1. Scope
This page explains how GhostRate supports data protection rights, including rights under the EU and UK GDPR where those laws apply.
2. Roles and legal bases
GhostRate generally acts as controller for account, billing, security, and support data. An organization using GhostRate determines the purpose of its feedback board and may be the controller for board configuration and any personal data it enters. Processing is based on contract, legitimate interests, consent where required, and legal obligations.
3. Anonymous responses
The Identity Firewall is designed so GhostRate cannot connect an invite recipient to a stored response. Whether particular information is anonymous under applicable law depends on the surrounding facts; organizations must not ask questions that solicit identifying or unnecessary personal information.
4. Rights
Depending on your location, you may have rights to access, correct, erase, restrict, object to, or export personal data, and to complain to a supervisory authority. Contact [email protected]. We may need to verify your identity before acting on a request.
5. International processing
Service providers may process data in countries outside your own. Where required, we use contractual and organizational safeguards appropriate to the transfer.
6. Incidents
We assess suspected personal-data breaches and notify regulators and affected people where required by applicable law.