Based on GDPR regulations, 1KA tool includes a GDPR profile available in the GDPR settings for editors, where the default DPA (Data Processing Agreement) is also provided. The DPA is part of the general terms and conditions that every 1KA user agrees to upon registration.
The default DPA contract states the following in Article 1 (Paragraph 13):
“The default retention period for personal and survey data in surveys that collect personal data is 5 years from the activation of the survey, as defined by the processor (the 1KA tool). After this period, the data will be permanently deleted. If the controller (the registered 1KA user) defines a different retention period for the purpose of the research, or if a deletion or withdrawal request is made by a respondent, it is the controller’s responsibility to ensure that deletion or withdrawal is carried out. In cases where the purpose of processing requires a different retention period and the controller would like the deletion to be performed by the processor, the controller must explicitly notify the processor in writing.”
Based on this, for all surveys that include personal data and are appropriately marked as GDPR-compliant surveys, 1KA will automatically delete all collected data and responses after the default 5-year retention period. Users will be notified of the deletion three days in advance. If a user sets a different retention period in the survey’s GDPR settings, the user is responsible for deleting the data accordingly. Similarly, the user is also responsible if personal data is collected in a survey but the survey is not properly marked as GDPR-relevant in the settings.
