Privacy notice for people who submit forms built with Clevertrek
This notice is for you if you filled in a form, sent a request or received an email from a business that uses Clevertrek's Surveys or CRM & Support tools. It explains who is responsible for your data, what happens to it and how to exercise your rights.
1. Who is responsible for your data
There are two different roles:
- The business that published the form (the "Controller"). It decides why and how your data is used. Its identity, contact details and its own terms are shown in the "Terms of …" link (followed by the business's name) next to the form you submitted and at the bottom of every email you receive about it. It is your first point of contact for anything related to your data.
- Clevertrek (the "Processor"). We provide the software. We store and process your data only on behalf of that business and following its instructions, under a data processing agreement (Article 28 GDPR). We do not use your data for our own marketing, we do not sell it and we do not combine it with data from other businesses.
Clevertrek is operated by Fernando Beneitez Vela-Hidalgo, sole proprietor under Spanish law, NIF 75794423Q, Avenida del Hotel, 1, 15º, 08860 Castelldefels, Barcelona, Spain. Privacy contact: privacy@clevertrek.com. Clevertrek has not appointed a Data Protection Officer; for any privacy matter, contact privacy@clevertrek.com.
In two cases Clevertrek acts as an independent controller for a limited purpose: (a) to keep our service safe from spam and abuse (section 7), and (b) to keep a minimal, anonymous record that you asked for your data to be erased (section 6), so we can prove we did it.
2. What data is collected
It depends on the form the business created. Usually:
- What you type in the form: for example your name, email address, company, phone number, your message and your answers.
- Technical data of the submission: date and time, the page where the form was shown, campaign tags in the link (UTM) if any, and a one-way, salted fingerprint of your IP address used only to stop abuse (we do not keep your IP address in clear text in the form records).
- Proof of your consent: the version of the terms you accepted and the date and time you accepted them.
- Conversation history: if your form opened a request, the messages exchanged with the business about it.
Forms built with Clevertrek must not ask for passwords, payment card numbers, bank account numbers (IBAN), identity document or social security numbers, or special categories of data (health, religion, sexual orientation, etc.). Our system checks every form and removes such questions. If a form asks you for them, do not answer and use Report this form at the bottom of the form (section 7).
3. Why your data is used and on what legal basis
The business that published the form decides the purpose and the legal basis, and must explain them in its own terms. Typical cases:
| Purpose | Usual legal basis (Article 6 GDPR) |
|---|---|
| Answering your request or question | Steps at your request before a contract, or the business's legitimate interest in answering you (6(1)(b) or 6(1)(f)) |
| Providing a service you asked for | Performance of a contract (6(1)(b)) |
| Sending you commercial communications | Your consent (6(1)(a)), which you can withdraw at any time |
| Surveys and feedback | The business's legitimate interest or your consent |
Clevertrek's own purposes, as an independent controller:
| Purpose | Legal basis |
|---|---|
| Preventing spam, phishing and abuse of the service | Our legitimate interest in keeping the service safe (6(1)(f)) |
| Keeping proof that an erasure request was fulfilled (anonymous) | Legal obligation to demonstrate compliance (6(1)(c), Article 5(2)) |
4. Who can see your data
- The people in the business's team who have been given access to that tool.
- Clevertrek's technical staff, only when needed to run, secure or support the service, under confidentiality.
- Service providers we use to run the platform (hosting, storage, email delivery and, where the business uses them, AI features), each bound by a data processing agreement. They are listed below, under Sub-processors, which is also Annex III of our Data Processing Addendum.
- If a survey shows its results to the people who answer it, they see only aggregated totals, which are published only when at least 5 new responses have arrived since the previous update; individual answers are never shown. If you delete your response, it may still be counted in the published totals until their next update. The business must not name people in the questions or options of such a survey.
- Authorities, when required by law.
International transfers. Clevertrek's servers are located in the United Kingdom, which benefits from an EU adequacy decision. If a provider processes data outside the European Economic Area and the United Kingdom, we use the safeguards required by the GDPR, such as an adequacy decision (including the EU–U.S. Data Privacy Framework) or the European Commission's Standard Contractual Clauses.
Sub-processors
Service providers that process personal data on Clevertrek's behalf, for forms and CRM data and for the rest of the platform. This list is also Annex III of our Data Processing Addendum. We give the businesses that use Clevertrek 30 days' notice before adding or replacing one.
| Provider | Service | Data it receives | Receives Google User Data | Location and transfer safeguard |
|---|---|---|---|---|
| Rocket.net, Inc. | Hosting, database and cache of the platform | All data processed by the Service | Yes | Servers in the United Kingdom (EU adequacy decision); Standard Contractual Clauses for any access from outside the EEA and the United Kingdom |
| Cloudflare, Inc. | File and archive storage (R2) | Stored files, the files of generated reports (deleted automatically 30 days after they are created) and the encrypted archive of project memory | Yes | Stored in Europe (archive of project memory under EU jurisdiction; report files in Western Europe) · EU–U.S. Data Privacy Framework and Standard Contractual Clauses |
| Railway Corp. | Rendering of reports (PowerPoint and PDF), such as SEO Controller and PageSpeed reports | The figures and texts of the report being generated | Yes | Servers in the EU (Amsterdam, Netherlands); Standard Contractual Clauses for any access from the United States |
| Anthropic, PBC | AI features (Claude API) when not in BYOK mode; in Surveys and CRM & Support, AI summaries only if the business enables AI features | Only what each AI feature needs | Yes | United States · Standard Contractual Clauses |
| ARBICHAT, S.L. (Zernio) | Connection to the social media and advertising accounts that users connect through it | Access to, and reports of, those accounts | No | Company in Spain (EU); data hosted in the United Kingdom (London; EU adequacy decision) · Standard Contractual Clauses for any access from outside the EEA and the United Kingdom |
| Google Ireland Limited (Google Workspace) | Email delivery | The emails sent by the platform (recipient, name and message) | No | EU–U.S. Data Privacy Framework and Standard Contractual Clauses |
| Stripe Payments Europe, Ltd. | Payments of Clevertrek's own customers | Billing data of the customer (never form or CRM data) | No | Ireland (EU) · EU–U.S. Data Privacy Framework and Standard Contractual Clauses for transfers within Stripe |
| Usercentrics A/S (Cookiebot) | Cookie consent on Clevertrek's website | Visitors' consent choice and technical data of their browser | No | Denmark (EU) · Not needed |
| Youtrust SAS, formerly Yousign (France) | Electronic signature of the business's agreement, where available | Name and email of the signer | No | Not needed (within the EU) |
5. How long your data is kept
- Form answers and requests: for the period shown in the business's own terms for that form (for example, up to 24 months after your request is closed), or, if the business closes its Clevertrek account earlier, until the business or you ask for their deletion (they are no longer used after the account is closed). The business can archive them earlier; archived data is not shown but is still stored until it is erased.
- Proof of consent: as long as the related data exists, plus the period needed to defend legal claims (5 years, the general limitation period under Spanish law).
- Anti-abuse counters: 30 days. IP fingerprints change every month and are kept only inside the submission record they belong to.
- Suppression fingerprint (section 7): as long as the business keeps a Clevertrek account.
- If you ask for erasure or mark a business as spam: your data is permanently deleted (not archived) at once, as explained in sections 6 and 7. Backups of the platform are kept for up to 30 days and are then overwritten; they are not used in the meantime.
6. Your rights and how to exercise them
You have the right to:
- Access your data and get a copy of it.
- Rectify inaccurate data.
- Erase your data ("right to be forgotten").
- Object to the use of your data, including at any time for direct marketing.
- Restrict the use of your data in some cases.
- Data portability, where the legal basis is consent or contract.
- Withdraw your consent at any time, without affecting what was done before.
How:
- Unsubscribe or delete my data: every email you receive after submitting a form includes the links "Unsubscribe" and "Delete my data". "Delete my data" permanently erases everything that business holds about you through Clevertrek (your answers, your contact record and your messages). We keep only an anonymous record that an erasure was requested, with no personal data.
- Contact the business using the details in its terms. It must answer within one month (extendable in some cases).
- Contact Clevertrek through the "Contact support" button in the business's terms page or at privacy@clevertrek.com. If your request is for the business, we will pass it on to them without delay and help them answer it.
To protect your data, we may ask you to confirm that the request comes from you (for example, by clicking a link sent to the email address you used in the form).
Complaints. You can complain to a data protection authority, in particular in the country where you live or work. Clevertrek's lead authority is the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).
7. Spam and abuse reports
If you received messages you did not ask for, or a form asked you for sensitive data, use "Mark as spam" at the bottom of the email or "Report this form" at the bottom of the form. When you report a business:
- your data held by that business through Clevertrek is permanently deleted;
- your identity is never shown to the business; if you give us your email, we send you a copy of your report;
- a review is opened on our side; repeated reports lead to a warning, a pause of that business's forms and a review;
- we keep only a record of the report (date, the business reported and the reason), without your personal data, and a one-way, salted fingerprint (hash) of your email address — never the address itself — so that business cannot add you again through Clevertrek (legal basis: our legitimate interest and the business's obligation to respect your erasure and objection, Articles 17 and 21 GDPR).
See our Anti-spam policy. Our general Privacy Policy covers the data of Clevertrek's own customers.
8. Security
Data is transmitted over encrypted connections, access is limited to authorised people, IP addresses are stored only as salted fingerprints, and the links in our emails are personal, signed and expire, so nobody can use them to see or delete someone else's data.
9. Changes to this notice
We will publish any change on this page with a new date. Each consent we record keeps the version you accepted.