Data Processing Agreement
Effective date: 2026-11-06
This Data Processing Agreement ("DPA") is part of the BootForm Terms of Use between Menelabs O.E., a general partnership registered in Greece (GEMI 156105433000, VAT EL801404909), Mastrakas - Virou, 49084 Corfu, Greece ("BootForm", "we", the "Processor"), and the Customer who accepts the Terms ("you", the "Controller").
1. Scope
1.1 This DPA applies automatically, without a separate signature, to every Customer who accepts the Terms and uses BootForm to collect personal data through their forms. Accepting the Terms means accepting this DPA.
1.2 It covers form submission data: what End Users send through your forms, and the data BootForm records with it. For that data you are the controller and BootForm is your processor. It does not cover your own account data (email, sign-in, billing, team members), which BootForm processes as a controller under its Privacy Policy.
1.3 Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the GDPR (Regulation (EU) 2016/679). If this DPA and the Terms conflict on the processing of personal data, this DPA wins.
2. Unclaimed forms and the first claim
2.1 A form can receive submissions before anyone has claimed it. BootForm holds up to 10 such submissions for up to 48 hours, then deletes them. The first account to claim the form receives them, and BootForm does not check who owns the page the form is on (see the Terms).
2.2 Until a form is claimed there is no Customer and no instruction. BootForm holds these submissions only so they can be handed to the person who set up the form, and does nothing else with them. When you claim a form, this DPA covers the held submissions as well, and by claiming you confirm that the form is yours (it is on a site you run, or you run it on behalf of its owner).
2.3 Because the first claim wins, you should claim a form before you put it on a live page. BootForm cannot undo a claim by someone else or recover submissions already delivered to them.
3. Processing on your instructions (Art. 28(3)(a))
3.1 BootForm processes submission data only on your documented instructions. Your instructions are the Terms, this DPA, and the settings you choose in the dashboard, API or MCP server (which fields you collect, where submissions are delivered, retention by plan, deletions and exports).
3.2 BootForm will not use submission data for its own purposes, sell it, or use it to train any model. If a law requires BootForm to process it in another way, BootForm will tell you first unless that law forbids it. BootForm will tell you if it believes an instruction breaks the GDPR.
3.3 You are responsible for having a lawful basis for what your forms collect, for informing your End Users, and for the destinations you send data to (Discord, Slack, Telegram, your webhook, Zapier, Make, your own Turnstile keys). Those destinations are your choice and act for you, not as BootForm's subprocessors.
4. Confidentiality (Art. 28(3)(b))
Everyone at BootForm who can access submission data is bound by confidentiality. Today that is the founder alone. Submission content is looked at only when needed to run the Service, to answer a support request you made, or to deal with abuse.
5. Security (Art. 28(3)(c), Art. 32)
BootForm applies the measures in Annex II, and may change them as long as the overall level of protection does not go down.
6. Subprocessors (Art. 28(2) and (4))
6.1 You give BootForm general written authorization to use subprocessors. The current list is in Annex III and on the Privacy Policy page.
6.2 Before adding or replacing a subprocessor that handles submission data, BootForm will update the list and email the account owner at least 30 days in advance. You may object in writing, on reasonable data protection grounds, within that period. If we cannot resolve the objection, you may close your account and BootForm will refund any prepaid fees for the unused period.
6.3 BootForm puts data protection obligations on each subprocessor that are at least as protective as this DPA, and remains responsible to you for their performance.
7. International transfers
7.1 BootForm's infrastructure runs on Microsoft Azure in the United States (East US region). BootForm does not offer EU data residency. Submission data is therefore transferred to and stored in the United States.
7.2 Where a subprocessor is certified under the EU-US Data Privacy Framework, transfers to it rely on that certification. Where it is not, or if the Framework stops being valid, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 apply and are incorporated by reference: Module 2 (controller to processor) between you and BootForm where needed, and Module 3 (processor to processor) between BootForm and its subprocessors. For the Clauses, the optional clause 7 does not apply, clause 9(a) option 2 applies with the notice period in section 6.2, clause 13 supervision lies with the supervisory authority competent for you, and clauses 17 and 18 choose the law and courts of Greece.
8. Helping you with data subject requests (Art. 28(3)(e))
8.1 Most requests can be handled directly in the dashboard: you can find, export (CSV or JSON, on every plan) and delete individual submissions, or delete a whole form with all its submissions and files.
8.2 If an End User contacts BootForm directly about your form, BootForm will refer them to you and will not answer the request itself unless you ask it to. Where the dashboard is not enough, BootForm will help you within reason.
9. Other assistance (Art. 28(3)(f))
BootForm will give you the information it reasonably can to help you with security, breach notification, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information BootForm has.
10. Personal data breaches
10.1 BootForm will notify the account owner by email without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your submission data.
10.2 The notice will describe, as far as known at the time, what happened, the data and number of people likely affected, the likely consequences, and what BootForm has done or proposes to do. Information not yet available will follow as soon as it is.
10.3 Notifying you is not an admission of fault. Notifying supervisory authorities and End Users remains your responsibility as controller.
11. Deletion or return at the end (Art. 28(3)(g))
11.1 You can export your submissions at any time while your account is open. Retention follows your plan (Annex I), and deleting a form removes its submissions, files and export files in the background shortly afterwards.
11.2 Closing your account from the dashboard stops all processing of new submissions but keeps your data, so that signing in again restores it. To end the processing for good, ask BootForm to erase your account (reply to the goodbye email or use the contact form). BootForm will then delete your submission data and confirm when it is done, unless a law requires it to keep some of it. Data in backups is deleted as those backups expire.
11.3 After a form is deleted, BootForm keeps only the form's ID, the owning account's ID and the deletion date, so the ID cannot be claimed again. This record contains no submission data.
12. Audits (Art. 28(3)(h))
12.1 BootForm will make available the information needed to show it meets Article 28, first in writing: this DPA, its annexes, and answers to a reasonable security questionnaire, once a year.
12.2 If that is not enough, or a supervisory authority requires it, you (or an independent auditor bound by confidentiality) may audit BootForm with at least 30 days' written notice, during business hours, no more than once a year, and at your cost. Audits must not access other Customers' data.
13. Liability, term and law
13.1 Each party's liability under this DPA is subject to the limitations in the Terms, to the extent the GDPR allows.
13.2 This DPA lasts as long as BootForm processes submission data for you, and its obligations on deletion and confidentiality survive the end of the Terms.
13.3 BootForm may update this DPA, for example when the law or its subprocessors change. Material changes will be emailed to account owners in advance and will not reduce the protection of your data.
13.4 This DPA is governed by the laws of Greece, and the courts of Greece have jurisdiction, as in the Terms.
Annex I: Description of the processing
| Controller | The Customer (contact: the account owner's email address) |
| Processor | Menelabs O.E., Mastrakas - Virou, 49084 Corfu, Greece; privacy contact: see Contact in the Privacy Policy |
| Subject matter | Receiving, storing and delivering form submissions for the Customer |
| Nature | Collection over HTTPS, spam filtering, storage, delivery to Customer-chosen destinations, display, export and deletion |
| Purpose | Providing the BootForm Service to the Customer |
| Duration | For the life of the account, subject to the retention below |
| Data subjects | People who submit the Customer's forms (End Users); visitors who react to items on a Customer's public feed |
| Categories of data | Whatever fields the Customer's form collects (often name, email address and message), uploaded files, the submitter's IP address, the country derived from Cloudflare's CF-IPCountry header, browser and referring page details, and submission time; for public feed reactions, the visitor's IP address |
| Special categories | None intended. The Customer must not collect them unless it has a lawful basis and BootForm's measures are adequate for them |
| Retention | Per plan, full access then kept before automatic deletion: Free 30 days / 6 months; Starter 6 months / 1 year; Pro 5 years / 7 years; Business unlimited / never deleted. Unclaimed held submissions: up to 48 hours. Export files: at most 8 days. Public feed reaction IPs: up to 90 days |
| Frequency | Continuous |
Annex II: Security measures
- In transit: all traffic to BootForm's service subdomains uses TLS, terminated at Cloudflare and re-encrypted to Azure.
- At rest: data is stored in Microsoft Azure services that encrypt stored data by default. Secrets that Customers give BootForm, such as webhook signing secrets and CAPTCHA secret keys, are additionally encrypted by the application. Passwords are stored as bcrypt hashes and API keys as hashes.
- Access control: Customer data is separated by account, and team roles limit what each member can see and change. Production access is limited to the founder. Application access to secrets uses Azure Key Vault with managed identities, not passwords in code.
- Accountability: an activity log records sensitive account actions (for example form deletion, API key changes, team and plan changes), without submission content or secrets.
- Availability and monitoring: logs and metrics are monitored with alerting, and there is a written incident response procedure.
- Deletion: automated deletion by retention plan, form deletion and export file expiry.
Annex III: Subprocessors for submission data
| Subprocessor | Purpose | Location |
|---|---|---|
| Microsoft Azure (Microsoft Corporation) | Hosting: database, file storage, queues, compute | United States (East US) |
| Cloudflare, Inc. | Network proxy and TLS for the form endpoint and service subdomains | Global network |
| Twilio Inc. (SendGrid) | Delivering submission notifications by email | United States |
Paddle.com Market Limited (billing) and the OAuth sign-in providers process only Customer account data, under the Privacy Policy, and do not receive submission data.