Corvers Survey - Acuerdo de tratamiento de datos
Acuerdo de tratamiento de datos
Última actualización: 14 de septiembre de 2026
Este Acuerdo de tratamiento de datos ("ATD") se aplica cuando una organización utiliza
Corvers Survey para recoger respuestas a sus propios cuestionarios. En ese caso la
organización es la responsable de los datos personales tratados en sus encuestas y
Corvers actúa como su encargada.
1. Alcance y finalidad
Corvers trata datos personales únicamente para prestar el Servicio: alojar el cuestionario,
almacenar las contribuciones, generar resultados y estadísticas, enviar las notificaciones
solicitadas por el responsable y mantener copias de seguridad. Corvers no utiliza las
contribuciones para fines propios ni las vende.
2. Categorías de datos
Según cómo diseñe el responsable su cuestionario, los datos pueden incluir nombres,
direcciones de correo electrónico, datos de la organización, respuestas de texto libre y archivos
cargados por los participantes. Los participantes pueden enviar contribuciones de forma anónima, en
cuyo caso el Servicio no registra datos de conexión identificativos.
3. Duración
Los datos personales se conservan durante el periodo que fije el responsable para la encuesta y
después se eliminan o se anonimizan siguiendo sus instrucciones. Las copias de seguridad técnicas
se conservan durante un periodo rotativo limitado y se sobrescriben en el curso normal.
4. Seguridad
Corvers aplica medidas técnicas y organizativas adecuadas: control de acceso con cuentas
individuales, cifrado TLS en las conexiones, almacenamiento en infraestructura controlada por
Corvers, acceso administrativo restringido y registro de las acciones administrativas. El
alojamiento del Servicio lo opera Corvers en su propia infraestructura.
5. Subencargados
Corvers utiliza las siguientes categorías de subencargados: alojamiento de infraestructura,
envío de correo para notificaciones y almacenamiento de copias de seguridad. Corvers impone a cada
subencargado obligaciones de protección de datos equivalentes a las de este ATD e informa al
responsable de los cambios cuando éste lo solicite.
6. Asistencia y solicitudes de los interesados
Corvers asiste al responsable en la atención de las solicitudes de los interesados (acceso,
rectificación, supresión, portabilidad, oposición) y en el cumplimiento de sus obligaciones en
materia de seguridad, notificación de brechas y evaluaciones de impacto. Las solicitudes recibidas
directamente por Corvers se trasladan al responsable sin dilación indebida, salvo que éste haya
indicado otra cosa.
7. Transferencias internacionales
Los datos se alojan en infraestructura ubicada en la Unión Europea. Cualquier transferencia
fuera del Espacio Económico Europeo se realiza únicamente con un mecanismo de transferencia
lícito y con el acuerdo del responsable.
8. Notificación de brechas
Corvers notifica al responsable sin dilación indebida desde que tiene conocimiento de una brecha
de seguridad que afecte a los datos del responsable, y le facilita la información que necesite para
cumplir sus propias obligaciones de notificación.
9. Supresión al finalizar
Al finalizar, y a elección del responsable, Corvers suprime o devuelve los datos personales que
trata por cuenta del responsable, salvo cuando la ley exija conservarlos.
10. Contacto
Cuestiones de protección de datos: Soporte.
Este texto ha sido preparado por Corvers como borrador de trabajo y
está pendiente de revisión y aprobación por la función jurídica de Corvers antes de que se invoque
como vinculante.
Corvers Survey - Data Processing Agreement
Data Processing Agreement
Last updated: 14 September 2026
This Data Processing Agreement ("DPA") applies where an organisation uses
Corvers Survey to collect responses to its own questionnaires. In that
situation the organisation is the controller of the personal data processed
in its surveys and Corvers acts as its processor.
1. Scope and purpose
Corvers processes personal data only to provide the Service: hosting the questionnaire,
storing contributions, generating results and statistics, sending the notifications requested
by the controller, and maintaining backups. Corvers does not use contributions for its own
purposes and does not sell them.
2. Categories of data
Depending on how the controller designs its questionnaire, the data may include names,
e-mail addresses, organisational details, free-text answers and files uploaded by
respondents. Respondents may submit contributions anonymously, in which case the Service does
not record identifying connection details.
3. Duration
Personal data is retained for the period set by the controller for the survey, and is
then deleted or anonymised on the controller's instruction. Technical backups are retained
for a limited rolling period and are overwritten in the normal course.
4. Security
Corvers applies appropriate technical and organisational measures: access control with
individual accounts, TLS encryption for connections, storage on infrastructure controlled by
Corvers, restricted administrative access, and logging of administrative actions. The
Service's hosting is operated by Corvers on its own infrastructure.
5. Sub-processors
Corvers uses the following categories of sub-processors: infrastructure hosting,
e-mail delivery for notifications, and backup storage. Corvers imposes data-protection
obligations equivalent to those in this DPA on each sub-processor and informs the controller
of changes on request.
6. Assistance and data-subject requests
Corvers assists the controller in responding to requests from data subjects (access,
rectification, erasure, portability, objection) and in meeting its obligations regarding
security, breach notification and impact assessments. Requests received directly by Corvers
are forwarded to the controller without undue delay, unless the controller has instructed
otherwise.
7. International transfers
Data is hosted on infrastructure located in the European Union. Any transfer outside the
European Economic Area is carried out only with a lawful transfer mechanism and with the
controller's agreement.
8. Breach notification
Corvers notifies the controller without undue delay after becoming aware of a personal
data breach affecting the controller's data, and provides the information the controller
needs in order to comply with its own notification duties.
9. Deletion on termination
On termination, and at the controller's choice, Corvers deletes or returns the personal
data it processes on the controller's behalf, except where retention is required by law.
10. Contact
Data-protection questions: Support.
This text was prepared by Corvers as a working draft and is
subject to review and approval by Corvers' legal function before it is relied upon.
Corvers Survey – Datenverarbeitungsvereinbarung
Datenverarbeitungsvereinbarung
Diese Vereinbarung ist in englischer Sprache verfügbar; die englische Fassung ist
maÃgeblich. Für eine Ãbersetzung oder bei Fragen wenden Sie sich bitte an Corvers.
Data Processing Agreement
Last updated: 14 September 2026
This Data Processing Agreement ("DPA") applies where an organisation uses
Corvers Survey to collect responses to its own questionnaires. In that
situation the organisation is the controller of the personal data processed
in its surveys and Corvers acts as its processor.
1. Scope and purpose
Corvers processes personal data only to provide the Service: hosting the questionnaire,
storing contributions, generating results and statistics, sending the notifications requested
by the controller, and maintaining backups. Corvers does not use contributions for its own
purposes and does not sell them.
2. Categories of data
Depending on how the controller designs its questionnaire, the data may include names,
e-mail addresses, organisational details, free-text answers and files uploaded by
respondents. Respondents may submit contributions anonymously, in which case the Service does
not record identifying connection details.
3. Duration
Personal data is retained for the period set by the controller for the survey, and is
then deleted or anonymised on the controller's instruction. Technical backups are retained
for a limited rolling period and are overwritten in the normal course.
4. Security
Corvers applies appropriate technical and organisational measures: access control with
individual accounts, TLS encryption for connections, storage on infrastructure controlled by
Corvers, restricted administrative access, and logging of administrative actions.
5. Sub-processors
Corvers uses the following categories of sub-processors: infrastructure hosting,
e-mail delivery for notifications, and backup storage. Corvers imposes data-protection
obligations equivalent to those in this DPA on each sub-processor and informs the controller
of changes on request.
6. Assistance and data-subject requests
Corvers assists the controller in responding to requests from data subjects (access,
rectification, erasure, portability, objection) and in meeting its obligations regarding
security, breach notification and impact assessments. Requests received directly by Corvers
are forwarded to the controller without undue delay, unless the controller has instructed
otherwise.
7. International transfers
Data is hosted on infrastructure located in the European Union. Any transfer outside the
European Economic Area is carried out only with a lawful transfer mechanism and with the
controller's agreement.
8. Breach notification
Corvers notifies the controller without undue delay after becoming aware of a personal
data breach affecting the controller's data, and provides the information the controller
needs in order to comply with its own notification duties.
9. Deletion on termination
On termination, and at the controller's choice, Corvers deletes or returns the personal
data it processes on the controller's behalf, except where retention is required by law.
10. Contact
Data-protection questions: Support.
This text was prepared by Corvers as a working draft and is
subject to review and approval by Corvers' legal function before it is relied upon.
Corvers Survey - Accord sur le traitement des données
Datenverarbeitungsvereinbarung
Diese Vereinbarung ist in englischer Sprache verfügbar; die englische Fassung ist
maÃgeblich. Für eine Ãbersetzung oder bei Fragen wenden Sie sich bitte an Corvers.
Data Processing Agreement
Last updated: 14 September 2026
This Data Processing Agreement ("DPA") applies where an organisation uses
Corvers Survey to collect responses to its own questionnaires. In that
situation the organisation is the controller of the personal data processed
in its surveys and Corvers acts as its processor.
1. Scope and purpose
Corvers processes personal data only to provide the Service: hosting the questionnaire,
storing contributions, generating results and statistics, sending the notifications requested
by the controller, and maintaining backups. Corvers does not use contributions for its own
purposes and does not sell them.
2. Categories of data
Depending on how the controller designs its questionnaire, the data may include names,
e-mail addresses, organisational details, free-text answers and files uploaded by
respondents. Respondents may submit contributions anonymously, in which case the Service does
not record identifying connection details.
3. Duration
Personal data is retained for the period set by the controller for the survey, and is
then deleted or anonymised on the controller's instruction. Technical backups are retained
for a limited rolling period and are overwritten in the normal course.
4. Security
Corvers applies appropriate technical and organisational measures: access control with
individual accounts, TLS encryption for connections, storage on infrastructure controlled by
Corvers, restricted administrative access, and logging of administrative actions.
5. Sub-processors
Corvers uses the following categories of sub-processors: infrastructure hosting,
e-mail delivery for notifications, and backup storage. Corvers imposes data-protection
obligations equivalent to those in this DPA on each sub-processor and informs the controller
of changes on request.
6. Assistance and data-subject requests
Corvers assists the controller in responding to requests from data subjects (access,
rectification, erasure, portability, objection) and in meeting its obligations regarding
security, breach notification and impact assessments. Requests received directly by Corvers
are forwarded to the controller without undue delay, unless the controller has instructed
otherwise.
7. International transfers
Data is hosted on infrastructure located in the European Union. Any transfer outside the
European Economic Area is carried out only with a lawful transfer mechanism and with the
controller's agreement.
8. Breach notification
Corvers notifies the controller without undue delay after becoming aware of a personal
data breach affecting the controller's data, and provides the information the controller
needs in order to comply with its own notification duties.
9. Deletion on termination
On termination, and at the controller's choice, Corvers deletes or returns the personal
data it processes on the controller's behalf, except where retention is required by law.
10. Contact
Data-protection questions: Support.
This text was prepared by Corvers as a working draft and is
subject to review and approval by Corvers' legal function before it is relied upon.
