Data Processing Agreement
Last updated October 15, 2026.
On this page
This Data Processing Agreement (the DPA) is part of the Terms of Use. It applies when Siamang processes personal data on behalf of a customer in the Services. It is written to meet Article 28 of the EU General Data Protection Regulation (GDPR) and of the UK GDPR.
How it is concluded. The DPA takes effect when the customer accepts the Terms of Use, by creating an account or by using the Services for an organization, and needs no separate signature. A copy signed by Siamang is available on request from support@siamang-team.org.
Parties
- Processor: Siamang Labs LLC, a Wyoming limited liability company, 30 N Gould St Ste N, Sheridan, WY 82801, USA (Siamang).
- Controller: the organization that uses the Services to collect, upload or otherwise process personal data, as identified by its account (the Customer).
1. Definitions and scope
1.1 Customer Personal Data means the personal data that Siamang processes on the Customer’s behalf in the Services, as described in Annex I: survey responses and their metadata, contact lists and invitation records, uploaded files, analysis outputs, and other project content that contains personal data.
1.2 Terms such as controller, processor, personal data, processing, data subject, personal data breach and supervisory authority have the meaning given in the GDPR. Data Protection Law means the GDPR, the UK GDPR and any other data-protection law that applies to the processing.
1.3 This DPA does not cover data for which Siamang is itself a controller: the account and sign-in data of the Customer’s users, billing records, support correspondence, security logs and records of staff actions. The Privacy Policy covers those.
1.4 Where this DPA conflicts with the Terms of Use, this DPA prevails for the processing of Customer Personal Data. Where the Standard Contractual Clauses apply (section 7), they prevail over this DPA.
2. Details of the processing
The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex I.
3. The Customer’s instructions
3.1 Siamang processes Customer Personal Data only on the Customer’s documented instructions, including with regard to transfers to third countries, unless the law requires otherwise; in that case Siamang tells the Customer before processing, unless the law forbids it.
3.2 The Terms of Use, this DPA, and the Customer’s use and configuration of the Services are the Customer’s complete instructions. Publishing a survey, importing contacts, sending a mailing, running an analysis, setting up a connector, a webhook or a deposit, turning on the AI assistant, and deleting a response, a contact or a project are all instructions. So is suppressing an address after an unsubscribe, a permanent bounce or a spam complaint, which is how the opt-out is honored.
3.3 Siamang tells the Customer by email to its organization’s owners if, in Siamang’s opinion, an instruction infringes Data Protection Law.
3.4 The Customer is responsible for the lawfulness of its instructions and of the data it collects: it has a lawful basis for the processing, gives data subjects the notices the law requires, obtains consent where needed, and decides whether to collect special categories of data.
4. Confidentiality and Siamang’s personnel
4.1 Siamang ensures that everyone it authorizes to process Customer Personal Data is bound by a duty of confidentiality.
4.2 Siamang’s support staff work from account and organization metadata. They do not look at response content, contact lists, file contents or questionnaire text, except what a published survey shows any visitor when Siamang reviews a report about it. When the Customer asks support to act on its data, for example to delete specific responses, support acts on the Customer’s written instruction and by reference to identifiers the Customer gives.
4.3 Administrator access to the production server, which technically reaches all stored data, is limited to one or two named engineers. They use it only to run, repair and restore the Services and to carry out the Customer’s instructions.
5. Security
5.1 Siamang implements the technical and organizational measures described in Annex II, and keeps them appropriate to the risk as required by Article 32 of the GDPR. Siamang may change the measures as long as the overall level of protection does not go down.
5.2 The Services are in beta and hold no security certification such as SOC 2 or ISO 27001.
6. Subprocessors
6.1 The Customer gives Siamang general authorization to engage subprocessors. The current subprocessors are listed on the subprocessors page (Annex III).
6.2 Siamang tells the Customer about any intended addition or replacement of a subprocessor at least 30 days in advance, by email to the owners of the Customer’s organization and by updating the subprocessors page. Where a change is urgently needed for security or to keep the Services running, Siamang may make it sooner and tells the Customer as soon as possible.
6.3 The Customer may object to a change on reasonable data-protection grounds by writing to support@siamang-team.org within that notice period. Siamang will then try in good faith to resolve the objection, for example by not using the new subprocessor for the Customer’s data. If it cannot, the Customer may stop using the affected Service, and Siamang refunds the unused part of any prepaid fees for it.
6.4 Siamang imposes on each subprocessor, by contract, data-protection obligations that give at least the same level of protection as this DPA, as far as they concern the subprocessor’s part of the processing. Siamang remains responsible to the Customer for its subprocessors.
7. International transfers
7.1 Siamang Labs LLC is established in the United States, and some subprocessors process data there. Customer Personal Data is stored on Google Cloud in the United States (Northern Virginia, region us-east4). The locations of all subprocessors are on the subprocessors page.
7.2 Where Customer Personal Data is transferred from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914 (Module 2, controller to processor) are incorporated into this DPA by reference, with the Customer as data exporter and Siamang as data importer. Annexes I to III of this DPA complete their annexes.
For the Standard Contractual Clauses: the docking clause in Clause 7 applies; Option 2 of Clause 9 applies (general written authorization, with 30 days’ notice of changes as in section 6); the optional language in Clause 11 does not apply; for Clause 13, the competent supervisory authority is that of the Customer’s establishment in the European Economic Area or, where the Customer has none, that of its representative; for Clauses 17 and 18, the clauses are governed by the law of Ireland and disputes go to the courts of Ireland. For transfers under the UK GDPR, the UK International Data Transfer Addendum issued by the Information Commissioner applies; for transfers under the Swiss Federal Act on Data Protection, the clauses apply with the adjustments that Act requires, and the Swiss Federal Data Protection and Information Commissioner is the competent authority.
7.3 Siamang ensures that its own subprocessors outside the European Economic Area and the United Kingdom are bound by a lawful transfer mechanism. For each of them this is the Standard Contractual Clauses, with the UK Addendum, in the provider’s data processing terms.
7.4 The AI assistant in Siamang Studio is not connected to any model provider during the beta and sends no Customer Personal Data outside Siamang. If Siamang connects one, it is a new subprocessor under section 6.
8. Assistance to the Customer
8.1 Data subject requests. Taking into account the nature of the processing, Siamang helps the Customer respond to requests from data subjects. Most requests can be handled by the Customer in the Services:
| Request | How | Who |
|---|---|---|
| Access, portability | Export responses (CSV, Excel, SPSS, Stata, Parquet), reports and the research bundle | The Customer, in Studio |
| Erasure of a response | Delete it in Data; it is removed, and the deletion is logged without its content | Owner or admin |
| Erasure of a contact | Delete the contact, or the project’s whole contact list; the record of each message sent to it keeps only an anonymous count | One contact: any member; whole list: owner or admin |
| Erasure of a project | Delete the project; it stays restorable in Recently deleted for 30 days and is then erased. Support can erase it sooner on request | Owner or admin; Siamang support |
| Erasure of an organization; export of a whole organization | On request to support@siamang-team.org; done by Siamang support | Siamang support |
8.2 If a data subject contacts Siamang about Customer Personal Data, Siamang does not answer the request itself. It passes the request to the Customer, where it can identify the Customer, and tells the data subject that it has done so.
8.3 Siamang answers a Customer’s request for help without undue delay, and normally within 10 business days.
8.4 Siamang gives the Customer the information it reasonably needs for its security obligations, for notifying a personal data breach, and for a data-protection impact assessment or prior consultation with a supervisory authority (Articles 32 to 36 of the GDPR): this DPA, its annexes and the subprocessors page, and answers to reasonable questions.
9. Personal data breaches
9.1 Siamang notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, by email to the owners of the Customer’s organization. Siamang may also show a notice in Studio.
9.2 The notice describes, as far as known at the time: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Siamang adds information as it learns it.
9.3 Siamang takes reasonable steps to contain the breach and limit its effects, and cooperates with the Customer. Notifying a breach is not an admission of fault.
10. Deletion and return at the end of the service
10.1 The Customer can export its data at any time (section 8.1). When the Customer stops using the Services, Siamang deletes the Customer’s organizations and the Customer Personal Data in them within 30 days of the Customer’s written request to support@siamang-team.org, and confirms the deletion by email. Until then, the Customer’s projects stay as they are, and deleted projects follow the 30-day restore period.
10.2 Backups. Deleted data remains in Siamang’s backups until those expire, up to 120 days after each backup was taken. Backups are kept only for recovery, are restored only as a whole, and only to recover the Services after a failure.
10.3 Siamang keeps no Customer Personal Data after deletion, except in backups as described in section 10.2 or where the law requires it to keep data.
11. Audits and information
11.1 Siamang makes available to the Customer the information needed to demonstrate compliance with Article 28 of the GDPR: this DPA, its annexes, the subprocessors page and, on request, written answers to a reasonable security questionnaire, normally within 30 days.
11.2 If that information is not enough, the Customer, or an independent auditor it appoints who is bound by confidentiality and is not a competitor of Siamang, may audit Siamang’s compliance with this DPA, including by inspection. The Customer gives at least 30 days’ notice, audits at most once in any 12 months unless a supervisory authority requires it or after a personal data breach, carries out the audit during business hours without disrupting the Services or other customers’ data, and bears its own costs.
12. Liability, term and law
12.1 Each party’s liability under this DPA is subject to the limitations of liability in the Terms of Use, to the extent Data Protection Law allows.
12.2 This DPA applies for as long as Siamang processes Customer Personal Data, including in backups.
12.3 This DPA is governed by the law that governs the Terms of Use, except that the Standard Contractual Clauses are governed by the law they name (section 7.2).
Annex I: Details of the processing
Subject matter and purpose. Hosting and operating the Customer’s surveys, mailings and analyses: building and publishing questionnaires, collecting responses, inviting and reminding respondents by email, storing and analyzing the data, producing reports and live dashboards, exporting and depositing results, sending data to services the Customer connects, and the backups, security and support that running the Services needs. In Siamang Cloud, this also covers hosting the Customer’s project repositories and deploying and analyzing the surveys defined in them.
Duration. For as long as the Customer uses the Services, then until deletion under section 10, including backup expiry.
Nature of the processing. Collection, recording, storage, organization, analysis, retrieval, transmission to services the Customer connects, and erasure.
Frequency of transfer. Continuous, for as long as the Customer uses the Services.
Competent supervisory authority (Clause 13 of the Standard Contractual Clauses). As set out in section 7.2.
Categories of data subjects.
- Respondents to the Customer’s surveys.
- People on the Customer’s contact lists who are invited to a survey.
- People whose data the Customer uploads in data files or imports from other tools.
- The Customer’s team members, as far as their names appear in project content such as comments and history.
Types of personal data. The table describes Siamang Studio. In Siamang Cloud, the same kinds of data arise from the surveys and analyses the Customer runs there, and the Customer’s project repositories, with their full history, hold whatever personal data the Customer puts in them, for example in data files.
| What | Detail |
|---|---|
| Survey answers | Whatever the Customer’s questionnaire asks. This can include special categories of data (Article 9 of the GDPR); the Services treat every answer as possibly sensitive and do not label it. |
| Partial answers | The answers so far, sent at each page change before the respondent submits. |
| Response metadata | Start time, duration, last page reached, counts of tab switches, seconds the page was hidden and pastes (counts only, never content), the captcha result when the survey uses one, parameters in the survey link (for example a panel’s respondent identifier or an invitation), and a random interview identifier. |
| Respondents’ IP addresses | Not stored with responses. Used for rate limiting, sent to Cloudflare when a survey uses the captcha, and recorded in the server’s request logs, which are overwritten as new entries arrive. |
| Contacts | Email address, optional name and attributes, a personal survey link with its token, and each contact’s delivery status: queued, sent, failed, bounced, complained, unsubscribed, started or completed. |
| Invitation emails | Each message as sent, with its address and text, including the personal survey link. |
| Files and outputs | Uploaded data files, analysis outputs, reports and live dashboard tiles. Reports and charts carry aggregates; scatter plots and box plots carry individual values, without respondent identifiers. |
| In the respondent’s browser | A draft of the answers for up to 7 days; with One per browser turned on, a mark that stays until the respondent clears their browser data. |
Retention.
| Data | Kept |
|---|---|
| Responses and partial responses | Until the Customer deletes them or the project is erased. |
| Contacts and suppressions | Until the contact or the list is deleted, or the project is erased. |
| Invitation emails as sent | Until the contact or the list is deleted, or the project is erased; then the address, text and error are erased and an anonymous count remains. |
| A deleted project | 30 days in Recently deleted, then erased. |
| Survey previews | 7 days. |
| An organization after its trial | Moves to the Free plan; nothing is deleted. |
| Server logs | Rotated by size and overwritten as new entries arrive. |
| Backups | Up to 120 days after each backup was taken (section 10.2). |
Annex II: Technical and organizational measures
The measures below are those of Siamang Studio. Siamang Cloud applies measures of the same kinds: encryption in transit, roles and checks on every request, sandboxed analysis, signed links for files, and backups. Details for either Service are available on request from support@siamang-team.org.
Access and separation
- Roles in each organization (owner, admin, member); deleting responses and projects requires owner or admin.
- Every request is checked against the organization it belongs to, and every project has its own database schema. People outside an organization get the same “not found” as for a project that does not exist.
- Survey builds run in sandbox containers with no network access. Analyses run in sandbox containers with no internet access, on a network that reaches only the database, with a database role limited to the project’s own schema, and with limits on memory, time and disk.
- Files are served only through signed links that expire.
- Published surveys are served from a separate address that shares no cookies or session with the app, and each survey page carries a content security policy. All surveys share one address; custom JavaScript and CSS are published only on paid plans.
Sign-in and sessions
- Sign-in through a managed authentication service, with email confirmation required for password sign-up, or through Google. No account is created unless the email address has been confirmed.
- A captcha on the sign-up and password forms; rate limits on sign-in, survey submissions and other costly requests.
- API keys and teammate invitation tokens are stored only as hashes.
Data in transit and at rest
- TLS on every public address, and HTTP Strict Transport Security on the Studio app.
- Connector credentials, webhook signing secrets and project secrets are encrypted with a dedicated key, and the Services refuse to start with development keys.
- Outgoing webhooks and connector exports go only to public internet addresses, checked again at every delivery.
Availability and recovery
- Nightly backups with checksums, verified after upload to separate cloud storage. The server can write and read backups there but cannot delete or overwrite them.
- Backups can be test-restored into a scratch database to prove they work.
- Daily disk snapshots, kept for 14 days; the server’s configuration is kept in a separate secret store.
Server and staff access
- Administrative access to the server only through Google’s Identity-Aware Proxy with individual accounts; the firewall opens only the web ports.
- Administrator access to production for one or two named engineers.
Audit
- An Activity trail of organization events (saves, publishing, runs, mailings, invitations, share links, deletions, member changes, the assistant turned on or off), visible to the Customer.
Annex III: Subprocessors
The current list, with what each subprocessor receives and where it processes data, is on the subprocessors page.
This DPA is written in plain language. It is not legal advice.