This section applies to people who are invited to give feedback through needseeq or who give a provider feedback on their own initiative, for example through a QR code. The provider is the company whose service you rate.
Who is responsible
- The provider is responsible for sending the invitations and reminders and for delivering your answers to the provider. needseeq processes this data on the provider's behalf (processing on behalf of a controller under Art. 28 GDPR). You can exercise your rights regarding this data with the provider.
- needseeq itself is responsible for your needseeq account, the rewards, checking the answers, preventing abuse, the unsubscribe list that applies across all providers and the newsletter. The same applies to feedback campaigns that needseeq runs for itself, for example at its trade fair booth.
What data we process
- Name, email address and company, and for an entry of your own also the country. For an invitation these details come from the provider, otherwise from you.
- Your role, for example operator or maintenance technician, when the provider uses roles: the provider assigns it with the invitation, or you choose it yourself.
- Your answers, the language you answer in and when you answered.
- Your reward choice (gift card, donation, donation to your own club or no reward) and your statements about it: whether you work in the public sector, that your employer allows you to accept a gift card, and for a donation to your own club, whether you are personally involved with it. We do not collect bank details from you.
- For an entry of your own without an invitation: a confirmation code for your email address and a hash of your IP address, which we use to detect repeated entries.
- If you create an account for your feedback: your confirmed email addresses and, if you enter them, first name, last name and role. If you sign up for the newsletter, also when you signed up and when you confirmed it.
What we use it for
- Invitation and reminder by email on behalf of the provider. The sender shown is the provider's name followed by “via needseeq”. Every invitation and reminder contains a link you can use to unsubscribe.
- Checking every answer before a reward is released. An AI checks first whether the answer addresses the questions and relates to the service. The AI can only accept an answer, never reject it; when it is unsure, someone on the needseeq team decides in person.
- For the AI check and for summarised analyses for the provider we use Gemini through Google Cloud Vertex AI, processed in the EU. Before that we remove email addresses, phone numbers, IBANs and links from the answers; names in free text may remain. Your name, email address and reward are not sent to the AI.
- Paying out the reward: we buy gift cards ourselves and send you the code by email; the gift card issuer receives no data about you. needseeq transfers donations in a collective transfer to the chosen organisation.
- The needseeq newsletter: only if you explicitly sign up for it with an entry of your own and then confirm your email address (double opt-in).
Who sees your answers
The provider sees your answers together with your name, your company and your role; we also point this out to you when you answer. Your statement on whether you are personally involved with your club, and your needseeq account, are not visible to the provider.
Sending emails through Resend
We send our emails through the service provider Resend (USA). The emails are sent from the EU (Ireland). However, Resend processes account data and email metadata, such as the recipient address and delivery status, primarily in the USA. This transfer is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795); in addition, the EU standard contractual clauses have been agreed.
Retention and deletion
- An entry of your own or a request for an invitation that you do not confirm is deleted 48 hours after you submit it. Deletion runs once a day, so this data is deleted after three days at the latest.
- A request for an invitation that the provider declines, or does not accept within 30 days, is deleted 30 days after that.
- Sign-in codes for your account are valid for 10 minutes. We delete them in the daily deletion run once they have been used or expired for 24 hours.
- You can delete your account yourself at any time. We then delete the account, your name, your role, your newsletter consent and the link to your email addresses. Answers and rewards you already gave stay with the providers' campaigns; you can ask for their deletion using the rights listed below.
- We keep your answers and your invitation data until the provider deletes them or you ask for their deletion. There is currently no fixed period after which they are deleted automatically.
- We keep accounting records for rewards and donations, namely invoices for purchased gift cards, bank statements for donation transfers and payout lists, for 8 years, and the emails in which we send gift card codes for 6 years (§ 147 AO, § 257 HGB, German tax and commercial law). The period starts at the end of the calendar year in which the record was created.
- If you unsubscribe from feedback invitations, we keep only a hash of your email address, with no time limit, so that the unsubscribe stays in effect. You will then receive no more invitations from any provider through needseeq until you undo the unsubscribe yourself or request an invitation again.
Legal basis
- Invitation to an address the provider uploads or enters: your consent (Art. 6(1)(a) GDPR in conjunction with § 7(2) UWG, the German Act against Unfair Competition). With every send, the provider confirms that it holds your consent or that the conditions of § 7(3) UWG are met; in the latter case the legal basis is the provider's legitimate interest (Art. 6(1)(f) GDPR).
- Entry of your own through a QR code or request for an invitation: your own request and participation (Art. 6(1)(b) GDPR).
- Answer, reward and your needseeq account: carrying out your participation, which you choose by submitting, and providing your account (Art. 6(1)(b) GDPR).
- Checking answers, preventing abuse and the unsubscribe list: our legitimate interest in paying rewards only for complete answers and in honouring unsubscribes permanently (Art. 6(1)(f) GDPR). There is no solely automated decision within the meaning of Art. 22 GDPR: the AI can only accept an answer; every other decision is made by someone on the needseeq team.
- Keeping records of rewards and donations: legal obligation (Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB).
- Newsletter: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future, for example by email to us.