This page is intended to provide information about UserVoice’s GDPR compliance tooling. The primary audience is for business customers that use our service and need to understand how we comply with the requirements of the GDPR.
Notice for end users
Goals in GDPR Compliance
UserVoice is required to be in compliance with the GDPR since we offer services to residents of the EU. In order to offer our service, we must collect data that can identify people. In addition to our obligation to follow the regulation, UserVoice intends to follow best practices in privacy and protection of data.
Our Role as a Data Controller and Data Processor
UserVoice has customers who are both companies and individuals.
We offer a product to companies that allows them to collect and analyze product feedback provided by individuals who may reside in the EU. In this case, through our contract with the company who is our customer, we are acting as a data processor. We collect, store, and retrieve data on their behalf and at their request.
We also use our own product to collect, store, and retrieve data to analyze our own product. In this capacity, we are both a data controller and data processor, since the data processing is happening for our own purposes.
Our Use of Third Party Data Processors
UserVoice makes use of third party services in infrastructure, reporting, and analytics. It is our obligation to ensure that the processing of data on our behalf is also GDPR compliant.
Consent Collection
When acting in our role as a data processor, it is the obligation of the data controller (our customer, a company) to ensure that they have collected consent and made clear that personal data is being collected for the purposes served by the UserVoice platform.
When acting in our role as a data controller, it is our obligation to make sure that we have collected consent to allow us to store and use data for the purposes served by the UserVoice platform.
However, whenever there is an opportunity for a user to create an account via a UserVoice controlled web property - in our case idea portals and widgets (the first opportunity to provide personal data), UserVoice will prompt the user to ensure that EU residents are informed of the data that is collected and the purposes for which it is being used and allow them to give consent.
Since these are not the only ways to provide personal data to UserVoice (for example, personal data can be submitted to us by data controllers through the API or data import functionality), data controllers must still ensure that they have appropriate consent collected for EU residents. Specifically, our SDKs, including iOS and Android SDKs, do not include any mechanism to collect consent. These SDKs are meant to be embedded by host applications whose UI is under control of the parent application, therefore the producer of the application is the Data Controller and should collect consent for this purpose.
Additionally, we will detect (through IP address) when a known user has changed from a non-EU location to and EU location. If we do not yet have a consent record upon noticing this change, we will prompt the user for consent.
Right to access / Right to portability
UserVoice has created an API[1] endpoint that can be used to export end user data. Documentation about the endpoint is located and kept up-to-date here:
https://developer.uservoice.com/docs/api/v2/reference/#/users_2
The endpoint will send an email to the identified user containing their personal information along with their user-submitted content, including ideas and comments. Companies can invoke this endpoint on their end users’ behalf, and if they do so, they can include a custom message in the email that can, for example, describe the purpose of the email, who initiated its delivery, and what is contained in it.
A user interface is be provided for end users to invoke this endpoint, instructions for which are linked in the “Notice for end users” section above.
This method is asynchronous. Results are delivered via email because the volume of content may be too large to return in a single API call. The results should be delivered within minutes.
Right to Erasure / Opt-out
UserVoice has created an API endpoint that can be used to invoke a Data Subject’s Right to Erasure or desire to Opt-out. Documentation about the endpoint is located and kept up-to-date here:
https://developer.uservoice.com/docs/api/v2/reference/#/users_5
This endpoint will remove the record of the user, point any user-generated content (ideas, comments, tickets, votes) to an anonymous user, and redact any personal information from the user generated content (i.e. any names, ID numbers, contact information, etc... will be removed). UserVoice administrators are always welcome to further remove content beyond these automated means. For example, they may choose to delete content associated with the user rather than simply de-identify it.
Erasure and Opt-out are logically the same thing within UserVoice, so this endpoint can be used for both purposes.
A user interface is be provided for end users to invoke this endpoint, instructions for which are linked in the “Notice for end users” section above.
This method is synchronous, immediate, and not reversible. An API return code of 200 or a message in the user interface will indicate successful execution of the routine.
Notification in the event of a Data Breach
We will notify the owners of UserVoice accounts within 48 hours of the discovery of a data breach. We will work with our customers to inform Data Subjects of the breach.
Data Processing Agreements
UserVoice has created a Data Processing Agreement with all of the required language and information that you can download and execute. Enterprise customers who have custom DPAs can submit the DPA for review to support@uservoice.com.
UserVoice Customer DPA
Contact Information
Questions and concerns can be directed via email to dpo at UserVoice dot com
[1] For basic usage information about our API, including authentication, please refer to https://developer.uservoice.com/docs/api/v2/getting-started/