Data Processing Addendum

Roles

You are the controller of form submissions and account data you send to splitforms. splitforms acts as your processor for that data and processes it only to provide, secure, support, and improve the service.

Processing Details

The subject matter is hosted form submission handling. The duration is the term of your account plus any retention period needed for backups, deletion workflows, legal obligations, or abuse prevention.

Personal data may include names, email addresses, IP addresses, user agents, submitted form fields, file-upload metadata, webhook delivery metadata, and account information. Data subjects include account users and people who submit forms powered by splitforms.

Security Measures

We protect submissions with TLS in transit, encryption at rest, row-level access controls, per-form access keys, domain locking, rate limits, audit-oriented logging, and spam and abuse controls. Operational access is restricted to service operators with a support or security need.

See the Security page for more detail.

Subprocessors

splitforms uses subprocessors to provide infrastructure, storage, authentication, email delivery, payments, and hosting. The current list is maintained in our Privacy Policy and may be updated as the service changes.

We remain responsible for subprocessors we appoint and require them to protect customer data using appropriate security and confidentiality obligations.

International Transfers

Where personal data is transferred internationally, splitforms relies on appropriate transfer mechanisms, including Standard Contractual Clauses where required.

Data Subject Requests

You can export, delete, and manage submissions from the dashboard. If you receive a data subject request that requires splitforms assistance, email [email protected]. We will provide reasonable assistance within the scope of the service.

Deletion And Return

You may delete submissions or your account from the dashboard. Account deletion removes associated forms and submissions from production systems, with backup and abuse-prevention records expiring through normal retention processes.

How This DPA Applies — No Signature Needed

This DPA is incorporated into our Terms of Service and applies automatically to every splitforms account that processes personal data — you do not need to sign anything or request a copy for it to be in force. For your records or a vendor file, reference it by URL (splitforms.com/dpa) together with the date of your review; this page is the authoritative, always-current version, and material changes are announced to account holders in advance per our Privacy Policy. You can also print this page to PDF directly from your browser.

If your organization's compliance process specifically requires a countersigned instrument, or you need a custom enterprise DPA, email [email protected] — sign this document and send it over, and we'll countersign and return it.