Data Processing Addendum

1. Scope and roles

This Data Processing Addendum (“DPA”) forms part of the Zunoform Terms of Service and applies whenever Zunoform processes personal data on behalf of a customer (“Customer”) in the course of providing the service. For data collected through the Customer's forms, the Customer is the controller and Zunoform is the processor. It is accepted by using the service; contact us for a countersigned copy.

2. Details of processing

• Subject matter & duration: hosting and processing of form definitions and responses for the duration of the Customer's account.
• Nature & purpose: collecting, storing, displaying, analyzing, and delivering form responses as configured by the Customer.
• Categories of data: whatever the Customer's forms collect (typically contact details and free-text answers) plus technical metadata (IP address, user-agent, timestamps).
• Data subjects: the Customer's form respondents and team members.

3. Customer instructions

Zunoform processes personal data only on the Customer's documented instructions — given through the service's settings, form configuration, and connected integrations — unless required otherwise by applicable law, in which case Zunoform will inform the Customer unless legally prohibited.

4. Confidentiality and security

Persons authorized to process personal data are bound by confidentiality. Zunoform implements appropriate technical and organizational measures, including encryption in transit (TLS), password hashing (bcrypt), AES-256-GCM encryption of stored credentials, network isolation of data stores, access controls, and mandatory multi-factor authentication for administrative access — described further on the Security page.

5. Subprocessors

The Customer authorizes these subprocessors, engaged only as needed to provide the service:

• Hosting infrastructure provider (application and database hosting, EU/US)
• Cloudflare, Inc. — DNS, TLS termination, CDN, file storage (R2)
• Email delivery provider (Resend) — transactional email
• Paddle / Lemon Squeezy / Stripe — subscription billing
• Third-party services the Customer explicitly connects (e.g. Google Sheets, Slack, Notion, HubSpot) — acting on the Customer's own instruction and account

Zunoform will give notice of new subprocessors (via this page or email), and the Customer may object on reasonable data-protection grounds; continued use after the notice period constitutes acceptance.

6. Assistance

Taking into account the nature of processing, Zunoform will assist the Customer with data subject requests (access, rectification, erasure, portability, objection) — largely achievable directly in-product through response viewing, export, and deletion — and with the Customer's obligations regarding security, breach notification, and impact assessments.

7. Personal data breaches

Zunoform will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data, providing information reasonably needed for the Customer to meet its own notification obligations.

8. Deletion and return

Upon termination of the service, Zunoform will, at the Customer's choice, delete or return the personal data (the in-product export covers return), and delete remaining copies within 30 days unless retention is required by law.

9. International transfers

Where processing involves transfers of EU/UK personal data to countries without an adequacy decision, the parties rely on the European Commission's Standard Contractual Clauses (Module 2: controller-to-processor), which are incorporated by reference, with the details of Section 2 serving as its annexes.

10. Audits and contact

Zunoform will make available information reasonably necessary to demonstrate compliance with this DPA. Questions and requests: [email protected].