Data Processing Agreement

Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service or other written or electronic agreement (the "Agreement") between FormAssembly and User for use of the FormAssembly service. Capitalized terms not defined in this DPA shall have the meaning given to them in the Agreement.

1. Data Protection

1.1 Roles

FormAssembly (the data processor) is appointed by User (the data controller) to process User Personal Data on behalf of User only as is necessary to provide the Services and as may subsequently be agreed by the parties in writing.

1.2 Compliance

Each party shall comply with its respective obligations under the Data Protection Laws as a data controller or a data processor (as applicable) in respect of the processing of User Personal Data under or in relation to the Agreement.

1.3 User Responsibilities

The categories of User Personal Data to be processed by FormAssembly and the processing activities to be performed are set out in Annex I. User has sole responsibility for the accuracy, quality, and legality of User Personal Data and warrants that:

• it has complied with its obligations under the Data Protection Laws in respect of the collection, use, and transfer of User Personal Data;
• it is able to document and evidence its compliance with Data Protection Laws;
• its use of the Services will not violate the rights of any data subject who has opted out from sales or other disclosures of Personal Data, to the extent applicable under the CCPA; and
• the quantity of User Personal Data provided to FormAssembly is the minimum necessary for the performance of the Services.

1.4 FormAssembly Obligations

FormAssembly agrees in respect of User Personal Data that it shall:

• only process User Personal Data in accordance with this DPA and the Agreement. If FormAssembly believes that any instruction from User is likely to infringe Data Protection Laws, it shall promptly notify User and may cease to provide the relevant Services until the parties have agreed appropriate amended instructions;
• implement, maintain, and comply with the minimum security requirements set out in Annex II;
• not publish, disclose, or divulge User Personal Data to a third party unless User has given prior written consent;
• ensure that only FormAssembly personnel who require access to User Personal Data to fulfil obligations under this Agreement have such access, and take reasonable steps to ensure the reliability of such personnel;
• at User's cost and taking into account the nature of the processing, provide reasonable cooperation to allow User to comply with its obligations as a data controller;
• at User's cost and option, following the end of the provision of Services, either return or delete all User Personal Data in FormAssembly's possession or control, except to the extent that applicable law requires retention. This obligation does not apply to User Personal Data archived on FormAssembly's back-up systems; and
• provide an adequate level of security and protection for User Personal Data in accordance with Data Protection Laws.

1.5 Subprocessors

FormAssembly may appoint third parties to process User Personal Data ("Subprocessors"), subject to:

• providing reasonable prior notice to User of the identity and location of the Subprocessor and a description of the intended processing; and
• imposing legally binding data protection obligations on the Subprocessor that are materially equivalent to those in this DPA.

Within 30 days of being informed of a new Subprocessor, User may object in writing. If the objection cannot be reasonably accommodated, either party may terminate the Agreement upon 30 days' prior written notice. This is User's sole and exclusive remedy.

The list of pre-approved Subprocessors is set out in Annex III.

1.6 Third-Party Integrations

Third-party services connected by Users through the integrations feature (such as Salesforce, Google Sheets, or other external platforms) are not Subprocessors of FormAssembly. When a User configures such an integration, the User is directing the transfer of Respondent data to a service the User controls. Users are responsible for ensuring those services comply with applicable Data Protection Laws.

1.7 Subprocessor Liability

FormAssembly remains liable to User for any breach of this DPA by a Subprocessor appointed by it.

1.8 Audit Rights

FormAssembly shall make available to User upon reasonable request such information as is necessary to demonstrate compliance with this DPA and with Article 28 of the EU GDPR. Subject to a maximum of one audit request per 12-month period and upon reasonable prior notice, FormAssembly shall allow for and contribute to audits conducted by User or an independent auditor mandated by User, provided such auditor is bound by appropriate obligations of confidentiality. FormAssembly may satisfy an audit request by providing a copy of a recent independent audit report, redacted as reasonably necessary to protect confidentiality. An on-site audit may only be requested if (a) FormAssembly notifies User of a Security Breach, (b) User reasonably believes FormAssembly is not in compliance with its security obligations, or (c) an on-site audit is required by Data Protection Laws.

2. Security Breaches

FormAssembly shall notify User without undue delay upon becoming aware of any confirmed accidental, unauthorized, or unlawful destruction, loss, alteration, or disclosure of, or access to, User Personal Data ("Security Breach").

3. Cooperation

At User's cost, FormAssembly agrees to provide reasonable assistance to enable User to respond to any request, complaint, or binding instruction received from: (a) any individual whose Personal Data is processed by FormAssembly on User's behalf; or (b) any regulator or data protection authority.

4. Data Transfers

4.1 General

FormAssembly shall not process User Personal Data outside the European Union, European Economic Area, Switzerland, or the United Kingdom without User's prior written consent.

4.2 Consent to Transfer

User hereby consents to User Personal Data being processed outside those jurisdictions, subject to FormAssembly's compliance with Sections 4.3 and 4.4 throughout the duration of the Agreement.

4.3 Transfer Mechanisms

To the extent that User Personal Data is processed outside the EU/EEA, Switzerland, or the UK:

• EU GDPR transfers are governed by the Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (Module Two: Controller to Processor), which are incorporated into this DPA by reference.
• UK GDPR transfers are additionally governed by the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner's Office (version B1.0, in force 21 March 2022, or as amended by the UK governing authority), which is incorporated by reference.

For purposes of the UK Addendum: User is the data exporter and FormAssembly is the data importer; the contact information and processing details in Annex I apply; and the answer to Table 4 is "neither party."

4.4 Alternative Mechanisms

If any transfer mechanism under Section 4.3 ceases to be lawful, the parties shall promptly implement an alternative lawful transfer mechanism.

5. Liability

Each party's liability for breaches of this DPA is subject to the limitations and exclusions set out in the Agreement. In no event shall either party's liability exceed the liability cap in the Agreement. Nothing in this DPA limits liability that cannot be excluded under applicable law.

6. General Terms

Nothing in this DPA reduces FormAssembly's obligations under the Agreement in relation to the protection of User Personal Data. In the event of conflict between this DPA and the incorporated Standard Contractual Clauses or UK Addendum, the Standard Contractual Clauses and UK Addendum shall prevail.

Either party may propose variations to this DPA by at least 30 days' written notice where reasonably necessary to address changes in Data Protection Laws. The parties shall negotiate in good faith to agree appropriate amendments.

7. Definitions

"Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with a party.

"Data Controller," "Data Processor," "Personal Data," "data subject," "supervisory authority," "process," and "processing" have the meanings given to them under applicable Data Protection Laws.

"Data Protection Laws" means any applicable law relating to the processing, privacy, and use of Personal Data, including:

• the EU General Data Protection Regulation (2016/679) ("EU GDPR");
• UK Data Protection Laws (including the UK GDPR and Data Protection Act 2018);
• the California Consumer Privacy Act ("CCPA"), Cal. Civ. Code § 1798.100 et seq.; and
• any laws implementing, replacing, or amending the foregoing.

"UK GDPR" has the meaning given in section 3 of the Data Protection Act 2018.

"User Personal Data" means any Personal Data processed by FormAssembly (and its Subprocessors) on behalf of User pursuant to or in connection with the Agreement.

---

Annex I — Description of Processing

Data exporter: User (as identified in the Agreement)
Role: Controller

Data importer: FormAssembly Inc., 885 S College Mall Rd, #399, Bloomington, Indiana 47401, USA | cedric@formassembly.com
Role: Processor

Categories of data subjects: Respondents who submit data through forms created by Users; Users who interact with the FormAssembly platform.

Categories of personal data: Names, email addresses, and other personal information that Respondents voluntarily submit through User-created forms. The specific categories depend on the content of forms created by User and may vary by deployment.

Sensitive data: Not transferred by default. Users who collect sensitive data (health information, financial data, or other special categories under the EU GDPR) are responsible for applying appropriate safeguards and notifying FormAssembly.

Frequency of transfer: Ongoing, as necessary to provide the Services for the duration of the Agreement.

Nature and purpose of processing: FormAssembly processes User Personal Data to provide the form-building, workflow automation, and data collection services described in the Agreement, including storing form submissions, routing data to connected systems as directed by User, and enabling User to access and manage Respondent data.

Retention period: For the term of the Agreement. Following termination or expiry, FormAssembly will delete User Personal Data within 180 days (with a recovery window of up to 30 days after expiry), except as required by applicable law. This does not apply to data archived on back-up systems.

Competent supervisory authority: The supervisory authority in the EU member state in which the data exporter is domiciled, or as otherwise required by applicable Data Protection Laws.

---

Annex II — Technical and Organisational Security Measures

FormAssembly maintains the following minimum technical and organisational measures to protect User Personal Data:

General security

• Risk-appropriate technical and organisational measures consistent with Articles 32(a)–(d) of the EU GDPR
• Annual review of security programs; review upon significant changes to systems or organisation
• Security awareness training for all staff with access to Personal Data upon hire and on a regular basis
• Confidentiality agreements for all personnel with access to Personal Data
• Criminal background checks for personnel
• Designated security officer(s)

Physical access control

• Data processing facilities secured by restricted access, security areas, and appropriate physical controls
• Data centre access controlled by security staff, video surveillance, intrusion detection, and multi-factor authentication

Logical access control

• Password policy: minimum 12 characters including upper/lowercase, numbers, and special characters; rotation at least every 90 days; passwords stored in hashed/encrypted form
• User access reviewed regularly; deactivated upon termination or when no longer required
• Failed login attempts logged and monitored; lockout upon repeated failures
• Automatic session lock after inactivity; full disk encryption on laptops
• Device management software enforcing security policies, remote lock, and remote wipe
• Industry-standard firewall and up-to-date anti-malware protection
• Principle of least privilege; no shared accounts

Incident management

• Security incidents recorded with type, date/time, resources affected, reporter, effects, and corrective measures
• Incident response procedures covering detection, containment, notification, documentation, analysis, remediation, recovery, and post-incident review

Transmission security

• Encryption in transit (TLS) for all Personal Data
• Audit logs maintained for information systems; reviewed on a regular basis
• Change management procedures including pre-implementation review and testing
• Quarterly vulnerability scans; annual penetration testing and third-party security review
• Production data not used in testing environments unless equivalent security controls are in place

Availability and recovery

• Infrastructure redundancy; disaster recovery systems and procedures
• Business continuity and disaster recovery plans tested and updated regularly
• Daily encrypted backups (AES-256); backup access restricted to systems team

Subprocessor control

• Subprocessors granted access to Personal Data only as permitted under this DPA
• Third-party vendor risk assessments conducted

---

Annex III — Pre-Approved Subprocessors

Subprocessor	Location	Purpose
Amazon Web Services	United States (with global regions)	Cloud infrastructure and hosting
Anthropic	United States	AI processing via the Fai assistant
OpenAI	United States	AI processing via the Fai assistant