LEGAL & TRUST
Privacy policy
Last updated 2 August 2026
This policy is an operational disclosure, not a substitute for a workspace owner’s own respondent privacy notice. Surveyor’s final legal documents should be reviewed by qualified Nigerian privacy counsel before enterprise contracting.
Who this policy covers
This policy describes how Surveyor handles personal data when people visit surveyor.ng, create or use an account, contact us, pay for a plan, or respond to a survey hosted by a Surveyor customer.
Controller and processor roles
Surveyor acts as a controller for account, billing, support, security, and website-operation data that it decides how to use. For survey instruments, respondent answers, optional location information, and files submitted to a customer workspace, the workspace owner is normally the controller and Surveyor acts as its processor or service provider. The workspace owner decides the purpose, questions, lawful basis, participants, access, and retention period.
Information we collect
Account and workspace data may include name, email address, authentication records, organisation type, workspace settings, member roles, activity history, subscription and usage records, and support messages. Research data may include survey configuration, consent answers, response data, device category, source links, completion timing, optional coordinates and accuracy, and permitted uploads. Technical data may include IP-derived security fingerprints, user agent, request identifiers, cookies, and error logs.
Lawful bases
Depending on the interaction and applicable law, Surveyor relies on contract to provide paid or requested services; legitimate interests to secure, maintain, and improve the service; legal obligation for accounting, fraud prevention, and regulatory duties; and consent where the law or feature requires it. Workspace owners must identify and communicate their own lawful basis for respondent data, especially sensitive or location data.
How information is used
We use data to authenticate users; create and isolate workspaces; deliver surveys; save and validate responses; provide analytics and exports; enforce plan and abuse limits; process subscriptions; send operational email; provide support; investigate incidents; maintain audit records; and improve reliability. Surveyor does not sell respondent data or use it to build advertising profiles.
Sensitive personal data and research ethics
Surveyor can be configured to collect information that may be sensitive. Workspace owners must minimise collection, obtain valid consent or another lawful basis, provide participant information, apply appropriate ethical review, limit access, and avoid collecting sensitive data merely because a field is available. Surveyor does not determine whether a particular study is ethically or legally approved.
Location data
Location is not collected automatically by Surveyor. A workspace must use an eligible location feature and the respondent or enumerator must grant device permission. Coordinates, accuracy, and capture time may then be stored with the response. Workspace owners must explain why location is needed, offer an appropriate alternative where required, and avoid using location to infer more than the data supports.
File uploads
Workspace logos and any enabled attachments are subject to file-type, size, access, and plan restrictions. Users must not upload malware, illegal material, identity documents, or sensitive files unless the workspace has a documented need, lawful basis, and suitable safeguards. Upload availability does not mean every file is appropriate to collect.
Cookies and analytics
Surveyor uses essential cookies for authenticated sessions, security, and workspace selection. The current public site does not use advertising cookies. If non-essential product analytics is enabled later, the Cookie Policy and consent controls will be updated before use where required. Browser storage may also hold an unfinished public response, offline queue, or interactive-demo progress on that device.
Service providers and payments
Surveyor uses service providers for hosting, database and authentication, bot and abuse prevention, payment processing, and transactional email. Paystack processes checkout and payment details under its own privacy terms; Surveyor stores transaction references, plan, amount, currency, status, and subscription identifiers but does not receive full payment-card details.
International transfers
Some service providers may process data outside Nigeria or the respondent’s country. Surveyor and workspace owners must use a transfer basis and safeguards required by the Nigeria Data Protection Act 2023 and other applicable laws, considering adequacy, approved transfer instruments, contractual protections, security measures, and the recipient jurisdiction.
Retention and deletion
Account and workspace data is retained while the service is active and for a limited period afterward where needed for security, disputes, accounting, or legal obligations. Workspace owners can export data and may configure eligible retention controls. Valid deletion requests are applied to active production records after identity and authority are verified. Operational records may be retained for fraud, security, or legal reasons. Exact periods may differ by record type and customer instructions.
Backups
Encrypted or provider-managed backups may retain residual copies until the relevant backup cycle expires. Individual records may not be removable from an immutable backup without compromising recovery integrity. Backups are access-restricted, used only for continuity or disaster recovery, and any restored data remains subject to applicable deletion instructions.
Security and incident notification
Surveyor uses authenticated access, workspace-scoped authorisation, row-level database controls, request limits, security headers, signed payment webhooks, audit logging, and other technical and organisational safeguards described on the Security page. No internet service can guarantee absolute security. We investigate suspected incidents and notify affected controllers, regulators, or individuals when required by law or contract, including applicable Nigerian breach-notification timelines.
Children’s data
Surveyor is not directed to children creating their own commercial accounts. A workspace collecting data about or from children must establish age thresholds, parental or guardian authority where required, child-appropriate notices, safeguarding processes, and a lawful and ethical basis before collection.
Respondent and account-holder rights
Depending on applicable law, people may have rights to be informed, access data, correct it, object, restrict processing, request portability or deletion, withdraw consent, complain to a supervisory authority, and avoid certain solely automated decisions. For survey responses, contact the workspace owner first because it controls the study. Surveyor will assist verified workspace requests as required. Account and website requests may be sent directly to privacy@surveyor.ng.
Workspace-owner responsibilities
Workspace owners must provide an accurate respondent notice; collect only necessary data; configure access and retention; manage members and exports; respond to participant requests; document lawful basis and ethics approval where applicable; secure exported copies; and comply with communications, research, employment, health, children’s, and data-protection laws relevant to the study.
Nigeria and cross-border customers
Surveyor’s privacy programme is designed with the Nigeria Data Protection Act 2023 in view, including fair, lawful, transparent, secure, and accountable processing. Customers outside Nigeria remain responsible for additional laws that apply to their organisation, participants, or collection locations. Nothing in this policy limits mandatory rights.
Contact and complaints
Privacy requests: privacy@surveyor.ng. Legal notices: legal@surveyor.ng. Security reports: security@surveyor.ng. Include enough detail to locate the account or workspace, but do not email passwords, API keys, or unnecessary respondent data. You may also complain to the Nigeria Data Protection Commission or another competent regulator.