Data processing agreement (DPA)

Parties and subject

This agreement under Art. 28 GDPR is concluded between the customer (controller) and Philipp Staudt IT-Dienstleistungen, Ursulinenstraße 40, 66111 Saarbrücken, Germany (processor) for the Formfeed service. It covers the personal data the customer sends to the API or the app for rendering documents, and the account data of the customer's users.

It is part of the terms of service for every paid plan. Customers on the Free plan may request it by email; the signed version is available as a PDF from hello@formfeed.dev.

Nature and purpose

Rendering PDF and image documents from templates and customer data, storing the outputs for the retention period the customer configures, delivering webhooks and emails the customer set up, and operating the service (logs, metering, support).

Categories of data and data subjects

Any personal data the customer includes in template data: names, addresses, contract and invoice details, identifiers. Data subjects are the customer's customers, employees and users. The customer decides what is sent and is responsible for its lawfulness.

Instructions

We process data only on documented instructions: the API calls, app actions and settings of the customer. Instructions outside the service require written agreement. We inform the customer if an instruction in our view violates data protection law.

Confidentiality and security

Staff with access are bound to confidentiality. Technical and organisational measures: EU-only processing, encryption in transit (TLS 1.2+) and at rest, per-tenant isolation through row-level security, API keys stored as hashes, signed and expiring download links, sandboxed rendering with network restrictions, access logging, least-privilege service accounts, regular dependency and vulnerability scanning, backups with point-in-time recovery. The security page describes the architecture.

Sub-processors

We use the sub-processors listed at formfeed.dev/legal/subprocessors. Changes are announced by email to the organisation owners at least 30 days in advance; the customer may object on reasonable data protection grounds, in which case either party may terminate the affected service.

Data subject rights and assistance

We forward requests from data subjects to the customer without undue delay and assist with technical means (export, deletion of specific renders or data). We assist with security incident notifications and data protection impact assessments as far as the service is concerned.

Personal data breaches

We notify the customer of a personal data breach affecting their data without undue delay after becoming aware of it, with the information available at that time, and follow up as the investigation progresses.

Deletion and return

Rendered documents are deleted at the end of the configured retention period. When the organisation is deleted, all data is removed within 30 days, backups within a further 30 days. On request before deletion, the customer exports templates and renders through the API or the CLI.

Audits

On request, we provide the information necessary to demonstrate compliance, including summaries of independent security assessments. Audits on site are possible once a year with reasonable notice, at the customer's expense, unless a supervisory authority requires otherwise.

Term

This agreement applies as long as we process data for the customer and ends with the deletion of the data. German law applies; place of jurisdiction is Saarbrücken.