Data processing addendum

Version 2026-10-31

Do you need this?

Usually not. SnagBane is software you install: your forms, responses, files and accounts stay on your server, and we have no access to your installation. For that data your organisation is the controller and SnagBane is not a processor (see GDPR and data protection).

This addendum covers the one case where we may process personal data on your behalf: when you share it with us to get support — for example a screenshot, an export, a log file or the details sent with Report a problem. It forms part of the licence agreement between you (the “Customer”, controller) and SnagBane (the “Processor”) and applies automatically; no signature is needed. Licence, purchase and website data that we handle for our own purposes are described in the privacy policy, where SnagBane or Freemius is the controller.

1. Subject matter, duration, nature and purpose

• Subject matter: support for the SnagBane software.
• Nature and purpose: receiving, reading and storing what you send us, only to understand and solve your support request.
• Duration: for as long as the support request is open, and then as set out in section 8.

2. Types of personal data and data subjects

Whatever you choose to include: typically names, email addresses, job details and form answers of your employees, respondents or approvers, and technical data such as IP addresses in logs. Please send only what is needed — remove or blur personal data where you can. Special categories of data (Art. 9 GDPR) should not be sent.

3. Instructions

We process the data only on your documented instructions, which are: to handle your support request. If we think an instruction breaks data protection law, we tell you. We don’t use support data for any other purpose, and we never sell it or use it for advertising.

4. Confidentiality

Only people who work on SnagBane support see the data, and they are bound to keep it confidential.

5. Security

We protect the data with measures appropriate to the risk (Art. 32 GDPR): support mail is kept in an account protected by two-step verification; files are opened on devices with encrypted disks and are not copied elsewhere; access is limited to support; data is deleted when no longer needed.

6. Sub-processors

You authorise these sub-processors:

We impose data protection obligations on them as required by Art. 28(4) GDPR through their terms. We announce new sub-processors on this page at least 30 days before they are used, with a new version date; you may object on reasonable grounds by email, and if we can’t resolve it you may stop sending support data or end the agreement. Where a sub-processor transfers data outside the European Economic Area, the transfer relies on the safeguards it provides, such as the EU standard contractual clauses.

7. Helping you

• Requests from people: we forward any request about support data we receive and help you answer it.
• Personal data breaches: we tell you without undue delay, and within 48 hours of becoming aware of a breach that affects your support data, with what we know and what we are doing about it.
• Impact assessments and authorities: we give you the information you reasonably need about this processing.

8. Deletion

We delete support data at the latest 12 months after the support request is closed, or earlier when you ask. We don’t keep copies after that, except where the law requires us to.

9. Information and audits

We answer your reasonable written questions about how we meet this addendum. Because the processing is limited to support email, information and written answers replace on-site audits unless a supervisory authority requires one.

10. Contact

Questions about this addendum: support@snagbane.com. Freemius, Inc., our reseller and merchant of record, can also put you in contact with us.