PRIVACY POLICY QUESTBACK AS TRIAL ACCOUNTS

1. Introduction

Questback AS (”Questback”) values your personal privacy. Questback is the data controller for the processing of your personal data described in this policy and is responsible for ensuring that such processing takes place in accordance with applicable data protection laws, including General Data Protection Regulations (GDPR). This policy provides information about how Questback processes your personal data when you sign up for a free trial of one of our SaaS products, including Questback Essentials, and what rights you have.

2. What do we mean by personal data?

Personal data means any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is someone who can be recognized, directly or indirectly, for example through an identifier such as a name, identification number, location data, online identifier, or by reference to one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural, or social identity.

3. What do we mean by processing?

Processing of personal data refers to any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

4. What data does Questback process about you and why?

When you sign up for a free trial of one of our products, you may provide certain personal data to us. This section explains what personal data we process about you, the purposes for which we process your personal data, the legal basis for such processing, and how long we retain your personal data.

In cases where we process your personal data based on legitimate interests, we have assessed that our legitimate interests in the processing outweigh your interests and fundamental rights and freedoms. We have described our legitimate interests in this policy. If you would like to know more about how we have carried out the balancing of interests, you can contact us. Our contact details can be found at the bottom of this policy.

When the purpose of processing your personal data is to create and manage your trial account…

…we process the following data about you: 

• Contact details (e.g. name, business email address, telephone number).
• Company details (e.g. company name, industry, country/region).
• Role information (e.g. job title or function).
• Credentials: Passwords.
• Subscription and licensing data: Information about your subscriptions, licenses, and other entitlements.

…the legal basis for processing your data is: 

• For potential customers who are private individuals or sole traders: The processing is necessary to fulfil an agreement with you as a user of the trial.
• For potential customers who are contact persons at legal entities: Legitimate interest. Questback’s legitimate interest is to create and manage your trial account.

…the personal data is stored during the trial period and up to one year after the trial period has ended.

When the purpose of processing your personal data is to help you use the software and follow up on support requests…

…we process the following data about you: 

• Contact details (e.g. name, business email address, telephone number).
• Technical data (e.g. IP address, browser type, usage logs), information about support requests.

…the legal basis for processing your data is legitimate interest. Questback’s legitimate interest is to provide support and assistance to users of the service during the trial.

…the personal data is stored during the trial period and up to one year after the trial period has ended.

When the purpose of processing your personal data is to understand how the trial is used and improve our services…

…we process the following data about you: Technical data (e.g. IP address, browser type, cookies, usage logs).

…the legal basis for processing your data is legitimate interest. Questback’s legitimate interest is to analyze trial usage to improve services.

…the personal data is stored during the trial period and for one year after the end of the trial period. Where applicable, some technical logs may be stored longer if required for security, regulatory or compliance reasons.

When the purpose of processing your personal data is to contact users about the trial and a possible purchase and to maintain business relationships with potential customers…

…we process the following data about you: 

• Contact details (e.g. name, business email address, telephone number).
• Company details (e.g. company name, industry).
• Subscription and licensing data: Information about your subscriptions, licenses and other entitlements.

…the legal basis for processing your data is legitimate interest. Questback’s legitimate interest is to market its services and maintain business relationships with potential customers.

…the personal data is stored until the recipient unsubscribes from the marketing communications.

When the purpose of processing your personal data is to secure and troubleshoot the service, protect the security and safety of the service, perform updates, prevent fraud, and detect malware and malicious activities. 

…we process the following data about you: 

• Contact details (e.g. name, business email address, telephone number).
• Company details (e.g. company name, industry, country/region).
• Subscription and licensing data: Information about your subscriptions, licenses, and other entitlements.
• Interactions: Data about your frequency, duration, and type of use of our service.
• Location data: We collect location data using the device’s IP address or data in the account profile that indicates where it is located with less precision, such as at a city or postal code level.

…the legal basis for processing your data is legitimate interest. Questback’s legitimate interest is to secure and troubleshoot the service, protect the security and safety of the service, perform updates, prevent fraud, and detect malware and malicious activities.

…the personal data is stored for the duration of the trial period and up to 2 years after the trial period has ended for security and compliance purposes.

5. Who can access your personal data?

When you sign up for a free trial of one of our SaaS products Questback processes your personal data as a data controller. When third parties, such as our IT and system suppliers, process your information on our behalf as data processors, we have entered into data processing agreements with them. This means that they are obligated to process the information securely, correctly and with confidentiality.

Trial signup and marketing data: May be shared in limited form (such as email address, IP address, cookie identifiers) with:

• Advertising platforms (e.g. Google Ads, Microsoft Ads, LinkedIn, Meta, X/Twitter)
• Analytics providers (e.g. Google Analytics, Hotjar)
• CRM and marketing platforms (e.g. Salesforce, Pardot, HubSpot, Marketo)
• Engagement and lead-enrichment tools (e.g. ZoomInfo, Clearbit, Leadfeeder, Drift)

For additional information about how Questback uses cookies, please see our cookie policy available here.

We share your personal data with all members of the Questback Group which includes:

• Questback Sweden AB, Kungsgatan 48, 111 35 Stockholm, Sweden
• Questback OY, Keilaranta 1, 02150 Espoo, Finland
• Questback AS, Bogstadveien 54, 0366 Oslo, Norge

We also transfer your personal data to recipients who are independent data controllers (not data processors acting on our behalf). These recipients are independently responsible for their processing of your personal data and determine their own purposes and means of processing. Such recipients include, for example, authorities when disclosure is required by law, banks, and payment service providers.

6. Is your personal data transferred to countries outside the EU or EEA (third country)?

Trial signup and marketing data: Stored primarily in the EU/EEA, but certain marketing-related data may be shared with trusted third-party providers outside the EU/EEA (as detailed below) for purposes such as displaying relevant advertisements.

Where personal data is processed outside the EU/EEA (in a ”third country”), we ensure adequate protection through either an EU Commission adequacy decision for the relevant third country or other appropriate safeguards in accordance with the GDPR, such Standard Contractual Clauses (SCCs) or equivalent protections. Where applicable, we implement additional supplementary security measures to ensure the protection of your personal data.

You may request a copy of the safeguards we have implemented and further information about where your personal data has been transferred by contacting us using the details provided below.

7. What rules apply to how long your personal data is stored?

Information about how long Questback stores data relating to you specifically in different situations can be found in section 4 above. We never process your personal data for longer than is permitted under applicable law, regulation, practice or authority decision. Personal data that we process in order to fulfil our agreement with you is as a starting point processed for the time necessary for us to be able to fulfil the agreement of providing a free trial of our products with you. We may, however, store your personal data for a longer period if it is necessary to comply with legal requirements, because you have given your consent to it or because we have the right to do so according to a balancing of interests.

8. Your rights

The following describes your rights regarding our processing of your personal data. To exercise your rights, you are welcome to contact us (see contact details below).

The right to withdraw consent

Where processing is based on consent, you have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Right to object to the processing

You may object to your data being processed for direct marketing purposes. We will then cease processing your data for such purposes. You also have the right to object to your data being processed based on a balancing of interests. If we cannot demonstrate compelling legitimate grounds for continuing to process the data, we must cease the processing.

The right of access

You have the right to request information about what personal data we process about you and how the data is processed (a so-called register extract). You also have the right to request a copy of the personal data that we process.

Right to rectification

You have the right to without undue delay obtain the rectification of inaccurate personal data concerning you and to have incomplete personal data completed by providing us with correct information.

The right to erasure (right to be forgotten) and limitation of processing

You have the right to request the erasure of your personal data at any time, for example if the processing is no longer relevant in relation to the purpose for which the data were collected or if you withdraw your consent.

You may also request that certain processing of your data is restricted, for example if you object to the accuracy of the data.

The right to data portability

Where you have provided your consent or where we base the processing on an agreement with you, you have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format and to transmit this data to another controller or have our help to transfer the data to another controller when this is technically feasible.

The right to lodge a complaint with a supervisory authority

If you have any complaints regarding our processing of your personal data, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. If you are located in Sweden, you can lodge a complaint with the Swedish Authority for Privacy Protection (www.imy.se).

9. Global applicability

Questback is based in Europe and our privacy policy is designed to meet the requirements of the EU/EEA General Data Protection Regulation (GDPR). Since we also have customers and trial users outside Europe, other privacy laws may apply depending on where you are located.

• United Kingdom – Our processing complies with the UK GDPR and the Data Protection Act 2018.
• United States – If you live in a state with its own privacy law (such as California, Virginia, Colorado, Connecticut, or Utah), you may have additional rights such as the right to opt out of the “sale” or “sharing” of your personal information.
• Brazil – If you are located in Brazil, your personal data is also protected under the Lei Geral de Proteção de Dados (LGPD).
• Canada – If you are located in Canada, our processing of your personal data also follows PIPEDA principles.
• Other regions – In countries with local privacy laws (such as South Africa, Singapore, or Australia), we will respect your rights under those laws.

If you live outside the EU/EEA and want to understand how your rights apply, please contact us at dataprotection@questback.com. We will handle your request in line with both GDPR and the privacy law relevant in your region.

10. Contact information

Questback AS, Bogstadveien 54, 0366 Oslo, Norway, is the controller of the processing of personal data described in this policy.

Our subsidiaries and offices in the EU/EEA and other regions may also process your data on our behalf.

If you wish to exercise your rights as set out above or wish to contact us regarding our personal data processing, you can do so by contacting us at dataprotection@questback.com

This privacy policy was last updated on 15 October 2025.