Data Processing Addendum

Last updated: 15 September 2026

This DPA applies where you use FormDock to process personal data of third parties (your form submitters) and forms part of the Terms of Service. It is written to satisfy Art. 28 GDPR and the Swiss Federal Act on Data Protection (FADP); FormDock is operated from Switzerland.

Roles

You (or your client) are the data controller of submission data. FormDock is the data processor. We process submission data only to provide the service: storage, spam filtering, notification delivery, webhooks, and export.

Subprocessors

Hetzner Online GmbH (PostgreSQL database hosting in Nuremberg, Germany, and encrypted backup storage in Helsinki, Finland), Vercel (application hosting — compute in Frankfurt, Germany, plus a global edge network), Postmark (transactional email), Stripe (billing — where Stripe Managed Payments applies, Stripe acts as merchant of record and is an independent controller of the payment transaction rather than our processor), Cloudflare (Turnstile spam verification), Sentry (error monitoring, EU-hosted — submission payloads and submitter identifiers are stripped before capture). We'll give 30 days' notice before adding subprocessors.

Change log. 15 September 2026: Neon (Postgres hosting, United States) was replaced by Hetzner Online GmbH (Germany/Finland), and application compute moved from the United States to Frankfurt, Germany. This change moves submission data at rest from the US into the EU; no data was shared with any additional party.

International transfers

Submission data at rest is stored in the EU (Germany, with backups in Finland) and is not transferred to the United States. Vercel, Postmark, Stripe and Cloudflare are US companies; personal data they process in their roles above (request handling at the edge, email delivery, billing, spam verification) may be transferred to the US. Those transfers from Switzerland and the EU/EEA rely on the EU/Swiss–US Data Privacy Framework where the subprocessor is certified, and on standard contractual clauses otherwise.

Security measures

Encryption at rest (AES-256 full-volume encryption of the database storage) and in transit (TLS) for all connections, including between the application and the database; encrypted (AES-256) backups with continuous point-in-time recovery; database reachable only over authenticated, encrypted connections; access limited to operational need; no payload contents in application logs; per-form rate limiting and abuse controls.

Data subject requests

The dashboard provides search, export, and deletion of individual submissions so you can service access and erasure requests directly. We'll assist with requests we receive by forwarding them to you.

Breach notification

We'll notify you without undue delay, and in any case within 72 hours, of becoming aware of a personal data breach affecting your submission data.

Deletion on termination

On account deletion, all submission data is deleted within 30 days.