1. Status and scope
These Data Processing Terms (“DPT”) form part of the EventForm Pro™ Terms of Service where NJ Services processes personal data contained in Customer Content on behalf of a Customer.
For that processing, the Customer is the controller (or a processor acting with authority from another controller) and we are the processor. The Customer remains responsible for determining the purposes and lawful basis of its forms and for providing required privacy information to respondents.
2. Processing details
| Subject matter | Providing the EventForm Pro form-building, response collection, private file storage, response email, API, administration and support features. |
|---|---|
| Duration | For the Customer's use of the service and any limited post-termination retention, backup or deletion period. |
| Nature and purpose | Collection, transmission, validation, organisation, storage, retrieval, display, email delivery, download, deletion and other processing required to provide the service on the Customer's instructions. |
| Data subjects | People who complete Customer forms and, depending on the Customer's use, its staff, crew, contractors, suppliers, clients, event attendees and other contacts. |
| Personal data | Names, contact details, event/job information, free-text answers, dates, selections, ratings, technical identifiers, files, photographs and any other information the Customer chooses to request or upload. |
| Sensitive data | Not required by the platform. A Customer may only collect special-category, criminal-offence or other high-risk data when it has assessed the legal and security requirements and determined that doing so is appropriate. |
3. Documented instructions
We will process Customer personal data only on the Customer's documented instructions, including these Terms, the Customer's configuration of forms and recipients, API requests and support instructions, unless applicable law requires otherwise. If law requires processing outside those instructions, we will inform the Customer before processing unless the law prohibits us from doing so.
4. Confidentiality and access
We will ensure that people authorised to process Customer personal data are subject to appropriate confidentiality obligations and receive access only as needed for their role.
5. Security measures
Taking account of the nature of the processing, we maintain proportionate technical and organisational safeguards. Current controls include:
- authenticated customer administration areas and organisation-level authorisation checks;
- hashed passwords and one-way hashing of API-token secrets;
- private, non-public storage paths for retained response files;
- HTTPS/TLS for production web traffic;
- server-side validation and conditional-logic recalculation for public submissions;
- rate limiting on relevant public/authentication endpoints; and
- restricted authenticated download routes for stored response files.
Security measures may evolve as the service changes, provided the overall level of protection is not materially reduced without good reason.
6. Sub-processors
The Customer gives general written authorisation for us to use sub-processors needed to provide the service. We remain responsible for imposing appropriate data-protection obligations on sub-processors that process Customer personal data for us.
| Provider | Service | Customer data involved |
|---|---|---|
| IONOS | Application, database and private file hosting in United Kingdom. | Account data, forms, responses, uploaded files and service logs. |
| Microsoft 365 / Exchange Online | Transactional and configured response-email delivery. | Email addresses and the response content/attachments included in messages sent at the Customer's instruction. |
Stripe processes billing and payment information for our commercial relationship with the Customer but is not used to process the content of Customer form responses as part of the core response-processing service.
Where practicable, we will give reasonable notice of a material new sub-processor before it begins processing Customer personal data. A Customer with a reasonable data-protection objection should contact us promptly so the parties can discuss an appropriate solution.
7. International transfers
We will not intentionally transfer Customer personal data outside the United Kingdom unless the transfer is permitted under applicable data-protection law and an appropriate transfer mechanism or safeguard is in place where required.
8. Data-subject requests
Taking account of the nature of the processing, we will provide reasonable assistance to the Customer with requests to exercise data-subject rights. Where a respondent contacts us directly about Customer-controlled form data, we may refer the request to the relevant Customer unless law requires us to handle it differently.
9. Personal-data breaches
If we become aware of a personal-data breach affecting Customer personal data, we will notify the Customer without undue delay and provide information reasonably available to us to help the Customer meet its legal obligations. Notification does not constitute an admission of fault or liability.
10. Compliance assistance
Taking account of the nature of the processing and information available to us, we will provide reasonable assistance with the Customer's obligations concerning security, breach assessment/notification, data-protection impact assessments and relevant regulator consultation.
11. Deletion and return
During an active account, Customers can view, download and delete stored responses and files through the service. On termination, and subject to legal obligations and backup cycles, we will delete or render inaccessible Customer personal data after the applicable retention period. If a Customer needs an export, it should request or download it before account closure.
12. Audit information
We will make available information reasonably necessary to demonstrate compliance with these processor obligations. Where a Customer reasonably requires further verification, the parties will first use existing documentation and remote information. Any audit must protect other customers' data and our confidential security information, avoid unreasonable disruption, and be proportionate to the risk.
13. Customer instructions and responsibilities
The Customer warrants that its instructions are lawful and that it has all required notices, lawful bases, permissions and conditions for the personal data it submits to the service. If we reasonably believe an instruction infringes applicable data-protection law, we may notify the Customer and pause the affected processing while the issue is resolved.
14. Contact
Data-processing questions can be sent to privacy@eventform.pro.