Privacy Notice

Explanation of data protection on the pages of the domain limesurvey.org and all its subdomains (hereinafter "websites").

Data protection is an important concern for us. In the following we would like to inform you about how we process your data. We would therefore ask you to read the following information on data protection carefully.


As a company that offers its services worldwide, we may be subject to different data protection regulations in the countries in which our services are used. We pursue a standardised approach to the protection of your personal data, which is always in accordance with the applicable law. Despite this, the specific requirements as well as rights and obligations regarding our processing of personal data may vary depending on the location and applicable law. The following descriptions of data processing, the associated rights and obligations and, in particular, the restrictions on the scope of data processing represent what applies within the scope of the European General Data Protection Regulation (GDPR). If we offer our services outside the European Union or in countries where the GDPR does not apply (such as the United States of America), these descriptions, rights and obligations and limitations of scope may not necessarily apply. In particular, this privacy policy does not establish any rights or obligations that go beyond what applies in accordance with the locally applicable data protection regulations.


1. Name and contact details of the Data Controller and the company data protection officer

This data protection information applies to data processing by:

Data controller:

LimeSurvey GmbH, Survey Services & Consulting

Papenreye 63, 22453 Hamburg

Phone: +49 40 22660066 (No telephone support)

Email: info@limesurvey.org, Support: support@limesurvey.org

Website: https://www.limesurvey.org/

The company data protection officer of LimeSurvey can be contacted at the above-mentioned address, for the attn. of Mr Jörg ter Beek, or at www.cortina-consult.com, as well as at dsb.limesurvey@cortina-consult.de

Collection and storage of personal data as well as type and purpose of their use:

When visiting our websites

When you visit our website, the browser used on your device automatically sends information to the server of our website. This information is temporarily stored in a so-called log file. The following information is recorded without your intervention and stored until it is automatically deleted:

  • Anonymised (= abbreviated) IP address of the requesting computer

  • The date and time of access

  • Name and URL of the downloaded file

  • Size of the data transferred

  • Indication as to whether the download was successful

  • Website from which access is made (referrer URL)

  • The browser used and, if applicable, the operating system of your computer as well as the name of your access provider

  • The data listed will be processed by us for the following purposes:

  • Ensuring efficient connection of the websites

  • Ensuring convenient use of our websites

  • Evaluation of system security and stability and

  • for other administrative purposes

The legal basis for data processing is Art. 6 (1) sentence 1 letter f GDPR. Our legitimate interest arises from the purposes listed above for data collection. Under no circumstances will we use the data collected for the purpose of drawing conclusions about you.

We additionally use cookies and analysis services when you visit our website. For further explanations, please refer to paragraphs 3 and 4 of this privacy notice.



When registering for our newsletter

If you have expressly consented in accordance with Art. 6 (1) sentence 1 letter a GDPR, we will use your email address to send you our newsletter on a regular basis. If you have provided further information in the context of our website (e.g., first and last name, company name, industry affiliation, job title, etc.), we may use this data to send you personalised newsletters and thus be able to display content that is more relevant to you in a more targeted manner.

You can unsubscribe at any time, for example via a link at the end of each newsletter. Alternatively, you can also send your cancellation request to info@limesurvey.org by email at any time.

We use the services of ZOHO CORPORATION B. V. to send our newsletter (see section 3).

When using our contact form

If you have any queries, you can contact us using the contact form provided on the website. A valid email address and first and last name are required so that we know who sent the enquiry and can respond to it. Further information can be provided voluntarily.

Data processing for the purpose of contacting us is performed pursuant to Art. 6 (1) sentence 1 letter a GDPR on the basis of your voluntarily given consent.

The personal data collected by us for the use of the contact form will be deleted after your request has been processed.

We use the services of ZOHO CORPORATION B. V. to store and respond to your enquiry (see section 3).

When using LimeSurvey's services

If you are a user of LimeSurvey's services, we process your personal data as described in the data processing agreement stored in your customer account.

As our customers, contractual partners and authors of your surveys, we process your contact and billing information such as your name, email address, telephone number and payment information as part of our contractual relationship.

We process this data on the basis of Art. 6 (1) b) GDPR: processing is necessary for the performance of a Contract to which you are party or in order to take steps at your request prior to entering into a Contract.

However, if you are a survey participant, we process personal data exclusively as a Data Processor in accordance with the instructions of the person responsible for the respective survey. Therefore, if you have any questions about processing, please contact the persons/companies responsible for processing. We do not store any personal data in the context of surveys and do not create any profiles of survey participants.

3. Disclosure of data

Your personal data will not be disclosed to third parties for purposes other than those listed below.

We will only disclose your personal data to third parties if:

  • you have given your express consent pursuant to Art. 6 (1) sentence 1 letter a GDPR;

  • the disclosure pursuant to Art. 6 (1) sentence 1 letter f GDPR is necessary to safeguard the legitimate interests of the Data Controller or a third party, unless the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, prevail, in particular if the data subject is a child;

  • there is a legal obligation for the disclosure pursuant to Art. 6 (1) sentence 1 letter c GDPR; and

  • this is legally permissible and necessary for the processing of contractual relationships with you pursuant to Art. 6(1) sentence 1 letter b GDPR.

Otherwise, we will only disclose your data on the basis of proper data processing agreements (order processing agreement pursuant to Art. 28 GDPR).

Data transfers to so-called third countries (countries outside the European Union or the European Economic Area) are only undertaken on the basis of the standard contractual clauses of the European Commission or an adequacy decision. We also ensure that the relevant processors provide sufficient guarantees for the existence of an appropriate level of data protection.

3.1 ZOHO CORPORATION B. V.

Personal data that you as a user of our website have communicated to us through a contact enquiry (via website, email, telephone, fax or in person), a newsletter registration or direct business relationships, are processed and maintained by us with the help of a customer relationship management system (CRM system for short).

To that end, we use the services of ZOHO CORPORATION B. V. (Hoogoorddreef 15, 1101 BA, Amsterdam, Netherlands). Zoho Corporation Pvt. Ltd. is involved in the provision of Zoho. (Estancia IT Park, Plot no. 140 & 151, GST Road, Vallancherry Village, Chengalpattu Taluk, Kanchipuram District 603 202, India). Please note that although there is no adequate level of data protection in India as a third country and there is no adequacy decision by the EU Commission, Zoho Corporation Pvt. Ltd has provided sufficient guarantees to ensure an adequate level of data protection. Specifically, we have concluded the Contract for order processing with ZOHO CORPORATION B. V. and Zoho Corporation Pvt. Ltd on the basis of the EU standard contractual clauses for order processing in third countries. Details on data protection at Zoho as well as setting options for the protection of your personal data can be found in Zoho's privacy notice: https://www.zoho.eu/privacy.html.

We use the following services of ZOHO CORPORATION B. V.:

ZOHO CRM

Purpose: Maintenance of customer data

Data transmission when: (1) using our contact form, (2) using our registration form

Data exchange: The data is exchanged with ZOHO SalesIQ, ZOHO Campaigns, ZOHO Flow and ZOHO Desk


ZOHO Campaigns

Purpose: Email marketing

Data transmission when: (1) registering for our newsletter

Data exchange: The data is exchanged with ZOHO SalesIQ, ZOHO CRM, ZOHO Flow and ZOHO DESK

ZOHO Flow

Purpose: Data processing service

Data transmission when: (1) using our contact form, (2) using our registration form, (3) registering for our newsletter

Data exchange: The data is exchanged with ZOHO SalesIQ, ZOHO CRM, ZOHO Campaigns and ZOHO DESK


ZOHO SalesIQ

Purpose: Customer service chat

Data transmission when: (1) using the chat function on our websites

Data exchange: The data is exchanged with ZOHO CRM, ZOHO Campaigns, ZOHO Flow and ZOHO DESK

3.2 Web hosting

Hetzner Online GmbH

Within the framework of an order processing Contract pursuant to Art. 28 GDPR, the server hardware on which we store your (personal) data is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.

The data is stored within Germany. Hetzner itself is not authorised to log on to the system and therefore has no direct access to customer data. We have also concluded an order processing agreement with Hetzner pursuant to Art. 28 GDPR.

3.3 Consent requirements for web analysis/tracking providers

If you have given your consent to the use of cookies for statistical purposes, the following essential services are used to optimise our website and thus ensure the best possible user experience. For this purpose, anonymised usage data about the respective service is collected when you visit our website. The services mentioned below use so-called "cookies", which enable an analysis of your user behaviour. You can prevent this "tracking" by making the appropriate settings in your browser or by using the cookie consent we have provided.

We store this data exclusively for the stated purposes. The IP addresses are shortened by the last digits to ensure anonymity.


Services of Google Ireland Limited

Google Analytics

Purpose: Google Analytics allows us to collect statistics on website visits.

https://policies.google.com/privacy

Google Optimize

Purpose: Google Optimize allows us to display content dynamically (e.g., for A/B tests) on the basis of the visitor's IP address and the user behaviour of the website.

https://policies.google.com/privacy


Services of ZOHO CORPORATION B. V.

PageSense

Purpose: PageSense allows us to check the general use of our website in the form of a heat map and, as a result, to display its important content in the right place on the individual websites. We can also use PageSense to anonymously record the history of individual sessions in order to gain an understanding of how visitors use our website. PageSense also enables us to display content dynamically (e.g., for A/B tests) based on the visitor IP address and the usage behaviour of the website.

https://www.zoho.com/pagesense/terms.html, https://www.zoho.com/privacy/cookie-policy.html

SalesIQ

Purpose: We use SalesIQ to integrate a chat function on our websites. In order to provide our customer advisors with precise information about your concerns when using the chat function, SalesIQ records the usage behaviour on our websites.

https://www.zoho.com/pagesense/terms.html, https://www.zoho.com/salesiq/terms.html

3.4 Consent requirements for marketing providers

At the moment, we do not involve any external marketing providers. The "Target groups for remarketing" function in Google Analytics is deactivated.

3.5 Google Tag Manager

Our websites use Google Tag Manager. Google Tag Manager is a solution with which any website content (HTML, CSS, Javascript) can be managed, controlled and reloaded. Google Tag Manager itself is loaded via a cookie-less domain and does not collect any personal data. If content that collects data is loaded via Google Tag Manager, Tag Manager does not access this data.

4. Cookies

5. Data subject rights

You have the right:

  • pursuant to Art. 15 GDPR, to request information about the personal data of yours that we process. In particular, you may obtain information about the purposes of processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned retention period, the existence of a right to correction, deletion, restriction of processing or objection, the existence of a right of appeal, the origin of your data, if not collected by us, the existence of automated decision-making including profiling and, where appropriate, meaningful information about the details of the above;

  • pursuant to Art. 16 GDPR, to demand the immediate correction of incorrect or the completion of your personal data that we store;

  • pursuant to Art. 17 GDPR, to request the deletion of your personal data that we store, unless that processing is necessary to exercise the right to freedom of expression and information, to fulfil a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims;

  • pursuant to Art. 18 GDPR, to demand the restriction of processing of your personal data in cases where you dispute the accuracy of the data, where the processing of data is unlawful but you object to its deletion, where we no longer need the data, but you require it to assert, exercise or defend legal claims, or where you have objected to processing pursuant to Art. 21 GDPR;

  • pursuant to Art. 20 GDPR, to receive personal data that you have provided to us in a structured, current and machine-readable format, or to request its transfer to another data controller;

  • pursuant to Art. 7(3) GDPR, to revoke the consent you have given us at any time. As a result, we would no longer be allowed to continue the processing of data based on this consent; and

  • pursuant to Art. 77 GDPR, to complain to a supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence, workplace, or our registered office.

_____________________________________________________

6. Right of objection

If your personal data is based on legitimate interests pursuant to Art. 6(1) sentence 1 letter f GDPR, you have the right under Art. 21 GDPR to object to the processing of your personal data if this is due to reasons which arise from your particular situation or if the objection is raised against direct advertising. In the latter case, you have a general right to object, which we will implement without specifying a particular situation.

If you wish to exercise your right of revocation or objection, simply send an email to info@limesurvey.org.


7. Data security

When you visit our website, we use the widely used SSL (Secure Socket Layer) method in conjunction with the highest level of encryption supported by your browser. Typically, this involves 256-bit encryption. If your browser does not support 256-bit encryption, we use 128-bit v3 technology instead. The transmission of a single page of our website in encrypted form is indicated on our website by the display of a closed key or lock icon in the bottom status bar of your browser.

We also use suitable technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorised access by third parties. When personal data is collected, their transfer will be encrypted in order to prevent misuse of data by third parties. Our security measures are continuously updated according to technological developments.


8. Updating and amending of this privacy notice

This privacy notice is currently valid as of 26 April 2024.

It may become necessary to amend this data protection notice as a result of further developing our websites and services or due to changes in legal or official requirements. You can access and print out the current privacy notice on our websites at any time.