Privacy Policy

Last Updated: 2025-11-15

OutSideSoft Solutions Inc. (“SimpleSurvey,” “we,” “us,” or “our”) is committed to protecting personal information and maintaining trust with our clients, users, and survey respondents.
This Privacy Policy explains how we collect, use, disclose, and protect personal information in connection with our services, and how we comply with Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and Québec’s Act to modernize legislative provisions regarding the protection of personal information (Law 25).

1. Definitions and Scope

“Personal information” means any information that relates to an identifiable individual, either directly or indirectly. This Policy applies to SimpleSurvey’s handling of personal information collected through our websites, platform, support channels, and business operations. It also explains how we process personal information on behalf of our Clients who use the SimpleSurvey platform to create and distribute surveys. If our website or documentation contains links to other sites, note that information exchanged on those external sites is governed by their own privacy policies.

2. Roles and Responsibilities

SimpleSurvey provides an online survey and data-collection platform.

For Client and Administrator Data (account, billing, authentication, and support information), SimpleSurvey acts as the data controller.
For Survey and Respondent Data collected by Clients through our data-collection platform, SimpleSurvey acts as a data processor, processing that information solely under the Client’s direction.

Clients are responsible for obtaining any required consents from their respondents and for ensuring that their surveys and tracking configurations comply with applicable laws.
We have appointed a Privacy Officer who oversees compliance with this Policy and applicable legislation. Contact details are provided in Section 12.

3. When and What We Collect

We collect personal information through several technological means, depending on your interactions with us.

3.1 Account creation and use of the platform

When you register for or use our services, we collect:

Name, organization, and contact details;
Account identifiers and login credentials;
Billing and payment information;
Service-usage data and system logs;
Communications and support requests.

3.2 Website visits and cookies

Our websites ( simplesurvey.com and simplesondage.com ) use cookies and similar technologies to ensure proper operation, improve performance, and analyse site traffic.
Cookies are small text files stored on your device when you visit a website. They allow certain features to function and help us understand how visitors use our site so we can improve it. Categories of cookies we use:

Strictly necessary cookies – required for website operation, session management, security, and language settings. These cookies do not store any personal information and cannot be disabled in our systems.
Functional cookies – remember choices such as language or cookie-banner preferences to enhance your browsing experience.
Analytics cookies – help us understand how visitors interact with our site (for example, page views, duration, and traffic sources). We use Google Analytics 4 in compliance with privacy regulations, and the data collected are aggregated and anonymized.

We do not use advertising or marketing cookies.

Consent management
Non-essential cookies (functional and analytics) are disabled by default. When you visit our site, a banner powered by CookieYes appears allowing you to:

Accept all cookies,
Reject all non-essential cookies, or
Customize your preferences.

You may withdraw or change your consent at any time using the “Cookie Settings” link displayed in the banner or at the bottom of the page.
Refusing non-essential cookies will not affect your access to the website, although some preferences may not be saved.

3.3 Contact forms, email, and phone communications

When you contact us by form, email, or telephone, we collect the information necessary to respond, such as your name, email address, language preference, and the content of your message or call details.
We ask that you share only information relevant to your request and avoid transmitting sensitive data unless necessary.

3.4 Recruitment or trial requests

If you apply for a job or request a trial account, we collect the personal information required to evaluate your request (for example, name, contact details, résumé, and related materials).

3.5 Information processed on behalf of Clients

Survey or respondent data are collected directly by Clients. SimpleSurvey does not access, use, or disclose such data except as necessary to provide technical support, ensure security, or comply with legal obligations.
If Clients activate optional tracking or analytics in their own surveys, they must obtain any necessary consent from respondents before enabling these features.
Platform defaults are configured to the highest level of confidentiality (“privacy by default”). By using our services, Clients agree to:

obtain all required consents; and
provide notices in accordance with applicable privacy laws before collecting personal information through surveys.

4. How We Use Personal Information
4.1 Client and Administrator Information

We use personal information that relates to our Clients, Administrators, and Users (for example, account holders, billing contacts, and support requesters) for the following limited purposes:

To provide, maintain, and improve the SimpleSurvey platform and services;
To authenticate users and manage access permissions;
To process payments and renewals;
To respond to support and security requests;
To communicate important updates about the services;
To meet contractual, accounting, audit, or legal obligations.

We may also use aggregated, anonymized data derived from platform activity for service analytics and performance improvement. These analytics do not identify any individual or Client.

4.2 Respondent and Survey Information

We process personal information collected by our Clients through surveys (“Respondent Data”) solely on behalf of the Client and under their documented instructions.
We do not access, use, or disclose Respondent Data for our own purposes, unless required to:

provide technical or security support at the Client’s request,
maintain system integrity, or
comply with applicable legal obligations.

Clients remain responsible for determining the purposes and means of processing Respondent Data, as well as for obtaining any required consents from respondents.

5. Data Hosting and Transfers

All Client and Survey Data are hosted exclusively in Canada, including outside the province of Québec, in secure data centers managed by a Canadian-based infrastructure provider that has undergone a SOC 2 Type 2 audit and holds ISO 27001 certification.
Data is encrypted at rest and in transit (TLS 1.2 or higher, AES-128 or stronger).
If personal information must be transferred outside Québec (for example, between Canadian regions for redundancy), we perform a privacy impact assessment and ensure contractual, technical, and organizational safeguards are in place.
Backups are stored within Canada by the same certified infrastructure provider.

6. Security and Access Controls
We apply layered physical, technical, and organizational security measures, including:

Strong authentication and least-privilege access controls;
Encryption, firewalls, and intrusion detection systems;
Employee confidentiality agreements and regular privacy/security training;
Access-log reviews;
Governance policies such as the Information-Security Policy and Employee Code of Conduct.

Access to personal information is granted strictly on a “need-to-know” basis.
Roles and responsibilities for handling personal information are documented and reviewed regularly.

7. Retention and Destruction

We retain personal information only as long as necessary for the identified purposes or to meet legal obligations.

Client Data are deleted from production systems within 60 days of contract termination and from backups within 67 days — this serves as SimpleSurvey’s certification of destruction.
Billing and support records are retained for up to seven (7) years for accounting and audit compliance.

For data collected by Clients through surveys, deletion and retention are managed by the Client. Respondents seeking erasure or correction must contact the survey owner directly.

8. Your Rights
8.1 If you are a Client, Administrator, or Platform User

If you have a SimpleSurvey account (as a Client or Administrator), you may exercise the following rights regarding your personal information that we control:

Access and copy the personal information we hold about you;
Request correction of inaccurate or incomplete information;
Withdraw consent where processing is based on consent (subject to legal or contractual restrictions);
Request deletion once the information is no longer necessary for the purposes for which it was collected;
Request data portability (for Québec residents, where applicable).

To exercise these rights, please submit a written request to our Privacy Officer (see Section 12).
We will respond within 30 days of receiving your request or within the time required by law. If additional time is required, you will be informed of the reason and expected timeframe.

8.2 If you are a Respondent to a Client’s survey

When you participate in a survey or data-collection project distributed by one of our Clients, SimpleSurvey acts only as a service provider.
Your personal information is collected and controlled by the organization that created the survey (the “Client”).
As a result:

Access, correction, or deletion requests for survey responses must be addressed directly to that organization.
SimpleSurvey cannot modify or erase survey data unless instructed to do so by the Client.

If we receive such a request directly from a respondent, we cannot respond to it.

8.3 Minors

If you are under 14 years old, please do not provide personal information unless a parent or guardian has consented.
Our Clients are responsible for ensuring that proper consent is obtained from minors when they collect information through their surveys.

9. Communications of Personal Information to Third Parties

We may disclose personal information to:

Our service providers assisting in operations (e.g., payment processing, hosting, security monitoring);
Legal authorities when required by law;
Our professional advisors (auditors, legal counsel) under confidentiality obligations.

We ensure third-party providers implement safeguards equivalent to ours and are contractually bound to protect personal information.

10. Security Incidents and Breach Notification

We maintain procedures to detect, assess, and respond to any unauthorized access, disclosure, or misuse of personal information.
If an incident creates a real risk of significant harm (PIPEDA) or a risk of serious injury (Law 25), SimpleSurvey will:

Notify affected Clients and, where applicable, individuals and regulators without undue delay;
Provide details of the incident, mitigation steps, and measures to protect against future occurrences;
Maintain a record of all incidents and corrective actions.

11. Privacy by Design and Governance

We integrate privacy protection into every stage of our service design (“privacy by design”) and configure settings by default to the highest confidentiality level (“privacy by default”).
We conduct Privacy Impact Assessments (PIAs) when launching new technologies or when personal information may be transferred outside Québec.
Our governance framework and policies are reviewed annually.

12. Contact and Complaints

Contacting the Privacy Officer
Questions, access requests, or privacy concerns can be sent to person listed on our Contact page | Email: security@simplesurvey.com

Complaint process
If you believe that the management of your personal information does not comply with this Policy or with applicable law, you may submit a written complaint to our Privacy Officer. Your complaint will be acknowledged, investigated, and answered within 20 days after receipt of all necessary information.
If additional details are required, we will contact you. A written response will be provided upon completion of the review.
If you are unsatisfied with our response, you may contact the Commission d’accès à l’information du Québec (CAI) at www.cai.gouv.qc.ca.

13. Updates to this Policy

We may modify this Privacy Policy from time to time. When such modifications are made, we will post the updated version on this page and indicate the date of the last revision. The updated Privacy Policy will take effect upon publication for new Clients and Users, and will become effective thirty (30) days after publication for existing Clients and Users of the Services. You understand and agree that continuing to use the Services after a revised Privacy Policy has been posted constitutes acceptance of the updated terms. If you do not agree to the updated Privacy Policy, you may be unable to continue using the Services.

14. Language and Governing Law

This Privacy Policy is available in English and French. In the event of any discrepancy, the English version shall prevail. This Policy is governed by the laws of Québec and the federal laws of Canada applicable therein.