Survey Gizmo Customer Data Privacy and Security Statement

We will not sell, rent, distribute or give away your email address or personal information to ANY third
party, except to comply with applicable law. We will not publish your email address, phone or mailing
address at any time.

Your email address

If you have subscribed to our newsletter, we hold your email address only in order to send you the
newsletter you have requested. You can unsubscribe at any time for any reason. If you ever have a
problem with your subscription, feel free to contact Customer Service.

Your most valuable asset: your data

We will proactively protect your customer, subscriber data, and survey data by keeping our servers up-
to-date and our internal data security high. Your subscriber data will never exported, sold, rented, or
used in any way by Widgix Software. It is your data, and we will protect it to the very best of our
abilities.

Staff access to your data

Only administrators and customer/technical support managers have access to customer data. Our staff
will not access your data, grant access to third parties or otherwise disseminate your data. If you open a
support ticket, hire our consulting services, call our telephone support then an administrator (or support
manager) may log into your account for the purpose of troubleshooting & correcting the reported issue
or performing their contracted task. All staff members have signed a customer confidentiality
agreement.

Requests to permanently remove data

A written request to permanently remove all response data from our service will be answered in no
more than 2 business days. SurveyGizmo will reply with written confirmation that all files, database
records and backups of this data have been destroyed. Data cannot be recovered after this is performed.

Safe Harbor Certification

We are happy to participate in the US Department of Commerce’s Safe Harbor Framework.
SurveyGizmo has self-certified adherence to the Safe Harbor Privacy Principles. For more information
about the Safe Harbor Privacy Principles and to view our certification, visit the U.S. Department of
Commerce’s Safe Harbor Web site.

HIPAA Certification
SurveyGizmo has self-certified its adherence to HIPAA, the Health Insurance Portability and
Accountability Act of 1996 for the handling of Protected Health Information (PHI). SurveyGizmo
follows the Privacy Rule and the Security Rule provisions of HIPAA. For more information about
HIPAA visit the US Department of Health and Human Resources HIPAA page.
 Survey Gizmo Customer Data Privacy and Security Statement
Server Security
Our data servers are hosted by Server Beach in San Antonio, Los Angeles, and Miami. They are in high
security data centers, monitored via closed circuit television and 24x7 onsite security personnel guard
the facility while military-grade pass card access and biometric handscan units provide further layers of
security. The facilities are equipped with an FM200 gas-based, hardware-friendly fire suppression
system and diesel backup power generators.
We use firewall software and perform daily scans for viruses and rootkits. Data sent between the
survey production machines is sent over an AES-256 (256 bit) encrypted connection. Our database is
behind a firewall and configured to only accept connections from a single machine in our local
network. User passwords are encrypted/hashed via MD5.

Disaster Recovery and Business Continuity

SurveyGizmo has two major components. The survey production environment for data collection and
the application which handles reporting and permanent data storage. The survey production
environment consists of several servers on a monitored round-robin configuration. They can continue
to capture information even if the primary application suffers a disaster. The application servers consist
of the application, the underlying architecture, and the database. A backup machine on a separate
subnet exists with the application and architecture for emergency use. All application data is backed up
on two servers and all primary servers have hot swappable RAID drives.