PRIVACY POLICY

Last updated: 11 August 2026

  1. INTRODUCTION

Data Illusion Zumbrunn (“DIZ”, “we”, “us” or “our”) is a Swiss company providing survey and form software, including ngSurvey Cloud and on-premise software and services (the “Services”). Our cloud infrastructure is hosted in the Netherlands (European Union).

This Privacy Notice explains how we collect, use, disclose, and otherwise process personal data:

• when you visit our websites (the “Sites”);
• when you interact with us as a customer, prospect, partner, or event participant;
• when you use our Services as an authorized user; and
• when an ngSurvey installation communicates with our licensing infrastructure for license activation, validation, or related licensing purposes.

If you participate in a survey or form created using our Services, the organization that invited you is the data controller. DIZ acts solely as a data processor for such survey data.

  1. DATA CONTROLLER

For the purposes of applicable data protection laws, including the EU General Data Protection Regulation (“GDPR”) and the Swiss Federal Act on Data Protection (“revDSG”), the data controller is:

Data Illusion Zumbrunn
Switzerland
Email: privacy@dataillusion.com

  1. DATA PROTECTION CONTACT

DIZ has not appointed a formal Data Protection Officer.

For any questions, requests, or complaints relating to personal data, please contact:

privacy@dataillusion.com

  1. SCOPE OF THIS PRIVACY NOTICE

This Privacy Notice applies to:

• visitors of our Sites, including www.ngsurvey.com;
• customers and prospective customers;
• authorized users of our Services;
• installations of ngSurvey communicating with DIZ licensing services;
• business partners; and
• event participants.

It does not apply to third-party websites linked from our Sites, which are governed by their own privacy notices.

  1. CUSTOMER DATA AND SURVEY DATA (PROCESSOR ROLE)

5.1 Customer Data

When providing the Services, DIZ may process personal data on behalf of its customers (“Customer Data”). Customers act as data controllers, and DIZ acts as a data processor.

Customer Data may include:

• end-user identifiers (e.g. IP address or email address);
• system or event logs;
• usage or configuration data; and
• data submitted in support requests.

Processing is governed by customer contracts and data processing agreements.

5.2 Survey and Form Data

All data collected through surveys or forms created using our Services is owned and controlled by the customer.

DIZ processes such data solely to provide the Services. DIZ does not use survey data for analytics, marketing, or any other independent purpose.

Requests from survey respondents must be addressed to the survey owner.

  1. PERSONAL DATA WE COLLECT AS DATA CONTROLLER

6.1 Business and Customer Relationship Data

We may collect:

• name, company, and job title;
• business address, phone number, and email address;
• billing and payment details;
• license, subscription, and usage information; and
• user credentials and account administration data.

6.2 Data Submitted via Our Sites

You may provide personal data when:

• completing contact or inquiry forms;
• downloading documentation or software;
• subscribing to newsletters; or
• corresponding with us by email or phone.

6.3 Customer Support Data

When you contact support, we may collect:

• support tickets and correspondence;
• call recordings, where applicable and lawful; and
• technical information necessary to investigate and resolve issues.

6.4 Usage and Technical Data

When you visit our Sites or interact with certain online Services, we may automatically collect:

• IP address;
• browser and device type;
• operating system;
• date, time, and duration of visits;
• pages viewed; and
• referral information.

6.5 License Activation and Validation Data

ngSurvey, including on-premise installations, may communicate with DIZ licensing services for purposes such as activating, validating, maintaining, or verifying the status and permitted use of a software license.

Depending on the product version, license type, and configuration, information transmitted as part of these requests may include:

• the ngSurvey license serial number or other license identifier;
• the installed ngSurvey software version;
• license-related information necessary to determine the validity, status, or permitted scope of the license;
• the date and time of the validation request;
• the IP address from which the request originates; and
• standard technical information transmitted as part of an HTTP or HTTPS request.

We process this information for the purposes of license activation and validation, administering software entitlements, providing updates and support, maintaining the security and integrity of our licensing systems, detecting unauthorized or fraudulent use of licenses, and protecting and enforcing our contractual and intellectual property rights.

License validation data is not used to access or collect the contents of surveys, forms, questions, answers, or respondent data.

Where an offline licensing mechanism is provided, online license validation may not be required or may operate differently depending on the applicable license and product configuration.

  1. COOKIES

Our Sites use cookies and similar technologies.

Details are provided in our Cookie Policy:

https://www.ngsurvey.com/cookies

  1. LEGAL BASES FOR PROCESSING

Where we act as data controller, we process personal data on one or more of the following legal bases, as applicable:

• performance of a contract or taking steps prior to entering into a contract;
• compliance with legal obligations;
• our legitimate interests, including operating and improving our business and Services, securing our systems, administering and validating software licenses, preventing fraud and unauthorized use, and protecting our legal and intellectual property rights; and
• consent, where required by law.

Where we rely on legitimate interests, we consider those interests against the rights and interests of the individuals concerned.

  1. HOW WE USE PERSONAL DATA

We use personal data to:

• operate and develop our business and Services;
• manage customer relationships and accounts;
• provide customer support;
• activate, administer, and validate software licenses;
• verify compliance with applicable license terms and software entitlements;
• detect and prevent fraud, misuse, and unauthorized use of our software;
• operate and improve our Sites;
• communicate with you, including marketing where lawful;
• manage events and promotions;
• ensure the security and integrity of our Services and licensing infrastructure; and
• establish, exercise, or defend legal and contractual rights.

  1. DE-IDENTIFIED AND AGGREGATED DATA

We may anonymize or aggregate data so that it can no longer reasonably be linked to an individual. Such data may be used for analytics, research, service improvement, and market insights.

  1. SHARING AND DISCLOSURE OF PERSONAL DATA

We may disclose personal data:

• to service providers and subprocessors acting on our instructions;
• to public authorities where required by law; and
• in connection with corporate transactions, such as mergers, acquisitions, or asset sales.

All subprocessors handling personal data on our behalf are subject to appropriate data protection obligations.

  1. SUBPROCESSORS

DIZ may engage third-party subprocessors to provide parts of the Services, such as hosting and support tools.

A current list of subprocessors is available upon request.

  1. INTERNATIONAL DATA TRANSFERS

Personal data may be transferred outside Switzerland or the EU/EEA. Where required, DIZ implements appropriate safeguards, which may include:

• applicable adequacy decisions;
• Standard Contractual Clauses (SCCs); or
• other lawful transfer mechanisms.

You may request further details by contacting privacy@dataillusion.com.

  1. AUTOMATED DECISION-MAKING

DIZ does not carry out automated decision-making or profiling that produces legal or similarly significant effects within the meaning of Article 22 GDPR.

Automated technical checks performed for software license activation or validation are not intended to constitute automated decision-making producing legal or similarly significant effects within the meaning of Article 22 GDPR.

  1. DATA RETENTION

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including compliance with legal, tax, accounting, security, and contractual obligations.

License activation and validation records may be retained for a period reasonably necessary to administer licenses, investigate licensing or security issues, prevent fraud or unauthorized use, resolve disputes, and establish, exercise, or defend legal claims.

  1. SECURITY

DIZ implements appropriate technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure.

No system is entirely secure, and we cannot guarantee absolute security.

  1. CHILDREN

Our Sites and Services are not intended for children under 16. We do not knowingly collect personal data directly from children under this age.

This does not apply to survey or form data processed by DIZ on behalf of customers, for which the relevant customer determines the lawful basis and conditions of collection.

  1. MARKETING COMMUNICATIONS

Where permitted by law, we may send marketing communications.

You may opt out at any time using the unsubscribe mechanism provided in the communication or by contacting us.

  1. YOUR RIGHTS

Subject to applicable law, you may have the right to:

• access your personal data;
• rectify inaccurate or incomplete personal data;
• request erasure or restriction of processing;
• object to certain processing;
• receive your data in a portable format where applicable;
• withdraw consent at any time where processing is based on consent; and
• lodge a complaint with a competent supervisory authority.

Requests can be made to privacy@dataillusion.com.

If your request relates to survey or form data processed by DIZ on behalf of a customer, we may refer you to the relevant customer as the data controller.

  1. SUPERVISORY AUTHORITIES

You have the right to lodge a complaint with a competent data protection authority.

In Switzerland, the competent federal authority is the Federal Data Protection and Information Commissioner (FDPIC).

Within the EU/EEA, you may contact the competent supervisory authority in your country or jurisdiction.

  1. CHANGES TO THIS PRIVACY NOTICE

We may update this Privacy Notice from time to time to reflect changes to our Services, processing activities, legal requirements, or other circumstances.

The latest version will always be made available on our Sites.

‍