1. Who we are
EventForm Pro™ is operated by NJ Services.
The legal operator is Nathan Jorden.
In this notice, “we”, “us” and “our” mean the operator of EventForm Pro™.
Business address: 61 Deerlands Way, Beckingham, Doncaster, S Yorks, DN10 4FW.
Privacy contact: privacy@eventform.pro.
2. Our role depends on the data
For information about EventForm Pro customers, account users, billing contacts, security logs and our own business relationship with you, we generally act as a data controller.
When a customer uses EventForm Pro to create a form and collect responses, the customer normally decides why the form is being used, what information is requested and what happens to the responses. For that customer-controlled content, the customer is normally the controller and we act as its data processor. Our Data Processing Terms apply to that processing.
3. Information we handle
Customer and account information
- name, email address, organisation/workspace name and account role;
- authentication and account-security information;
- plan, usage, storage and subscription status;
- Stripe customer, subscription and billing references, payment status and invoice-related information; and
- support communications and any information you choose to send us.
Payment card details are entered into Stripe-hosted payment pages. EventForm Pro does not need to store your full card number or card security code.
Service and technical information
- IP address, browser/user-agent information and request/security logs;
- session and CSRF-protection information;
- API token metadata and audit information (API secrets themselves are stored in hashed form); and
- a record of legal terms accepted during self-service signup, including the version, time, IP address and user agent.
Customer form content
Depending on how a customer configures a form, EventForm Pro may process names, contact details, event or job information, free-text answers, dates, selections, ratings, files, photographs and other information submitted by respondents. Customers control the questions they ask and are responsible for making sure they have an appropriate reason and lawful basis for collecting that information.
4. Why we use personal information
| Purpose | Typical basis when we act as controller |
|---|---|
| Provide accounts, subscriptions, billing and support | Necessary to perform our contract or take steps at your request before entering a contract. |
| Secure, operate, troubleshoot and improve the service | Our legitimate interests in operating a reliable and secure SaaS service, balanced against your rights. |
| Maintain accounting, tax, fraud-prevention and legal records | Compliance with legal obligations and, where appropriate, legitimate interests. |
| Send essential service, security, billing and account messages | Contract, legal obligation or legitimate interests depending on the message. |
Where an account user is acting for a Customer organisation rather than contracting with us personally, our legitimate interests in administering that business relationship may apply instead of contractual necessity for that user's account data.
Where we process customer form content as a processor, we process it to provide the service under the customer's documented instructions rather than choosing a separate purpose of our own.
5. Who we share information with
We only share personal information where needed to run EventForm Pro, comply with law, protect the service or provide a feature requested by a customer. Relevant service providers can include:
- Stripe for hosted checkout, subscription billing, payment status and the customer billing portal;
- Microsoft 365 / Exchange Online for transactional and response email delivery, which can include form-response content and attachments where a customer has configured email delivery;
- our infrastructure hosting provider for application hosting, databases and private response-file storage (currently IONOS, United Kingdom);
- Google Fonts to deliver the Public Sans web font, which can involve the visitor's browser making a request to Google; and
- professional advisers, insurers, authorities or law-enforcement bodies where reasonably necessary or legally required.
We do not sell personal information to advertisers.
6. International transfers
Some service providers may process information outside the United Kingdom. Where data-protection law requires a transfer safeguard, we use or rely on an appropriate lawful mechanism, such as adequacy regulations or approved contractual safeguards. The exact position can depend on the provider and service in use at the time.
7. How long we keep information
- Account data: generally for the life of the account and for a reasonable period afterwards where needed for records, disputes, security or legal obligations.
- Billing and transaction records: for the period required by applicable tax, accounting and legal rules.
- Customer form responses and uploaded files: normally until the customer deletes them, the account is closed and the applicable deletion process completes, or an agreed retention rule applies.
- Security and service logs: for a proportionate period based on operational and security needs.
Deleted data may remain temporarily in backups or recovery copies until those copies are rotated or securely removed.
8. Security
We use technical and organisational measures appropriate to the service, including authenticated customer areas, organisation-level access checks, private storage for response files, hashed passwords, hashed API-token secrets and HTTPS/TLS in production. No internet service can guarantee absolute security, and customers are responsible for protecting their own account credentials and choosing appropriate form content.
9. Your rights
Depending on the circumstances, UK data-protection law can give you rights to access, correct, erase or restrict use of your personal information, object to certain processing, receive portable data, and withdraw consent where consent is the basis used.
If your request concerns data in a form created by one of our customers, contact that customer first where possible because it normally controls the purpose and use of the response. You may also contact us and we will route or assist with the request as appropriate.
10. Complaints
Please contact us first at privacy@eventform.pro so we can try to resolve the issue. You also have the right to complain to the UK Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint.
11. Changes to this notice
We may update this notice as EventForm Pro changes or legal requirements develop. The effective date and version at the top of this page identify the current published version.