Data Processing Agreement (DPA)

Last updated: 06th July 2025

1. Introduction

This Data Processing Agreement ("DPA") is part of the Terms of Service ("Principal Agreement") between Ikiform ("Processor", "we", "us", or "our") and you ("Controller", "Customer", "you").

This DPA sets out the terms for the processing of Personal Data in accordance with applicable Data Protection Laws, including the General Data Protection Regulation (EU) 2016/679 ("GDPR").

2. Definitions

  • Personal Data: Any information relating to an identified or identifiable natural person.
  • Processing: Any operation performed on Personal Data, such as collection, storage, use, transfer, or deletion.
  • Data Controller: The entity that determines the purposes and means of Processing Personal Data.
  • Data Processor: The entity that processes Personal Data on behalf of the Data Controller.
  • Subprocessor: Any third party appointed by the Processor to assist with Processing activities.

3. Scope and Roles

You, as the Customer, are the Data Controller of any Personal Data collected through forms created on Ikiform. Ikiform acts as the Data Processor, processing Personal Data on your behalf.

4. Processing of Personal Data

  • We process Personal Data only on your documented instructions, unless required by law to act otherwise.
  • Persons authorized to process Personal Data are bound by confidentiality obligations.
  • We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.
  • We assist you, as far as possible, in fulfilling your obligations to respond to Data Subject requests.
  • We provide reasonable assistance in ensuring compliance with security, breach notifications, data protection impact assessments, and consultations with supervisory authorities.
  • Upon termination of services, at your choice, we will delete or return all Personal Data, unless otherwise required by law.

5. Subprocessors

Ikiform may engage Subprocessors to process Personal Data on your behalf. A current list of Subprocessors is available in our GDPR Policy.

We will notify Customers of any changes to Subprocessors as required by applicable Data Protection Laws.

6. International Data Transfers

When transferring Personal Data outside the European Economic Area (EEA), Ikiform ensures such transfers comply with applicable Data Protection Laws. We rely on appropriate safeguards, such as Standard Contractual Clauses (SCCs), for such transfers.

7. Data Subject Rights

We assist you, to the extent reasonably possible, in fulfilling your obligations to respond to requests by Data Subjects to exercise their rights under the GDPR, including rights of access, rectification, erasure, and portability of their Personal Data.

8. Security Measures

Ikiform implements and maintains appropriate technical and organizational security measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Details about our security practices are available upon request.

9. Personal Data Breach

In the event of a Personal Data breach affecting your Personal Data, Ikiform will notify you without undue delay and provide all necessary information to enable you to comply with your breach notification obligations under GDPR.

10. Termination

Upon termination of the Principal Agreement, you may request deletion of your Personal Data processed by Ikiform. We will comply with such a request within a reasonable time unless otherwise required to retain the data under applicable law.

11. Governing Law

This DPA is governed by and construed in accordance with the laws of India.

By using Ikiform, you agree to this Data Processing Agreement.