Data Processing Addendum

Last updated: September 29, 2026

This Data Processing Addendum (the "DPA", also called a data processing agreement) sets out how Upform processes the personal data you collect through your forms. It follows Article 28 of the EU General Data Protection Regulation (GDPR). Where the UK GDPR applies, references to the GDPR mean its UK equivalent.

This DPA forms part of our Terms of Service and applies to every account, Free and Pro. If it conflicts with the Terms on anything to do with personal data, this DPA wins. Where Standard Contractual Clauses apply, they win over both.

Who this addendum is between

• You, the customer: the person or organization that holds the Upform account. If you use Upform for an employer or a client, "you" means that organization.
• Upform ("we", "us"): INKYY Bojan Sandić s.p. Laktaši, Kozarska ulica 12, 78250 Laktaši, Bosnia and Herzegovina.

Data we handle for our own purposes, such as your sign-in details, your plan or your messages to us, is not covered: for that data we are the controller, and our Privacy Policy applies.

Who decides and who processes

For the personal data your forms collect, you are the controller and Upform is the processor. You decide what to ask, why, who on your team sees the answers, which integrations receive them and how long they are kept.

You are responsible for the lawfulness of what you collect and of your instructions to us, including a lawful basis for each question, consent where you rely on it, and a privacy notice that names the tools you send answers to. The guide to GDPR compliant forms covers the practical side. This page is not legal advice.

What the processing covers

The details Article 28(3) requires:

Whose data it is

• Respondents: anyone who opens or fills in one of your forms, and anyone whose details a respondent enters.
• Team members: people you invite to your workspace on Pro (up to 5). Their own account details are covered by our Privacy Policy.

What kinds of data

• Answers: whatever your questions ask for, such as names, email addresses, phone numbers, addresses, dates, ratings, choices and free text, plus when each response arrived and whether it was completed.
• Uploaded files: documents and images sent through a File Upload question, stored in a storage bucket scoped to the form.
• Analytics events: views, starts, submissions and completion time, with device type, browser, operating system and approximate country, linked to a random visitor ID (upform_visitor_id) kept in the respondent's browser.
• Spam checks: technical data, such as IP address and browser and device information, that Google collects through invisible reCAPTCHA v3 to score a submission.
• Workspace data: team members' email addresses, permissions and invitation status.

Sensitive data

We do not offer a HIPAA business associate agreement, so do not use Upform to collect protected health information. Collect special category data only if you have a lawful basis and judge the measures in this DPA adequate for it.

How we act on your instructions

• We process the personal data only on your documented instructions: the Terms, this DPA and the choices you make in the app, such as the forms you publish and the integrations you connect. That includes international transfers, which happen only as described below.
• If we believe an instruction breaks data protection law, we will tell you promptly.
• If a law requires us to process the data in another way, we will tell you first, unless that law forbids it.
• We do not sell the data, use it for advertising, or use it for purposes of our own.

Who at Upform can see your data

Access is limited to the people who need it to run, secure and support the service, and all of them are bound by confidentiality. We look at your forms or responses only when you ask us to, when security or a suspected breach of the Terms requires it, or when the law does.

How we keep the data secure

We apply technical and organizational measures appropriate to the risk, as Article 32 requires. They are described in full on our security page and include:

• row-level security on every public table, with roles kept in a separate table and checked through a security-definer function;
• uploaded files stored in a bucket scoped to the form that collected them;
• the app and published forms served over HTTPS;
• sign-in by email and password or with Google, with password reset by email;
• invisible reCAPTCHA v3 on public submissions, verified on the server;
• forms that stay private until you publish them.

We do not hold a SOC 2 report or an ISO 27001 certificate. We review these measures and will not lower the overall protection they give.

How we help you meet your obligations

As controller, you answer respondents who ask to access, correct or delete their data. The app gives you a searchable responses table with CSV export, a contacts directory built from submitted answers, and deletion of single responses or many at once. To have an uploaded file removed, or for anything else the app does not cover, email hello@upform.com. If a respondent contacts us about your form, we will refer them to you and let you know.

Based on the information available to us, we will also give you reasonable help with security, breach notification, data protection impact assessments and prior consultation with a supervisory authority (Articles 32 to 36).

Which sub-processors we use

You give us general authorization to use the sub-processors below. We impose on each of them data protection obligations that meet Article 28(4), and we remain responsible to you for their performance.

Integrations you connect are not sub-processors

When you connect an integration such as Google Sheets, Slack, HubSpot or Notion, you sign in with your own account for that service. A custom webhook or n8n workflow receives answers at the URL you enter. These providers act under your own agreements with them: they are your choices, not our sub-processors. Google Analytics receives no response data, and Google Forms is an import into Upform only.

How we tell you about new sub-processors

Before a new or replacement sub-processor starts handling your data, we will update this page and email the owner of every account. You can object on reasonable data protection grounds by writing to hello@upform.com, and we will work with you in good faith to resolve it. If we cannot, you may close your account, and we will delete your data as described below.

How international transfers are protected

Your data is stored in [Data hosting region], and you cannot choose another region today.

When personal data from the European Economic Area or the UK goes to a country without an adequacy decision, we cover the transfer with the European Commission's Standard Contractual Clauses (SCCs) or, for UK data, the UK International Data Transfer Addendum, with supplementary measures where needed. Where the SCCs are needed between you and us, they are incorporated by reference: Module Two (controller to processor) applies, this page completes their annexes, and their general authorization option for sub-processors applies with the notice process above. We require equivalent safeguards from any sub-processor that transfers the data.

What happens if there is a data breach

If we become aware of a personal data breach affecting your data, we will notify you without undue delay after becoming aware of it, by email to the account owner, and take reasonable steps to contain it. As far as we know at the time, the notice will say what happened, the categories and approximate number of people and records affected, the likely consequences, the steps we have taken or plan to take, and who to contact.

If we do not have every detail yet, we will send what we have and follow up. You decide whether to notify a supervisory authority or the people affected, and we will share what we know to help you do so. Notifying you is not an admission of fault.

How you can check our compliance

We will give you the information you reasonably need to show that we meet our Article 28 obligations: written answers to your security and privacy questions and a current description of our measures and sub-processors. We hold no third-party certification, so there is no audit report to send.

If that is not enough, or a supervisory authority requires it, we will agree in advance on the scope, timing and confidentiality of an audit by you or an independent auditor. Audits are at your cost, on reasonable notice, at most once a year unless a breach or a regulator requires more, and never with access to other customers' data.

What happens to the data when you leave

You can delete forms and responses at any time. Before you leave, export your responses as CSV and download any uploaded files you want to keep: that is how your data is returned to you. To close your account, email hello@upform.com from the address on the account.

We then delete the personal data we process for you, including uploaded files, within a reasonable period, unless a law requires us to keep it. Copies in backups stay covered by this DPA until they are overwritten in the normal course. Data already sent to your integrations stays in those services. Ask us and we will confirm when deletion is complete.

Liability and governing law

Each party's liability under this DPA is subject to the limits in the Terms, except where the law does not allow liability to be limited. This DPA is governed by the laws of Bosnia and Herzegovina, unless the Standard Contractual Clauses require a different law for a particular transfer.

Changes to this addendum

We may update this DPA as the service or the law changes, and we will email account owners before any change that lowers the protection it gives your data.

How to sign or get a countersigned copy

You do not need to sign anything: this DPA takes effect when you accept the Terms and lasts as long as we process personal data for you.

If you need a signed copy, email hello@upform.com with your organization's legal name and registered address, the name and role of the person signing, and the email address of your Upform account. We will send back a copy countersigned by Upform.