Data Processing Agreement

Controller: the customer who holds a FormzoAI workspace ("you"). Processor: Ansorjon Juraev, trading as FormzoAI, Eschersheimer Landstraße 42, 60322 Frankfurt am Main, Germany ("we").

This agreement covers the personal data we process on your behalf: everything your respondents give your forms and the results we produce from it. It doesn't cover data we're responsible for ourselves, such as your account, billing and people's own FormzoAI profiles; our Privacy Policy describes those. It runs as long as you have a workspace with us, and ends when all your data has been deleted (section 10).

• Purpose: hosting your forms, holding the conversation with each respondent, saving their progress, storing their answers and files, writing summaries, translations and scores with AI, showing you the results, exporting them and sending the emails and integrations you set up.
• People concerned: the respondents to your forms, and anyone they mention in their answers.
• Types of data: whatever your questions ask for, typically names, email addresses, phone numbers, links, location, education, work history, opinions and free text; uploaded files; the full conversation; the language used; AI-written summaries, translations, scores and soft flags; technical data such as a keyed hash of the IP address. You decide whether to ask for special categories of data (Art. 9 GDPR); if you do, you're responsible for having a legal basis.
• Nature: storing, organising, analysing with AI, transmitting to you and the destinations you choose, and deleting.
• Duration: until you delete a response, a form or your workspace, until your retention setting deletes it, or until the deletion rules in our Terms apply after a plan ends.
• Location: your workspace's region (EU, Frankfurt, or US, Ohio), shown in Settings, plus the providers in Annex III.

We process the data only on your documented instructions. Those are this agreement, the Terms, and what you set up in FormzoAI: the forms you publish, your settings, exports, integrations, API calls and deletions. If we're legally required to do something else, we'll tell you first unless the law forbids it.

We'll tell you if we think an instruction breaks data protection law. We never use your respondents' data for our own purposes, never sell it and never use it to train AI models.

Everyone who can access the data on our side is bound to confidentiality and accesses it only as far as running and supporting the service requires.

We keep technical and organisational measures appropriate to the risk (Art. 32 GDPR) and improve them over time without lowering the level of protection:

• Encryption: HTTPS for all traffic; databases and file storage encrypted at rest by our providers.
• Access control: responses and files are visible only to signed-in members of the workspace and to its own API keys. Uploaded files have no public links. API keys are stored as one-way hashes; webhook deliveries are signed.
• Separation: every workspace's data is separated by workspace in the application, and stored in the workspace's region.
• Data minimisation: IP addresses are stored only as keyed hashes; CVs used to fill answers are read in memory and never stored; anonymous drafts and unfinished conversations are deleted after 30 days.
• AI safety: respondent text is passed to the AI as data, never as instructions. Attempts to instruct the AI are flagged to you, and can't change scores.
• Availability: managed databases with point-in-time recovery; hosting on redundant infrastructure.
• People and process: production access limited to the operator; secrets kept out of code and stored with our hosting provider; dependencies and changes tested before they go live.

You authorise us to use the sub-processors listed below and on our sub-processor page. We bind each one by contract to data protection obligations at least as strict as these. We stay responsible to you for their work.

We'll tell workspace owners by email at least 30 days before we add or replace a sub-processor. If you object on reasonable data protection grounds and we can't resolve it, you may end your plan before the change takes effect and we'll refund any prepaid time you can't use.

Some sub-processors work from the United States. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses in that provider's data processing terms. Data of an EU workspace is stored in Frankfurt; US workspaces are stored in the United States because their owners are based there.

FormzoAI gives you the tools to answer respondents' requests yourself: find every response from one email address, export it as JSON or CSV, correct it and delete it, including stored files (Settings → Data requests). If a respondent contacts us directly, we pass the request to you and don't answer it ourselves unless you ask us to.

We'll also help, as far as we reasonably can, with data protection impact assessments, consultations with authorities and the security duties of Articles 32–36 GDPR.

We'll tell you without undue delay, and at the latest within 48 hours, after we become aware of a breach affecting your data, with what we know: what happened, which data and roughly how many people are affected, the likely consequences and what we're doing about it. We'll add details as we learn them.

You can export your data at any time. When your plan ends, you keep read and export access for the period our Terms set; after that, and after an email warning, we delete your forms, responses and files. Deleted data disappears from backups as they roll over, within 30 days. Copies you send elsewhere yourself, for example to Google Sheets, through webhooks or with the API, are outside our reach and under your control.

We'll give you the information you need to show that we meet Article 28, including this agreement, our security measures and our sub-processors' certifications. If that isn't enough, you may audit us, or have an independent auditor bound to confidentiality do so, once a year with 30 days' notice, during business hours and at your cost, unless a breach or an authority requires more.

• Liability follows Article 82 GDPR and the Terms of Service.
• If this agreement and the Terms conflict on data protection, this agreement wins.
• We may update this agreement when the law or our service changes. We'll email workspace owners about changes that matter and give the new text a new version; changes never lower the protection of your data.
• German law applies. Questions about this agreement: [email protected].