Feedbackly

GDPR overview

Feedbackly states repeatedly that it is 100% GDPR compliant, and its GDPR-aligned terms took effect on 1 April 2018. Five documents are published: general terms, a controller privacy policy, a processor privacy policy, a customer Data Protection Agreement whose acceptance is compulsory, and a Finnish version of the processor policy. A data protection officer is named, although two different names appear depending on the page. Concrete measures are described: personal data carries a default expiry date, personal details are displayed only on explicit request and leave an audit trail, backups are periodically filtered, breaches are notified within 24 hours, and customers may audit the vendor through a non-competing external auditor. Feedbackly undertakes not to transfer data covered by its processing agreements outside the EU or EEA.

Who owns the data?

Feedbackly's general terms state plainly that the customer owns the data and the personal data held in the service, and that Feedbackly acts as a processor. The customer is therefore the controller and carries the duties attached to that role. The same terms nevertheless grant the vendor a non-exclusive, royalty-free and irrevocable licence over all data the platform generates — customer data and Net Promoter Scores included — for its own purposes such as benchmarking within industry sectors, provided nothing identifies the customer or an individual. A separate licence covers the customer's name and logo for Feedbackly's marketing. The vendor states it will not sell or trade customer information to third parties.

Reuse rights

Because the customer owns what it collects, it may reuse that material freely without asking Feedbackly: data export is included from the entry tier upwards, and shareable real-time dashboards let results reach colleagues who hold no account. Feedbackly itself processes the data only to run the service, on the customer's documented instructions. The vendor does, however, reserve the right to use, summarise, analyse and commercially exploit every piece of data its platform collects or analyses once it has been anonymised, and that reservation expressly covers all non-personal data. For its own marketing and billing registers Feedbackly is the controller and allows itself profiling and targeting on purchase, transaction and location data. OpenAI, in Ireland, is a declared subprocessor described as a data and text analytics engine used on occasion; the site never says whether customer data is used to train AI models.

Data retention & training

Hosting summary

The Data Processing Agreement states that all Feedbackly data is hosted on Google Cloud Platform in Hamina, Finland, inside the European Union. Three other named subprocessors sit around it: Auth0 in Frankfurt, Germany, handles account authentication and holds no end-user data; Next Up Oy, in Finland, provides the SMS gateway; and OpenAI, in Ireland, is used as a data and text analytics engine on occasion. Sendgrid sends transactional email. Feedbackly undertakes never to transfer personal data covered by its processing agreements outside the EU or EEA, and provides for the European Commission's standard contractual clauses should a transfer to a third country become necessary. It does reserve the right to process data belonging to its own registers outside those territories under adequate safeguards, and acknowledges that staff may reach data from outside the EU under internal access restrictions, undertaking to report it to the customer if that happens. Subprocessors delete personal data within one business day of the need for it ending. The marketing website itself is served from Helsinki, which should not be confused with where the application data lives.