Data processing agreement

Last updated: 2026-10-27

This agreement (the "DPA") is part of the terms between you (the "Controller") and TW Works (the "Processor", "FormHaven") and applies automatically to every FormHaven account. It covers the personal data that visitors send through your forms, as required by Article 28 of the GDPR. Need a signed copy for your records? Email [email protected].

1. Subject, nature and purpose

FormHaven receives submissions sent to your form addresses, stores them, filters spam and emails them to the address on your account. We process the data only for that purpose and only on your documented instructions, which are these terms and the settings you choose in your dashboard.

2. Duration

For as long as your account exists. Submissions are deleted when they pass the retention period you set per form, when you delete them, or within 30 days after you delete your account. Backups containing them are overwritten within a further 30 days.

3. Types of data and data subjects

Data subjects: the visitors who fill in your forms. Data: whatever fields your form sends (typically name, email address and a message), plus a one-way hash of the visitor's IP address, their browser's user agent and the page they submitted from. You decide which fields your form asks for; do not use FormHaven for special categories of data (health, religion and similar) or for data on children.

4. Our obligations

• Process the data only on your instructions, and tell you if we believe an instruction breaks the GDPR.
• Make sure everyone with access is bound to confidentiality.
• Keep appropriate security measures in place, at least: encryption in transit (TLS), encrypted off-site backups, access to production limited to named administrators over a private network, automatic security updates, and rate limiting on form addresses.
• Store submissions in the EU.
• Help you answer data subject requests: you can view, export and delete submissions yourself in the dashboard, and we assist on request.
• Notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations.
• Delete the data at the end of the service as described in section 2.
• Give you the information needed to show compliance with this DPA, and allow audits at your expense with reasonable notice, at most once a year unless a breach has occurred.

5. Subprocessors

You authorise the subprocessors on our subprocessor list. We impose the same data protection obligations on them as this DPA imposes on us. We announce new subprocessors by email at least 30 days in advance; if you object, you may end your subscription before the change takes effect and receive a pro-rata refund.

6. Transfers outside the EU

Where a subprocessor processes data outside the EU, the transfer relies on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

7. Liability

Liability under this DPA follows the limitation in our terms, except where the GDPR does not allow a limitation.