Duration, processing and data categories
Processing lasts for service provision and the agreed return/deletion period. It includes receiving, organising, storing, displaying, exporting, transmitting as configured and erasing data. Data subjects include form respondents, customers and prospects, contact persons and conversation participants. Depending on the form, data includes names, email, phone, enquiries, additional fields, UTM and correspondence. Processing of special-category data or criminal-conviction data is not agreed here.
Parties and scope
These terms form the GDPR Article 28 data processing agreement: the customer is controller and the ZoraForms operator is processor. They cover respondent data and other personal data supplied in forms, solely to provide, secure and support the service under the customer’s documented instructions.
Instructions and confidentiality
The operator processes data only on the customer’s documented instructions, including access, export, deletion and retention. Persons authorised to access data are bound by confidentiality. Form content is not used for separate purposes of the operator. Legally required processing is notified unless law prohibits notice. Account and billing data are processed under the separate role described in the privacy notice.
Security
The operator applies risk-appropriate measures: encryption of CAPTCHA, SMTP and TOTP secrets, access controls, secure sessions, pseudonymisation of the daily abuse identifier and limited logging. Full IP addresses and CAPTCHA tokens are not retained in the database or logs.
Subprocessors
General authorisation covers Atman/OVH and providers enabled by the customer: SMTP, Turnstile/Google, Stripe, webhooks and AI where their role requires it. The infrastructure providers are Atman/OVH; the current configured services are listed in the privacy notice and account settings. The operator gives 30 days’ notice of a proposed new subprocessor; the customer may raise a reasoned objection. The parties try to resolve it, and if unresolved the customer may terminate the affected service under the agreement; objection is not automatic consent.
Assistance and breaches
Taking the nature of processing and available information into account, the operator assists with data-subject requests, security, impact assessments and consultations. The operator notifies the customer without undue delay after becoming aware of a personal data breach concerning the customer’s data and shares available information. The 72-hour period concerns the controller’s notification duty to the authority where applicable; it is not an unconditional promise for processor notice.
Audit
The operator provides information needed to demonstrate compliance and permits audits proportionate to risk, generally once a year and additionally after a justified incident or where required by law, subject to confidentiality and other customers’ security.
Return and deletion
At the end of the service, following the customer’s instruction, the operator returns or deletes data within 30 days unless law requires continued retention. Earlier versions in backups expire no later than 30 days after deletion from the active database; restoring a backup does not return erased data to routine use.
Customer responsibilities
The customer is responsible for its legal basis, form content, notices to respondents, retention instructions and integration configuration, and for avoiding special-category data, card data and passwords in forms unless it has an appropriate legal basis and safeguards.