{"id":29465,"date":"2026-10-07T11:06:57","date_gmt":"2026-10-07T11:06:57","guid":{"rendered":"https:\/\/refiner.io\/docs\/?post_type=knowledgebase&#038;p=29465"},"modified":"2026-10-07T11:12:55","modified_gmt":"2026-10-07T11:12:55","slug":"legal-framework","status":"publish","type":"knowledgebase","link":"https:\/\/refiner.io\/docs\/kb\/legal-compliance\/legal-framework\/","title":{"rendered":"Legal Framework"},"content":{"rendered":"\n\n\n<h3 class=\"wp-block-heading\" id=\"security\">Terms of Service<\/h3>\n\n\n\n<p>When you create an account with Refiner, you agree to our Terms of Service and Privacy Policy. Both documents are designed with a strong emphasis on data protection, regulatory compliance, and information security.<\/p>\n\n\n\n<p>For Enterprise customers, we offer the option to execute custom agreements, including tailored Data Processing Agreements (DPAs) and additional contractual safeguards as required.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/refiner.io\/legal\/terms-of-service\/\" target=\"_blank\" rel=\"noreferrer noopener\">Terms of Service<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/refiner.io\/legal\/privacy-policy\/\" target=\"_blank\" rel=\"noreferrer noopener\">Privacy Policy<\/a><\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Roles &amp; Responsibilities<\/h3>\n\n\n\n<p>Refiner provides the tools and infrastructure to support compliance, but you are responsible for configuring your implementation in accordance with applicable laws.<\/p>\n\n\n\n<p>Generally speaking<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>You (the customer)<\/strong> act as the <strong>data controller<\/strong>, deciding what data is collected and how it is used.<\/li>\n\n\n\n<li><strong>Refiner<\/strong> acts as the <strong>data processor<\/strong>, processing data on your behalf.<\/li>\n<\/ul>\n\n\n\n<p>This means you are responsible for:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Defining the legal basis for data collection<\/li>\n\n\n\n<li>Informing users about how their data is used<\/li>\n\n\n\n<li>Handling user rights requests (access, deletion, etc.)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"protection\">Data Protection (GDPR, CCPA, &#8230;)<\/h3>\n\n\n\n<p>Refiner supports compliance with major international data protection regulations and healthcare standards. Our platform is designed to help you meet your regulatory obligations while maintaining full administrative control over your data.<\/p>\n\n\n\n<p>If you operate in the European Union or process data of EU residents, the <a href=\"https:\/\/refiner.io\/legal\/gdpr\/\" target=\"_blank\" rel=\"noreferrer noopener\">General Data Protection Regulation (GDPR)<\/a> applies.<\/p>\n\n\n\n<p>To stay compliant, you should:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Establish a valid legal basis for processing (e.g. legitimate interest or consent)<\/li>\n\n\n\n<li>Inform users about data collection in your privacy policy<\/li>\n\n\n\n<li>Provide mechanisms for users to access or delete their data<\/li>\n<\/ul>\n\n\n\n<p>Refiner supports:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Data access requests<\/li>\n\n\n\n<li>Data deletion requests<\/li>\n<\/ul>\n\n\n\n<p>We provide multiple technical and organizational mechanisms to support lawful data processing, subject access requests, deletion workflows, and controlled data retention.<\/p>\n\n\n\n<p>For detailed information, please refer to:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/refiner.io\/legal\/gdpr\/\">GDPR compliance<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/refiner.io\/legal\/ccpa\/\">CCPA compliance<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/refiner.io\/legal\/hipaa\/\" target=\"_blank\" rel=\"noreferrer noopener\">HIPAA compliance<\/a><\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"security\">Data Security (SOC 2) <\/h3>\n\n\n\n<p>Refiner applies industry-standard security measures to protect your data, including:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Encrypted data transmission (HTTPS)<\/li>\n\n\n\n<li>Secure infrastructure and access controls<\/li>\n\n\n\n<li>Ongoing monitoring and best practices for data protection<\/li>\n<\/ul>\n\n\n\n<p>We work with&nbsp;<a href=\"https:\/\/scytale.ai\/\" target=\"_blank\" rel=\"noreferrer noopener\">Scytale<\/a>&nbsp;to manage our security certification requirements. Audits are performed by an independent third party,&nbsp;<a href=\"https:\/\/decrypt.cpa\/\" target=\"_blank\" rel=\"noreferrer noopener\">Decrypt Compliance<\/a>.<\/p>\n\n\n\n<p>Refiner has successfully completed a SOC 2 Type II audit every year since 2024, validating the operational effectiveness of our security controls over each respective audit period.<\/p>\n\n\n\n<p>For additional details on our security posture and to request a copy of our SOC 2 report, please refer to:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/refiner.io\/legal\/soc-2\/\">SOC 2 Type II certification<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/refiner.io\/security-statement\/\">Security Statement<\/a><\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Consent &amp; Tracking<\/h3>\n\n\n\n<p>Depending on how you use Refiner, you may need to <a href=\"https:\/\/refiner.io\/docs\/kb\/javascript-client\/user-consent\/\">obtain user consent<\/a> before collecting data.<\/p>\n\n\n\n<p>This is especially relevant when:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Using the JavaScript SDK in combination with cookies or tracking technologies<\/li>\n\n\n\n<li>Operating in jurisdictions with strict consent requirements (e.g. EU ePrivacy Directive)<\/li>\n<\/ul>\n\n\n\n<p>Refiner\u2019s JavaScript SDK stores an anonymous user token in the browser\u2019s <a href=\"https:\/\/refiner.io\/docs\/kb\/javascript-client\/web-storage-cookies\/\">Local Storage<\/a> to ensure consistent user recognition and correct survey delivery.<\/p>\n\n\n\n<p>No sensitive personal data is stored in Local Storage or cookies by default &#8211; only the minimal technical identifiers necessary to operate the SDK.<\/p>\n\n\n\n<p>For more details, please refer to the dedicated documentation <a href=\"https:\/\/refiner.io\/docs\/kb\/javascript-client\/user-consent\/\">page<\/a>.<\/p>\n\n\n\n<p>You are responsible for:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Integrating Refiner with your consent management solution (if applicable)<\/li>\n\n\n\n<li>Respecting user preferences regarding tracking and data collection<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Accessibility<\/h3>\n\n\n\n<p>We are committed to making our surveys accessible to all users by following established accessibility best practices. This includes using semantic HTML, ensuring proper keyboard navigation, and maintaining compatibility with assistive technologies. Accessibility is an ongoing effort, and we continuously work to identify and address potential barriers. We welcome feedback from our users to help us improve and provide a more inclusive experience for everyone.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Terms of Service When you create an account with Refiner, you agree to our Terms of Service and Privacy Policy. Both documents are designed with a strong emphasis on data protection, regulatory compliance, and information security. For Enterprise customers, we offer the option to execute custom agreements, including tailored Data Processing Agreements (DPAs) and additional [&#8230;]<\/p>\n<p><a class=\"btn btn-secondary understrap-read-more-link\" href=\"https:\/\/refiner.io\/docs\/kb\/legal-compliance\/legal-framework\/\">Read More&#8230;<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","template":"","knowledgebase_tag":[],"class_list":["post-29465","knowledgebase","type-knowledgebase","status-publish","hentry","knowledgebase_cat-legal-compliance"],"acf":[],"featured_image_urls_v2":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","ab-block-post-grid-landscape":"","ab-block-post-grid-square":"","gb-block-post-grid-landscape":"","gb-block-post-grid-square":""},"post_excerpt_stackable_v2":"<p>Terms of Service When you create an account with Refiner, you agree to our Terms of Service and Privacy Policy. Both documents are designed with a strong emphasis on data protection, regulatory compliance, and information security. For Enterprise customers, we offer the option to execute custom agreements, including tailored Data Processing Agreements (DPAs) and additional contractual safeguards as required. Terms of Service Privacy Policy Roles &amp; Responsibilities Refiner provides the tools and infrastructure to support compliance, but you are responsible for configuring your implementation in accordance with applicable laws. Generally speaking You (the customer) act as the data controller, deciding&hellip;<\/p>\n","category_list_v2":"","author_info_v2":{"name":"Moritz Dausinger","url":"https:\/\/refiner.io\/docs\/author\/user\/"},"comments_num_v2":"0 comments","yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.3 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Legal Framework<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/refiner.io\/docs\/kb\/legal-compliance\/legal-framework\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Legal Framework\" \/>\n<meta property=\"og:description\" content=\"Terms of Service When you create an account with Refiner, you agree to our Terms of Service and Privacy Policy. Both documents are designed with a strong emphasis on data protection, regulatory compliance, and information security. For Enterprise customers, we offer the option to execute custom agreements, including tailored Data Processing Agreements (DPAs) and additional [...]Read More...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/refiner.io\/docs\/kb\/legal-compliance\/legal-framework\/\" \/>\n<meta property=\"og:site_name\" content=\"Refiner Documentation\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-07T11:12:55+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/refiner.io\/docs\/kb\/legal-compliance\/legal-framework\/\",\"url\":\"https:\/\/refiner.io\/docs\/kb\/legal-compliance\/legal-framework\/\",\"name\":\"Legal Framework\",\"isPartOf\":{\"@id\":\"https:\/\/refiner.io\/docs\/#website\"},\"datePublished\":\"2026-10-07T11:06:57+00:00\",\"dateModified\":\"2026-10-07T11:12:55+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/refiner.io\/docs\/kb\/legal-compliance\/legal-framework\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/refiner.io\/docs\/kb\/legal-compliance\/legal-framework\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/refiner.io\/docs\/kb\/legal-compliance\/legal-framework\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/refiner.io\/docs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Legal Framework\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/refiner.io\/docs\/#website\",\"url\":\"https:\/\/refiner.io\/docs\/\",\"name\":\"Refiner Documentation\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/refiner.io\/docs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/refiner.io\/docs\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/refiner.io\/docs\/#organization\",\"name\":\"Refiner Documentation\",\"url\":\"https:\/\/refiner.io\/docs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/refiner.io\/docs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2022\/11\/cropped-Group-8.png\",\"contentUrl\":\"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2022\/11\/cropped-Group-8.png\",\"width\":400,\"height\":61,\"caption\":\"Refiner Documentation\"},\"image\":{\"@id\":\"https:\/\/refiner.io\/docs\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Legal Framework","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/refiner.io\/docs\/kb\/legal-compliance\/legal-framework\/","og_locale":"en_US","og_type":"article","og_title":"Legal Framework","og_description":"Terms of Service When you create an account with Refiner, you agree to our Terms of Service and Privacy Policy. Both documents are designed with a strong emphasis on data protection, regulatory compliance, and information security. For Enterprise customers, we offer the option to execute custom agreements, including tailored Data Processing Agreements (DPAs) and additional [...]Read More...","og_url":"https:\/\/refiner.io\/docs\/kb\/legal-compliance\/legal-framework\/","og_site_name":"Refiner Documentation","article_modified_time":"2026-10-07T11:12:55+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/refiner.io\/docs\/kb\/legal-compliance\/legal-framework\/","url":"https:\/\/refiner.io\/docs\/kb\/legal-compliance\/legal-framework\/","name":"Legal Framework","isPartOf":{"@id":"https:\/\/refiner.io\/docs\/#website"},"datePublished":"2026-10-07T11:06:57+00:00","dateModified":"2026-10-07T11:12:55+00:00","breadcrumb":{"@id":"https:\/\/refiner.io\/docs\/kb\/legal-compliance\/legal-framework\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/refiner.io\/docs\/kb\/legal-compliance\/legal-framework\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/refiner.io\/docs\/kb\/legal-compliance\/legal-framework\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/refiner.io\/docs\/"},{"@type":"ListItem","position":2,"name":"Legal Framework"}]},{"@type":"WebSite","@id":"https:\/\/refiner.io\/docs\/#website","url":"https:\/\/refiner.io\/docs\/","name":"Refiner Documentation","description":"","publisher":{"@id":"https:\/\/refiner.io\/docs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/refiner.io\/docs\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/refiner.io\/docs\/#organization","name":"Refiner Documentation","url":"https:\/\/refiner.io\/docs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/refiner.io\/docs\/#\/schema\/logo\/image\/","url":"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2022\/11\/cropped-Group-8.png","contentUrl":"https:\/\/refiner.io\/docs\/wp-content\/uploads\/2022\/11\/cropped-Group-8.png","width":400,"height":61,"caption":"Refiner Documentation"},"image":{"@id":"https:\/\/refiner.io\/docs\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/refiner.io\/docs\/wp-json\/wp\/v2\/knowledgebase\/29465","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/refiner.io\/docs\/wp-json\/wp\/v2\/knowledgebase"}],"about":[{"href":"https:\/\/refiner.io\/docs\/wp-json\/wp\/v2\/types\/knowledgebase"}],"author":[{"embeddable":true,"href":"https:\/\/refiner.io\/docs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/refiner.io\/docs\/wp-json\/wp\/v2\/comments?post=29465"}],"version-history":[{"count":2,"href":"https:\/\/refiner.io\/docs\/wp-json\/wp\/v2\/knowledgebase\/29465\/revisions"}],"predecessor-version":[{"id":29471,"href":"https:\/\/refiner.io\/docs\/wp-json\/wp\/v2\/knowledgebase\/29465\/revisions\/29471"}],"wp:attachment":[{"href":"https:\/\/refiner.io\/docs\/wp-json\/wp\/v2\/media?parent=29465"}],"wp:term":[{"taxonomy":"knowledgebase_tag","embeddable":true,"href":"https:\/\/refiner.io\/docs\/wp-json\/wp\/v2\/knowledgebase_tag?post=29465"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}