FormDoc
Sign in Create your form

Data processing agreement

Last updated: 29 October 2026

This agreement forms part of the terms of service between the customer (“you”, the data controller or data fiduciary) and Vage Digital Ventures (“FormDoc”, the data processor). It applies to personal data in form submissions that FormDoc processes for you.

1. Subject and duration

  • Subject: receiving, storing, filtering and delivering form submissions from your websites.
  • Duration: for as long as you use FormDoc, plus the deletion periods below.
  • Data subjects: people who fill in your forms.
  • Data: whatever fields your forms collect, plus request details (page address, user agent, country, daily-rotating IP hash).

2. Our obligations

FormDoc will:

  1. Process submission data only on your documented instructions (your form settings and integrations are instructions), unless the law requires otherwise.
  2. Make sure staff with access are bound by confidentiality.
  3. Keep appropriate security measures, including encryption in transit (TLS) and at rest (AES-256-GCM), hashed IP addresses, access control and audit logs.
  4. Use only the sub-processors listed in the privacy policy, under written terms with equivalent protection, and give 30 days’ notice of new ones so you can object.
  5. Help you answer data subject requests and with impact assessments, as far as reasonably possible.
  6. Tell you without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting your data.
  7. Delete submission data at the end of its history period, or return it through the export tools and then delete it when you close your account.
  8. Make available, on reasonable written request and no more than once a year, the information needed to show compliance with this agreement.

3. Your obligations

You confirm you have a lawful basis and give the notices needed to collect the data your forms collect, and that your forms don’t collect special categories of data unless the law allows it.

4. International transfers

Submissions are stored in Mumbai, India. Some sub-processors process data elsewhere (for example email delivery and Cloudflare’s edge network). Where GDPR applies, transfers rely on the European Commission’s Standard Contractual Clauses. Transfers out of India follow the rules made under the Digital Personal Data Protection Act, 2023.

5. Contact

Data protection questions: support@formdoc.dev.