1. Parties

This Data Processing Agreement ("DPA") is entered into between:

• Data Controller: Your Organisation ("Controller"), and
• Data Processor: FormVault / the operator of this FormVault instance ("Processor").

2. Subject matter and purpose

The Processor processes personal data on behalf of the Controller for the purpose of operating online forms and collecting form responses. Processing is limited to what is necessary to provide this service.

3. Nature and types of Personal Data

The categories of personal data processed depend on the form fields configured by the Controller, and may include:

• Contact information (name, email address, phone number)
• Identification data as entered by data subjects
• Technical metadata (IP address, user agent, submission timestamp)
• Form view metadata: the time a published form was opened and the host name of the referring website (for example linkedin.com). Full referrer URLs are discarded before storage, so paths and query strings — where personal data in a link would sit — are never retained.

4. Obligations of the Processor

The Processor agrees to:

• Process personal data only on documented instructions from the Controller.
• Implement appropriate technical measures to protect personal data (AES-256-GCM encryption at rest).
• Not engage sub-processors without prior authorisation from the Controller.
• Assist the Controller in responding to data subject rights requests (access, erasure, portability).
• Delete or return all personal data upon termination of the service agreement.
• Make available all information necessary to demonstrate compliance with Article 28 of the GDPR.

5. Obligations of the Controller

The Controller agrees to:

• Ensure a lawful basis for processing (e.g., consent, legitimate interest) before deploying any form that collects personal data.
• Inform data subjects about the processing activity in accordance with Articles 13 and 14 of the GDPR.
• Configure appropriate data retention periods within the FormVault platform.

6. Data retention

Submissions are stored until the Controller deletes them or until the configured retention period expires. Respondents may independently request erasure via the unique respondent portal link provided upon submission.

7. Security

All submission data is encrypted at rest using AES-256-GCM with a Controller-managed encryption key. Data is never shared with third parties. No third-party tracking or analytics scripts are included in the FormVault platform.

8. Sub-processors

Where file uploads are enabled, files may be stored in an S3-compatible object store operated by the Controller's chosen infrastructure provider. No other sub-processors are engaged by default.

9. Data subject rights

Data subjects may exercise their rights under GDPR Chapter III (including access, rectification, erasure, restriction, portability, and objection) by contacting the Controller directly or by using the self-service respondent portal link included in the submission confirmation.

10. Governing law

This DPA is governed by the laws of the European Union and the European Economic Area, in particular the General Data Protection Regulation (EU) 2016/679.