Data Processing Agreement

Roles

Words such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning the GDPR gives them. "Customer personal data" means the personal data in your forms, responses, uploaded files and answers in progress that we process for you.

For customer personal data you are the controller and we are your processor. If you act for your own client, you are their processor and we are your subprocessor. For your account, billing and the use of fillio.so, we are the controller, as our Privacy Policy explains.

Details of the processing

• Subject matter: hosting your forms, collecting and storing their responses and files, and showing, sending and exporting them for you.
• Duration: for as long as you use the Service, until the data is deleted as described below.
• Nature and purpose: storing, organising, showing, sending, exporting and deleting customer personal data, only to provide the Service to you.
• Data subjects: the people who open or fill in your forms, the people named in their answers, and the teammates you invite.
• Types of personal data: whatever your forms ask for, such as names, email addresses, phone numbers, answers and uploaded files; when a response was sent, the page it came from and campaign tags; a confirmed email address if your form asks for one; and the pages reached in a form and, while your plan includes partial responses, unsent answers.
• Sensitive data: only if your form asks for it. You decide whether to collect it and you are responsible for having a lawful basis for it.

Your instructions

We process customer personal data only on your documented instructions. These terms, this DPA and the actions you take in the Service, such as publishing a form, setting a retention period, connecting a webhook, exporting or deleting responses, are your instructions. We tell you if we believe an instruction breaks data protection law.

If the law requires us to process customer personal data in another way, we tell you before we do, unless the law forbids it.

Your responsibilities

You are responsible for having a legal basis for the data you collect, for telling the people who fill in your forms how you use their answers, and for making sure your instructions follow the law. You are also responsible for the services you connect to your forms, such as webhooks or tracking pixels, and for the data you send to them.

Confidentiality

Everyone we allow to process customer personal data is bound to keep it confidential. We access it only when needed to provide the Service, to answer your support requests, to review a report or to meet a legal obligation.

We don't sell customer personal data, we don't use it for advertising or for our own purposes, and we don't use it to train AI models.

Security measures

We protect customer personal data with these measures:

• Fillio is served only over HTTPS, and our hosting provider encrypts the database and stored files.
• Access rules on the database and file storage let only a form's owner and the teammates they invite read its responses.
• Form passwords, claim links and sign-in codes are kept in records that only our servers can read. Sign-in and verification codes are stored only as hashes and expire after 10 minutes.
• The folder of a form's uploaded files can't be listed, so knowing a form never reveals the files sent to it. A single file can be opened by anyone who has its link.
• File uploads accept only certain file types, up to the size the form owner's plan allows.
• Rate limits and spam checks protect forms and sign-in from abuse.
• Our analytics don't see the content of forms or what respondents type.

We may change these measures over time, but never in a way that lowers the overall protection of customer personal data.

Subprocessors

You authorise us to use the subprocessors listed below. Each one is bound by data protection terms that protect customer personal data at least as well as this DPA requires, and we remain responsible to you for them as the law requires.

Before we add a new category of subprocessor or move customer personal data to a new region, we update the list below and tell account holders by email or in the app, so you have time to object. If you object on reasonable data protection grounds and we can't resolve your concern, you can end the agreement by deleting your account, and we refund the unused part of any fee you paid in advance.

Current subprocessors

• Cloud hosting and database provider: hosting, database, file storage and sign-in. All customer personal data. United States.
• Email delivery provider: response notification emails and email verification codes, with the answers of a response and email addresses. United States.
• Session recording tool: interaction data such as clicks and scrolling on form pages, with the form's content and what respondents type hidden. United States.
• Analytics provider: usage data on form pages, such as pages viewed, device type and approximate country. United States.
• Location lookup service: finding a respondent's country from their IP address, for the phone number field. United States.
• AI model providers: only when you use the AI form builder, with your description and a form's questions and options, never responses. They don't store or train on this data. United States.

Paddle isn't a subprocessor. It handles your payments as the merchant of record and receives no responses. Services that you connect to a form, and content from other sites that you show inside a form, are your own choice and not our subprocessors. You can ask us for the current list of providers in each category at support@fillio.so.

International transfers

Customer personal data is stored with our cloud hosting provider in the United States, and our subprocessors process it in the United States.

Where the GDPR applies to you and a transfer of customer personal data to us or to our subprocessors needs a safeguard, the standard contractual clauses adopted by the European Commission in Decision (EU) 2021/914 apply between you and us and form part of this DPA: Module Two when you are a controller, and Module Three when you are a processor. In those clauses, the optional clause 7 doesn't apply, clause 9 option 2 applies with the notice described above, the optional wording in clause 11 doesn't apply, and clauses 17 and 18 choose the law and courts of Ireland. The sections of this DPA give the information of Annexes I, II and III, and the competent supervisory authority is the one set by clause 13.

For data protected by the UK GDPR, the International Data Transfer Addendum issued by the UK Information Commissioner applies together with those clauses. For data protected by Swiss law, the clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner is the competent authority.

When our subprocessors transfer data, they rely on the standard contractual clauses or on an adequacy decision such as the EU-US Data Privacy Framework.

Requests from data subjects

You can find, export and delete responses in Fillio yourself, which covers most requests from the people who fill in your forms. If someone asks us directly about their data in your form, we tell them to contact you, and we don't answer the request ourselves unless the law requires it. When you need more help to answer a request, write to us and we will help as far as we reasonably can.

Help with your obligations

Taking into account the nature of the processing and the information we have, we give you reasonable help with your security obligations, data protection impact assessments and consultations with a supervisory authority that concern the Service.

Personal data breaches

If we become aware of a personal data breach that affects customer personal data, we tell you without undue delay by email to the address of your account. We describe what happened, the data and people likely affected, the likely consequences and the steps we are taking, and we add details as we learn more. We take reasonable steps to contain the breach and limit its effects. Telling you about a breach doesn't mean we admit fault.

You are responsible for telling supervisory authorities and the people affected where the law requires it, and we help you with the information we have.

Deletion

Customer personal data is deleted when you delete it: a single response, a form with its responses, files and records, or your whole account. On the Business plan, you can also have responses delete themselves after a set time. Answers in progress and visit statistics are deleted after 91 days.

Export what you want to keep before you delete it. After deletion, our providers may keep the data in their systems for a limited time before it is fully erased. We keep data longer only where the law requires it.

Information and audits

We give you the information you reasonably need to show that this DPA is being followed, through this page, the subprocessor list and written answers to your questions. Our hosting provider publishes the certifications and audit reports of the infrastructure Fillio runs on.

If that information isn't enough, or a supervisory authority requires it, you can audit our compliance with this DPA, at most once a year unless a supervisory authority requires more. Give us at least 30 days' notice, use an auditor bound by confidentiality, and pay the costs of the audit. An audit can't give access to other customers' data.

Liability

The limits of liability in the terms apply to this DPA, to the extent the law allows. They don't limit the rights the law gives the people your data is about.

Duration and changes

This DPA applies for as long as we process customer personal data for you. We may update it, for example when our subprocessors change. The date at the top shows when it last changed. If a change is significant, we tell account holders by email or in the app before it takes effect.

Contact

Questions about this DPA or about customer personal data: support@fillio.so.