Data Processing Agreement

This Data Processing Agreement ("DPA") is between Webbebo Technologies, H946, Phase 4, Ganapathy Maanagar, Coimbatore, Tamil Nadu 641006, India ("Onlyform", "we") and the customer that has accepted the Onlyform Terms of Service ("Customer"). It forms part of the Terms and applies automatically whenever we process personal data on the Customer's behalf while providing Onlyform. No separate signature is required.

The Customer is the controller of the personal data in its forms and responses, or a processor acting for its own controller. Onlyform is the Customer's processor, or sub-processor. Personal data that Onlyform processes for its own purposes, such as account administration, billing and security, is covered by our Privacy Policy and not by this DPA.

We process Customer personal data only on the Customer's documented instructions. The Customer's instructions are these Terms and DPA and the way it configures and uses Onlyform, including its forms, exports, integrations, follow-ups and AI features. If the law requires us to process data in another way, we will tell the Customer first unless the law prohibits it. We will tell the Customer if we believe an instruction breaks data protection law.

The Customer is responsible for the lawfulness of its instructions, for giving respondents the required notices, for having a legal basis and any consent needed, and for the accuracy of the data it collects.

We give access to Customer personal data only to personnel who need it to provide, support or secure the service, and every such person is bound by a duty of confidentiality.

We implement and maintain the technical and organisational measures in Annex 2 to protect Customer personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. We may update these measures over time, but never in a way that reduces the overall level of protection.

The Customer gives general authorisation for us to use the sub-processors listed on our Service Providers and Sub-processors page. We will update that page at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period by emailing support@onlyform.com. If we cannot resolve the objection, the Customer may terminate the affected service and receive a refund of prepaid fees for the unused period.

We impose data protection obligations on each sub-processor that are no less protective than this DPA, and we remain responsible for their performance.

If we receive a request from a data subject about Customer personal data, we will pass it to the Customer and will not respond ourselves unless the Customer instructs us to or the law requires it. Taking into account the nature of the processing, we will help the Customer respond to data subject requests and meet its obligations on security, breach notification, data protection impact assessments and consultation with supervisory authorities.

We will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer personal data. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed and a contact point. Where not all information is available at once, we will provide it in stages. We will take reasonable steps to contain and remedy the breach.

During the subscription, the Customer can export and delete its forms and responses at any time. When the Customer's account is closed, we delete Customer personal data within 30 days, unless the law requires us to keep it. Data in backups is deleted when the backups rotate and is not restored into active use.

We will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA, including answers to security questionnaires. Where that information is not sufficient, we will allow an audit by the Customer or an independent auditor bound by confidentiality, on at least 30 days' written notice, no more than once a year unless a supervisory authority requires it or a breach has occurred, and in a way that does not disrupt the service or expose other customers' data.

Where Customer personal data subject to the GDPR is transferred to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914, which are incorporated into this DPA by reference: Module 2 (controller to processor) where the Customer is a controller, and Module 3 (processor to processor) where the Customer is a processor. For those clauses: clause 7 (docking) applies; clause 9 option 2 (general authorisation, 30 days' notice) applies; the optional wording in clause 11 does not apply; clauses 17 and 18 are governed by and subject to the courts of Ireland; and Annexes I and II are completed by Annexes 1 and 2 of this DPA.

For transfers subject to the UK GDPR, the UK International Data Transfer Addendum issued by the Information Commissioner applies, with the parties' details, these selected clauses and Annexes 1 and 2 of this DPA as its tables. For transfers subject to Swiss law, the Standard Contractual Clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection and the competent supervisory authority being the Federal Data Protection and Information Commissioner.

Where US state privacy laws apply, we act as the Customer's service provider or processor. We will not sell or share Customer personal data, will not retain, use or disclose it outside the direct business relationship or for any purpose other than providing the service, and will not combine it with personal data from other sources except as those laws permit.

Each party's liability under this DPA is subject to the limits in the Terms of Service, except where the law does not allow it to be limited. If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer personal data. If it conflicts with the Standard Contractual Clauses or UK Addendum, those prevail.