Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between GoGoSoon Private Limited, operator of GenZform ("Processor," "we"), and the customer using GenZform ("Customer," "you"). It applies when we process personal data on your behalf, mainly the responses and files your respondents submit to your forms, and is designed to meet the requirements of Article 28 of the EU and UK GDPR.

This DPA applies automatically to every GenZform account.

You are the controller of the personal data collected through your forms. We are your processor. You are responsible for having a lawful basis to collect that data, for giving respondents any required privacy notice, and for obtaining any consent your use requires.

We process personal data only on your documented instructions, including the configuration of your forms and integrations, unless the law requires otherwise (in which case we will tell you first, unless the law forbids it). We will tell you if we believe an instruction breaks data protection law. We do not sell customer personal data, use it for advertising, or use it to train AI models.

Everyone we authorize to process customer personal data is bound by confidentiality obligations.

We implement appropriate technical and organizational measures under Article 32 GDPR, including:

• Encryption of all data in transit using HTTPS/TLS
• Application servers and database hosted by Hetzner in ISO 27001-certified data centers in Germany
• Uploaded files and backups stored with Cloudflare R2, which encrypts data at rest
• Daily database backups
• Passwordless authentication with short-lived, single-use sign-in codes; OAuth 2.0 with expiring tokens for API and AI assistant access
• Access to production systems restricted to authorized personnel who need it, bound by confidentiality obligations
• Logical separation of each customer's data by account; form access limited to the owner and invited collaborators
• Rate limiting and optional reCAPTCHA to protect forms from abuse
• Respondents' answers and uploaded files are not sent to AI providers by GenZform

We may update these measures over time, provided the overall level of protection is not reduced.

You give general authorization for us to use the subprocessors listed in the Subprocessors section of our Privacy Policy. We impose data protection obligations on each subprocessor that are no less protective than this DPA, and we remain responsible for their performance.

We will update that list at least 30 days before a new subprocessor processes customer personal data. You may object on reasonable data protection grounds by emailing [email protected] within that period. If we cannot reasonably resolve the objection, you may terminate the affected service and receive a pro-rata refund of prepaid fees for it.

We will notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting your data. Our notice will describe, as far as known at the time:

• The nature of the breach and the categories and approximate number of data subjects and records affected
• The likely consequences of the breach
• The measures taken or proposed to address it and limit its effects
• A contact point for more information (our Data Protection Officer)

We will provide further information as it becomes available and reasonably assist you with any notifications you must make to supervisory authorities or data subjects.

• You can export your responses (CSV or Excel) and delete individual responses at any time from your dashboard.
• When you delete your account, it is deactivated immediately. On your request to [email protected], we permanently delete your account, forms, responses, and uploaded files within 30 days, and confirm deletion in writing.
• Residual copies in backups are overwritten as backups rotate, and remain protected by this DPA until then.
• We may keep data longer only where the law requires it.

If we receive a request from one of your respondents, we will refer them to you and not respond ourselves unless you authorize it. Taking into account the nature of the processing, we will help you respond to requests to access, correct, delete, restrict, or port personal data, and with data protection impact assessments and prior consultations where required.

We will make available the information reasonably necessary to demonstrate compliance with this DPA, including responses to security questionnaires. Where that is not sufficient, you may audit our compliance once per year on at least 30 days' written notice, during business hours, at your own cost, and subject to reasonable confidentiality terms.

This DPA remains in effect for as long as we process personal data on your behalf. If it conflicts with our Terms of Service, this DPA prevails for matters relating to personal data. If it conflicts with the Standard Contractual Clauses, the Standard Contractual Clauses prevail.

See also our Privacy Policy.