Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the agreement between [Company Legal Name] (“Processor”, “SureForm”) and the customer using the Service (“Controller”, “you”). It governs our processing of personal data contained in the form submissions you collect through SureForm (“Customer Personal Data”) on your behalf. Where terms are capitalised but not defined, they have the meaning given in the GDPR.

For Customer Personal Data, you are the controller and SureForm is the processor. You are responsible for having a lawful basis to collect the data and for providing your respondents with the required privacy information.

• Process Customer Personal Data only on your documented instructions (using the Service is such an instruction).
• Ensure people authorised to process the data are bound by confidentiality.
• Implement appropriate technical and organisational security measures (Annex II).
• Not engage another sub-processor without the authorisation below.
• Assist you, taking into account the nature of processing, with data-subject requests and with your security, breach-notification, and impact-assessment obligations.
• Delete or return Customer Personal Data at the end of the service, per Section 8.
• Make available information needed to demonstrate compliance and allow for reasonable audits.

You authorise us to engage the sub-processors listed at /subprocessors (Annex III). We will impose data-protection obligations on each of them no less protective than this DPA, and remain liable for their performance. We will give reasonable notice of any intended change so you may object.

Where we transfer Customer Personal Data outside the EEA/UK, we do so under an appropriate transfer mechanism such as the EU Standard Contractual Clauses (and the UK Addendum), which are incorporated by reference where applicable.

We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and provide the information reasonably available to help you meet your notification duties.

Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures — including the in-product export and erasure tools — to respond to requests to exercise data-subject rights.

On termination, or when data reaches your configured retention period, we delete Customer Personal Data (including uploaded files in object storage) unless retention is required by law. Deleted data may persist briefly in routine backups before being overwritten on their normal cycle.

• Subject matter: provision of the SureForm form-building Service.
• Duration: the term of the agreement plus the retention period.
• Nature & purpose: collecting, storing, displaying, exporting, and forwarding form submissions; sending notifications.
• Data subjects: your respondents (and your own personnel who use the account).
• Categories of data: whatever your forms collect — typically contact details and free-text answers; special-category data only if you choose to collect it.

Encryption in transit (TLS); encryption of stored secrets and optional encryption of answer data at rest; hashed passwords; pseudonymised IP addresses; role-based access control; optional two-factor authentication; audit logging; rate-limiting and bot protection; least-privilege access to production systems. [Add or adjust to match your actual controls.]

The current list of authorised sub-processors is published and kept up-to-date at /subprocessors.