GDPR Compliance

BugBasket is fully committed to compliance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”). As a company based in the Netherlands and serving customers across the European Union, data protection is fundamental to how we build and operate our platform.

We have implemented comprehensive technical and organizational measures to ensure that all data processing activities comply with the GDPR. This page outlines our practices and your rights.

BugBasket processes personal data in connection with providing our feedback collection and management platform. The categories of data we process include:

Categories of personal data

• Account data: Name, email address, company name and billing information of our customers.
• Feedback data: Screenshots, screen recordings, text descriptions, browser metadata and other information submitted through the BugBasket widget.
• Usage data: Log data, IP addresses, browser type and interaction data collected during use of the Service.

Categories of data subjects

• Customers: Individuals and organizations that register for and use BugBasket.
• End users: Individuals who interact with the BugBasket widget embedded on customer websites and applications.
• Website visitors: Individuals who visit bugbasket.com.

We process personal data under the following legal bases as defined by the GDPR:

• Consent (Article 6(1)(a)): Where you have given explicit consent for processing, such as subscribing to our newsletter or accepting optional cookies.
• Contract performance (Article 6(1)(b)): Processing necessary to fulfil our contractual obligations to you, including providing the Service, managing your account and processing payments.
• Legitimate interest (Article 6(1)(f)): Processing necessary for our legitimate business interests, such as improving the Service, ensuring security, preventing fraud and providing customer support, provided these interests do not override your fundamental rights and freedoms.

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Article 15): You have the right to request a copy of the personal data we hold about you.
• Right to rectification (Article 16): You have the right to request correction of inaccurate or incomplete personal data.
• Right to erasure (Article 17): You have the right to request deletion of your personal data, subject to certain legal exceptions.
• Right to data portability (Article 20): You have the right to receive your personal data in a structured, commonly used and machine-readable format.
• Right to restriction (Article 18): You have the right to request restriction of processing of your personal data under certain circumstances.
• Right to object (Article 21): You have the right to object to the processing of your personal data based on legitimate interest grounds.

To exercise any of these rights, please contact us at privacy@bugbasket.com. We will respond to your request within 30 days as required by the GDPR.

BugBasket has appointed a Data Protection Officer (DPO) to oversee our data protection strategy and ensure compliance with the GDPR. You can contact our DPO directly for any questions or concerns regarding data protection:

• Email: dpo@bugbasket.com
• Location: The Netherlands, EU

For Business and Enterprise customers, we offer a Data Processing Agreement (DPA) that outlines the terms under which we process personal data on your behalf as a data processor.

Our DPA includes Standard Contractual Clauses (SCCs) and covers all aspects required by Article 28 of the GDPR. To request a copy of our DPA or discuss data processing arrangements, please contact us at legal@bugbasket.com.

We use a limited number of third-party sub-processors to help us provide the Service. All sub-processors are carefully vetted and bound by data processing agreements:

We will notify customers of any changes to our sub-processor list with at least 30 days' notice.

All customer data is stored and processed within the European Union. Our primary infrastructure is hosted on Amazon Web Services (AWS) in the eu-west-1 region (Ireland).

We do not transfer personal data outside the EEA unless adequate safeguards are in place, such as Standard Contractual Clauses or an adequacy decision by the European Commission.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Our data retention periods vary by plan:

• Starter plan: Feedback data retained for 90 days.
• Pro plan: Feedback data retained for 1 year.
• Business / Enterprise plan: Unlimited data retention for the duration of the subscription.

Upon account deletion, all personal data is permanently removed within 30 days, except where retention is required by law (e.g., invoicing records for tax purposes).

In the event of a personal data breach, BugBasket will comply with the notification requirements set out in GDPR Article 33 and Article 34:

• We will notify the relevant supervisory authority within 72 hours of becoming aware of a breach that is likely to result in a risk to the rights and freedoms of data subjects.
• If the breach is likely to result in a high risk to data subjects, we will notify affected individuals without undue delay.
• We will notify affected customers as data controllers promptly, providing all relevant details to enable them to meet their own notification obligations.

If you have any questions about our GDPR compliance practices, data processing activities or wish to exercise your data protection rights, please contact us:

• Privacy inquiries: privacy@bugbasket.com
• Data Protection Officer: dpo@bugbasket.com
• Legal inquiries: legal@bugbasket.com
• Location: The Netherlands, EU