Data processing agreement — Typeform

Cited by

Facts read from this source

• DPA entity Report an error

  “This Data Processing Agreement entered into between you and TYPEFORM SL (the “Company”, “we”, or “us”) regulates the particularities of data processing in connection with your use of both the platform accessible through the www.typeform.com and www.videoask.com domain names”

• Exporter identity Report an error

  “Data exporter(s): TYPEFORM, S.L., a Spanish entity with registered address at Via Augusta 29 - 31, 08006 – Barcelona (Spain), and N.I.F. (Spanish tax identification number) B65831836. The Company is registered in the Commercial Registry of Barcelona, page B-421911, folio 145, volume 43262.”

• Supervisory authority Report an error

  “C. COMPETENT SUPERVISORY AUTHORITY –the Spanish Data Protection Agency.”

• Audit certifications Report an error

  “You agree that the obligation to provide information demonstrating compliance with this DPA may be satisfied by us making available to you copies of the audit reports and/or certifications undergone by us, such as ISO27001 or SOC2 certificates.”

• Audit rights Report an error

  “you agree that you may only conduct up to one (1) audit per year, unless there are reasonable grounds to believe that we are not performing the obligations laid down in this DPA. Audits will only be carried out during normal business hours, and you will bear all costs unless we are found to be in a material breach of this DPA.”

• Affiliates Report an error

  “TYPEFORM shall be entitled to seek the assistance of its affiliates TYPEFORM US LLC, conducting business in the US and having registered address at Spaces 95, 3rd St. 2nd Floor - San Francisco, CA 94103 (United States of America); TYPEFORM UK Limited, a company incorporated in England and Wales with registered office at 9th Floor, 107 Cheapside, London, EC2V 6DN (United Kingdom); and Typeform DE GmbH, a company incorporated in Germany with registered office at EdisonStr. 63 - 12459 Berlin (Germany).”

• List URL Report an error

  “Said page includes a current list of approved subprocessors for purposes of this Section.”

• Objection period Report an error

  “you will be entitled to reasonably oppose (i.e. any challenge based on the potential or actual failure to meet the legal requirements set forth by the GDPR by the subprocessor to be appointed) to such change in the non-extendable term of fifteen (15) calendar days and, if you exercise such right, we will be entitled to early terminate the contractual relationship set forth in for the provision of the Services.”

• Videoask named Report an error

  “Company shall be entitled to engage Amazon Web Services Inc., a US entity with registered address at 2021 Seventh Ave., Seattle — Washington 98121 (United States of America) for the provision of hosting services; Auth0, Inc., a US entity with registered address at 10800 NE 8th, St Suite 700, Bellevue, WA 98004 (USA) for user authentication services; Slack Technologies, LLC, a US entity with registered address at 500 Howard Street, San Francisco — California 94105 (USA)”

• Data processing instructions Report an error

  “We will process any personal data we may have access to because of the provision of the Services in accordance with the documented instructions provided by you from time to time.”

• Data categories Report an error

  “the types of personal data and the categories of data subjects that are likely to be used in our product are name, surname, email address, telephone number, other ID details belonging to employees, candidates, prospects, and clients.”

• Encryption Report an error

  “All data is encrypted in transit using modern encryption protocols (TLS 1.2 or higher). At rest, data is encrypted using robust encryption standards (AES-256). Keys are managed through secure, centralized key management services to ensure confidentiality and integrity.”

• Access controls Report an error

  “Access to data and systems is limited according to the principle of least privilege and managed via role-based access control. Multi-factor authentication is required for all privileged users, and access provisioning is integrated with Single Sign-On systems.”

• Penetration testing Report an error

  “Routine vulnerability scans are performed across all environments. Security updates and patches are applied based on risk assessment, severity, and system criticality. External security assessments and penetration tests are conducted regularly.”

• Backups Report an error

  “Backups are encrypted and created on a daily basis, with redundancy across multiple geographic regions. Business continuity and disaster recovery plans are documented, tested, and regularly updated to ensure system resilience and data availability.”

• Breach notification Report an error

  “we will notify you without undue delay upon we becoming aware of a personal data breach affecting personal data and, in any event, within the deadlines set forth under the GDPR.”

• Scc module4 Report an error

  “you and us enter into the SCCs, module 4, as a mechanism to ensure the adequate protection of personal data being transferred outside the EEA.”

• UK addendum Report an error

  “International Data Transfer Addendum to the EU Commission Standard Contractual Clauses This Addendum has been issued by the Information Commissioner for Parties making Restricted Transfers.”

• Scc law Report an error

  “In Clause 13, 17 and 18, Spanish law shall be the applicable law, and the competent courts and authorities of the Kingdom of Spain shall be the ones competent to solve any disputes connected with the SCCs.”

• Deletion on termination Report an error

  “You will decide whether you want us to delete or return personal data, unless Union or Member State law requires storage of the personal data. To this end, you acknowledge that deletion of the account provided as part of the Services will always result in deletion of personal data, and its request to delete the account will be understood as a request to delete data under this Section 7.”

• Inactive free user deletion Report an error

  “If you are an inactive free user, as this term is described in the STC, you accept that data is deleted after the 24-month period of time set forth in these STC.”

• Retention period Report an error

  “The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: data will be retained for as long as the data exporter requires the services.”

• Data subject requests Report an error

  “we will send to you any request data subjects may address directly to us together with all relevant information, if any, so that you can formally contact and answer to data subjects.”

• Employee confidentiality Report an error

  “We will ensure that all employees authorized to process personal data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality.”

• Subprocessor liability Report an error

  “We will enter into written agreements with any sub-processors engaged in the provision of the Services including the safeguards and guarantees required by the GDPR, particularly in respect of implementing the security measures required in the GDPR, and we will be liable for any actions by our sub-processors.”

• Sensitive data Report an error

  “sensitive information may be processed, and subject to the security measures described in Annex II.”

• Transfer frequency Report an error

  “The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis) – Continuous basis.”

• CCPA notice Report an error

  “If you are also subject to the CCPA, please check our ‘CCPA Notice’ here to learn which specific provisions apply to you.”

• DPA last updated Report an error

  “This policy was last updated on July 20, 2026, to clarify the identities of the data exporter and the data importer in Annex IV and to revise the technical and organisational measures in Annex II so they reflect the enhanced current practices.”

• UK spain transfers Report an error

  “Should you be based in the United Kingdom, the Parties declare that the transfer of data from the United Kingdom to Spain or from Spain to the United Kingdom will not be construed as an international transfer of personal data, considering the adequacy decisions passed on this subject.”

• Free plan after cancel Report an error

  “Canceling your paid subscription shall not result in a termination of the Services and, therefore, a termination of this DPA. You will still be able to keep using our Services under a free plan, but some of the functionalities offered to you may not be fully available.”

Scores citing this record

• The Academic Researcher Consent, GDPR & respondent data
• The Academic Researcher European sovereignty
• The Data Protection Officer Consent, GDPR & respondent data
• The Data Protection Officer European sovereignty
• The HR Lead Consent, GDPR & respondent data
• The HR Lead European sovereignty
• The Market Researcher Consent, GDPR & respondent data
• The Market Researcher European sovereignty
• The Operations Manager Consent, GDPR & respondent data
• The Operations Manager European sovereignty
• The Skeptic Consent, GDPR & respondent data
• The Skeptic European sovereignty