Data processing agreement.

1. Definitions

For the purposes of this Data Processing Agreement, the following terms shall have the meanings set out below:

• "Controller": The customer (you) who determines the purposes and means of processing personal data through the use of WittyForm's services.
• "Processor": WittyForm, which processes personal data on behalf of the Controller in the course of providing its services.
• "Personal Data": Any information relating to an identified or identifiable natural person, as defined in Article 4(1) of the GDPR.
• "Processing": Any operation or set of operations performed on personal data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
• "Sub-Processor": A third-party entity engaged by WittyForm to assist in the processing of personal data on behalf of the Controller.
• "Data Subject": An identified or identifiable natural person whose personal data is processed.
• "GDPR": Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation).

2. Scope and Purpose

This DPA applies to the processing of personal data by WittyForm (Processor) on behalf of the customer (Controller) in connection with the provision of the WittyForm platform and related services.

• WittyForm processes personal data solely to provide the services agreed upon in the Terms of Service, including form data collection, response storage, analytics, AI form generation, and integrations.
• The Processor shall not process personal data for any purpose other than as documented in the Controller's instructions, unless required by applicable law.
• This DPA supplements and forms part of the WittyForm Terms of Service and Privacy Policy.

3. Duration of Processing

The Processor shall process personal data for the duration of the service agreement between the Controller and WittyForm. Processing will commence upon account creation or first use of the services and will continue until the service agreement is terminated.

Upon termination, the Processor will handle personal data in accordance with Section 13 (Data Return and Deletion) of this DPA.

4. Nature and Purpose of Processing

WittyForm processes personal data to provide the following services on behalf of the Controller:

• Form data collection: Receiving, validating, and storing responses submitted through forms, surveys, and quizzes created by the Controller.
• Data storage: Securely storing form configurations, response data, file uploads, and account information.
• Analytics and reporting: Generating response analytics, conversion metrics, and reporting dashboards.
• AI-powered features: Processing data through AI models for form generation and field suggestions, only when explicitly initiated by the Controller.
• Email and notification delivery: Sending transactional emails, form submission notifications, and integration dispatches.
• Third-party integrations: Transmitting data to external services (e.g., Google Sheets, Slack, Shopify) as configured and initiated by the Controller.

5. Types of Personal Data

The following categories of personal data may be processed in connection with the services:

• Identity data: Names, email addresses, phone numbers, and other identifiers provided by form respondents.
• Form response data: Any data submitted through forms, surveys, and quizzes, the content of which is determined by the Controller.
• Payment data: Billing information processed through Stripe for subscription and payment management. WittyForm does not store full credit card numbers.
• Technical data: IP addresses, browser type, device identifiers, and usage logs collected for security and service operation.
• File uploads: Documents, images, or other files uploaded by form respondents as part of form submissions.

6. Categories of Data Subjects

The personal data processed concerns the following categories of data subjects:

• Form respondents: Individuals who submit responses to forms, surveys, and quizzes created by the Controller.
• Account holders: Individuals who register for and maintain a WittyForm account.
• Team members: Individuals invited by the Controller to collaborate within a workspace or organization.

7. Obligations of the Processor

WittyForm, as Processor, undertakes the following obligations:

• Process only on instructions: Process personal data only on documented instructions from the Controller, unless required by EU or Member State law. The Processor shall inform the Controller of any such legal requirement before processing.
• Ensure confidentiality: Ensure that all personnel authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
• Implement security measures: Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including TLS 1.3 in transit, AES-256-GCM encryption of stored integration credentials, access controls, and audit logging.
• Assist with data subject rights: Assist the Controller in responding to requests from data subjects exercising their rights under the GDPR, including access, rectification, erasure, portability, restriction, and objection.
• Notify of breaches: Notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach.
• Assist with compliance: Assist the Controller in ensuring compliance with obligations under Articles 32 to 36 of the GDPR, including data protection impact assessments and prior consultations with supervisory authorities.
• Delete data on termination: At the choice of the Controller, delete or return all personal data upon termination of the services, unless retention is required by applicable law.

8. Sub-Processors

The Controller authorizes the Processor to engage the following sub-processors. The Processor shall ensure that each sub-processor is bound by data protection obligations no less protective than those set out in this DPA.

The Processor shall notify the Controller of any intended changes concerning the addition or replacement of sub-processors, giving the Controller the opportunity to object to such changes. Notifications will be sent to the email address associated with the Controller's account at least 14 days before the change takes effect.

9. International Data Transfers

Personal data may be transferred to and processed in countries outside the European Economic Area (EEA). WittyForm ensures that all international transfers are protected by appropriate safeguards:

• EU Standard Contractual Clauses (SCCs): All transfers to third countries are governed by the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), as applicable.
• EU-US Data Privacy Framework: Where applicable, transfers to the United States are supported by the EU-US Data Privacy Framework certification of our sub-processors.
• Transfer Impact Assessments: WittyForm conducts transfer impact assessments to evaluate the level of data protection in the recipient country and implements supplementary measures where necessary.

10. Security Measures

The Processor implements and maintains the following technical and organizational security measures to protect personal data:

11. Data Breach Notification

In the event of a personal data breach, the Processor shall notify the Controller without undue delay, and in any event within 48 hours of becoming aware of the breach. The notification shall include:

• A description of the nature of the personal data breach, including the categories and approximate number of data subjects and records concerned.
• The name and contact details of the Processor's data protection point of contact.
• A description of the likely consequences of the personal data breach.
• A description of the measures taken or proposed to be taken to address the breach, including measures to mitigate its possible adverse effects.

The Processor shall cooperate with the Controller and take reasonable commercial steps to assist in the investigation, mitigation, and remediation of the breach.

12. Audit Rights

The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and this DPA, and shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

• Reasonable notice: The Controller shall provide at least 30 days' written notice prior to conducting an audit, unless a shorter period is required due to a regulatory investigation or data breach.
• Scope: Audits shall be limited to the processing activities carried out on behalf of the Controller and shall be conducted during normal business hours with minimal disruption.
• Confidentiality: The Controller and its auditors shall treat all information obtained during the audit as confidential.

13. Data Return and Deletion

Upon termination of the service agreement, the Processor shall, at the choice of the Controller:

• Return data: Provide the Controller with a complete export of all personal data in a structured, commonly used, and machine-readable format (JSON or CSV).
• Delete data: Permanently delete all personal data from active systems within 30 days of termination. Residual copies in encrypted backup systems will be purged within 90 days.
• Certification: Upon request, the Processor shall provide written certification that all personal data has been deleted in accordance with this DPA.

Data required to be retained by applicable law will be isolated and protected from further processing until deletion is possible.

14. Record of Processing Activities

In accordance with Article 30 of the GDPR, WittyForm maintains a record of all processing activities carried out on behalf of the Controller:

15. Data Protection Contact

For questions about this DPA, data protection inquiries, to exercise data subject rights, or to request a signed copy of this agreement:

• Privacy and data protection: [email protected]
• General support: [email protected]
• Data hosting location: Hetzner Cloud, Falkenstein, Germany (EU)

This DPA was last updated on March 29, 2026.