Data Processing Agreement

• You are the controller of the personal data your forms collect. If you run forms for your own clients, you may be their processor instead, and Ikiform is then your sub-processor.
• Ikiform is your processor. For your own account, billing and sign-in data, Ikiform is a separate controller, as the Privacy Policy explains.
• You're responsible for having a lawful basis for what your forms collect and for telling the people who fill them in, including that you use Ikiform.

• We process the data only on your documented instructions. Those are the Terms, this agreement, your settings and what you do in the dashboard or through the API.
• If the law makes us process it in some other way, we'll tell you first, unless that law forbids it.
• We'll tell you if we think an instruction breaks data protection law.
• We don't sell the data, use it for advertising, or use it to train AI models.

Today only Preet Suthar can access Ikiform's production systems. Anyone who is given access later will be bound to keep the data confidential, and will only see it when that's needed to run the service, fix a problem you've asked about, stop abuse or meet a legal duty.

We keep the data safe with measures that fit the risk. Today they include:

• Ikiform is served over HTTPS, and only sends webhooks to HTTPS addresses.
• Data is stored in Cloudflare's D1 database, which Cloudflare encrypts at rest.
• Every submission is scoped to its workspace. Only that workspace's members and API keys can read it, and members have owner, admin or member roles.
• API keys are stored only as hashes and can be limited to certain scopes or domains.
• Every webhook is signed with HMAC-SHA256. Signing secrets and Turnstile secrets are encrypted with AES-256-GCM under a separate key-encryption key, which can be rotated.
• IP addresses from form posts are hashed with a secret key before they're stored.
• Spam checks, rate limits and optional Cloudflare Turnstile protect forms, and webhook addresses are checked so they can't reach private networks.
• Data is kept only as long as needed: spam for 30 days, held submissions for 30 days, webhook attempt logs for 30 days, webhook delivery records for 90 days, and notification email records for 90 days.

We may change these measures, but never in a way that makes the data less safe.

You allow us to use the sub-processors on our sub-processor list. Today, Cloudflare is the only one that handles your form submissions.

• Before we add or replace a sub-processor that handles your data, we'll update the list and email workspace owners at least 30 days ahead.
• You can object, on reasonable data protection grounds, by emailing us within those 30 days. We'll try to find a fix. If we can't, you can stop using Ikiform and cancel your plan before the change.
• Each sub-processor is bound by data protection terms at least as protective as this agreement. We stay responsible to you for their work.

• You can find, export and delete submissions yourself, in the dashboard or through the API, so you can answer requests from people to see, correct, move or delete their data.
• If someone asks us directly about data in your forms, we'll pass the request to you and won't answer it ourselves, unless the law requires it.
• Where you need it, we'll help with data protection impact assessments and with consulting a data protection authority, using the information we have.

If we become aware of a breach affecting your data, we'll tell workspace owners without undue delay, aiming for within 48 hours. We'll say what happened, what data and roughly how many people it affects, the likely consequences and what we're doing about it, and send more as we learn it. This gives you time to meet your own deadline, such as the 72 hours the GDPR gives you to tell your authority.

• You can export your submissions as CSV or through the API at any time while you have an account.
• When you delete a submission, form or workspace, the data is deleted as the Privacy Policy describes, within 24 hours.
• When the agreement ends, we delete the remaining data within 30 days, unless the law makes us keep it.
• Deleted data can stay in Cloudflare's database recovery history for up to 30 days. It isn't used from there except to recover from a failure, and is gone after that.

On reasonable request, we'll give you the information you need to check that we meet this agreement, such as answers to a security questionnaire and our sub-processors' own reports, like Cloudflare's certifications.

If that isn't enough, you or an independent auditor bound by confidentiality can audit us, with 30 days' notice, once a year at most, at your own cost. More often is fine after a breach or when a data protection authority asks.

Ikiform is run from India, outside the EU, the UK and Switzerland. Your data is hosted by Cloudflare on its global network, with the database in Asia-Pacific.

• Where the EU GDPR applies to data you send us, this agreement includes the EU Standard Contractual Clauses (Commission Decision 2021/914): Module 2 if you're a controller, Module 3 if you're a processor. You are the data exporter and Ikiform is the data importer. The optional clause 7 doesn't apply. Under clause 9 option 2, sub-processors are authorised in general, with the notice above. Under clause 11, the optional wording doesn't apply. Under clauses 17 and 18, the law and courts of Ireland apply. Annex I is the Details of the processing above, Annex II is Security above, and Annex III is our sub-processor list.
• Where the UK GDPR applies, the UK Addendum to those clauses, issued by the Information Commissioner, applies as well.
• Where Swiss law applies, the same clauses apply with references to the GDPR read as the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as the authority.
• Our sub-processors move data under their own safeguards, including the Standard Contractual Clauses in Cloudflare's data processing terms.

The limits on liability in the Terms apply to this agreement too, as far as data protection law allows. We may update this agreement. We'll change the date at the top and email account owners before a significant change takes effect. We won't make it less protective of your data.

Questions about this agreement go to hello@ikiform.com.