Data Processing Agreement (DPA)

Version 1.2 · Effective: December 1, 2026 (for new registrations from the date of publication)

The Czech version is the controlling version. This English translation is for convenience.

Parties

Controller: the Customer of the SimplyForms Service — the natural or legal person registered in the Service dashboard (the "Controller" or "Customer").

Processor: Adam Todt, IČO 19197438, DIČ CZ8909294592, registered office Drahy 1625, 696 42 Vracov, Czech Republic (the "Processor").

Contact: privacy@simplyforms.app.

Preamble

This Data Processing Agreement (the "DPA") is entered into under Art. 28 of Regulation (EU) 2016/679 (GDPR) and forms an integral part of the agreement on the provision of the SimplyForms service (the Terms of Service, the "Main Agreement").

The DPA is entered into automatically upon registration of the Customer's Account by ticking the separate consent "I accept the Data Processing Agreement (DPA)". The acceptance record (timestamp, IP address, user agent, DPA version) is maintained by the Processor as evidence of its conclusion.

1. Subject matter of the processing

The Processor processes the personal data contained in the form submissions (Submissions) received via the API of the SimplyForms Service on the Controller's instruction and relays them by email to the Controller's inbox.

2. Duration of the processing

For the term of the Main Agreement.

3. Nature and purpose of the processing

Nature: acceptance of the HTTP request containing the form data, validation (rate limit, CAPTCHA, plan limits), transmission by email to the Controller's inbox, discarding of the payload from working memory.

Purpose: performance of the Processor's obligation to relay the Controller's form submissions to its email inbox.

Stateless model: the Processor does not store the content of Submissions in any database or application log. Once the message has been handed over to the outbound SMTP server, the payload is removed from working memory; in the SMTP server queue the message is temporarily stored solely until delivery, for no longer than 5 days. The Submitter's IP address is processed for a short time for rate limiting (for no longer than 60 seconds) and in the operational logs (for no longer than 30 days).

4. Categories of data subjects

Visitors to the Controller's websites who complete and submit a form connected to the SimplyForms Service (the "Submitters").

5. Categories of personal data processed

This depends on the content of the Controller's form. Typically:

• name, email address, telephone number,
• address, company registration number,
• message / text content,
• uploaded files.

Optionally (if the Controller activates opt-in metadata in the dashboard):

• the Submitter's IP address,
• user agent,
• referrer.

The Controller undertakes NOT TO SEND through the Service any special categories of personal data under Art. 9 GDPR (health, racial/ethnic origin, political opinions, religious beliefs, sexual orientation, biometrics, genetic data) or criminal-offence data under Art. 10 GDPR — without its own explicit consent from the Submitter and a completed DPIA.

6. Processor obligations (Art. 28(3) GDPR)

The Processor undertakes to:

6.1 Process personal data only on documented instructions from the Controller

The Controller's instructions are given by the Account configuration in the dashboard (choice of CAPTCHA, webhook, autoresponder, email template, etc.) and by active API requests. The Processor may process personal data without the Controller's instruction only:

• to the extent necessary to comply with legal obligations,
• for the security of the Service (rate limit, anti-abuse),
• for the purpose of informing the Controller of relevant matters.

The Processor will immediately inform the Controller if, in its opinion, a particular instruction infringes the GDPR or other Union or Member State data protection provisions (Art. 28(3) GDPR, final subparagraph); pending clarification it may suspend execution of the instruction.

6.2 Maintain confidentiality

The Processor ensures that persons who have access to the personal data are bound by a confidentiality undertaking or by a statutory obligation of confidentiality.

6.3 Security measures (Art. 32 GDPR)

The Processor implements technical and organizational measures appropriate to the level of risk:

• TLS 1.3 for all communication,
• API keys stored as a SHA-256 hash,
• passwords stored as a bcrypt hash,
• JWT with a short validity + refresh token rotation,
• the principle of least privilege,
• stateless relay — no storage of Submission content,
• regular code reviews,
• hosting in an ISO 27001 certified data centre.

6.4 Sub-processors (Art. 28(2) and (4) GDPR)

The Processor is entitled to use the sub-processors set out in the current list at simplyforms.app/en/legal/sub-processors. The Controller hereby gives its general prior authorisation for the use of those sub-processors.

The Processor will inform the Controller of any intended change of sub-processors (addition of a new one or replacement) by email to the Account address at least 30 days in advance. Within that period the Controller has the right to:

• raise a written objection delivered to privacy@simplyforms.app,
• and, if no agreement is reached, terminate the Main Agreement as of the effective date of the change, with a proportionate refund of prepaid Fees.

Current sub-processors (as at the effective date of this DPA): see Annex 1.

6.5 Assist the Controller in giving effect to data-subject rights (Art. 28(3)(e) GDPR)

The Processor will, upon request, assist the Controller in handling data-subject requests (access, rectification, erasure, restriction, portability, objection) to the extent within the Processor's capabilities having regard to the nature of the processing (stateless model — the Processor does not store the content of Submissions, so assistance concerns primarily metadata and configuration). Assistance going beyond the functions available in the dashboard (export, deletion) may be charged by the Processor at a rate of CZK 1,500 per commenced hour, subject to the Controller's prior approval of the scope.

6.6 Assist with the security of processing, breach notification and DPIAs (Art. 28(3)(f) GDPR)

The Processor assists the Controller in complying with its obligations under Art. 32–36 GDPR.

6.7 Notification of a personal data breach (Art. 33(2) GDPR)

The Processor will notify the Controller without undue delay (as a rule within 72 hours of confirmation of the incident) of any breach of the security of personal data processed for the Controller. The notification includes:

• a description of the nature of the breach,
• the categories and approximate number of data subjects and records concerned,
• the likely consequences,
• the measures taken or proposed.

6.8 Records of processing activities (Art. 30(2) GDPR)

The Processor maintains internal records of all categories of processing activities carried out on behalf of the Controller.

6.9 Audit (Art. 28(3)(h) GDPR)

The Processor allows the Controller and an independent third-party auditor to carry out audits aimed at the compliance of the processing with this DPA:

• the audit must be announced at least 30 days in advance,
• the audit may be carried out no more than once a year (except where there is a genuine suspicion of a breach),
• the audit must not disrupt the Processor's normal operations or those of other Controllers,
• the auditor is bound by confidentiality (NDA),
• the Controller bears the costs of the audit,
• as an alternative the Processor may submit third-party certifications (ISO 27001 of Hetzner hosting, SOC 2 reports of sub-processors where available) that cover the scope of the audit.

6.10 Erasure or return of data after the end of the processing

Upon termination of the Main Agreement the Processor will delete or return to the Controller all personal data processed on the Controller's behalf, unless legislation requires retention. Specifically:

• Submissions: not retained (stateless model), no erasure is required,
• Configuration data and anonymous metrics (Account, email templates, webhook configuration): the Controller exports them before deleting the Account (GET /user/{form_id}/export); upon deletion of the Account they are deleted immediately, and copies in encrypted backups are overwritten within 30 days at the latest,
• Accounting documents and the record of acceptance of the DPA: retained for the statutory period (10 years under Section 31 of Act No. 563/1991 Coll.; 4 years being the limitation period) — an exception from erasure.

7. Controller obligations

The Controller undertakes to:

7.1 Have a lawful basis

Have its own valid lawful basis under Art. 6 GDPR (and, where applicable, Art. 9) for every form field whose data it has processed by the Processor.

7.2 Information duty towards Submitters (Art. 13 GDPR)

Publish its own privacy policy on its website and inform Submitters:

• of its identity as the controller,
• of the fact that the data is transferred to SimplyForms / Adam Todt, IČO 19197438 as processor,
• of all active optional features (webhook metadata, autoresponder, reCAPTCHA, Cloudflare Turnstile) and the related data flows.

7.3 Prohibition of special categories

Not send through the Service any special categories of data under Art. 9 GDPR or criminal-offence data under Art. 10 GDPR without its own explicit consent from the Submitter and a completed DPIA.

7.4 API key security

Safeguard the API key as confidential; not place it in public repositories or in client-side JavaScript.

7.5 Cooperation on erasure / access

Handle its own Submitters' requests to exercise their rights (access, erasure, etc.) within the statutory time limits; make use of the Processor's assistance under clause 6.5 of this DPA.

7.6 Children

Where it targets persons under 16 through the Service, ensure legal-guardian consent under Art. 8 GDPR.

8. International transfers

The Processor's sub-processors listed in Annex 1 are all in the EU, and no transfer to third countries of the personal data of Data Subjects processed under this DPA takes place.

The seller of paid plans (Paddle) is not a sub-processor under this DPA — see the note in Annex 1. Paddle processes no Data Subject (form Submitter) data, only the Controller's own billing data, in respect of which the Processor is itself a controller and Paddle an independent controller; that processing is governed by the Privacy Policy (/en/legal/privacy), not by this DPA.

If the Controller is itself established outside the EU/EEA, the Processor's transfer of data to the Controller is covered by SCCs 2021/914 Module 4 (processor-to-controller), which hereby become an integral part of this DPA.

9. Liability and limitation

9.1 The parties are liable for a breach of this DPA in accordance with Art. 82 GDPR and the general provisions of Czech law.

9.2 The limitation of the Processor's liability under the DPA is governed by Article 12 of the Main Agreement (the SimplyForms Terms of Service). The Processor's aggregate liability to a Controller that is a Business Customer under the DPA shall not exceed an amount equal to the Fees for the 6 months preceding the event; for the FREE plan, CZK 1,000. Liability under the DPA and under the Main Agreement counts jointly towards that cap.

9.3 The limitations in clause 9.2 do not apply to damage caused intentionally or by gross negligence (Section 2898 of the Czech Civil Code), nor to the extent they would conflict with the mandatory provisions of Art. 82 GDPR.

9.4 Indemnification. If a claim is asserted against the Processor by a regulator or a data subject as a result of a breach of the Controller's obligations (in particular Article 7 of this DPA), the Controller will compensate the Processor for the related harm in accordance with Article 14 of the Main Agreement.

10. Term and termination of the DPA

10.1 The DPA runs for the term of the Main Agreement.

10.2 The DPA may be terminated only together with the Main Agreement.

10.3 Provisions surviving termination: clause 6.10 (erasure/return), Article 8 (international transfers in respect of data not yet transferred), Article 9 (liability).

11. Final provisions

11.1 Governing law: Czech law (in particular the GDPR, Act No. 110/2019 Coll., the Civil Code).

11.2 Jurisdiction: as per the Main Agreement.

11.3 Amendment of the DPA: the Processor is entitled to amend the DPA unilaterally in accordance with Article 3 of the Main Agreement. Material changes will be notified to the Controller by email at least 30 days in advance; disagreement entitles the Controller to terminate the Main Agreement free of charge.

11.4 Severability: the invalidity of an individual provision does not affect the validity of the remainder; an invalid provision will be replaced by one which in its meaning and purpose best corresponds to the original intention.

11.5 Incorporation: the DPA is an integral part of the Main Agreement; in the event of a conflict between the DPA and the Main Agreement on data-protection matters, the DPA prevails.

11.6 Versioning: the record of the accepted DPA version is maintained with the Controller's Account and forms part of the Account export. The Processor will provide previous versions on request at privacy@simplyforms.app.

Annex 1 — Current list of sub-processors

The SMTP relay and CI/CD run on servers leased by the Processor from Hetzner and administered exclusively by him — with no third-party email provider and no third-party CI operator.

Note — Paddle. Paid plans are sold by Paddle.com Market Ltd (30 Old Bailey, London EC4M 7AU, United Kingdom) as the seller (merchant of record). Paddle is not a sub-processor under this DPA: it processes no Data Subject (Submitter) data passed to the Processor by the Controller, but only the Controller's own billing data, and it does so as an independent controller deciding on the purposes and means of its own processing. It is listed here for completeness and transparency. Details: /en/legal/privacy Articles 5 and 6, and paddle.com/legal/privacy.

Updated list: simplyforms.app/en/legal/sub-processors (we notify changes by email to the Account address).

Annex 2 — Standard Contractual Clauses (SCCs)

If the Controller is established outside the EU/EEA, the Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914, Module 4 (processor-to-controller), are hereby incorporated into this DPA and form an integral part of it.

Should any sub-processor be established outside the EU/EEA, Module 3 (processor-to-processor) of the SCCs applies to it and is concluded by the Processor with that sub-processor.

To the extent this DPA and the SCCs would lay down different rules, the SCCs prevail.

Version 1.2 · Effective: December 1, 2026

Document hash (SHA-256): 3a797f10e1a6bb34347ce633e7643dbf7bf48895bb91b2467accacf735b5d42c