Draft. The highlighted details aren’t filled in yet, and these documents need a lawyer’s review before EscForms takes real customers.
Data Processing Addendum
This addendum forms part of our Terms of Service and applies whenever EscForms handles personal data on your behalf. It covers what GDPR Article 28 and similar laws, including India’s DPDP Act, require in a contract with a processor.
1. Roles
For personal data submitted through your forms (“Customer Data”), you’re the controller or data fiduciary, and EscForms is your processor. Each of us will follow the data protection laws that apply to us.
2. What’s processed
| Purpose | Receiving, filtering, storing and forwarding form submissions |
|---|---|
| Duration | While your account is active, within the retention periods in our Privacy Policy |
| Data subjects | People who submit your forms |
| Types of data | Whatever your forms collect, typically names, contact details and messages, plus a shortened IP address and timestamps |
| Special categories | Not intended. Our Acceptable Use policy restricts them |
3. Our commitments
- We process Customer Data only on your documented instructions, which are these terms and how you configure the service, unless the law requires otherwise. We’ll tell you if we believe an instruction breaks the law.
- Anyone authorised to handle Customer Data is bound by confidentiality.
- We keep the security measures in section 7 in place.
- We help you respond to requests from people exercising their rights, mainly through the dashboard, where you can find, export and delete leads.
- We help you with security, breach notification, impact assessments and consultations with regulators, as far as our role allows.
4. Subprocessors
You authorise us to use the companies on our Subprocessors page. We bind them to data protection terms that give at least the same protection, and we stay responsible for their work. We’ll give at least 30 days’ notice before adding or replacing one. If you have a reasonable objection, tell us, and if we can’t resolve it you may end the affected service.
5. Security incidents
If we become aware of a personal data breach affecting Customer Data, we’ll tell you without undue delay and within 48 hours, with what we know about what happened, what’s affected and what we’re doing about it.
6. International transfers
Where Customer Data leaves the EEA, the UK or Switzerland for a country without an adequacy decision, the European Commission’s Standard Contractual Clauses apply (Module Two where you’re a controller, Module Three where you’re a processor), with the UK Addendum for UK data. These terms and this addendum supply the details those clauses need. Customer Data is hosted by Render Services, Inc. in United States.
7. Security measures
- Connections use HTTPS, with strict security headers on every page.
- Each request is checked against the signed-in account, so accounts can’t reach each other’s data.
- Passwords are stored as salted scrypt hashes, and login sessions and remembered browsers as SHA-256 hashes.
- A new browser must confirm a code sent to the account’s email, and passkeys are available as a stronger way in.
- IP addresses are shortened before they’re stored.
- Login, signup, submissions and email sending are all rate limited.
- Data is backed up daily, and backups are kept for up to 14 days.
8. Returning and deleting data
You can export or delete Customer Data at any time. When you delete your account, your forms and leads are erased from our live data immediately and from backups within 14 days, unless the law requires us to keep something.
9. Audits
We’ll give you the information you reasonably need to show compliance with this addendum. If that isn’t enough, or a regulator requires it, you may audit us with reasonable notice, during business hours, and no more than once a year unless there’s been an incident.
10. Order of precedence
If this addendum conflicts with the Terms of Service, this addendum applies to Customer Data.