Policies

This page explains, in plain language, what it means to run an Organisation on Eddy. The binding text lives in the Trust Center. If anything here disagrees with the Trust Center, the Trust Center wins.

These duties apply whether the Organisation is on a free or paid plan. Paying changes product features and commercial terms; it does not move controller responsibility onto Eddy Works for the data your Maps collect.

Who decides what to collect

Your Organisation designs Maps and runs Sessions. You choose what to ask, who participates, and why. For that Session data, your Organisation is the controller and Eddy Works is the processor.

Eddy Works is a controller in its own right for account data and platform operations (sign-in, telemetry, and similar). That split is described in the Privacy Policy and the Data Processing Addendum.

Notices and consents

Before people take part in your Sessions, you are responsible for having a lawful basis and for giving them the notices and consents the law requires for your use of their data on Eddy.

In practice that means:

1. Eddy platform terms — every Eddy user accepts these when they create an account.
2. Organisation notice — your Organisation's notice to first-time participants (jurisdiction, purpose, how responses are used). Eddy does not yet present Organisation notices in-product. Until it does, the Organisation must provide its notice through its own channel before sharing a Session link with a first-time participant.

On request, you may need to confirm to Eddy Works in writing that you have those consents and notifications. See Terms of Use §8.

Sensitive and regulated data

The Acceptable Use Policy tiers what you may put through Eddy:

• Tier 1 — categories that are not permitted today (for example certain health or payment data). When Eddy is ready to support them, they will require a separate written agreement.
• Tier 2 — categories such as workplace health and safety, EDI surveys, employment or education records. Permitted when you have a lawful basis, safeguards, notifications to the people involved, and you meet your controller obligations.
• Always prohibited — illegal content and other absolute bans in the AUP.

Eddy does not certify that your sector use is lawful. You remain responsible for licences, permissions and notices.

Members, Guests and conduct

You are responsible for how Members and Guests use the Service under your Organisation, including compliance with the Terms and AUP. A breach by a Member or Guest can be treated as a breach by the Organisation. See Terms of Use and Membership.

Data subject requests

If someone asks Eddy Works for access or erasure that relates to data your Organisation controls, Eddy Works forwards that request to you so you can instruct as controller. Eddy Works handles requests about data it controls (for example account profile data) itself. Detail: Data Processing Addendum and Privacy Policy.

When policies change

Eddy Works may update the Terms and related policies. For material changes we try to give at least 30 days' notice (email, in-app, or on the website). Changes take effect on the date in the notice. Continued use after that date is acceptance. If you do not accept the changes, you may terminate before the effective date.

We give at least 30 days' notice before increasing fees, or 90 days for a material increase. The new price applies from the next billing period. Changes required by law or for security may take effect immediately, with notice as soon as practicable.

See Terms of Use §3 and §9.7.

Where to read the full text

Related

• Introduction
• Membership
• Permissions