Data Processing Agreement (DPA)

Version 1.0 — Last updated at August 4th, 2026

---

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Masas Technologies, LLC, a company registered in Delaware, USA ("Formly", the "Processor") and the customer accepting the Terms of Service ("Customer", the "Controller"), and reflects the parties' agreement with regard to the processing of personal data under Regulation (EU) 2016/679 ("GDPR").

By creating a Formly account and accepting the Terms of Service, the Customer enters into this DPA. If you require a countersigned copy for your records, email contact@formly.so and we will return a signed copy, normally within 3 business days.

1. Roles and Scope

1.1. The Customer acts as the Data Controller of the personal data contained in form responses collected through the Formly service ("Customer Data"). Formly acts as the Data Processor of Customer Data, processing it solely on behalf of and under the instructions of the Customer.

1.2. This DPA applies to all processing of Customer Data by Formly. It does not apply to personal data for which Formly acts as a controller (such as the Customer's own account and billing information), which is governed by our Privacy Policy.

2. Details of Processing

• Subject matter: Hosting, storage, and processing of form responses submitted to forms created by the Customer.
• Duration: For the term of the Customer's use of the service, until deletion of the data or the account in accordance with Section 8.
• Nature and purpose: Collection, storage, display, export, notification, and deletion of form responses as directed by the Customer through the service.
• Categories of data subjects: Individuals who submit responses to the Customer's forms ("respondents").
• Types of personal data: Determined by the Customer through the design of their forms. May include contact details, free-text responses, uploaded files, and signatures. Formly additionally stores technical metadata (such as IP address) only where the Customer enables features that require it (e.g., duplicate-response prevention).

3. Processor Obligations

Formly shall:

1. Process Customer Data only on documented instructions from the Customer, including with regard to international transfers, unless required to do so by applicable law (in which case Formly will inform the Customer before processing, unless prohibited by law);
2. Ensure that all persons authorized to process Customer Data are bound by confidentiality obligations;
3. Implement appropriate technical and organizational measures pursuant to Art. 32 GDPR, as described in Annex 2;
4. Respect the conditions in Sections 5 and 6 for engaging sub-processors;
5. Taking into account the nature of the processing, assist the Customer with appropriate technical and organizational measures in fulfilling the Customer's obligation to respond to data subject requests under Chapter III GDPR (the service's export and deletion functions allow the Customer to fulfill most such requests directly);
6. Assist the Customer in ensuring compliance with Arts. 32–36 GDPR (security, breach notification, data protection impact assessments), taking into account the nature of the processing and the information available to Formly;
7. At the Customer's choice, delete or return all Customer Data at the end of the provision of services, in accordance with Section 8;
8. Make available to the Customer all information necessary to demonstrate compliance with Art. 28 GDPR and allow for and contribute to audits conducted by the Customer or an auditor mandated by the Customer, subject to reasonable notice and confidentiality obligations.

4. Personal Data Breach

Formly shall notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, and shall provide the Customer with information reasonably required to fulfill the Customer's breach notification obligations under Arts. 33 and 34 GDPR.

5. Sub-processors

5.1. The Customer grants Formly general authorization to engage the sub-processors listed in Annex 1 for the processing of Customer Data.

5.2. Formly shall impose data protection obligations on each sub-processor by way of contract that are no less protective than those set out in this DPA, and remains fully liable to the Customer for the performance of each sub-processor's obligations.

5.3. Formly shall inform the Customer of any intended addition or replacement of sub-processors by updating Annex 1 and, for customers who request it at contact@formly.so, by email notice at least 14 days in advance. The Customer may object on reasonable data protection grounds; if the objection cannot be resolved, the Customer may terminate the service and delete their data.

6. International Transfers

6.1. Customer Data (form responses) is stored on infrastructure located in Germany (see Annex 1). Uploaded files and signatures are stored with Cloudflare, Inc. as set out in Annex 1.

6.2. Because Formly's contracting entity, Masas Technologies, LLC, is established in the United States, the parties agree that any transfer of Customer Data to Formly or to sub-processors in third countries is governed by the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 ("SCCs"), Module Two (controller to processor), which are hereby incorporated into this DPA by reference, with:

• the Customer as "data exporter" and Masas Technologies, LLC as "data importer";
• Clause 7 (docking clause) included; Clause 9(a) Option 2 (general authorization) with the notice period in Section 5.3; Clause 11(a) optional language not included; Clause 17 Option 1 with the law of the Republic of Ireland; Clause 18(b) with the courts of the Republic of Ireland;
• Annex I of the SCCs completed with the information in Section 2 and Annex 1 of this DPA, and Annex II of the SCCs completed with Annex 2 of this DPA.

6.3. In case of conflict between this DPA and the SCCs, the SCCs prevail.

7. Special Categories of Data (Art. 9 GDPR)

The service applies the same technical protections (encryption in transit and at rest, access controls) to all Customer Data regardless of content. The Customer is responsible for ensuring a valid legal basis under Art. 9(2) GDPR (typically explicit consent) before collecting special category data through their forms, and for designing forms so that no more special category data is collected than necessary.

8. Deletion and Return of Data

8.1. The Customer can export Customer Data (CSV/JSON) at any time through the service.

8.2. When the Customer deletes a form response, a form, a workspace, or their account, the corresponding Customer Data (including uploaded files and signatures) is permanently deleted from Formly's production systems immediately. Deletion is not reversible.

8.3. Any residual copies in operational backups, where they exist, expire and are deleted within at most 30 days of the deletion.

8.4. Records that Formly is legally required to retain as a controller (e.g., billing records for tax purposes) are governed by the Privacy Policy and do not include form response data.

9. Liability and Term

9.1. This DPA takes effect upon acceptance of the Terms of Service and remains in force as long as Formly processes Customer Data.

9.2. The liability provisions of the Terms of Service apply to this DPA, except where the SCCs provide otherwise.

---

Annex 1 — Sub-processors

Sub-processor	Purpose	Data processed	Location of processing
Hetzner Online GmbH (Germany)	Application and server hosting	All Customer Data (form structure and responses)	Germany
MongoDB, Inc. (MongoDB Atlas)	Managed database hosting	Form responses and metadata	Frankfurt, Germany (AWS eu-central-1)
Cloudflare, Inc. (USA)	Content delivery network, object storage for file uploads and signatures, bot protection	Uploaded files, signatures, request metadata	Global network; object storage currently located in North America
Resend (Plus Five Five, Inc., USA)	Transactional email	Response data contained in submission notification emails, where the Customer enables email notifications	USA
OpenAI, L.L.C. (USA)	AI-assisted form generation	Prompts provided by the Customer when using AI form creation; no respondent data	USA

Providers that process only Formly's own customer account data (not form responses) — Stripe, Inc. (billing), Crisp IM SARL (support chat, France), Google LLC (sign-in), Plausible Insights OÜ (cookieless website analytics, EU) — are listed in the Privacy Policy.

Annex 2 — Technical and Organizational Measures

• Encryption of data in transit (TLS/HTTPS) for all connections;
• Encryption of data at rest for databases and object storage;
• Logical separation of Customer Data by account and workspace;
• Access to production systems restricted to authorized personnel, protected by strong authentication;
• Hard deletion of Customer Data upon deletion actions (no soft-delete retention);
• Bot and abuse protection on public form endpoints;
• Continuous monitoring, and vendor due diligence for all sub-processors.

---

Questions about this DPA can be sent to contact@formly.so.