Formspark Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Formspark Terms of Service ("Terms") between you ("Customer") and Trampoline Software SRL ("Formspark") and reflects the parties' agreement with regard to the processing of personal data within the meaning of Article 28 of the General Data Protection Regulation ("GDPR").

This DPA applies automatically to all customers as part of the Terms, at no additional cost, and requires no signature.

Effective date: 8/1/2026

Parties and Roles

For the purposes of this DPA, the Customer acts as the data controller and Formspark acts as the data processor with respect to the personal data that Formspark processes on the Customer's behalf when providing the Service.

Where Formspark processes personal data for its own purposes, such as account and billing information, Formspark acts as a data controller and the Privacy Policy applies instead of this DPA.

Subject Matter, Duration, Nature and Purpose of Processing

The subject matter of the processing is the personal data submitted through the Customer's forms and the associated request metadata.

The processing lasts for the duration of the Customer's use of the Service, until the Customer's account is cancelled or terminated in accordance with the Terms.

The nature and purpose of the processing is the collection, storage, forwarding, and display of form submissions and related services such as spam filtering, email notifications, and exports, as configured by the Customer.

Categories of Data Subjects and Personal Data

The data subjects are the individuals who submit data through the Customer's forms.

The personal data processed on the Customer's behalf includes:

Submission data: any personal data that data subjects enter into the Customer's forms, as determined by the Customer
IP address
Browser type
Referring website addresses

It is the Customer's responsibility as a data controller to ensure that any personally-identifying information collected via the Service is collected lawfully. The Service is not to be used to collect children's personal information, personal health information, or personal criminal history.

Documented Instructions

Formspark processes personal data only on the Customer's documented instructions, unless required to do so by law. In that case, Formspark informs the Customer of the legal requirement before processing, unless the law prohibits this.

The Customer's instructions consist of the Terms, this DPA, and the Customer's configuration and use of the Service.

Confidentiality

Formspark ensures that persons authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

Security Measures

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, Formspark implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

Encryption of data in transit
Hosting on Amazon Web Services in the eu-west-1 (Ireland) region
Access controls limiting access to personal data to a small number of authorized persons
Monitoring and error reporting

Subprocessing

The Customer grants Formspark general authorization to engage subprocessors for the processing of personal data. The list of subprocessors is published at formspark.io/legal/subprocessors and is incorporated into this DPA by reference.

Formspark will update that page before engaging a new subprocessor, giving the Customer the opportunity to object. If the Customer objects to a new subprocessor, the Customer may cancel their account in accordance with the Terms.

Formspark imposes data protection obligations on its subprocessors that are no less protective than those set out in this DPA, and remains liable to the Customer for the performance of its subprocessors' obligations.

International Transfers

Personal data processed on the Customer's behalf is stored in the European Economic Area (Ireland).

Where a subprocessor processes personal data outside the European Economic Area, Formspark ensures that the transfer is covered by an adequacy decision of the European Commission or by appropriate safeguards such as the Standard Contractual Clauses adopted by the European Commission.

Assistance with Data Subject Rights

Taking into account the nature of the processing, Formspark assists the Customer by appropriate technical and organizational measures, insofar as this is possible, in fulfilling the Customer's obligation to respond to requests from data subjects exercising their rights under the GDPR, such as access, rectification, erasure, restriction, and data portability.

If a data subject contacts Formspark directly about personal data processed on the Customer's behalf, Formspark will refer the data subject to the Customer.

Personal Data Breach Notification

Formspark notifies the Customer without undue delay after becoming aware of a personal data breach affecting personal data processed on the Customer's behalf, and provides the Customer with information reasonably required to meet the Customer's obligations under the GDPR.

Deletion or Return at Termination

At the Customer's choice, Formspark deletes or returns all personal data processed on the Customer's behalf after the end of the provision of the Service, and deletes existing copies unless the law requires storage of the personal data.

The Customer can export their submission data from the Service at any time. Upon cancellation of the Customer's account, personal data is deleted in accordance with the Terms.

Audit and Information Rights

Formspark makes available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR, and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer.

Formspark will inform the Customer if, in its opinion, an instruction infringes the GDPR or other data protection provisions of the European Union or of a member state.

Audit requests should be sent to support@formspark.io. Audits are limited to once per year unless required by a supervisory authority, and must be conducted with reasonable notice and without disrupting the Service.

Precedence

In the event of a conflict between this DPA and the Terms with respect to the processing of personal data, this DPA prevails. In all other respects, the Terms remain in full force.

Governing Law

This DPA shall be governed and construed in accordance with the laws of Belgium, without regard to its conflict of law provisions. The place of jurisdiction shall be exclusively in Belgium.

Questions

Have any questions, comments, or concerns about this DPA?

Please get in touch by emailing us at support@formspark.io, and we'll be happy to answer them.

Formspark is owned by Trampoline Software SRL.