Data processing agreement

This agreement applies where Formwire processes personal data on your behalf — that is, the submissions your forms collect. You are the controller; we are the processor. It forms part of our terms of service.

1. Subject matter and duration

We process submission data for as long as your account exists and your plan's retention window allows, and no longer. Processing ends when you delete the data, delete your account, or the retention window expires — whichever comes first.

2. Nature and purpose

Receiving submissions from your website, storing them, scoring them for spam, delivering them to channels you configure, and making them available to you in a dashboard and export. Nothing else. We do not use submission content to train anything, sell it, or analyse it across customers.

3. Categories of data and data subjects

Whatever your forms ask for — you choose the fields, so you determine the categories — plus a country code and a salted, truncated hash of the submitter's IP address. Data subjects are the visitors who submit your forms.

You agree not to collect special-category data (health, biometrics, political opinions and the rest of Article 9) through Formwire, and not to collect passwords or payment card numbers.

4. Our obligations

• We process only on your documented instructions, which are: the settings in your account.
• Everyone with access is under a confidentiality obligation.
• We apply the technical and organisational measures described on the security page — including tenant isolation enforced in the database itself, encryption of channel credentials at rest, and IP hashing.
• We help you meet requests from data subjects, and support your DPIAs, with the export and deletion tools in the dashboard.
• We tell you about a personal data breach without undue delay and within 72 hours.
• On termination we delete the data. Our deletion is real: see the privacy policy.

5. Subprocessors

You give general authorisation for the subprocessors below. We give 30 days' notice before adding or replacing one, and you may object; if we cannot resolve your objection you may terminate the affected service.

6. Transfers

We choose EU regions everywhere our providers offer them. Where a provider processes outside the EEA, the transfer relies on Standard Contractual Clauses or an adequacy decision.

7. Audits

We will answer reasonable written questions about our processing and provide the documentation we have. We are a small operation and cannot host on-site audits.

Signing

Using the service constitutes acceptance of this agreement. If your procurement process needs a countersigned copy with your company's details, write to legal@formwire.dev and we will send one.