If your company has a data protection officer, make sure to consult this person to ensure GDPR compliance.

It’s ok to collect privacy-sensitive information, as long as you have a valid reason for it and take necessary measure to ensure the privacy regardless of what happens. If you are capturing private-sensitive data, willingly or not, you need a Data Processing Agreement (DPA) between your company and Task Analytics.

It's not uncommon for visitors to collect personal data inadvertently via the free text inputs on the survey. Sometimes visitors to your site that respond might provide their email address or phone number. While this is mostly harmless and a great way for you to get in touch with them directly, collecting and storing that personal data, even accidentally, adds a responsibility our customers don't always want. Learn how: http://help.taskanalytics.com/running/deleting-text-responses

You should only use and keep the personal data that is needed at any given time for any given purpose. If it’s not needed for that intended purpose and duration, it should be deleted. And customers have the right, at any time, to withdraw consent and request data to be deleted. You are obliged to remove all traces of the customer data that may have been shared and stored. This does not apply for data that has been stored anonymously.

You are responsible for maintaining, protecting, and making backups of your content. Optionally, you can remove privacy-sensitive information before making a back-up. The storage of back-ups with privacy-sensitive data should be processed conform GDPR regulation. How  to backup your data