you, as a Respondent, contact us.

(b) Cookies.

We use required cookies to ensure the operation of a Creator’s survey, form, application, or other IAY product. These cookies are used to ensure that all aspects of the survey operate appropriately and optimally. For more information please read our Cookies section below and our Respondent Cookies Notice.

Examples: We also use cookies to ensure a respondent can only take a survey once and to track completion rates of surveys.

After completion of a survey, in most cases, you will be redirected to our website and treated as a website visitor where other cookies may be used so you should read our Website Visitor section if this is of interest to you.

We use device data both to troubleshoot problems with our service and to make improvements to it.

We use your device and browser data to provide our services to the Creator. For example: your IP address is used to ensure that you do not complete the same survey, form, application or questionnaire twice if the creator has included settings to avoid this (ballot stuffing).

(d) Inferred geographic location.

We also may infer your geographic location based on your IP address. This allows Creators to filter responses by inferred geographic location. Note: we do not collect precise (GPS) location.

(e) Event data.

We use event data for many different business purposes including the following:

To create and improve services, features, content or make recommendations;
To track behavior at the aggregate/de-identified level to identify and understand trends in the various interactions with our services; and
To fix bugs and troubleshoot product functionality.

(f) Third parties and integration data.

We will collect and use information from third parties and integration partners to facilitate Creators in sending surveys/forms/applications/questionnaires to you.

(g) Survey response data.

IAY may use first party machine learning or third-party artificial intelligence tools on data around the type of survey the Creator has sent you, the question type, survey responses (at an aggregated and de-identified/pseudonymized level only where possible), and device and event data associated with responses to fulfill our contract with Creators and provide Creators with useful and relevant insights from the data they have collected using our services. Specifically, we use machine learning on survey data to help Creators by:

identifying trends in their responses;
ongoing training of models to optimize responses;
extracting and analyzing usage patterns, for example, we might use this data to help improve analysis of responses;
undertaking personalization for survey Creators;
improving user experience (for example, by collecting and using device and browser information from Respondents to improve how our survey service operates on those devices and in those browsers or by altering questions to match the responses being provided by a Respondent); and
identify insightful data trends (which do not disclose Personal Data) and make recommendations to Creators based on those trends.

3.2.2 Legitimate Interests

(a) Usage information.

We use information about how you use our services to improve our services for you and all users and to make recommendations to our customers about usage of our services.

(b) Responses (in aggregated and/or de-identified form).

To build new product features.

We may infer your geographic location based on your IP address to produce aggregated data around Respondent location trends. We will use this information to compare and look at trends on how our service operates. Note: we do not collect precise (GPS) location.

(d) Email address.

Depending on your geographic location, we may share your email address in hashed form with marketing vendors to present personalized advertisements such as display, videos, and content on the web or connected devices.

(e) Customer support information.

3.2.3 Legal obligation

(a) To respond to legal requests, we may need to disclose information we hold about you. If we receive a subpoena or other legal request, we may need to inspect the data we hold to determine how to respond.

(b) We may also use usage data, event data, and aggregated or de-identified survey questions and responses:

To enforce our agreements where applicable;
To investigate security issues;
To prevent or address potentially unlawful activities; and
To screen for and prevent undesirable or abusive activity . For example, we have automated systems that screen content for phishing activities, spam, and fraud under our Acceptable Uses Policy.

How we share or disclose Personal Data

4.1 Information you share

Remember that when you share information publicly, it can be indexable by search engines. Our services provide you with different options on sharing and deleting your content but we cannot delete content from search engines so you need to be careful about information you make public.

4.2 Information we share

We do not share your information or data with third parties outside IAY except in the following limited circumstances:

(a) If you are a Creator that is part of a IAY team plan, your account information and data will be shared with the primary administrator(s). Your administrator(s) will be able to view your account data, change your passwords, suspend, transfer or terminate your account or restrict your settings.

(b) If you are the primary administrator of a IAY team plan, the team name and the domain of the email address on your account may be shared with an individual who has been invited to preview a survey created by one of the members of your team in order to facilitate their request to join the team.

(c) If you are part of a IAY team plan, your plan’s administrator(s) can transfer your survey questions and responses to, or share them with, other members in your team, including your plan’s administrator(s) themselves. Your plan’s administrator(s) can also delete your survey questions and responses.

(d) If your organization has purchased a IAY plan and you are using an email address on a domain owned by your employer or organization your email address, name and account data will subsequently be visible to the primary administrator(s) for that account.

(e) To help us provide certain aspects of our services we use our affiliates and trusted key partners – in particular, we engage third parties to:

facilitate our collectors for sending surveys by email or text to Respondents. For email delivery, we use Mailgun and for text/SMS services we use Twilio. We share the relevant contact information for respondents (email address or phone number as applicable) with these third parties.
to facilitate the delivery of certain features, for example if you use Holly AI we will send your survey prompts to our AI vendor. We recommend that you do not include Personal Data in these prompts but if you do they will be shared with the AI vendor.
to detect fraud (to include, for example, performing identify checks or verify malicious IPs).
deliver and help us track our marketing and advertising content.
help us track website conversion success metrics.
manage our sales and customer support services to you, including for resolving any disputes.

We enter into confidentiality and data processing terms with partners to ensure they comply with high levels of confidentiality and best practices in privacy and security standards and we regularly review these standards and practices.

(f) On your instructions, we share your information or data if you choose to use an integration in conjunction with IAY services, to the extent necessary to facilitate that use.

(g) We also may have to share information or data for the following purposes:

To meet any applicable law, regulation, legal process or enforceable governmental request;
To enforce applicable policies, including investigation of potential violations;
To detect, prevent, or otherwise address fraud, security or technical issues;
To protect against harm to the rights, property or safety of our users, the public or to IAY and/or as required or permitted by law; and
To facilitate a sale, merger or change in control of all or any part of our company or business or in preparation for any of these events.

Data retention

If you are a Creator, we generally do not delete the data in your account as long as your account is active – you are responsible for and control the time periods for which you retain this data. You can read about this here for account use. Here are some exceptions:

If you are a IAY Basic (free) user on our platforms and you have not engaged with the service actively for some time, we reserve the right to delete your account and data in accordance with our data retention policy.

If you have exceeded your response limit as a IAY Basic (free) account holder, we will delete the overages if you do not upgrade within a fixed timeframe.

We also encourage Creators to actively review their data retention practices in their account and take care to retain data only as long as is strictly necessary.

We also describe the expiry periods for cookies on our websites in our Cookies Notice.

Personalized marketing and cookies

We and our partners use cookies and similar technologies on our websites. For more information see our Cookies Notice. For information about cookies used in our surveys please see Cookies used on Survey Pages. If you are a customer of IAY and separately use cookies or similar technologies in conjunction with any of our products and services, then you yourself will be responsible for complying with any laws related to the use of those technologies and this Privacy Notice is not applicable to that use by you.

You can also choose to remove or disable cookies via your browser settings and, depending on your geographic location you can withdraw consent to non-essential cookies using the in-product cookie preferences tool.

You can opt-out from direct marketing in your account and we provide opt-out options in all direct marketing emails. Finally, if you do not wish to see personalized marketing content on the web related to our service you can clear the cookies in your browser settings. See our Help Center article on how to do this here.

Depending on your geographic location, we may share your email address in hashed form with marketing vendors to present targeted and personalized marketing and sales information online. You can opt out via this portal.

Security

We have a published security statement related to our self-serve businesses. For more information please ask.

Safety of Minors

Our services (including creating and responding to surveys) are not intended for and may not be used by minors. “Minors” are individuals under the age of 16 (or under a higher age as provided in certain countries or territories). IAY does not knowingly collect Personal Data from Minors or allow them to register. If it comes to our attention that we have collected Personal Data from a Minor, we may delete this information without notice. If you have reason to believe that this has occurred, please contact customer support.

Data Transfers

Your information and data may be processed in and transferred or disclosed in the United States and countries in which our affiliates are located and in which our service providers are located or have servers. You can view a list of these locations in our EU Data Transfer Statement. You can also read about data that is stored in our other data centers here in our International Data Center Overview. We ensure that the recipient of your Personal Data offers an adequate level of protection, for instance by entering into the appropriate back-to-back agreements with standard contractual clauses or other transfer mechanisms as approved by the European Commission or relevant data protection authority.

We have also provided a help article which answers some additional questions about data transfers to the US.

9.1 EU-U.S. Data Privacy Framework (DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF Principles.

IAY Inc. has self-certified its compliance under the EU-U.S. Data Privacy Framework, the UK Extension and the Swiss-U.S. DPF Principles. IAY Inc. is committed to subjecting all personal information received from the European Union (EU) member countries, the United Kingdom, and Switzerland to the Framework’s applicable Principles. IAY Inc. has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. IAY Inc. has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Privacy Notice and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework Program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

IAY Inc. also complies with the onward transfer liability provisions of the DPF.

When IAY Inc. receives personal information under the DPF and then transfers it to a third-party service provider acting as agent on IAY Inc.'s behalf, IAY Inc. has certain liability under the DPF if both (i) the agent processes the information in a manner inconsistent with the DPF and (ii) IAY Inc. is responsible for the event giving rise to the damage. In certain situations, IAY Inc. may be required to disclose Personal Data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

With respect to Personal Data received or transferred pursuant to the DPF, IAY Inc. is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission. Please contact IAY Inc. as described in Section 11 below if you have any concerns or complaints of any nature. If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact us. Under certain conditions, you may invoke binding arbitration when other dispute resolution procedures have been exhausted.

Who is my data controller?

If you have provided survey responses, filled out a form, submitted an application, or provided website feedback to a Creator using IAY services, that Creator is the controller of your data, and IAY is the processor of that data.

For IAY Enterprise account holders, your organization’s primary administrator controls some basic account level information which you input when setting up your account like name, email address, and profile photo. 

If you have provided survey responses, filled out a form, submitted an application, or provided website feedback directly to IAY or at IAY's request through a third party, then IAY is the controller and our use of that data is described by this Notice and in our IAY Research Privacy Notice.

If you are a Creator and have received more responses than your plan allows (“overage data”), IAY is the controller over the overage data until you change your plan type, or the overage data is deleted in accordance with section 12.4 of our Terms of Use or per the terms of your negotiated contract.

Your rights

You may wish to exercise a right to obtain information about yourself or to correct, update or delete that information. For more information about these rights you can read about it here. Some of these rights may be subject to some exceptions or limitations in local law. Please note your rights and choices vary depending upon your location. We will take reasonable steps to verify your identity and we will respond to your request to exercise these rights within a reasonable time (and in all cases within 30 days of receiving a request) subject to the below for specific categories of person.

11.1 Creator

Where you hold an account with any IAY service, you are entitled to a copy of all Personal Data which we hold in relation to you. You also may be entitled to request that we restrict how we use your data or object to some aspect of our treatment of your data. You can access a lot of your data in your own account when you log in. If you want to exercise your rights, please contact us here.

11.2 Respondent

Where you have responded to a survey, form, questionnaire or application sent to you by a Creator using a IAY service, you will need to reach out directly to that individual or organization to discuss managing, deleting, accessing, restricting access to or otherwise withdrawing consent for use of the information which you provided to them in your responses. IAY does not control your response data and, accordingly, is not in a position to directly handle these requests in relation to that data. If you are having difficulties finding this Creator or if you have any other questions after reading this Privacy Notice, you can contact us through our support team and we will try our best to help you.

11.3 Other rights and choices

For rights and choices specific to US persons, please refer to our Region Specific Privacy Notice. Please note we will take reasonable steps to verify your identity and the authenticity of your request as described in that Notice.

11.4 Contact

Please contact us online here.

11.5 Complaints

If you are a resident in the European Union and you are dissatisfied with how we have managed a complaint you have submitted to us, you are entitled to contact your local data protection supervisory authority. As IAY Europe UC operates its business in Ireland, it operates under the remit of the Irish Office of the Data Protection Commissioner (see: IDPC Website).

Changes to our Privacy Notice

We can make changes to the Privacy Basics and this Privacy Notice from time to time. We will identify the changes we have made on this page. In circumstances where a change will materially change the way in which we collect or use your personal information or data, we will send a notice of this change to all of our account holders