Formspark and GDPR

Formspark wears two hats under the GDPR, and which one applies depends on whose data it is.

For your account, your billing and your support emails, we decide the use of the data. We are the controller.

For everything your visitors type into your forms, you decide the use of the data and we act on your instructions. You are the controller and we are the processor.

This page explains both, and how to exercise your rights. The contract behind it is our Data Processing Agreement.

Effective date: 22 August 2026

A note first

We are not lawyers and this is not legal advice. This page describes what Formspark does. If you need advice on your own obligations, ask someone qualified to give it.

The words this page uses

Controller: The party that decides why and how personal data is used.
Processor: A party that uses personal data on a controller's behalf.
Subprocessor: A vendor a processor brings in to help do that job.
Data subject: The person the data is about.

Where we are the controller

We decide the use of the data we hold about you as our customer. That covers:

Account: create your account, sign you in, and contact you about the service
Sign-up and sign-in IP address: keep the service secure
Sign-in identity from a social provider: let you sign in without a password
Newsletter subscription: send you product news
Billing: take payment, calculate tax, and issue invoices
Autoresponder suppression list: make sure someone who unsubscribed never receives another autoresponse
Autoresponder complaint records: keep the records needed to answer complaints about autoresponder email
Server logs: keep the service running and diagnose failures
Email delivery events: keep email deliverable and stop sending to addresses that reject it
Map tile requests: load the map behind the submission heatmap in the dashboard
Checkout script requests: load the checkout our payment processor runs
Error reports: find and fix failures

Our Privacy Policy gives the full picture, including the basis we rely on for each one and how long we keep it.

Where we are the processor

When a visitor fills in your form, we store what they typed and pass it to you. You chose the questions and you decide what happens to the answers. We act on your instructions, which are your use of the service plus the terms you agreed to.

Here is what we handle for you:

Data	Purpose	Retention
Submission content every field a form's visitor fills in	Deliver submissions to the customer who owns the form	Until the customer deletes it. Deleted submissions stay recoverable for 30 days
Submitter IP address IP address	Filter spam, keep the service secure, and show the customer where submissions came from	12 months
Approximate location derived from an IP address continent, country, region, city, latitude, longitude	Draw the submission map and country breakdown the customer sees	12 months
Request metadata browser user agent, referring page, origin	Filter spam and help the customer see where a submission came from	With the submission it belongs to
Filtered submissions submission content, IP address, user agent, referring page, origin	Hold submissions that were not delivered to the customer's inbox, and keep the records needed to answer complaints about the service	12 months. Filtered submissions are visible to the customer for 30 days
Notification recipients email address	Send form notifications to the addresses a customer chooses	Until the customer removes the address, or until the account that owns it is deleted
Export files the submission content covered by the export	Give the customer their submissions as CSV or JSON	7 days

Submission content is the important one on that list. Whatever your form asks for is what we end up holding, so the fields you choose decide how sensitive it is.

Making that collection lawful is your job, not ours. You need a basis for it, and your own privacy notice needs to cover it.

Formspark must not be used to collect:

Special category data under GDPR Art. 9
Children's personal data
Personal health information
Personal criminal history
Payment card numbers
Biometric data

Where the data is stored

Everything we hold stays in the European Economic Area. It lives in Ireland and Germany.

Because both are in the European Economic Area, storing your data does not transfer it out. Some of the vendors we use sit outside it. Our subprocessors page lists where each vendor is and the transfer safeguard that applies to it.

Subprocessors

We use vendors to help run the service. Some are used for every customer. Others are used only when you switch on a feature that needs them.

The subprocessors page is the live list. We update it at least 30 days before a new vendor starts handling personal data, so you have time to object.

Your rights

The GDPR gives you the right to:

Get a copy of the personal data we hold about you
Have it corrected when it is wrong or incomplete
Have it deleted
Limit what we do with it while a question about it is open
Object to us relying on our legitimate interests
Receive it in a structured, machine-readable file
Withdraw your consent to marketing email at any time
Know who else receives it

Email support@formspark.io to use any of them. We answer within one month. If a request is complicated we may take longer, and we will tell you inside that first month if so.

We make no decisions about you by automated means that carry a legal or similarly significant effect.

If a visitor to your form contacts us about their data, we point them to you. You are the controller of it, so the answer is yours to give. We will help you give it.

Data protection officer

We have not appointed one. Our processing does not meet the conditions in Article 37 that would require it. Rights requests go to support@formspark.io and reach the people who can act on them.

We have no representative under Article 27 either. We are established in Belgium, so we do not need one.

Complaints

Tell us first and we will try to put it right. You can also complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), which supervises us. If you live in another EU country, you may complain to your own authority instead.

The agreement itself

Our Data Processing Agreement is the Article 28 contract between us. It forms part of our Terms of Service, applies to every customer at no extra cost, and needs no signature.

Questions

Have a question about this page, your data, or your rights? Email us at support@formspark.io and we will answer it.

Formspark is operated by Trampoline Software SRL, Rue de Marsannay-la-Côte 16, 5032 Mazy, Belgium. Enterprise number BE 0799.398.081.