How StrawPoll handles your data

1. Party responsible for this website

The party responsible for processing data on this website (controller) is:

Gregor Krambs Internet GmbH & Co. KG
Margaretenstraße 46
20357 Hamburg, Germany
Contact: Gregor Krambs
Telephone: +49 40 36942520
Email: gregor@gk-internet.de

The controller is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data (names, email addresses, etc.).

2. Your rights

Under the GDPR, you have the right at any time and free of charge to:

• request information about your stored personal data, its origin, its recipients and the purpose of processing (Art. 15 GDPR);
• have incorrect data corrected (Art. 16 GDPR);
• have your data deleted (Art. 17 GDPR);
• have the processing of your data restricted (Art. 18 GDPR);
• receive data that we process based on your consent or in fulfillment of a contract in a standard, machine-readable format, or have it transferred to another controller where technically feasible (Art. 20 GDPR);
• object to processing based on our legitimate interests (Art. 21 GDPR);
• revoke your consent at any time with future effect (Art. 7 (3) GDPR). An informal email is sufficient. Data processed before we receive your request may still be legally processed.

To exercise these rights, contact us using the details above. If you believe that the processing of your data violates data protection law, you also have the right to file a complaint with a supervisory authority. The authority responsible for us is the data protection officer of the German state in which our company is headquartered. A list of data protection officers and their contact details can be found at bfdi.bund.de.

3. SSL/TLS encryption

This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as the data you send to us. You can recognize an encrypted connection by “https://” and the lock icon in your browser’s address bar. With SSL or TLS encryption activated, the data you transfer to us cannot be read by third parties.

4. Server log files

Our servers automatically collect and store information that your browser transmits to us in server log files:

• Browser type and browser version
• Operating system used
• Referrer URL
• Host name of the accessing computer
• Time of the server request
• IP address

These data are not combined with data from other sources. The legal basis is Art. 6 (1) (f) GDPR; we have a legitimate interest in operating the website securely and free of technical errors. Log files are deleted after 90 days.

5. Cookies

Cookies are small text files that your browser stores on your device. They do not harm your computer and do not contain viruses. We use cookies that are necessary to run StrawPoll, for example to keep you signed in or to recognize that your browser has already voted in a poll. The legal basis is § 25 (2) TDDDG and Art. 6 (1) (f) GDPR; we have a legitimate interest in providing a technically error-free service.

On the free plan, Google sets advertising cookies when it shows ads. These are only used with your consent, which you give or refuse in our consent banner (see Advertising on the free plan). Our own usage statistics (Rybbit, see section 10) work without cookies.

You can also configure your browser to inform you about cookies, to reject them, or to delete them when you close it. Disabling cookies may limit the functionality of this website.

6. Registration and account

You can register on our website to access additional functions. The data you enter is only used for the purpose of using the respective service. The mandatory information requested during registration must be provided in full; otherwise we will reject the registration. We use the email address specified during registration to inform you about important changes, such as changes to our service or technical changes.

If you sign in with a third-party account (such as Google, Facebook, Microsoft or Discord), that provider sends us your name, email address and, where available, your profile picture. We do not receive your password for that account.

We process the data provided during registration based on your consent per Art. 6 (1) (a) GDPR. You may revoke your consent at any time with future effect. We store the data for as long as you remain registered. Statutory retention periods remain unaffected.

With each sign-in session we store your IP address and browser, so you can review your sessions in Settings. The IP address is deleted after 90 days.

To be able to answer orders from authorities, we also keep a separate log of sign-ups, sign-ins and image uploads with the time, your email address, IP address and browser. It is only used to answer such orders and deleted after 90 days. The legal basis is Art. 6 (1) (f) GDPR; we have a legitimate interest in being able to trace illegal content back to the account that posted it.

7. Polls and votes

When you create a poll, we store its content and settings. When you vote, we store your answers. To enforce the duplicate vote checks chosen by the poll creator and to prevent abuse, we also store your IP address and browser information with the vote and, if the poll requires it, your email address. The IP address is deleted 90 days after the vote; the vote itself stays, but the duplicate check no longer recognizes it by IP address.

The poll creator and their team can see the answers, and the IP address, country and contact details stored with each vote, for example when they export responses. If a business or organization created the poll, it is the controller for this data and we process it on its behalf under our data processing agreement. Please contact the poll creator to exercise your rights for it; if you contact us, we forward your request.

If you create a poll without an account, we keep the poll’s address with your IP address and browser in the same log, which is deleted after 90 days.

Polls, votes and the other data stored with them are kept until the poll creator deletes the poll. On the Business plan, the creator can instead have responses deleted automatically after a period they set. Deleted polls are kept in the trash for 30 days and then permanently deleted, together with their votes. The legal basis is Art. 6 (1) (b) GDPR (providing the service) and Art. 6 (1) (f) GDPR (our legitimate interest in fair results and in preventing abuse).

8. Comments

If you comment on a poll, we store the comment together with the time it was created, your username if you are signed in, and your IP address. We do not check comments before they go live, so we need this information to be able to act against illegal or slanderous content. The IP address is deleted after 90 days. Comments are stored until the poll is deleted or the comment has to be removed for legal reasons. The legal basis is Art. 6 (1) (a) GDPR; you may revoke your consent at any time with future effect.

9. Service providers

We use the following providers to run StrawPoll:

• Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) hosts the dedicated servers that run StrawPoll and store all of its data, in data centers in Germany.
• Amazon Web Services (Amazon SES) to send emails, such as sign-in links, vote confirmations and notifications. We use the AWS region Frankfurt (eu-central-1), so emails are processed in Germany.

These providers process data only on our behalf and according to our instructions. The legal basis is Art. 6 (1) (b) and (f) GDPR.

Payments. If you buy a paid plan, the payment is handled by Paddle.com Market Limited (Judd House, 18–29 Mora Street, London EC1V 8BT, United Kingdom), which sells our plans as reseller and merchant of record. Paddle receives the data needed for the purchase, such as your name, email address, billing address and payment details, and processes it as an independent controller under its own privacy policy. We do not receive your full payment details. This only applies to paid plans; if you use StrawPoll for free, no data goes to Paddle. The legal basis is Art. 6 (1) (b) GDPR.

Advertising. On the free plan, ads are shown by Google AdSense; see section 11.

Some protections run entirely on our own servers, without any third party:

• When a poll requires a captcha, we use Cap, an open-source captcha that we host ourselves. Your browser solves a small computing task to show that it is not a bot; no data is sent to a captcha provider.
• When a poll blocks VPNs and proxies, we check voters’ IP addresses against a list of known VPN and datacenter addresses stored on our own servers. IP addresses are not sent to any third party for this check.

10. Usage statistics (Rybbit)

To see how StrawPoll is used and improve it, we use Rybbit, an open-source analytics software (AGPL-3.0). We host Rybbit ourselves on our servers in Germany; no analytics provider or other third party receives the data.

When you visit a page, Rybbit records the page address and title, the referring page, the time, your browser, operating system, device type, screen size and language, and your approximate location (country, region and city) derived from your IP address. Your IP address is only used for this lookup and is not stored. To count visitors without cookies, Rybbit derives an identifier from a hash of your IP address and browser information with a salt that changes every day, so you cannot be recognized from one day to the next.

Rybbit sets no cookies and stores nothing on your device, so no consent is needed for it (§ 25 TDDDG). The legal basis is Art. 6 (1) (f) GDPR; we have a legitimate interest in understanding how our service is used. You can object to this at any time (Art. 21 GDPR), for example by contacting us using the details above.

11. Advertising on the free plan (Google AdSense)

To offer StrawPoll for free, we show ads on the free plan. They are provided by Google AdSense, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Paid plans and polls created with a paid plan are ad-free, and no data is sent to Google for advertising there.

When a page with ads loads, your browser connects to Google’s servers. Google receives technical data such as your IP address, browser and device information, the address of the page and the time of the visit. Google uses this data to deliver ads, measure them and prevent fraud. We do not pass any of our own data to Google: your account details, votes, answers and poll results are never shared for advertising.

Google uses cookies and similar technologies to personalize ads based on your interests and to limit how often you see the same ad. We only allow this after you have given your consent in our consent banner (Art. 6 (1) (a) GDPR and § 25 (1) TDDDG). If you do not consent, Google only shows ads that are not based on your profile. You can withdraw or change your consent at any time with future effect through the privacy settings link in the footer.

Google may process data in the United States. Google LLC is certified under the EU–US Data Privacy Framework, on which the European Commission has based an adequacy decision; Google also uses the EU standard contractual clauses. More information is available in Google’s privacy policy and at how Google uses data for advertising. You can also manage personalized ads from Google in your Google ad settings.

California residents. Under the California Consumer Privacy Act (CCPA), as amended by the CPRA, showing personalized ads can count as “selling” or “sharing” personal information, even though no money changes hands for your data. You have the right to opt out of it: choose “Do not sell or share my personal information” in the privacy settings, or send your browser’s Global Privacy Control signal, which we honor. You will then only see ads that are not personalized. You also have the right to know what personal information we collect, to have it deleted or corrected, and not to be treated differently for using these rights.

12. Sharing polls

You can share polls on social networks such as Facebook, X, Reddit or WhatsApp. We use our own share buttons, which only contact the network after you click one. No data is transferred to these networks before that, so they cannot build profiles of your browsing behavior from our pages.

13. Objection to promotional emails

We hereby expressly prohibit the use of contact data published in the context of our legal notice for sending promotional and informational materials not expressly requested. We reserve the right to take legal action if unsolicited advertising material, such as spam emails, is received.

1. Parties and scope

This agreement is between Gregor Krambs Internet GmbH & Co. KG (“we”, the processor) and every customer who uses StrawPoll to collect personal data for purposes other than purely personal or household activities, such as a company, school, association, public body or freelancer (“you”, the controller). It forms part of the contract for using StrawPoll, on the free plan and on paid plans, and applies as soon as you create a poll, form or sign-up sheet that collects personal data. It is concluded electronically (Art. 28 (9) GDPR); no signature is needed. You accept it when you sign up, upgrade or buy credits, and we record which version you accepted and when. If you need a countersigned copy, email gregor@gk-internet.de.

Where this agreement and our Terms of Service differ on the processing of personal data, this agreement prevails.

2. Subject, nature and purpose

We host your polls and forms, collect the responses, store them, show you the results and let you export them. This includes the checks you switch on, such as duplicate vote checks, email verification, captchas and VPN blocking, and sending the emails a poll needs, such as verification codes and confirmations. The agreement lasts as long as you use StrawPoll and ends when all of your polls or your account have been deleted.

3. Data subjects and types of data

Data subjects: people who vote in, answer or are invited to your polls and forms, and the members of your team or workspace.

Types of data, depending on how you set up your poll:

• answers, votes, uploaded files and the time they were submitted;
• name, email address, phone number and voting codes, if you ask for them;
• IP address, the network it belongs to, the country derived from it, browser information (user agent) and the referring page;
• a random identifier stored in the participant’s browser to recognize repeat votes;
• hidden fields you add to your poll links, such as campaign parameters.

Do not ask for special categories of personal data (Art. 9 GDPR), such as health data or political opinions linked to a person, unless you have a legal basis for it.

4. Your instructions

We process the data only on your documented instructions. Your instructions are this agreement and the settings you choose in StrawPoll, for example which duplicate check a poll uses, who can see results, and when you export or delete data. Further instructions can be given by email. We tell you without delay if we believe an instruction infringes data protection law. We process data otherwise only where EU or German law requires it, and we tell you about that requirement first unless the law forbids it.

5. Our obligations

• Everyone at StrawPoll who can access your data is bound to confidentiality (Art. 28 (3) (b) GDPR).
• We take the technical and organizational measures described in section 9 (Art. 32 GDPR). We may improve them over time, but not lower the level of protection.
• We help you answer requests from data subjects. You can view, export, invalidate and delete individual responses yourself; requests that reach us about your polls we forward to you.
• We help you with data security, data breach notifications, data protection impact assessments and consultations with supervisory authorities (Art. 32 to 36 GDPR), taking into account the information available to us.
• We notify you without undue delay after we become aware of a personal data breach that affects your data, with the information you need to meet your own obligations.
• We give you the information needed to show that we meet these obligations and allow audits, including inspections, by you or an auditor you appoint. We usually answer audit requests in writing first; inspections need reasonable notice and must not disrupt our operations or other customers’ data.

6. Subprocessors

You authorize us to use the following subprocessors:

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: servers and databases, in data centers in Germany.
• Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg: sending emails with Amazon SES from the AWS region Frankfurt (eu-central-1).

The current list is also on our transparency page. We bind each subprocessor to data protection obligations equivalent to this agreement. We announce new or replaced subprocessors on that page at least 30 days before they start; paid customers are also informed by email. You may object for an important data protection reason. If we cannot resolve the objection, you may end your use of StrawPoll and paid plans before the change takes effect.

7. What this agreement does not cover

We remain the controller for processing we do for our own purposes, as described in the privacy policy: your account, payments through Paddle, server log files, the log we keep to answer orders from authorities, security and abuse prevention, usage statistics with Rybbit, and ads on the free plan.

Ads on the free plan. On free plans, ads from Google AdSense are shown on poll pages, so your participants’ browsers connect to Google, which acts as an independent controller (see section 11 of the privacy policy). Participants’ answers and votes are never shared with Google. If participants’ data must not reach any advertiser, use a paid plan; polls created with a paid plan are ad-free.

8. Retention and deletion

IP addresses are deleted 90 days after they were collected; the responses they belong to are kept. All other data is kept until you delete it or the poll it belongs to. On the Business plan, you can instead have responses deleted automatically after a period you choose in Settings, which counts as your instruction under section 4.

You can export your responses and delete them, individual polls or your whole account at any time. Deleted polls stay in the trash for 30 days so they can be restored, and are then permanently deleted together with all responses. When the agreement ends, we delete the remaining data, unless EU or German law requires us to keep it.

9. Technical and organizational measures

• Location and physical security: all data is stored on Hetzner servers in data centers in Germany certified under ISO/IEC 27001, with access control and around-the-clock surveillance.
• Encryption in transit: all connections to StrawPoll use HTTPS (TLS).
• Access control: only the people who run StrawPoll can access servers and databases. Customers can only see polls in their own account or workspace, and workspace roles decide who on a team may edit or see responses.
• Secrets: account passwords and email verification codes are only stored as hashes.
• Data minimization: captchas, VPN detection and usage statistics run on our own servers, so no participant data goes to a third party for them. Usage statistics don’t store IP addresses.
• Abuse prevention: rate limits on voting, verification emails, questions and uploads.
• Deletion: IP addresses are cleared automatically after 90 days and server log files are deleted after 90 days. Responses are deleted with their poll or after the retention period you set, and deleted polls are purged automatically after 30 days in the trash.
• Separation: each poll’s responses are stored and evaluated separately, and data is only used for the poll it was collected in.