Data processing agreement

“Personal Data,” “Processing,” “Controller,” “Processor,” “Data Subject,” and “Personal Data Breach” have the meanings given in the EU GDPR, UK GDPR, or other applicable data protection law.

“Service” means Formable’s hosted software and APIs for document workflows, including e-signing, redlining, templates, and related features. “Sub-processor” means a third party engaged by Formable to Process Personal Data on behalf of Customer.

Customer is the Controller (or a processor acting on behalf of a controller). Formable is the Processor for Personal Data contained in Customer Content and related workflow data processed under Customer’s instructions. Each party will comply with data protection laws applicable to its role.

• Subject matter: Providing the Service to Customer.
• Duration: For the term of Customer’s use of the Service plus any retention period required by the agreement or law.
• Nature and purpose: Hosting, transmitting, displaying, signing, redlining, notifying, auditing, and supporting document workflows as configured by Customer.
• Types of Personal Data: As determined by Customer, which may include names, email addresses, titles, signature data, IP/device metadata, and document contents that include Personal Data.
• Categories of Data Subjects: As determined by Customer, which may include Customer personnel, counterparties, signers, and other individuals identified in Customer Content.

Formable will Process Personal Data only on documented instructions from Customer, including through the Service configuration and API calls, unless required by law. If Formable believes an instruction infringes applicable data protection law, it will notify Customer without undue delay where legally permitted.

Formable ensures that persons authorized to Process Personal Data are bound by appropriate confidentiality obligations.

Formable implements appropriate technical and organizational measures designed to protect Personal Data against unauthorized or unlawful Processing and against accidental loss, destruction, or damage, including encryption in transit and at rest where appropriate, access controls, logging, and vulnerability management. Additional information is available on our Security page.

Customer authorizes Formable to engage Sub-processors to support delivery of the Service. Formable will impose data protection obligations on Sub-processors that are no less protective than those in this DPA in material respects.

Formable will remain responsible for Sub-processor performance. Customer may request information about current Sub-processors through their Formable account where available. Formable will provide notice of material Sub-processor changes where required by applicable law or Customer’s written agreement.

Where Personal Data is transferred from the EEA, UK, or Switzerland to a country without an adequacy decision, Formable will implement an appropriate transfer mechanism, such as the EU Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum, unless another lawful mechanism applies.

Taking into account the nature of Processing, Formable will:

• Assist Customer by appropriate technical and organizational measures with Data Subject requests, to the extent possible
• Assist Customer with security, breach, DPIA, and prior consultation obligations, considering the information available to Formable
• Make available information reasonably necessary to demonstrate compliance with this DPA

Formable will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Personal Data Processed under this DPA, and will provide information reasonably available to help Customer meet its notification obligations.

Upon termination of the Service or written request, Formable will delete or return Personal Data in Customer Content according to Service functionality and Customer instructions, unless retention is required by law or needed for short-term backups that are securely isolated and deleted on a rolling schedule.

Upon reasonable written request, Formable will provide documentation or reports reasonably sufficient to demonstrate compliance with this DPA. If Customer reasonably requires an audit beyond available documentation, the parties will agree on scope, timing, and confidentiality, and audits will be limited to once per twelve months unless a Personal Data Breach or regulatory requirement justifies more frequent review.

Liability under this DPA is subject to the limitations and exclusions in the Formable Terms and Conditions or other governing commercial agreement, except where prohibited by applicable data protection law. If there is a conflict between this DPA and the Terms regarding Processing of Personal Data, this DPA controls.