63% of people consider a company's privacy and security history before using their products or services.
LAST UPDATED: September 22, 2023
This Privacy Notice applies to all the products, services, websites and apps offered by SurveyMonkey Inc., SurveyMonkey Europe UC, SurveyMonkey Brasil Internet Ltda., SurveyMonkey Netherlands B.V., and other SurveyMonkey affiliates (collectively “SurveyMonkey”), except where otherwise noted. The services include SurveyMonkey, SurveyMonkey Apply, SurveyMonkey Audience, SurveyMonkey Rewards, SurveyMonkey Contribute, Wufoo, TechValidate, GetFeedback Direct, and GetFeedback Digital. We refer to those products, services, websites, and apps collectively as the “services” in this notice. Unless otherwise noted in your contract, our services are provided by SurveyMonkey Inc. inside of the United States, by SurveyMonkey Brasil Internet Ltda. inside of Brazil, and by SurveyMonkey Europe UC everywhere else.
US residents: Please visit our Region Specific Privacy Notice for more information on our privacy practices specific to individual states.
This Privacy Notice does not apply to personal information we collect from our employees or job applicants in their capacity as employees or candidates. Employees and candidates should refer to our Employee Privacy Notice or Candidate Privacy Notice, respectively.
This Notice consists of the following sections:
If you are a Creator, we may also collect:
When you use our services, we may also collect the following data on your behalf for certain services:
Information you share
Many of our services let you share information with others. Remember that when you share information publicly, it can be indexable by search engines. Our services provide you with different options on sharing and deleting your content but we cannot delete content from search engines so you need to be careful about information you make public.
Information we share
We do not share your information or data with third parties outside SurveyMonkey except in the following limited circumstances:
We enter into confidentiality and data processing terms with partners to ensure they comply with high levels of confidentiality and best practices in privacy and security standards and we regularly review these standards and practices. You can find more information in our Subprocessor Statement.
If you are a Creator, we generally do not delete the data in your account as long as your account is active – you are responsible for and control the time periods for which you retain this data. You can read about this here for account use. Here are some exceptions:
We also encourage Creators to actively review their data retention practices in their account and take care to retain data only as long as is strictly necessary.
You can also choose to remove or disable cookies via your browser settings and, depending on your geographic location you can withdraw consent to non-essential cookies using the in-product cookie preferences tool.
You can opt-out from direct marketing in your account and we provide opt-out options in all direct marketing emails. Finally, if you do not wish to see personalized marketing content on the web related to our service you can clear the cookies in your browser settings. See our Help Center article on how to do this here.
Our services are not intended for and may not be used by minors. “Minors” are individuals under the age of 16 (or under a higher age as provided in certain countries or territories). SurveyMonkey does not knowingly collect personal data from Minors or allow them to register. If it comes to our attention that we have collected personal data from a Minor, we may delete this information without notice. If you have reason to believe that this has occurred, please contact customer support.
Your information and data may be processed in and transferred or disclosed in the United States and countries in which our affiliates are located and in which our service providers are located or have servers. You can view a list of these locations in our EU Data Transfer Statement. We ensure that the recipient of your Personal Data offers an adequate level of protection, for instance by entering into the appropriate back-to-back agreements with standard contractual clauses or other transfer mechanisms as approved by the European Commission or relevant data protection authority.
We have also provided a help article which answers some additional questions about data transfers to the US.
EU-U.S. Data Privacy Framework (DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF Principles.
SurveyMonkey Inc. has self-certified its compliance under the EU-U.S. Data Privacy Framework, and will certify to the UK Extension and the Swiss-U.S. DPF Principles once approved. SurveyMonkey is committed to subjecting all personal information received from the European Union (EU) member countries, the United Kingdom, and Switzerland to the Framework’s applicable Principles. To learn more about the DPF, see https://www.dataprivacyframework.gov/s.
SurveyMonkey also complies with the onward transfer liability provisions of the DPF.
When SurveyMonkey receives personal information under the DPF and then transfers it to a third-party service provider acting as agent on SurveyMonkey's behalf, SurveyMonkey has certain liability under the DPF if both (i) the agent processes the information in a manner inconsistent with the DPF and (ii) SurveyMonkey is responsible for the event giving rise to the damage. In certain situations, SurveyMonkey may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
With respect to personal data received or transferred pursuant to the DPF, SurveyMonkey is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission. Please contact SurveyMonkey as described in Section 11 below if you have any concerns or complaints of any nature. If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third party dispute resolution provider, (free of charge) at https://www.jamsadr.com/dpf-dispute-resolution.
Under certain conditions, more fully described on the DPF website https://www.dataprivacyframework.gov/s/article/How-to-Submit-a-Complaint-Relating-to-a-Participating-Organization-s-Compliance-with-the-DPF-Principles-dpf, you may invoke binding arbitration when other dispute resolution procedures have been exhausted.
If you have provided survey responses, filled out a form, submitted an application, or provided website feedback to a Creator using SurveyMonkey services, that Creator is the controller of your data, and SurveyMonkey is the processor of that data.
For SurveyMonkey Enterprise account holders, your organization’s primary administrator controls some basic account level information which you input when setting up your account like name, email address and profile photo.
If you have provided survey responses, filled out a form, submitted an application, or provided website feedback directly to SurveyMonkey, then SurveyMonkey is the controller and our use of that data is described in our SurveyMonkey Research Privacy Notice.
SurveyMonkey can be a data controller of data about Respondents only in the very limited ways described in the section here called “How we use the information we collect - Respondent”. To the extent that is the case we have identified the correct controller below.
SurveyMonkey is a controller for the account-level data provided by its Creators and panelists from Contribute and Rewards.
You may wish to exercise a right to obtain information about yourself or to correct, update or delete that information. For more information about these rights you can read about it here. Some of these rights may be subject to some exceptions or limitations in local law. Please note your rights and choices vary depending upon your location. We will take reasonable steps to verify your identity and we will respond to your request to exercise these rights within a reasonable time (and in all cases within 30 days of receiving a request) subject to the below for specific categories of person.
Other rights and choices
Except as explicitly provided herein, please use the following contact information for privacy inquiries
SurveyMonkey Europe UC
2 Shelbourne Buildings,
Or contact us here.
Data Protection Officer: SurveyMonkey's Data Protection Officer is registered with the Irish Data Protection Commission. Contact our DPO at firstname.lastname@example.org.
Note that our contact form is the best way to make a rights request with us.
If you are a resident in the European Union and you are dissatisfied with how we have managed a complaint you have submitted to us, you are entitled to contact your local data protection supervisory authority. As SurveyMonkey Europe UC operates its business in Ireland, it operates under the remit of the Irish Office of the Data Protection Commissioner (see: IDPC Website).
We can make changes to the Privacy Basics and this Privacy Notice from time to time. We will identify the changes we have made on this page. In circumstances where a change will materially change the way in which we collect or use your personal information or data, we will send a notice of this change to all of our account holders.
ALTHOUGH THIS NOTICE APPLIES TO ALL OUR SERVICES, IF YOU ARE USING THE BELOW SERVICES PLEASE CLICK ON THE RELEVANT LINK TO BRING YOU DIRECTLY TO SERVICE SPECIFIC INFORMATION: