Privacy policy — Typeform

Cited by

Facts read from this source

• Entity Report an error

  “TYPEFORM, S.L. Via Augusta 29 - 31, 08006 – Barcelona (Spain)”

• Policy last updated Report an error

  “This policy was last updated on March 14, 2024.”

• US joint controllers Report an error

  “For the activities to offer and sell you the plan and following-up with the commercial relationship with you, both Typeform SL and Typeform US LLC act jointly and severally, as joint data controllers. On the contrary, for providing the services only, Typeform SL is the entity acting as sole data controller.”

• DPA available Report an error

  “If you are using our Services and you are interested in learning how we are processing any personal data that we collect on your behalf, please check our Data Processing Agreement out in the following link. Please note that in this case you are the Data Controller and we are the Data Processor as further elaborated within the DPA.”

• Certifications Report an error

  “These controls are part of our platform-wide security program, which is certified under SOC 2 Type II, ISO/IEC 27001:2022, ISO/IEC 27017, ISO/IEC 27018, ISO/IEC 27701, CSA STAR, and HIPAA, and is GDPR-compliant.”

• Trust center Report an error

  “Additional security documentation, audit reports, and certifications are available at https://trust.typeform.com.”

• Complaint authority Report an error

  “You can always lodge a complaint at any time with the Spanish Data Protection Agency.”

• Retention contractual Report an error

  “we will process your data when we have to perform a contract, and we will be processing your data as long as the contractual relationship with you is in force and during the five years following the end of said relationship.”

• Account deletion Report an error

  “Please note that if you choose to cancel your data as a customer, your account will be deleted and all data in your account will be permanently deleted from our systems.”

• Backup retention google data Report an error

  “encrypted backups follow the same controls and a 15-day retention policy”

• Encryption at rest Report an error

  “All data at rest is encrypted with AES-256, using keys managed by AWS Key Management Service (KMS)”

• Encryption in transit Report an error

  “All communication with Google APIs, and all internal service-to-service communication within our infrastructure, is encrypted in transit using TLS 1.2 or 1.3.”

• Storage infrastructure Report an error

  “Google user data accessed by our Google Calendar scheduler block (OAuth access and refresh tokens, the connected account's email and display name) is stored exclusively in a PostgreSQL database hosted on AWS RDS within our production VPC.”

• Eea processing Report an error

  “For clarification purposes, we will process information from the European Economic Area. In some cases, data may also be processed from other countries, including the UK, in which case we will implement the security measures required by law.”

• US customers processing Report an error

  “For clarification purposes, we will process information from the European Economic Area and the US. In some cases, data may also be processed from other countries, including the UK, in which case we will implement the security measures required by law.”

• International transfer mechanism Report an error

  “In particular, we will be signing Standard Contractual Clauses to ensure that the information is protected at all times and applying additional technical and organizational measures to ensure that the information is protected at all times.”

• Categories Report an error

  “The categories of recipients of personal data are: (i) hosting and infrastructure providers; (ii) providers of audience analytics tools; (iii) providers of product and user experience analytics tools; (iv) providers of security of our systems; (v) providers of subscription, accounting and billing management; (vi) auditing and consulting services providers; (vii) providers of marketing campaign management; (viii) providers of electronic communication management; (ix) providers that supports customer relationship management; (x) providers of SSO services; and (xi) our affiliates.”

• Respondent controller relationship Report an error

  “please note that we are not the entity responsible for the processing of data, but a mere provider rendering services to the person or company that sent you the form at issue.”

• Respondent data visibility Report an error

  “Also, depending on how the person or company that sent you a form configured that form, your data may be shared or made public.”

• Workspace activity visibility Report an error

  “We share your profile information with other users to permit and facilitate that you collaborate with them, and work across multiple workspaces and organizations. This information includes your name, account email, as well as things like the forms that you have created or removed, the time they were edited, or usage activity. As a result, the administrator of the organization or workspace where you collaborate may be able to access or export logs of your activity.”

• Public result sharing Report an error

  “you may opt for creating a form and share publicly the results that are displayed not in an aggregated manner but by providing the particular responses provided by respondents.”

• Signin providers Report an error

  “Microsoft Corporation, dba. Microsoft - for further information on their Privacy Policy click here. Google Ireland Limited, dba. Google - for further information on their Privacy Policy click here. Automattic Inc., dba. Gravatar - for further information on their Privacy Policy click here.”

• Google calendar block Report an error

  “Should you decide to use the 'calendar block' functionality with your Google Inc. email account, Google Inc. will share with us your email address and whether it is verified or not, your full name, calendar names, IDs, access roles, calendar time zone and available slots, but no specifics of your appointments (name, content, or attendees) will be shared.”

• Data enrichment Report an error

  “We may enrich the data we have about you by obtaining information from a select third party for data enrichment purposes, provided that you have given us prior permission.”

• Site access no personal info required Report an error

  “You are not required to provide any personal information when using the Site, unless you choose to access features that require such information (as, by way of example, subscribing to any newsletter).”

• User rights Report an error

  “You have the right to withdraw your consent at any time. You also have the right to request access to, and rectification of, or erasure of your personal data, or restriction of processing, or to object to processing, as well as the right to data portability.”

• Privacy contact channels Report an error

  “Send a request via our Typeform Contact Form or VideoAsk Contact Form. In the Help Center click on the Contact Support link at the bottom of any article. You can always contact us at gdpr@typeform.com for any privacy-related matters.”

• Personnel access controls Report an error

  “Operational access by Typeform personnel requires SSO with enforced MFA, is granted on a least-privilege basis, and is logged and audited.”

• CCPA notice Report an error

  “if you are a California resident, please click here and refer to the ‘CCPA Notice’ section for additional California-specific privacy disclosures”

1 fact read from this page is not shown because it could not be confirmed on the page as captured.

Scores citing this record

• The Academic Researcher Consent, GDPR & respondent data
• The Academic Researcher Hosting choice, teams & portability
• The Academic Researcher European sovereignty
• The Data Protection Officer Consent, GDPR & respondent data
• The Data Protection Officer Hosting choice, teams & portability
• The Data Protection Officer European sovereignty
• The HR Lead Consent, GDPR & respondent data
• The HR Lead Hosting choice, teams & portability
• The HR Lead European sovereignty
• The Market Researcher Consent, GDPR & respondent data
• The Market Researcher Hosting choice, teams & portability
• The Market Researcher European sovereignty
• The Operations Manager Consent, GDPR & respondent data
• The Operations Manager Hosting choice, teams & portability
• The Operations Manager European sovereignty
• The Skeptic Consent, GDPR & respondent data
• The Skeptic Hosting choice, teams & portability
• The Skeptic European sovereignty