Start free trial
Legal

Data Processing Agreement (DPA)

Last updated 29 October 2026 · Effective 23 September 2026 · 9 minute read

In short

  • It applies automatically when you accept the Terms. No signature needed.
  • You decide what your forms collect. Formentic processes it only on your instructions.
  • We tell you within 48 hours of learning about a personal data breach.
  • You get 30 days’ notice before a new sub-processor handles your data.

1. About this DPA

1.1 This Data Processing Agreement ("DPA") forms part of, and is incorporated into, the Terms and Conditions between Formentic ("Formentic", "we", "Processor") and the Client ("you", "Controller"). It applies automatically from the date you accept the Terms, without any further signature required, though a signed or countersigned copy is available on request for your records.

1.2 This DPA reflects the requirements of Article 28 of the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR, and equivalent US state privacy laws that use "service provider" or "processor" terminology (including the CCPA/CPRA). Capitalised terms not defined here have the meaning given in the Terms or the Privacy Policy.

1.3 This DPA applies to Client Data — personal data that the Service processes on your behalf and under your instructions, principally the contacts, leads and form submissions stored in the Provisioned Assets in your SFMC account. It does not apply to Account Data, for which Formentic is an independent controller, as described in the Privacy Policy.

2. Roles of the parties

2.1 As between the parties, the Client is the controller (or "business"/"covered entity" under applicable US law) and Formentic is the processor (or "service provider"/"contractor") of Client Data.

2.2 The Client is solely responsible for determining the lawful basis for processing Client Data, providing any required notices and obtaining any required consents from its data subjects, and for the accuracy and legality of Client Data it submits to the Service.

3. Details of processing

  • Subject matter: the provision of the Formentic form-building, email-building and Cloud Page publishing Service, including provisioning and updating Data Extensions, content blocks and emails in the Client's SFMC account, managing on the Client's instruction the triggered sends that use the Client's Formentic Emails and, if the Client uses Credits, reading credit usage figures from the Client's Data 360 org.
  • Duration: for the term of the Agreement, plus any period Client Data is retained afterward under Section 12 below.
  • Nature and purpose: storage, structuring, reading, writing, and deleting of records in Provisioned Assets, and the limited operations on Linked Client Assets described in the Terms, Section 4.2, strictly to configure, operate, support and improve the Service for the Client, and technical support activities described in the Terms.
  • Categories of data subjects: the Client's contacts, leads, customers, event registrants, or other individuals whose data the Client chooses to route through forms built with the Service.
  • Categories of personal data: the specific fields the Client configures in its forms and Data Extensions — typically name, email address, and other contact or preference fields the Client selects. The Client controls what fields exist and what data is collected; Formentic does not decide this. Credits reads no customer records; asset names are chosen by the Client, and a name that happens to contain a person's name is incidental.
  • Special categories of data: Formentic does not knowingly process special categories of personal data (Article 9 GDPR) or data relating to criminal convictions through the Service, and the Client agrees not to submit such data without Formentic's prior written agreement (see Terms, Section 6.5).
  • Form pages: where the Client chooses, Formentic's form code sets the cookies listed in the Cookie Policy, section 4, and waits for the visitor's consent as the Client has set it. The daily counts of sends saved and blocked by the bot checks are kept in the Client's SFMC account and hold no personal data.

4. Formentic's obligations

Formentic will:

  • process Client Data only on the Client's documented instructions, including regarding international transfers, unless required to do otherwise by law (in which case Formentic will inform the Client before processing, unless the law prohibits this);
  • ensure that persons authorised to process Client Data are subject to confidentiality obligations;
  • implement appropriate technical and organisational measures as described in Section 6 and Annex 1;
  • engage sub-processors only as permitted under Section 7;
  • assist the Client, taking into account the nature of the processing, in responding to data subject requests under Section 9;
  • assist the Client with its own security, breach notification, and data protection impact assessment obligations, to the extent Formentic's cooperation is reasonably needed and the relevant information is available to Formentic;
  • at the Client's choice, delete or return Client Data at the end of the Service, as set out in Section 12; and
  • make available the information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits under Section 11.

5. Confidentiality

Formentic ensures that personnel authorised to process Client Data have committed to confidentiality (whether by contract or statutory duty) and are trained on their data protection obligations before being given access.

6. Security measures

Formentic implements the technical and organisational measures described in Annex 1 (Technical and Organisational Measures) and summarised in the Security & Trust Center, taking into account the state of the art, cost of implementation, and the risk to data subjects. These measures may be updated over time provided they do not materially decrease the overall level of security.

7. Sub-processors

7.1 The Client gives Formentic general written authorisation to engage sub-processors to help provide the Service. The current list of sub-processors is maintained in the Subprocessor List, which forms part of this DPA.

7.2 Formentic will give the Client at least 30 days' advance notice before authorising a new sub-processor to process Client Data (by updating the Subprocessor List and, where practical, notifying account owners by email), giving the Client the opportunity to object on reasonable data-protection grounds. If the parties cannot resolve an objection, the Client may terminate the affected part of the Service.

7.3 Formentic imposes data protection terms on each sub-processor that are no less protective than this DPA, and remains liable to the Client for a sub-processor's performance of its obligations.

7.4 A tag manager, analytics tool or consent tool that the Client adds to its forms by ID (for example Google Tag Manager, Adobe Launch, Cookie Information, Cookiebot or OneTrust) is the Client's own vendor, loaded on the Client's instruction. It is not a sub-processor of Formentic, and the Client's own agreement with that vendor applies. Formentic sends it form events with the names of fields, never the answers.

8. International data transfers

Where Client Data is transferred outside the EEA, the UK or Switzerland, Formentic relies on an adequacy decision (including the EU–US Data Privacy Framework where the recipient is certified) or on the European Commission's Standard Contractual Clauses (Module 2: Controller to Processor), together with the UK International Data Transfer Addendum where relevant, and additional safeguards where needed. Those clauses are incorporated into this DPA by reference and prevail over any conflicting term of this DPA for the transfers they cover. A copy is available on request to legal@formentic.com.

9. Assistance with data subject rights

Formentic will, taking into account the nature of the processing, assist the Client by appropriate technical and organisational measures to respond to requests from data subjects exercising their rights under Applicable Data Protection Law. If Formentic receives such a request directly regarding Client Data, it will promptly forward it to the Client without responding, unless legally required to respond.

10. Personal data breach notification

Formentic will notify the Client without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Client Data, and will provide the information reasonably available to it to help the Client meet its own notification obligations under Applicable Data Protection Law, including a description of the nature of the breach, likely consequences, and measures taken or proposed.

11. Audits

On reasonable prior written notice (at least 30 days, or shorter in the case of a suspected breach) and no more than once per 12 months, Formentic will make available the information reasonably necessary to demonstrate compliance with this DPA, including relevant summaries of audits or certifications where available, and will allow for and contribute to audits or inspections, which may be satisfied by a mutually agreed third-party audit report where one exists, conducted during business hours and subject to confidentiality, at the Client's expense.

12. Deletion or return of data

At the end of the Service, the Client may export Client Data for 30 days. After that period, Formentic will delete Client Data and related integration credentials from its own systems within 60 days, unless the law requires longer retention, in which case Formentic will continue to protect the data and limit processing to what the law requires. Client Data that resides in the Client's own SFMC account, including the Provisioned Assets, is not held by Formentic and is unaffected by this Section — it remains under the Client's sole control.

13. Liability

Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in Section 11 of the Terms.

14. Term

This DPA takes effect on the date the Client accepts the Terms and remains in effect for as long as Formentic processes Client Data on the Client's behalf.

15. Governing law

This DPA is governed by the same governing law and jurisdiction as the Terms (Section 14.2), except where the Standard Contractual Clauses incorporated under Section 8 specify otherwise for the transfers they cover.

Annex 1: Technical and organisational measures

  • Encryption in transit: TLS 1.2 or higher for all traffic between the Client, the Service, and Formentic's infrastructure.
  • Encryption at rest: SFMC integration credentials and other secrets are encrypted at rest (AES-256); Users' passwords are never stored in readable form and are stored only as salted cryptographic hashes (SHA-2 family).
  • Access control: role-based access, least-privilege principles, and row-level security in Formentic's database so one Client's data is not reachable through another Client's session.
  • Logging and monitoring: User actions in the Service are logged for security and accountability, as described in the Terms, Section 6.2.
  • Scoped SFMC access: the Installed Package is limited to Data Extension, Documents and Images, Saved Content and Email read/write permissions (and Journeys read where the Client chooses to grant it), and Formentic's systems act only on the Provisioned Assets and, as described in the Terms, Section 4.2, the Linked Client Assets.
  • Personnel: confidentiality obligations, need-to-know access to production systems and credentials, and security awareness for staff.
  • Backups and continuity: regular backups of Formentic's own systems and a documented approach to restoring service after an incident.
  • Vendor management: written agreements with sub-processors imposing data protection obligations, as described in Section 7.

Annex 2: Sub-processors

See the Subprocessor List, incorporated into this DPA by reference.