Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms and Conditions between Silver Apple Studios LTD (t/a SnipForm), 22 Wenlock Road, London N1 7TA, United Kingdom ("SnipForm") and the customer holding a SnipForm account ("Customer"). It applies automatically, without signature, wherever SnipForm processes personal data within Customer Data on the Customer's behalf. If you need a countersigned copy for your records, email david@snipform.io and we will provide one.

1. Definitions and roles

"Applicable Data Protection Law" means the laws applying to the processing of personal data under this DPA, including the EU GDPR, the UK GDPR and Data Protection Act 2018, South Africa's POPIA, and the CCPA/CPRA and other US state privacy laws. "Customer Data" has the meaning given in the Terms. Terms like "personal data", "processing", "controller", and "processor" carry their meanings under Applicable Data Protection Law.

For personal data in Customer Data, the Customer is the controller (POPIA: responsible party; CCPA: business) and SnipForm is the processor (POPIA: operator; CCPA: service provider). For account, billing, and security data about the Customer's own users, SnipForm is an independent controller as described in the Privacy Notice; that processing is outside this DPA.

2. Scope and instructions

SnipForm processes personal data in Customer Data only on the Customer's documented instructions, which are: the Terms and this DPA, the Customer's configuration of the Services (dashboard settings, integrations, automations), and the Customer's use of the APIs - unless processing is required by law, in which case SnipForm will inform the Customer before processing where the law allows. SnipForm will inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law. The details of processing are set out in Annex 1.

3. Customer obligations

The Customer is responsible for the lawfulness of the personal data it collects through the Services: establishing a lawful basis, publishing its own privacy notice, obtaining any consents its configuration or jurisdiction requires, honouring data subject requests addressed to it, and not submitting special-category data or data subject to regulations the Services are not designed for, as set out in the Terms.

4. SnipForm obligations

• Confidentiality: persons authorised to process Customer Data are bound by confidentiality obligations and access it only as needed to provide the Services.
• Security: SnipForm implements the technical and organisational measures in Annex 2 (GDPR Article 32; POPIA section 19) and keeps them current as technology evolves.
• Data subject rights: the Services provide the tools to honour access and erasure requests directly - per-record viewing and deletion at submission, contact, form, property, and account level. SnipForm will forward requests it receives that identify the Customer, and will provide reasonable further assistance where the tools do not suffice.
• Breach notification: SnipForm will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, with the information reasonably required for the Customer's own notification obligations (this also satisfies the operator's duty under POPIA section 21(2)).
• Assistance: taking into account the nature of processing, SnipForm will reasonably assist the Customer with data protection impact assessments and consultations with supervisory authorities where required.
• Deletion: on termination or deletion of the account, Customer Data is deleted as described on the compliance page. Residual copies in encrypted backups age out with the backup cycle. Data is retained for the life of the account and is not returned in a portable dump by default; exports are available through the Services and API during the term.
• Demonstrating compliance: SnipForm will make available the information reasonably necessary to demonstrate compliance with this DPA, including completing security questionnaires. Audits are limited to once per year on 30 days' notice, at the Customer's cost, must not access other customers' data, and are satisfied by documentation and written responses where these reasonably demonstrate compliance.

5. Sub-processors

The Customer gives general authorisation for the sub-processors in Annex 3, which is kept current at snipform.io/compliance. SnipForm imposes data protection obligations on sub-processors equivalent to those in this DPA and remains liable for their performance. SnipForm will give notice (via the dashboard or email to account holders) at least 30 days before a new sub-processor processes Customer Data. The Customer may object on reasonable data protection grounds; if the objection cannot be resolved, the Customer may terminate the affected Services and receive a pro-rata refund of prepaid fees for the unused period.

6. Customer-directed disclosures

The Services let the Customer route Customer Data to destinations the Customer configures: webhooks to the Customer's own endpoints, Slack workspaces, Zapier, conversion uploads to ad platforms, API and MCP token holders, and similar integrations. Automation payloads include submission fields and request metadata (device, coarse location, and the one-way hashed visitor identifier). These disclosures are made on the Customer's instruction; the recipients are not SnipForm sub-processors, and the Customer is the controller of what it sends them.

7. International transfers

Primary processing takes place in the European Union (Google Cloud europe-west1, Belgium). Where a sub-processor processes personal data outside the EU/EEA, the UK, or another jurisdiction requiring transfer safeguards, the transfer relies on a valid mechanism: an adequacy decision, the EU-US Data Privacy Framework, or standard contractual clauses (with the UK Addendum or IDTA where UK data is in scope), as applicable. For South African data subjects, processing in the EU takes place under a legal regime providing protections substantially similar to POPIA's conditions for lawful processing, supporting transfers under POPIA section 72.

8. US state privacy laws

Where the CCPA/CPRA or another US state privacy law applies, SnipForm acts as the Customer's service provider: it does not sell or share personal information, does not process it for cross-context behavioural advertising, does not combine it with personal information from other sources except as permitted for service providers, and processes it only for the business purposes described in this DPA. SnipForm certifies that it understands and will comply with these restrictions.

9. Liability, precedence, and duration

Liability under this DPA is subject to the limitations in the Terms. If this DPA conflicts with the Terms on a data protection matter, this DPA prevails. This DPA applies for as long as SnipForm processes personal data in Customer Data and until deletion under section 4 is complete.

Annex 1 - Details of processing

• Subject matter and nature: hosting, storage, aggregation, analysis, display, spam filtering, and delivery of configured automations, as needed to provide the SnipForm Services (cookieless analytics, forms, landing pages, conversion tracking).
• Duration: the term of the Customer's account, until deletion.
• Data subjects: visitors to the Customer's Properties; people who submit the Customer's forms; contacts the Customer identifies through the Services.
• Categories of personal data: usage data (pages viewed, referrers, device class, coarse location, and salted daily-rotating visitor identifiers - no cookies, no stored IP addresses); form submission content (determined by the Customer); contact records the Customer creates (such as email, name, phone, company, and custom traits); automation payloads derived from the above.
• Special categories: none intended; the Customer agrees not to submit them (Terms, section 6).

Annex 2 - Technical and organisational measures

• Minimisation by architecture: no cookies or device storage; visitor identifiers are salted hashes rotating every 24 hours, scoped per property; no raw IP addresses stored anywhere - spam checks use a keyed one-way hash; no cross-site or cross-day linkage.
• Encryption: TLS with HSTS for all traffic in transit; encryption at rest via cloud provider storage encryption (Google Cloud, Elastic Cloud).
• Data residency: primary compute and storage in the EU (Google Cloud europe-west1, Belgium); EU regions for email and error monitoring.
• Access control: per-user authentication with hashed passwords, team roles and permissions, scope-limited API tokens, and OAuth-gated integrations.
• Deletion and redaction: cascading deletion at submission, contact, form, property, and account level; contact deletion destroys every identifying field and scrubs related event records.
• Monitoring and operations: EU-region error monitoring with masked session replay; encrypted backups aging out on the backup cycle; personnel access limited to what operating the Services requires, under confidentiality obligations.

Annex 3 - Sub-processors

Customer-configured destinations (Slack, Zapier, webhooks, ad platforms) are not sub-processors - see section 6. The live list is maintained at snipform.io/compliance.