Privacy notice for the employee survey

This notice explains how your personal data is processed when you take part in the specified organisation’s employee wellbeing and work environment survey. It supplements the brief information shown before you complete the questionnaire. The survey is conducted on the app.motify.lv platform.

1. Who is responsible for data processing?

The personal data controller for the particular survey is the organisation on whose behalf the survey is conducted. The controller’s name, contact details and the data protection officer’s contact details (where applicable) are provided in the short privacy notice presented before the survey begins.

This full privacy notice must be read together with the short privacy notice for the particular survey. Together, these documents provide information about the processing of personal data in that survey.

The data processor is SIA “Motify”, registration No. 40103454804, Jūras iela 44A, Engure, Tukuma novads, LV-3113, Latvia; email motify@motify.lv. Motify organises data collection and analysis on behalf of the controller. If you contact Motify about your data protection rights, we will help forward your request to the controller.

2. Why do we conduct the survey and what is the legal basis?

Assessing work environment risks. The purpose of the survey is to assess the work environment, including psychosocial risks, job demands, resources, and employees’ wellbeing, so that the controller can identify necessary improvements and preventive measures. The basis for processing is Article 6(1)(c) GDPR — compliance with a legal obligation applicable to the controller. If the survey collects health data that can be linked to an individual, Article 9(2)(b) GDPR also applies, subject to the requirements of employment and occupational health and safety law.

In Latvia, this obligation is based on the Labour Protection Law and Cabinet Regulation No. 660 on internal supervision of the work environment.

Invitations, access and reminders. We use contact details provided by the employer and an individual survey code to invite employees, provide access to the questionnaire, prevent accidental duplicate submissions and, where planned, send reminders. This processing serves the survey purpose described above.

Individual report, if this option is offered. If you voluntarily choose to receive your wellbeing report, we ask for your explicit consent for this separate purpose (Article 6(1)(a) GDPR; if the report includes health data, also Article 9(2)(a)). Declining the report does not affect your ability to take part in the survey. You can withdraw consent by writing to motify@motify.lv. Withdrawal does not apply to data already lawfully processed for assessing work environment risks.

3. What data do we process and where do we obtain it?

From the employer: the necessary invitation and identification information, such as your name, email address, department, position or job group, length of service and an individual survey code, to the extent provided for in this project.

From you: answers about work experience, workload, relationships, the work environment, motivation and wellbeing; some questions also concern physical or mental wellbeing and may involve health data.

From the survey system: technical access, security and error logs, such as session identifiers and technical device or network data, to the extent necessary for the platform to function.

If you choose an individual report: your choice to receive the report, evidence of consent, calculated individual indicators and the information needed to send the report.

4. What does a pseudonymised survey mean?

Your answers are assigned an individual code. We store contact details and information linking identities separately from survey answers. A limited number of authorised Motify employees may technically be able to re-establish the link between the code and the person. This survey is therefore not completely anonymous.

The employer receives aggregated results for the organisation and its employee groups, rather than individual answers or a table linking codes to personal identities. We present survey results in aggregate form, applying a minimum group size of at least 5 respondents. Results for groups with fewer than 5 respondents are not shown separately, to reduce the risk of identifying individual answers. We process free-text comments to minimise the identifiability of employees and other persons as far as possible. However, particularly in small groups or where comments are specific, the risk of identification cannot be eliminated entirely.

If the survey is repeated, we compare its results with previous measurements at organisation and department level using aggregated data. We link individual respondents’ answers across survey waves only where necessary to prepare individual reports or assess changes on a statistically sound basis, including calculating confidence intervals and standard errors using repeated individual measurements. We make these links using pseudonymised identifiers. Individual results are not shared with the employer.

5. Who may have access to the data?

Only authorised persons who need access to perform their duties can access individual survey answers and data that can be linked to identities. As a data processor, Motify may use subprocessors to provide technical infrastructure and communications:

• Vercel — operating the survey platform and, where planned, storing report files (EU infrastructure).
• MongoDB Atlas — hosting the survey database (EU region).
• Twilio SendGrid — sending survey invitations and individual reports by email.
• BudgetSMS — sending survey invitations to the specified telephone numbers and sending links to individual reports.
• Documint — generating an individual PDF report using the results data needed for that purpose (USA).

Individual answers are not shared with other employees or managers merely because they work in the same organisation. Disclosure to competent authorities may be mandatory in cases prescribed by law.

6. Is data transferred outside the European Economic Area?

Core survey data is stored in EU regions. Service providers outside the European Economic Area (EEA), including the USA, may be involved in providing certain technologies or support, particularly where the project includes generating individual PDF reports. Data is transferred outside the EEA only using a lawful mechanism under Chapter V GDPR.

7. How long do we retain data?

We retain personal data only for as long as necessary for the survey’s purpose. The standard period is up to two years after the survey ends, unless the agreement with the controller specifies a shorter period or another appropriate legal basis exists. The retention period for personal data in the particular survey and the point from which it is calculated are stated in the short privacy notice available before the survey begins. At the end of the specified period, we delete or irreversibly anonymise personal data unless another legal basis exists for retaining it further.

Irreversibly anonymised summaries at organisation level may be retained for longer for statistical and comparative analysis, provided the controller has authorised their use and the information no longer allows individuals to be identified.

8. Is participation mandatory?

Taking part in the survey and providing answers are voluntary. Choosing not to complete the questionnaire must not result in adverse consequences for the employee. However, the controller may have a legal obligation to assess work environment risks. This obligation is the legal basis for processing personal data; it does not oblige you to provide particular answers.

9. Your rights and contact details

Where the GDPR applies and your data can be identified, you have the right to receive information about its processing and to request access, correction of inaccuracies, erasure or restriction of processing in the cases provided for by law. Depending on the basis for processing, rights to object to processing and to data portability may also apply.

If an individual report is prepared on the basis of consent, you can withdraw that consent at any time; this does not affect the lawfulness of processing already lawfully carried out. However, assessment of work environment risks based on a legal obligation cannot be stopped simply by withdrawing consent, because consent is not the basis for that processing.

Address requests to the data controller: motify@motify.lv. We will respond without undue delay, usually within one month. If you believe that your rights have been infringed, you can contact Latvia’s Data State Inspectorate (www.dvi.gov.lv) or the data protection supervisory authority in the relevant country.

10. Automated calculations and changes to this notice

The survey system may automatically calculate group indicators and, if you choose, an individual wellbeing report. The survey is not intended for automated personnel decisions concerning individual employees that would have legal or similarly significant effects.

If the survey’s purpose, the scope of data, retention or recipients change, we update this notice and inform you in accordance with applicable requirements.