Privacy Notice
Introduction
This Privacy Notice explains how personal data is handled when you use PollSpark. References to PollSpark, "we", "us" and "our" refer to the service. PollSpark is a live polling and survey platform that enables users to create and run interactive sessions.
Who this notice covers
This notice covers customers, account holders and participants. If PollSpark is purchased personally, the individual purchaser is the customer. If it is purchased by an authorised person on behalf of an organisation, the organisation is the customer. The PollSpark Team owner manages the account and billing but is not necessarily the legal customer.
The customer or relevant organisation is the data controller for participant or session personal data it chooses to collect through PollSpark. PollSpark processes that content on the controller's behalf as a data processor.
PollSpark separately acts as data controller for technical and operational data processed for its own purposes, including billing, security, service operation and platform administration.
Participants are people who join sessions created by account holders. Participants do not need a PollSpark account.
Data we collect
From account holders:
| Data | Why we collect it |
|---|---|
| Name and email address | Account registration and communication |
| Organisation name | Account setup |
| Billing information, processed by Stripe. We do not store card details. | Payment processing |
| Usage data | Sessions created, features used, questions asked |
| Technical data including IP address, browser type and device information | Security and performance |
From participants:
| Data | Why we collect it |
|---|---|
| Session responses | To display results to the session presenter |
| Nickname | Only if the session is not in anonymous mode |
| Technical data including IP address and device information | Security and abuse prevention |
We do not collect special category data as part of the platform's core function. If a customer asks questions that elicit special category data from participants, the customer or relevant organisation is responsible for ensuring a lawful basis exists under UK GDPR.
How we use your data
When PollSpark acts as data controller, we process personal data for the following purposes:
| Purpose | Legal basis |
|---|---|
| Providing access to the platform | Performance of a contract |
| Processing payments and managing subscriptions | Performance of a contract |
| Sending account and subscription emails | Performance of a contract |
| Maintaining security and preventing misuse | Legitimate interests |
| Improving and developing the service | Legitimate interests |
| Complying with legal obligations | Legal obligation |
For participant and session content processed by PollSpark as data processor, the customer or relevant organisation determines the purpose and legal basis. PollSpark processes that content on the controller's instructions to provide live results, exports and related session functions.
Data storage and location
PollSpark's core application database is hosted in London. Some specialist service providers may process limited operational data in the UK or EEA as part of delivering the service.
Who we share data with
We do not sell personal data to any third party. We use carefully selected service providers to help us operate PollSpark, including hosting, database and authentication services, payment processing, email delivery, analytics, security and performance monitoring. These providers process information only where necessary to provide their services to us and are subject to appropriate contractual and data-protection safeguards.
How long we keep your data
| Data | Retention period |
|---|---|
| Account data | Retained while the account remains open. A verified request to close the account starts PollSpark’s manual closure process. Ordinary account and session data is removed as soon as safely practical and within 90 days. Limited technical and evidential records may be retained separately. |
| Session results on paid accounts | Retained while the account remains open, unless the customer deletes the session or explicitly closes the account |
| Session results on free accounts | Visible in the Free account for 60 days from the session date. This is an access period, not a deletion date. |
| Inactive Free-account session content | If a Free account owner has not signed in for 90 complete days, PollSpark may review the account. Following manual review and approval, qualifying session content may be removed from the active service. The account itself remains open. |
| Participant response data | Retained with the session and deleted from the active service when the session is deleted |
| Security and technical audit logs | Normally 90 days; longer only for an active security, abuse, fraud or legal investigation |
| Provider logs | Retained according to each provider’s configured or contractual retention arrangements |
| Non-billing email delivery evidence | 12 months after the delivery reaches a confirmed final outcome |
| Billing, payment, refund and related billing-email records | 7 years; longer only where a legal hold or statutory requirement applies |
Unresolved email outcomes are kept until provider evidence establishes the outcome, after which the normal period begins. Records subject to an active legal, security, fraud or abuse investigation may be held for the duration of that case. Retention review and deletion are currently controlled manual operations.
Cancelling a paid subscription does not close the PollSpark account or start account-data removal. A verified explicit request starts PollSpark's manual closure process. Ordinary account and session data is removed as soon as safely practical and within 90 days. Billing, payment, refund, fraud, security, legal and limited technical evidence remains subject to the separate retention periods that apply.
Limited pseudonymous participation records may be retained separately where needed for usage, refund, security or legal evidence. These records do not contain participant names, email addresses, answers, Q&A content or original session content.
When a customer deletes a session, PollSpark deletes that session and its participant response data from the active service. Residual copies may remain temporarily in backups or provider systems until they expire under their normal retention processes.
Security
We use encrypted connections (HTTPS/TLS), access controls, row-level database security and regular monitoring to protect personal data. PollSpark's core application database is hosted in London. Some specialist service providers may process limited operational data in the UK or EEA as part of delivering the service.
Your rights
Under UK GDPR you have the right to access a copy of your personal data, request correction of inaccurate data, request deletion of your data, restrict or object to processing, request your data in a portable format, and withdraw consent where processing is based on consent.
To make a request, contact hello@pollspark.co.uk. We will respond within one calendar month.
You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
Cookies
We use cookies to enable login, maintain security and understand platform usage. See our Cookie Policy for full details.
Changes
We will notify account holders of material changes to this policy by email before they take effect.
Contact
hello@pollspark.co.uk