Data Processing Agreement
This Data Processing Agreement is the Article 28 contract between you and Trampoline Software SRL. It covers the personal data we handle on your behalf when you use Formspark.
It forms part of our Terms of Service. It applies to every customer, at no extra cost, and needs no signature. If you need a signed copy for your records, ask us.
Effective date: 22 August 2026
Parties and roles
You are the controller of the personal data your forms collect. We are the processor of it.
Where we handle personal data for our own purposes, such as your account and your billing, we are the controller. This agreement does not cover that. Our Privacy Policy does.
Subject matter, duration, nature and purpose
The subject matter is the personal data submitted through your forms, together with the request details that arrive with it.
The processing lasts as long as you use the service. It ends when your account is closed under the Terms.
The nature and purpose is to collect, store, forward and display your form submissions. That includes the related work you configure: spam filtering, email notifications, connections to other tools, and exports.
Categories of data subjects and personal data
The data subjects are the people who submit data through your forms. The personal data we process for you is:
| Category | Fields | Retention |
|---|---|---|
| Submission content | every field a form's visitor fills in | Until the customer deletes it. Deleted submissions stay recoverable for 30 days |
| Submitter IP address | IP address | 12 months |
| Approximate location derived from an IP address | continent, country, region, city, latitude, longitude | 12 months |
| Request metadata | browser user agent, referring page, origin | With the submission it belongs to |
| Filtered submissions | submission content, IP address, user agent, referring page, origin | 12 months. Filtered submissions are visible to the customer for 30 days |
| Notification recipients | email address | Until the customer removes the address, or until the account that owns it is deleted |
| Export files | the submission content covered by the export | 7 days |
Submission data is whatever your form asks for, so you decide what it contains. Collecting it lawfully is your responsibility as controller.
The service must not be used to collect:
- Special category data under GDPR Art. 9
- Children's personal data
- Personal health information
- Personal criminal history
- Payment card numbers
- Biometric data
Documented instructions
We process personal data only on your documented instructions. Your instructions are the Terms, this agreement, and how you set up and use the service.
We will step outside them only where the law requires it. If that happens we tell you first, unless the law forbids us to.
If we think an instruction of yours breaks the GDPR or another data protection law, we will tell you.
Confidentiality
Everyone we allow to handle this data is bound to keep it confidential, either by agreement or by law.
Security measures
We take account of the state of the art, the cost, and the nature and risk of the processing. On that basis we apply the measures listed in Annex II below. They are what is actually in place, not a wish list.
Subprocessors
You give us general permission to use subprocessors. The current list is published at formspark.io/legal/subprocessors and forms part of this agreement.
We add a new subprocessor to that page at least 30 days before it starts handling personal data. That gives you time to object.
If you object and we cannot resolve it, you may stop using the service and we will refund what you have not used.
We put the same data protection obligations on every subprocessor that this agreement puts on us. We stay liable to you for what they do.
International transfers
The personal data we process for you is stored in the European Economic Area, in Ireland and Germany.
Some subprocessors process personal data outside the European Economic Area. The subprocessors page lists where each one processes it and the transfer safeguard that applies to it. Where we rely on a safeguard, it is an adequacy decision, the Standard Contractual Clauses, or the EU-US Data Privacy Framework.
Helping you answer data subject requests
We help you meet requests from data subjects, as far as the nature of the processing allows. That covers access, correction, deletion, restriction, objection and portability.
In practice you can do most of it yourself. The dashboard lets you search, edit and delete submissions, and export them as CSV or JSON. Write to us for anything that needs more.
If a data subject contacts us directly about data we hold for you, we point them to you.
Personal data breaches
If there is a breach affecting the personal data we process for you, we tell you without undue delay after we find out.
We tell you what we know: what happened, which categories of data and roughly how many records are involved, the likely consequences, and what we are doing about it. It is then your call whether to notify your supervisory authority or the people affected.
Helping you with impact assessments
We help you with data protection impact assessments, and with any prior consultation of a supervisory authority. That help goes as far as the nature of the processing allows and the information is ours to give.
Deletion or return when we are done
You can export your submissions at any time, so you never need our help to get a copy.
When you delete your account, we delete the workspaces you own and every submission in them. That happens straight away rather than on a schedule.
If you would rather have the data returned than deleted, tell us before you close the account and we will send it to you first.
We keep two things after that, and only these two. We keep your email address, so that closing and reopening an account cannot hand out a second free allowance. We keep the list of addresses that have unsubscribed from autoresponses, so that an unsubscribe cannot be undone by an account closing.
Audits and information
We give you the information you need to check that we meet our Article 28 obligations. We allow audits, including inspections, by you or an auditor you appoint.
Send audit requests to support@formspark.io. Audits happen once per year, unless a supervisory authority asks for more. Give us reasonable notice, and do not disrupt the service for other customers.
Precedence
Where this agreement and the Terms disagree about personal data, this agreement wins. Everything else in the Terms stands.
Governing law
The law of Belgium governs this agreement, without regard to its conflict of law rules. The courts of Belgium have exclusive jurisdiction.
Annex I: details of the processing
The controller is you. The processor is Trampoline Software SRL, Rue de Marsannay-la-Côte 16, 5032 Mazy, Belgium.
The categories of data subjects, the categories of personal data, the purposes and the retention periods are in the table above. The processing continues for as long as your account is open.
Annex II: technical and organisational measures
- Encryption in transit
- Access to production data limited to a small number of authorized people
- Sensitive values removed from error reports before they leave the service
- Monitoring and alerting on the production service
This list is what we have verified is in place. We would rather it be short and true than long and aspirational. Ask us if you need detail on any line for a vendor review.
Annex III: subprocessors
These are used for every customer: Amazon Web Services, Hetzner, OOPSpam, Paddle, Sentry, Mapbox. Some of those can be switched off, and the subprocessors page says which and where.
These are used only when you switch on the feature that needs them: Cloudflare (Turnstile), GitHub, Google (reCAPTCHA), Google (Sheets), Google (Sign-in), hCaptcha, Notion, Slack (Connection), Slack (Sign-in), Zapier.
The subprocessors page is the authoritative version, with the location, safeguard and retention for each. It is incorporated here by reference, so updating it does not require re-signing this agreement.
Questions
Have a question about this page, your data, or your rights? Email us at support@formspark.io and we will answer it.
Formspark is operated by Trampoline Software SRL, Rue de Marsannay-la-Côte 16, 5032 Mazy, Belgium. Enterprise number BE 0799.398.081.