Data Processing Agreement (template)

forms.ax acts as processor for respondent data; the form owner is the controller.

Scope

We process respondent data only to provide the service (hosting forms, storing responses, generating adaptive follow-ups and analysis at the owner's configuration).

Subprocessors

Listed and kept current at /legal/subprocessors. We notify controllers of changes.

International transfers

Respondent data is stored in EU-jurisdiction storage. Adaptive processing uses the Anthropic API (USA) under appropriate transfer safeguards; only the answer text needed for a follow-up or validation is sent.

Security & subject rights

Multi-tenant isolation, encryption in transit, access-controlled audit logs. We support access, deletion, and export requests via the owner's tooling.

A signed DPA is available on the Business plan. Contact legal@forms.ax.