Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Foresight Technologies LLC ("ToWebForm", "Processor") and the organization using ToWebForm ("Merchant", "Controller"). It applies when ToWebForm processes personal data of the Merchant's respondents, signers, and other End Users on the Merchant's behalf, including under the EU and UK General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection. If this DPA conflicts with the Terms, this DPA wins for personal data.

1. Subject Matter, Duration, and Nature of Processing

• Subject matter: hosting forms, collecting submissions and electronic signatures, generating and storing completed PDFs, and sending related emails and texts.
• Duration: for as long as the Merchant uses the Service, plus the deletion period in section 9.
• Data subjects: the Merchant's End Users (for example clients, patients, applicants, tenants, and contract counterparties) and the Merchant's staff.
• Personal data: whatever the Merchant's forms collect (such as names, contact details, addresses, dates of birth, and free-text answers), signatures and signing audit data (IP address, browser details, timestamps, verified email or phone), uploaded files, and staff notes.
• Special category data: only if the Merchant's forms ask for it. The Merchant is responsible for having a lawful basis and any required safeguards.

2. Processing on Instructions

ToWebForm processes personal data only on the Merchant's documented instructions, which are the Terms, this DPA, and the Merchant's configuration of the Service, unless the law requires otherwise (in which case ToWebForm will tell the Merchant first unless the law forbids it). ToWebForm will tell the Merchant if it believes an instruction breaks data protection law.

3. Confidentiality

Everyone at ToWebForm with access to personal data is bound by confidentiality obligations and accesses it only as needed to run and support the Service.

4. Security Measures

• Application-layer AES-256-GCM encryption of submissions, signature audit trails, IP addresses, verified contact details, staff notes, and uploaded files before they are stored.
• Encryption in transit (TLS) for all traffic.
• Tenant isolation with PostgreSQL Row-Level Security and role-based access (Owner, Admin, Member).
• Private storage buckets; completed PDFs are shared only through time-limited signed links, never as email attachments.
• Rate limiting on public endpoints, security audit logs, and optional one-time-code identity checks for signers.
• Automatic deletion of temporary uploads within 24 hours and of partly signed PDFs once a signing request ends.

5. Sub-processors

The Merchant gives general authorization for ToWebForm to use the sub-processors below. ToWebForm binds each one to data protection terms at least as protective as this DPA and remains responsible for their performance. ToWebForm will give at least 30 days' notice of a new sub-processor by updating this page and emailing the organization owner; the Merchant may object on reasonable data protection grounds, and if the parties cannot resolve the objection the Merchant may end the affected service.

6. International Transfers

Personal data is processed in the United States. For transfers from the European Economic Area, the United Kingdom, or Switzerland, the parties incorporate the European Commission's Standard Contractual Clauses (Module Two: controller to processor) by reference, together with the UK International Data Transfer Addendum and the Swiss amendments where applicable. Where a sub-processor is certified under the EU-U.S. Data Privacy Framework, ToWebForm may also rely on it.

7. Help with Data Subject Requests

The Service lets the Merchant search, export (CSV and PDF), correct by resending, and permanently delete End-User submissions. If ToWebForm receives a request from an End User directly, it will refer the End User to the Merchant and will not respond itself unless the Merchant asks. ToWebForm will reasonably help the Merchant with requests it cannot handle using the Service.

8. Personal Data Breaches

ToWebForm will notify the Merchant without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting the Merchant's data, with the information the Merchant needs to meet its own notification duties, and will take reasonable steps to contain it.

9. Deletion and Return

The Merchant can export and delete its data at any time. ToWebForm keeps the Merchant's data until the Merchant deletes it or closes its organization, and never deletes it for inactivity; the Merchant decides how long its End-User records are kept. When the Merchant closes its organization in Settings, all of its data, including forms, submissions, files, and staff notes, is permanently deleted 30 days after the request, unless the law requires ToWebForm to keep some of it. Encrypted backups expire on the hosting provider's standard rotation.

10. Audits and Information

ToWebForm will make available the information reasonably needed to show compliance with this DPA, such as security documentation and answers to security questionnaires, and will allow audits by the Merchant or an independent auditor on at least 30 days' notice, during business hours, no more than once a year unless a breach or regulator requires it.

11. Assistance

ToWebForm will reasonably help the Merchant with data protection impact assessments and prior consultations with supervisory authorities, to the extent they relate to the Service.

12. Contact

To request a countersigned copy of this DPA, or for any data protection question, contact Foresight Technologies LLC at Legal@ToWebForm.com. See also our Privacy Policy.