Data Processing Addendum

1. Scope

This addendum applies when Rowform processes personal data contained in forms, responses, uploaded files, and related service records on a customer's behalf. It supplements the agreement governing the customer's use of Rowform.

2. Roles and instructions

The customer is the controller or a processor acting for another controller. Rowform is the processor or subprocessor for customer response data. Rowform processes that data to provide, maintain, secure, and support the service, and according to the customer's documented use of the product.

3. Processing details

Processing can include collection, storage, organization, retrieval, transmission, deletion, and other operations needed to provide online forms and related workflows. Data subjects can include customer users, respondents, and people whose information a customer submits. Data categories depend on the customer's form and may include contact details, responses, uploaded files, identifiers, and technical usage information.

4. Data location and transfers

Primary response data is stored through Supabase in the EU. Selected subprocessors may process limited data in other regions, as described in our DPA and subprocessor list. Rowform does not sell respondent data.

Supabase is configured for primary data storage in Frankfurt, Germany. Vercel may process service-delivery data globally. ZeptoMail processes limited transactional-email data in India. The customer authorizes the subprocessors listed on the subprocessor page.

5. Confidentiality and security

Rowform limits access to personal data to people and providers that need it to operate or support the service and requires them to handle it confidentially. Rowform maintains safeguards intended to protect the service against unauthorized access, alteration, loss, or disclosure. This statement does not claim a certification or recurring independent audit.

6. Assistance and deletion

Taking into account the nature of the service and information available to Rowform, Rowform will provide reasonable assistance with data-subject requests, security incidents, and legally required assessments. At the end of service, Rowform will delete or return customer personal data according to product functionality, contractual requirements, and applicable retention obligations.

7. Requests and execution

Contact arjun@rowform.io to request an executed DPA or ask about transfer terms that apply to your organization.