Skip to content
Formwire
Legal

Data processing agreement

This agreement applies automatically to every customer and forms part of the terms of service. It sets out how we process your visitors' personal data on your behalf.

Effective Last updated

How to use this

You do not need to sign anything. This DPA is incorporated into the terms of service and applies from the moment you create an account. If your own compliance process needs a countersigned copy, email support@formwire.com and we will send one.

Definitions

  • Customer or you: the account holder, acting as controller of Customer Data.
  • Formwire or we: the provider of Formwire, acting as processor.
  • Customer Data: the personal data contained in submissions to your forms, including uploaded files and the request metadata we store with them.
  • Data Protection Law: the GDPR (Regulation 2016/679), the UK GDPR and Data Protection Act 2018, the Swiss FADP, and the CCPA where applicable.
  • Subprocessor: a third party we use to process Customer Data, listed on the subprocessors page.
  • SCCs: the standard contractual clauses in Commission Decision 2021/914, Module Two (controller to processor), and the UK Addendum to them.

Other capitalised terms have the meaning given in the GDPR.

Roles and scope

You are the controller of Customer Data and we are the processor (Article 28). Data about you as our customer, such as your email address sign-in and billing details, is covered by the privacy policy, where we are the controller, and is outside this agreement.

Details of the processing

  • Subject matter: receiving, storing, filtering and delivering form submissions.
  • Duration: for as long as you hold an account, and then the deletion periods in this agreement.
  • Nature and purpose: storing submissions, filtering spam, emailing them to recipients you choose, sending confirmation emails you configure, delivering to your webhooks, and making them available in the dashboard, API and MCP server.
  • Types of personal data: whatever your forms ask for. Typically name, email address, phone number and free text; files if you enable uploads; and the IP address and user agent of the submitting request.
  • Categories of data subjects: people who submit your forms, and the recipients you nominate.
  • Special categories: none are expected. If your form collects any, you must tell us and ensure you have a lawful basis under Article 9.

Our obligations as processor

We will:

  • process Customer Data only on your documented instructions, which are these terms, the settings you choose in the product and the requests you make through the dashboard, API and MCP server, unless the law requires otherwise, in which case we tell you first where we may (Article 28(3)(a));
  • ensure everyone who works on Customer Data is bound by confidentiality (Article 28(3)(b));
  • implement the security measures below (Articles 28(3)(c) and 32);
  • only engage subprocessors as set out below (Article 28(3)(d));
  • help you respond to data subject requests (Article 28(3)(e));
  • help you with security, breach notification, impact assessments and prior consultation where you need our input (Article 28(3)(f));
  • delete or return Customer Data at the end of the service (Article 28(3)(g));
  • make available the information needed to show compliance and allow audits as set out below (Article 28(3)(h));
  • tell you if we think an instruction breaks Data Protection Law.

Your obligations as controller

You are responsible for the lawfulness of the collection, for giving your visitors the notice the law requires, for the content of your forms and confirmation emails, for the recipients and webhooks you point data at, and for keeping your API keys secret.

Security measures

The technical and organisational measures in place are:

  • TLS 1.2 or newer on every endpoint; encryption at rest for databases, file storage and backups.
  • API keys stored only as hashes; webhook signing secrets stored encrypted and shown only when created or rolled.
  • Rate limiting on every sign-in path and Cloudflare Turnstile bot checks on code and password sign-in; session cookies that are HttpOnly, Secure and limited to the dashboard host.
  • Scoped API keys and role-based access (owner, admin, member) to workspaces.
  • Separation of the public submit host from the dashboard host, so no dashboard credential is ever sent to the host that receives untrusted traffic.
  • Per-form retention periods enforced by a daily job, a 30-day trash, and deletion of spam after 30 days.
  • Nightly database backups kept for 30 days plus 12 monthly points, on top of 30 days of point-in-time history.
  • An audit log of account actions that never contains submission content.
  • Spam and abuse controls on every form (honeypot, spam scoring, rate limits, and optional blocked words, allowed domains and captcha), and the ability to suspend a form or a whole workspace.

The security page describes these in more detail and is kept current.

Subprocessors

You give general authorisation (Article 28(2)) for the subprocessors on the subprocessors page. Each is bound by a written contract imposing data protection obligations no less protective than this agreement (Article 28(4)). Before adding or replacing one we update that page and email account owners at least 30 days in advance. If you object on reasonable data protection grounds and we cannot resolve it, you may close your account and we will refund any prepaid fees for the rest of the period.

International transfers

Customer Data is stored in the region you choose for each workspace, the United States or the European Union (see where data is stored). Where Customer Data leaves the EEA, UK or Switzerland, for example a US workspace, account data or email (including notifications of submissions), the following applies. For transfers from the EEA, the SCCs (Module Two) are incorporated into this agreement with you as data exporter and us as data importer; for the UK, the UK Addendum applies; for Switzerland, the SCCs as adapted by the FDPIC. Our subprocessors in turn rely on their own SCCs or on the EU-US Data Privacy Framework where certified.

Data subject rights

The dashboard, API and MCP server let you search, export and delete any submission yourself, which covers most access, erasure and portability requests without our involvement (Articles 15 to 20). If a data subject contacts us directly we will tell them to contact you and forward the request to you. Where you need help we cannot provide through the product, we respond within 10 business days.

Personal data breach

If we become aware of a personal data breach affecting Customer Data we will notify the account owners by email without undue delay and in any case within 48 hours, with what we know at the time: the nature of the breach, the data and approximate number of people affected, the likely consequences and what we are doing about it, followed by updates as we learn more (Article 33(2)). We do not notify supervisory authorities or data subjects on your behalf unless you ask us to.

Audits

On request we provide the information reasonably needed to show compliance with this agreement: this page, the security page, our subprocessors' certifications. If that is not enough, you may audit once per year, at your cost, on 30 days' notice, during business hours, in a way that does not disturb other customers' data or service.

Deletion and return

You can export any submission to CSV or over the API, and delete any submission, form, workspace or your whole account, at any time. On account deletion, organizations you own alone are deleted for good after 30 days, and backups age out on the schedule in the privacy policy. We retain nothing afterwards except what the law requires us to keep.

Liability and precedence

Each party's liability under this agreement, including under the SCCs as far as they allow, is subject to the disclaimers, exclusions and cap in the terms of service: our total liability for all claims is limited to the lesser of the fees you paid us in the 12 months before the claim and 100 US dollars, and we are not liable for indirect or consequential losses or lost data, to the fullest extent the law allows. Where this agreement conflicts with the terms on a data protection matter, this agreement wins; where the SCCs conflict with either, the SCCs win.

Related