Data Processing Terms

For personal data in your forms and responses (“customer personal data”), you are the controller and FlowyForm is your processor. Under Canadian law, you are the organisation accountable for the data and we are your service provider. Where you act for another controller, we are your subprocessor and you confirm you have their authority. Our Privacy Policy covers data we control ourselves, such as account and billing details.

• Purpose and nature: hosting your forms, collecting, storing and showing responses, delivering them to the destinations you set up, detecting spam, and support.
• Data subjects: people who fill in your forms, and anyone whose details you add (such as notification recipients).
• Types of data: whatever your forms ask for, plus uploaded files, signatures, and the technical details our Privacy Policy describes (browser, device type, referring page and timestamps). Special-category data only if you choose to collect it.
• Duration: for as long as you keep the data in FlowyForm, then until it rolls off our backups (14 days).

We process customer personal data only on your documented instructions. Those instructions are these terms and your settings and actions in FlowyForm, such as the integrations you turn on and the responses you delete. The exception is processing that the law requires; in that case we will tell you first unless the law forbids it. If we believe an instruction breaks data protection law, we will tell you. We do not sell customer personal data. We do not use it for our own purposes, including advertising or training AI models.

Only staff who need access to run FlowyForm or support you can reach customer personal data, and they are bound to keep it confidential. Staff access to customer accounts is logged.

We keep the technical and organisational measures described on our Security page. They include encryption in transit, hashed passwords, encrypted integration credentials, private file storage, access controls, rate limiting and regular backups. We may improve these measures, but will not reduce the overall level of protection.

You authorise us to use the subprocessors on our Subprocessors page. Each one is bound by written terms that protect the data at least as well as these terms. We stay responsible for them. Before adding or replacing a subprocessor, we update that page; if you have asked to be notified, we also email you, at least 14 days before the change. If you object on reasonable data protection grounds and we cannot address it, you may stop using FlowyForm. We will refund any prepaid time you have not used.

Services you connect yourself, such as Slack, Google Sheets or your own webhook endpoints, are not our subprocessors. Sending data to them is your instruction.

• Requests from individuals: FlowyForm lets you find, export and delete responses yourself. If a respondent contacts us directly, we will pass the request to you and not answer it ourselves, unless you ask us to.
• Assessments: we will give you reasonable information you need for data protection impact assessments or consultations with regulators.

If we become aware of a breach of security that leads to customer personal data being lost, destroyed, changed, disclosed or accessed without authorisation, we will tell you without undue delay, and within 72 hours of confirming it. We will explain what happened, the data involved and what we are doing about it, and keep you updated. We will also take reasonable steps to contain it.

FlowyForm is operated from Canada, which the European Commission recognises as providing adequate protection for commercial organisations. Customer personal data is stored with DigitalOcean in North America, and some subprocessors work from the United States. Where data protected by the GDPR, UK GDPR or Swiss law goes to a country without an adequacy decision, we rely on the safeguards in our subprocessors’ data processing terms. These include the European Commission’s Standard Contractual Clauses and, where a subprocessor is certified, the EU–US Data Privacy Framework.

You can export responses as CSV at any time. When you delete responses, forms or your account, we delete the related customer personal data from our live systems immediately; it leaves our backups within 14 days. We keep data longer only where the law requires it.

We will give you the information reasonably needed to show we meet these terms, including answers to security questionnaires. If that is not enough, or a regulator requires it, you may audit our compliance once a year, at your cost, with 30 days’ notice, during business hours and under confidentiality. The audit must not disrupt the service or expose other customers’ data.

If these terms conflict with the Terms of Service on the processing of customer personal data, these terms win. Liability under these terms is subject to the limits in the Terms of Service, unless the law does not allow that. Questions or requests go to help@flowyform.com.