What this covers
This agreement applies when you use Formif to process personal data. For that data you are the controller and Formif is the processor, acting on your documented instructions. It forms part of the terms of service.
Data Processing Agreement
How Formif processes customer data in its capacity as a processor.
Last updated: October 1, 2026
Subject matter and duration
Subject matter: providing the Formif platform. Duration: as long as your account is open, plus the export window in the terms. Nature and purpose: hosting, storing and processing the records, files, documents and invoices you create. Data subjects: your staff, your customers, and anyone whose details you record in a form. Categories: whatever you choose to collect — typically names, contact details, addresses, property details, photographs, measurements and billing data. You decide; we do not require any particular category.
Our obligations
We process personal data only on your documented instructions, including for transfers, unless the law requires otherwise — in which case we tell you first unless that law forbids it. Everyone with access to the data is under a duty of confidentiality. We take the technical and organisational measures set out below and do not materially reduce them during the term.
Security measures
Encryption in transit and at rest. Role-based access on least privilege, down to field level. Separation between workspaces so one tenant cannot reach another. Audit logging of changes and automation runs. Scoped API keys with rate limits and signed webhooks. Regular backups with restore testing. Access to production limited to named staff with multi-factor authentication.
Sub-processors
You authorise the sub-processors listed in the privacy notice — hosting, payments, transactional mail and analytics. We impose the same data protection obligations on each. We will tell you 30 days before adding or replacing one, and you may object on reasonable data protection grounds; if we cannot resolve it, you may terminate the affected service.
Helping you
We assist you, so far as is reasonable, with data subject requests, with data protection impact assessments, and with consultations with a supervisory authority. The product’s own export and deletion tools cover most requests without needing us.
Breach notification
If we become aware of a personal data breach affecting your data we notify you without undue delay and in any case within 48 hours of becoming aware, with what we know about the nature of the breach, the likely consequences and the measures taken.
Deletion and return
On termination we delete or return your personal data at your choice, and delete existing copies unless the law requires us to keep them. Backups age out on the ordinary cycle.
Audits
We make available the information needed to show we meet these obligations, and allow audits by you or an auditor you appoint, once in any twelve months and on reasonable notice, subject to confidentiality and to not disrupting other customers.
Transfers
Personal data is processed in the European Union. Where a sub-processor operates outside the EEA, the transfer relies on Standard Contractual Clauses or an adequacy decision.