Controller or processor depends on the data
AYA is a controller for the personal data needed to run our website, accounts, billing, service security and direct customer relationships. We determine why and how that information is used.
When a customer determines the purpose of research content placed in its AYA workspace, the customer may be the controller and AYA may act as its processor. The applicable service agreement and, where required, a data processing agreement set out those instructions.
Not a compliance certificate
This page explains our operating approach. GDPR compliance depends on the particular data, purpose, relationship and safeguards. Customers remain responsible for their own lawful basis, notices and research instructions where they act as controller.
The principles we work to
- Lawfulness, fairness and transparency: explain what is happening and identify a legal basis.
- Purpose limitation: use personal data for defined, compatible purposes.
- Data minimisation: request and share only what the workflow needs.
- Accuracy: provide routes to correct account and source information.
- Storage limitation: retain records according to purpose, account lifecycle, risk and legal duties.
- Integrity and confidentiality: apply technical and organisational safeguards proportionate to risk.
- Accountability: document decisions, contracts and incident handling.
Lawful bases
Depending on the processing, we rely on performance of a contract, steps requested before a contract, legitimate interests, legal obligations or consent. We use consent for non-essential cookies and similar technologies. A customer using AYA for its own research must identify the appropriate basis for the data it controls.
AYA is not designed for customers to submit special-category data. If a lawful use genuinely requires it, contact us before submitting it so the purpose, basis and safeguards can be assessed.
When AYA processes for a customer
Where AYA acts as processor, we process personal data on documented instructions, require confidentiality, apply appropriate security, assist with rights and incident obligations, control subprocessor access, and delete or return data in line with the agreement and law.
Customers can request our data processing terms and relevant subprocessor information at privacy@askyouraudience.ai.
Subprocessors and international transfers
AYA uses managed providers for hosting, databases, authentication, payments, email, analytics and AI-assisted workflows. We assess the role each provider performs and use appropriate contractual terms.
Where personal data moves outside the EEA or UK and no adequacy decision applies, we use a recognised safeguard such as Standard Contractual Clauses and, where relevant, the UK Addendum, together with supplementary measures appropriate to the risk.
Individual rights
| Right | What it means |
|---|---|
| Access | Ask whether we process your data and receive a copy. |
| Rectification | Correct inaccurate or incomplete data. |
| Erasure | Request deletion where a lawful exception does not require retention. |
| Restriction | Limit processing in specified circumstances. |
| Portability | Receive eligible data in a structured, machine-readable format. |
| Object | Object to legitimate-interest processing and direct marketing. |
| Withdraw consent | Change a consent choice at any time, without affecting earlier processing. |
Send a request to privacy@askyouraudience.ai. We may verify identity and will normally respond within one month. If AYA is processing solely for a customer, we may direct or forward the request to that controller.
AI and automated decisions
AYA uses automated systems to help create audience research outputs. The service provides evidence for a human user to interpret; it does not make solely automated decisions about users that produce legal or similarly significant effects.
We minimise the data supplied to model providers for a workflow and apply contractual and access controls. Customers should not use AYA output as the sole basis for decisions that materially affect an identifiable person.
Security and incidents
Our controls include managed authentication, role-based access, encryption in transit, protected infrastructure, logs and operational review. We assess incidents and notify affected controllers, people or authorities when required by law.
Customers should configure access carefully, remove former users, avoid unnecessary personal data and report suspected incidents promptly.
Questions and complaints
Contact our privacy team at privacy@askyouraudience.ai. We use “privacy contact” rather than claiming a statutory Data Protection Officer appointment.
You can also complain to Malta’s Information and Data Protection Commissioner or the supervisory authority where you live, work, or believe an infringement occurred.