Data processing · Formcrier

1. Parties and scope

In short: This agreement covers the personal data in your form submissions, which we process for you. It's part of our terms, so there's nothing to sign.

This data processing agreement is between you, the customer who uses Formcrier (the controller), and Coysh Digital Ltd, a company registered in England and Wales (number 16868808), whose registered office is 14 Sutherland Close, Warwick, CV34 5UJ (the processor, "we").

It forms part of our terms and applies whenever we process personal data on your behalf. It is written to meet Article 28 of the UK GDPR and, where it applies to you, the EU GDPR. If it conflicts with the terms, this agreement wins on data protection.

It doesn't cover data we control ourselves, such as your account and billing details. Our privacy policy covers that.

2. What we process

In short: Whatever your visitors type into forms you switch on, to alert you and show you your submissions, for your plan's history period.

	Details
Subject matter	Receiving form submissions from your websites, storing them, and delivering alerts about them to the destinations you choose
Duration	For as long as you use Formcrier, and until the data is deleted as set out in section 9
Nature and purpose	Collection, storage, encryption, spam filtering, display in your dashboard, transmission to your alert destinations, and deletion
Data subjects	People who fill in forms on your websites, and people whose details they give
Types of data	Whatever your forms ask for: typically names, contact details and messages, plus files attached to forms (Pro and Agency), the page address, the browser's user agent, and a one-way code made from the IP address
Special category data	Only if your forms ask for it. You are responsible for having a lawful basis and safeguards if they do

Before submissions leave the visitor's browser, and again on our server, we remove password fields, security tokens and anything that looks like a payment card number.

3. What we promise

In short: We only follow your instructions, keep your data confidential and secure, and help you meet your own duties.

We will:

process the data only on your documented instructions, which are these terms, this agreement and the way you set up Formcrier, unless the law requires otherwise (and we'll tell you first where the law allows);
tell you if we think an instruction breaks data protection law;
make sure everyone who can access the data is bound by confidentiality;
keep the data secure, as set out in section 4;
use sub-processors only as set out in section 5;
help you respond to people exercising their rights (section 7), and with security, breach notifications, data protection impact assessments and consultations with regulators, taking into account what we process and the information we have;
delete the data when you ask or when our service ends (section 9);
give you the information you need to show you're meeting Article 28, and allow audits (section 10).

You confirm that you have a lawful basis for the data your forms collect, that you tell your visitors about Formcrier, and that your instructions to us comply with the law.

4. Security

In short: Submissions are encrypted with a separately kept key, IP addresses are never stored, and data is deleted automatically.

We protect the data with measures including:

encrypting submission contents, file names, alert destinations and provider messages in our database, with a key kept separately from the database;
using encrypted connections (HTTPS) for everything;
never storing visitors' IP addresses: we keep only a one-way code, made with a key that changes daily and is destroyed after 48 hours;
storing attached files under random names in a private bucket, downloadable only through links that expire after minutes;
removing passwords, security tokens and card numbers before they reach us;
limiting access to workspace members, by role, with two-factor authentication available, and to a small number of our own staff who need it;
signing the links in alerts so they expire, and letting you revoke them all at once;
deleting submissions automatically at the end of your plan's history period, or the shorter period you choose;
rate limits, spam filtering, activity records, backups and monitoring.

5. Sub-processors

In short: These providers help us run Formcrier. We'll tell you before we add one, and you can object.

You give us general authorisation to use the sub-processors below. We have a written contract with each that protects the data at least as well as this agreement, and we remain responsible for them.

Provider	What for	Where
Our server provider	Hosting the application and database	UK and EU
Cloudflare, Inc.	Protecting and delivering our website and script, the bot check on our contact and sign-up forms (Turnstile), and storing attached files (R2, EU jurisdiction)	Global network; files in the EU
Mailgun Technologies, Inc. (Sinch)	Sending email (EU region)	EU
Meta Platforms Ireland Ltd (WhatsApp)	WhatsApp alerts: the phone number and the alert content	EU and US
Twilio Inc.	SMS alerts and codes: the phone number and the alert content	US
Telegram	Telegram alerts: the chat and the alert content	Outside the UK
Slack Technologies, LLC (Salesforce)	Slack alerts, posted to the channel you choose	US
Stripe Payments Europe, Ltd and Stripe, Inc.	Payments, tax and invoices	EU and US

Alerts go only to the channels you connect, so, for example, Twilio only processes a submission if you send alerts by text. Microsoft Teams alerts go to a workflow in your own Microsoft 365 account, so Microsoft is your provider, not ours.

We'll update this list and email account owners at least 30 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds, tell us within that time. If we can't address your concern, you can end your paid plan and we'll refund any period you've paid for but won't receive.

6. International transfers

In short: Some alert channels are based outside the UK. Those transfers are covered by the law's approved safeguards.

Our application, database and stored files are in the UK and EU. To deliver an alert, its content passes through the channel you chose, and some of those providers process data in the United States or elsewhere.

Where personal data leaves the UK (or the EEA), we rely on adequacy regulations or decisions (including the UK Extension to the EU-US Data Privacy Framework for certified US companies), or on the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, or the EU standard contractual clauses themselves.

7. People's rights

In short: You can find and delete submissions yourself. If someone asks us, we'll pass it to you.

You can find, read and delete submissions in your dashboard, which lets you answer most requests yourself.

If someone contacts us to exercise their rights over data we process for you, we'll pass the request to you without undue delay and won't answer it ourselves unless you ask us to. We'll help with anything you can't do from the dashboard.

8. Breaches

In short: If something goes wrong with your data, we'll tell you within 48 hours of finding out.

If we become aware of a personal data breach affecting data we process for you, we'll tell the account owner without undue delay, and within 48 hours of becoming aware of it.

We'll tell you what happened, what data and people are likely to be affected, the likely consequences, and what we're doing about it, and keep you updated as we learn more. We'll help you notify the regulator and the people affected where you need to.

9. Deletion

In short: Submissions are deleted at the end of your plan's history period, or straight away when you delete them.

Submissions and their files are deleted automatically at the end of your plan's history period (Free 7 days, Starter 30 days, Pro 90 days and Agency 1 year), or a shorter period you choose in Workspace settings (as little as a day). You can delete them sooner at any time.

When you delete a workspace or your account, or our service to you ends, we delete the data we process for you straight away. Deleted data may remain in our encrypted backups for up to 30 days before it's overwritten, and isn't used in the meantime.

We may keep data longer only where the law requires it, and then only for that purpose.

10. Audits

In short: We'll answer your questions about how we protect your data, and allow a reasonable audit.

We'll give you the information you reasonably need to show that we meet this agreement, including answers to security questionnaires.

If that isn't enough, or a regulator requires it, you (or an independent auditor bound by confidentiality) may audit our compliance once a year, with at least 30 days' notice, during business hours, and at your cost. Audits must not put other customers' data at risk.

11. Liability and changes

In short: The limits in our terms apply to this agreement too.

Each party's liability under this agreement is subject to the limits in our terms, except where the law doesn't allow them to be limited.

We may update this agreement to reflect changes in the law or in how Formcrier works. We'll email account owners at least 30 days before a change that reduces your protection.

Questions about this agreement: [email protected].