Data Processing Addendum, in plain language.

01Roles & scope

This Data Processing Addendum (“DPA”) forms part of the agreement between you (“Controller”) and Purple SaaS, LLC (DBA SureForm), 30 N Gould St Ste R, Sheridan, WY 82801, USA (“Processor”, “we”, “us”) for your use of the SureForm form builder and hosted forms (the “Service”).

It applies where we process personal data on your behalf under the EU General Data Protection Regulation (GDPR), the UK GDPR, the Swiss FADP, or comparable laws. Two distinct relationships exist, and it matters which one you are reading about:

• Response data — you are the controller, we are the processor. The answers people submit through your forms. You decide what is collected and why; we process it only to run the Service for you. This DPA governs that data.
• Account data — we are the controller. Your own name, email, billing details, and product usage. That processing is governed by our Privacy Policy, not this DPA.

No signature is required: this DPA takes effect when you accept the Terms of Service and remains in force for as long as we process response data for you.

02Our instructions from you

We process response data only on your documented instructions. Your instructions are: this DPA, the Terms of Service, and the choices you make in the product — the fields you add to a form, the integrations you enable, the retention you configure, the people you invite to your workspace.

We do not sell response data, use it to train models, use it for advertising, or use it for our own purposes at all. If we ever believe an instruction from you breaches applicable data protection law, we will tell you promptly and may pause that processing rather than carry it out.

You are responsible for having a lawful basis to collect what your forms collect, for the notices and consent you present to respondents, and for not putting categories of data in a form that your own compliance obligations do not permit.

03Confidentiality & staff

Everyone who can access response data is bound by written confidentiality obligations that survive the end of their engagement. Access is granted on a least-privilege, need-to-know basis, is tied to a named individual, and is revoked when it is no longer required.

We do not read your form responses. Staff access to production data happens only where it is strictly necessary — for example to resolve a support ticket you have raised or to investigate an incident — and it is logged.

04Security measures

We implement and maintain appropriate technical and organisational measures under Article 32 GDPR, taking into account the state of the art, the cost of implementation, and the risk to data subjects. The measures in force are described in Annex B.

We may update those measures as technology evolves, provided we do not materially reduce the overall level of protection.

05Sub-processors

You give us general written authorisation to engage sub-processors to help deliver the Service. Our current sub-processors are published at sureform.io/subprocessors.

• Every sub-processor is bound by a written contract imposing data protection obligations no less protective than this DPA.
• We remain fully liable to you for the performance of each sub-processor's obligations.
• We give at least 30 days' notice before adding or replacing a sub-processor. Subscribe to notifications on the sub-processor page to receive these.
• If you reasonably object on data protection grounds within those 30 days, tell us at [email protected]. We will work with you on a reasonable alternative; if none exists, you may terminate the affected part of the Service and receive a pro-rated refund of prepaid, unused fees.

06Data subject requests

The Service gives you self-serve tools to search, export, correct, and delete individual responses, which will resolve most requests without involving us.

If a respondent contacts us directly about data in your forms, we will not answer on your behalf: we will refer them to you and let you know promptly. Where you cannot resolve a request with the built-in tools, we will provide reasonable assistance, taking into account the nature of the processing and the information available to us.

07Breach notification

If we become aware of a personal data breach affecting response data we process for you, we will notify you without undue delay and in any event within 72 hours of confirming it, at the admin contact on your account.

The notification will describe, so far as we know it at the time: the nature of the breach, the categories and approximate number of records affected, the likely consequences, and the measures taken or proposed. We will keep you updated as the investigation develops and will assist you with your own notification duties to regulators and data subjects. We will not delay telling you because our investigation is incomplete.

08International transfers

We are established in the United States, so processing response data for you generally involves a transfer outside the EEA, the UK, and Switzerland.

• For transfers from the EEA we rely on the European Commission's Standard Contractual Clauses (Decision 2021/914), Module Two (controller to processor), which are incorporated into this DPA by reference and take effect automatically where they apply.
• For the UK, the UK International Data Transfer Addendum to those clauses applies.
• For Switzerland, the clauses apply with the amendments required by the FADP, with the Swiss Federal Data Protection and Information Commissioner as supervisory authority.

Where the clauses require a choice, docking is permitted, the governing law and forum follow the clauses' defaults for the exporting jurisdiction, and Annex I and Annex II of the clauses are populated by Annex A and Annex B of this DPA. We carry out transfer impact assessments where required and will tell you if we become legally unable to meet these commitments.

09Audits & assistance

On request, we will make available the information reasonably necessary to demonstrate our compliance with Article 28 GDPR — normally by providing our current security documentation and answering a security questionnaire.

If that is genuinely insufficient for your regulator or your own compliance obligations, you may audit us (or appoint an independent auditor who is not our competitor and who signs a confidentiality agreement) no more than once in any 12-month period, on at least 30 days' written notice, during business hours, without unreasonable disruption to the Service. You bear the cost of the audit unless it uncovers a material breach of this DPA. We will also assist you with data protection impact assessments and prior consultations under Articles 35 and 36 where your use of the Service makes one necessary.

10Return & deletion

You can export response data at any time while your account is open. When your account closes, you have 30 days to export before we delete response data from live systems; encrypted backups age out on their documented cycle, and data in them stays subject to this DPA until it does.

We will delete sooner on your written request, except where applicable law requires us to keep something — in which case we will tell you what and why, and keep processing it only for that purpose.

11Liability & precedence

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service, except where applicable data protection law does not permit that.

If this DPA conflicts with the Terms of Service on a data-processing matter, this DPA wins. If this DPA conflicts with the Standard Contractual Clauses, the Clauses win.

12Annex A — Processing details

This Annex populates Annex I of the Standard Contractual Clauses.

• Exporter: you, the customer, acting as controller of response data.
• Importer: Purple SaaS, LLC (DBA SureForm), acting as processor.
• Subject matter: provision of the SureForm form builder and hosted forms.
• Duration: the term of your subscription, plus the deletion window in Section 10.
• Nature and purpose: collecting, storing, organising, transmitting, displaying, and deleting form responses so that you can build forms, receive submissions, and analyse results.
• Categories of data subjects: the people who submit your forms — determined entirely by you. Typically customers, employees, applicants, event attendees, survey participants, or website visitors.
• Categories of personal data: determined entirely by you through the fields you create. Commonly name, email address, phone number, postal address, free-text answers, uploaded files, and technical metadata such as IP address, timestamp, and user agent captured with a submission.
• Special category data: not requested by us and not required by the Service. You may configure forms that collect it (for example health information), in which case you are responsible for the additional safeguards and lawful basis that Article 9 requires.
• Frequency: continuous, for as long as your forms are live.
• Competent supervisory authority: that of your EEA establishment, or of the member state where your representative is established.

13Annex B — Security measures

This Annex populates Annex II of the Standard Contractual Clauses.

• Encryption in transit: TLS 1.2 or higher on every connection, HSTS enforced, modern cipher suites only.
• Encryption at rest: response data and backups encrypted at rest with AES-256 or equivalent.
• Access control: least-privilege, role-based access; named individual accounts; multi-factor authentication required for administrative access; access reviewed and revoked promptly on role change or departure.
• Tenant isolation: logical separation of each workspace's data, enforced in the application layer on every request.
• Network security: firewalled infrastructure, no direct public access to databases, hardened HTTP security headers and a strict content security policy on our web properties.
• Application security: CSRF protection, input validation and output encoding, dependency monitoring, and security review of changes before release.
• Logging & monitoring: administrative and authentication events logged, retained, and monitored for anomalies.
• Backups & resilience: encrypted automated backups with periodic restore testing and documented recovery objectives.
• Vulnerability management: tracked disclosure route at [email protected], prioritised remediation, and prompt patching of dependencies and infrastructure.
• Personnel: written confidentiality obligations and security awareness expectations for everyone with production access.
• Sub-processor assurance: due diligence before engagement and contractual flow-down of these obligations.
• Deletion: documented deletion routines on account closure and on request, as described in Section 10.

14Contact & countersignature

This DPA is already in force — you do not need to sign it. If your procurement or compliance process requires a countersigned copy on paper, email [email protected] with your legal entity name and registered address and we will return one.

Privacy questions: [email protected]. Security reports: [email protected]. Legal notices: Purple SaaS, LLC (DBA SureForm), Attn: Legal, 30 N Gould St Ste R, Sheridan, WY 82801, USA.