Data Processing Agreement

This Data Processing Agreement (DPA) forms part of the Terms of Service and applies where Universal Global Services Ltd (UGS) processes personal data on behalf of a customer in connection with FeatureVote. It is entered into automatically when you use the service and can be requested as a signed copy at [email protected].

1. Roles and scope

• The customer is the controller of the data relating to its feedback portal and users.
• UGS acts as processor providing the FeatureVote service (Article 28 GDPR).
• Subject matter: provision of feedback collection, voting boards and roadmaps.
• Duration: while the customer account is active, plus the retention period described in the Privacy Policy.

2. Nature, purpose and data categories

• Processing operations: hosting of the customers portal, storage of feedback content and display in dashboards.
• Categories of personal data: account data, feedback content, votes and technical data as described in the Privacy Policy.
• Categories of data subjects: customers, their end users and feedback submitters.

3. Processor obligations

• Process personal data only on documented instructions from the controller, including these Terms and the product settings.
• Ensure that persons authorised to process the data are bound by confidentiality.
• Apply appropriate technical and organisational security measures, including encryption in transit and least-privilege access.
• Assist the controller with data subject requests; the product provides export and deletion in the dashboard.
• Notify the controller without undue delay after becoming aware of a personal data breach.

4. Sub-processors

UGS uses the following categories of sub-processors: payment processing (Stripe), transactional email delivery (Brevo, AhaSend, SMTP2GO, Resend) and AI model access (OpenRouter). Sub-processors are bound by data processing agreements. A current list is available on request from [email protected]. The controller is notified of changes with the opportunity to object.

5. International transfers

Where personal data is transferred outside the UK/EEA, UGS relies on appropriate safeguards such as the UK International Data Transfer Addendum or the European Commission Standard Contractual Clauses.

6. Deletion and return

On termination, personal data is deleted according to the retention settings and the Privacy Policy, unless retention is required by law.

7. Audits

UGS provides the information reasonably necessary to show compliance, including the security and processing information published in these pages.

8. Contact

Data protection enquiries: [email protected]