Is Artologik Survey&Report GDPR compliant? What researchers and universities should check
Artologik Survey&Report is a survey and course evaluation tool from Artisan Global Media in Växjö, Sweden, used for course evaluations and research at Swedish universities such as Örebro University. It is sold as a cloud service or for installation on the institution's own servers. This page sets out what Artologik publicly documents about hosting, contracts, anonymity and data clean-up, and what that means for research surveys.
Short answer
Artisan Global Media is a Swedish company that hosts Survey&Report cloud customers in its own ISO 27001 certified data centre in Sweden. Cloud customers sign a data processing agreement built on the Swedish IT and telecom industry's standard cloud terms, and the product can also be installed on a university's own servers. Artologik publishes a detailed GDPR guide covering consent forms, personal data reports, anonymisation of surveys, automated clean-up and masking of IP addresses in logs. A public subprocessor list was not found. Whether it suits a research survey depends on the installation, the anonymity settings and your clean-up routines.
Prefer a tool built in the EU? Kahubi, from Avidemic AB in Sweden, covers research surveys with EU hosting and, for institutions, only European subprocessors. See how Kahubi handles research data
What Artologik documents publicly
Everything in this table comes from Artologik's own pages and its GDPR guide for Survey&Report, read on 7 October 2026. Numbers in brackets refer to the sources at the end of the page.
| Topic | What the vendor states | Source |
|---|---|---|
| Company and establishment | Artisan Global Media, Videum Science Park, Växjö, Sweden, which develops and sells the Artologik products. For customer data in the products, Artisan describes itself as processor and the customer as controller. | [1] [2] [8] |
| Where survey data is stored | Sweden "In our own ISO 27001-certified data centre in Sweden, where we host our cloud customers´data". The privacy policy places the data centre in Växjö. Backups are stored in separate physical locations. On-premise installations keep data on the customer's servers. | [3] [5] [8] |
| Data processing agreement | Documented Cloud customers sign an agreement based on the Swedish IT and telecom industry's "Cloud Services, General Terms and Conditions 2023" and its special terms for personal data. On-premise customers can sign one when Artisan accesses their installation for support. | [2] |
| Subprocessors | Not public A subprocessor list for Survey&Report data was not found in public documentation (checked 7 October 2026). The website privacy policy, last updated 22 September 2020, names Google Analytics and the payment provider Nets for the website. | [8] |
| International transfers | No transfers outside the EU are described. Hosting is in Artisan's own data centre in Sweden. | [3] [8] |
| Anonymity | Surveys can identify respondents or stay anonymous. Closed or archived surveys can be anonymised: respondent data is cleared, except respondent category values, and the answers are kept. An anonymisation warning reminds users of closed surveys not yet anonymised. | [4] [6] |
| IP addresses and logs | Activity logs, login history and application logs are deleted automatically after 180 days. Administrators can mask, hash or delete personal identifiers, usernames and IP addresses in the logs. Whether respondent IP addresses are stored with answers was not found in Artologik's public documentation (checked 7 October 2026). Örebro University's page for ORU-Survey states that IP addresses cannot be linked to responses, whatever the survey type. | [6] [10] |
| Rights requests and clean-up | A personal data report lets authorised users find and export a user's or respondent's data. Respondents can be anonymised or removed. Automations can delete archived surveys after a set number of days, for example course evaluations closed for 730 days. | [6] |
| Security certifications | Documented ISO/IEC 27001 covering "both the company operations and our Data Center", held since 2018. The certification body was not found publicly. 99.9% availability for the cloud service. | [2] [3] [9] |
| Institution controls | Login via SAML2, BankID, LDAP and single sign-on, plus two-factor authentication. Integration with Blackboard, Moodle and Canvas. WCAG 2.1 AA. | [5] [7] |
| AI features | Not found AI features were not found in public documentation (checked 7 October 2026). | [4] [8] |
Artologik deserves credit for running its own ISO 27001 certified data centre in Sweden, using a recognised Swedish industry standard as the basis for its data processing agreement, offering an on-premise option, and publishing a detailed GDPR guide that explains exactly where personal data sits in the product and how to clear it. Automatic log deletion after 180 days and IP masking in logs are useful defaults for institutions with many users.
What this means for research and teaching
Validemic's analysisLocation and contract are familiar ground for Swedish institutions. Swedish hosting and a data processing agreement on the IT and telecom industry's standard terms make the assessment shorter than for most cloud survey tools. Örebro University's page for ORU-Survey, its survey service supplied by Artisan Global Media, notes that Artisan Global Media's servers are in Sweden and that data processing agreements exist [10].
Course evaluations and research need different settings. Örebro uses its service for research, course evaluations and dissertations [10], and respondents can be imported from files or LDAP [6]. For research, decide in advance whether the survey is anonymous, because the guide explains that answers on anonymous surveys cannot later be deleted for an individual respondent: the software does not know which answer is whose [6]. That is good for anonymity and should be explained to participants who may later ask for deletion.
Anonymity is more than the survey setting. Data is only anonymous under the GDPR if individuals cannot be identified by any means reasonably likely to be used (Recital 26) [11]. Respondent category values kept after anonymisation, small groups and free-text answers can still identify people. Turn on IP masking in logs and anonymise closed surveys promptly.
Survey content decides the risk level. Questions about health, sexual orientation, religion, political opinions or trade union membership collect special category data under Article 9(1) GDPR [11]. Large surveys on such topics, or surveys of children or other vulnerable groups, will often meet the criteria for a data protection impact assessment under Article 35 [11]. Our DPIA screening tool gives a first view.
Storage is not archiving. Örebro's guidance says ORU-Survey should not be used for long-term storage of collected data [10]. Plan export to the university's research data storage and deletion from the survey tool in the data management plan.
Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace
Questions to ask Artisan Global Media before approving it
- Which subprocessors, if any, process Survey&Report data, for example for email or SMS distribution?
- Are respondent IP addresses stored anywhere in connection with answers, and does that apply to every installation?
- Can we receive the ISO 27001 certificate with its scope and certification body?
- How long do backups of deleted surveys remain in the separate backup locations?
- Is data encrypted at rest in the cloud service?
- Are any AI features planned, and would they involve external providers?
- Can the privacy policy, last updated in 2020, be updated to reflect current processing?
The EU AI Act angle
The EU AI Act, Regulation (EU) 2024/1689, applies alongside the GDPR [12]. AI literacy under Article 4 has applied since 2 February 2025; the Digital Omnibus on AI, Regulation (EU) 2026/1744, reworded it in July 2026 as a duty to take measures to support staff AI literacy [12] [13]. Running research surveys is not one of the high-risk education uses in Annex III [12]. As no AI features were found in Survey&Report's documentation, the AI Act adds little to the assessment today.
Sources
- Artologik home page, retrieved 7 October 2026
- GDPR | Artologik, retrieved 7 October 2026
- Availability and security | Artologik, retrieved 7 October 2026
- Artologik Survey&Report, retrieved 7 October 2026
- Security | Artologik Survey&Report, retrieved 7 October 2026
- Survey&Report Guide: GDPR and Clean-up (PDF), retrieved 7 October 2026
- Schools and universities | Artologik Survey&Report, retrieved 7 October 2026
- Privacy policy | Artologik, updated 22 September 2020, retrieved 7 October 2026
- ISO 27001 | Artologik, retrieved 7 October 2026
- ORU-Survey | Örebro University, retrieved 7 October 2026
- Regulation (EU) 2016/679 (General Data Protection Regulation), Recital 26 and Articles 9 and 35, retrieved 7 October 2026
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Article 4 and Annex III, retrieved 7 October 2026
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), retrieved 7 October 2026
About this page
We read Artologik's security, GDPR, ISO 27001 and privacy pages, the Survey&Report product, security and higher education pages, and the Survey&Report GDPR and clean-up guide on 7 October 2026, together with Örebro University's page for ORU-Survey. Artisan Global Media is a Swedish company with hosting in Sweden, so the EU-U.S. Data Privacy Framework is not relevant. "Not found" means we could not find the information in public documentation; it does not mean the vendor lacks it.
This page describes public documentation and gives our own analysis. It is not legal advice and it is not a statement that the tool is or is not GDPR compliant, which depends on your contract, configuration and use. If you work for Artisan Global Media and see an error, please contact us and we will correct it.
Frequently asked questions
Can I use Artologik Survey&Report for research surveys under GDPR?
Artisan Global Media hosts cloud customers' data in its own ISO 27001 certified data centre in Sweden and signs a data processing agreement based on the Swedish IT and telecom industry's standard cloud terms. Survey&Report can also be installed on the university's own servers. Check with your DPO which installation your institution uses and how anonymisation is configured.
Where does Survey&Report store data?
For cloud customers, in Artisan Global Media's own ISO 27001 certified data centre in Växjö, Sweden, with backups stored in separate physical locations. On-premise installations store data on the institution's own servers.
Are Survey&Report surveys anonymous?
Surveys can be anonymous or identify respondents. Closed or archived surveys can be anonymised, which clears respondent data while keeping the answers. Administrators can also mask, hash or delete IP addresses and other identifiers in the system logs, and logs are deleted automatically after 180 days.
Does Artologik have a data processing agreement?
Yes. Cloud customers sign a data processing agreement based on the Swedish IT and telecom industry's Cloud Services General Terms and Conditions 2023 and its Special Terms and Conditions for personal data. On-premise customers can also sign one when Artisan accesses their installation for support.
Does Survey&Report use AI?
AI features were not found in Survey&Report's public documentation (checked 7 October 2026), and the privacy policy does not mention AI.