Data Processing Agreement

Purpose and Scope

This Data Processing Agreement sets the terms on which FORMA DIGITAL S.R.L. processes personal data on behalf of a client. Art. 28 of the GDPR requires a written contract wherever one party processes personal data for another, and this is ours.

It forms part of the Client Services Agreement and applies whenever we process personal data for you in delivering the services. Accepting a Statement of Work under that agreement brings this document with it, and it binds both of us from that point without a separate signature.

Where this agreement and either the Client Services Agreement or a Statement of Work differ on the processing of personal data, this agreement prevails, as that agreement provides.

Everything else in the Client Services Agreement continues to apply and is not repeated here. That includes its governing law and jurisdiction, its termination rules, its confidentiality obligations and its limitation of liability, none of which this document restates. Its limitation of liability continues to govern claims between us on its own terms: this document neither extends it nor disapplies it.

These are our standard processor terms, offered so that an engagement can start without negotiating a data protection contract from scratch. If your organisation has its own data processing agreement, we are willing to enter into it instead by written agreement, in which case it replaces this one for that engagement.

This document covers personal data we process for you. Personal data we process for our own purposes, including your billing details and our correspondence with the people you nominate, is covered by our Privacy Policy instead, where we are the controller rather than the processor.

Definitions

These terms carry the meanings given in Art. 4 of the GDPR. They are repeated here so that the rest of the document can be read without a second tab open.

Data protection law Regulation (EU) 2016/679, the General Data Protection Regulation or GDPR, together with the Romanian legislation implementing it, including Law no. 190/2018, and any other data protection or privacy law that applies to the processing.

Controller The party that determines the purposes and means of processing personal data, as defined in Art. 4(7). Under this agreement that is you.

Processor The party that processes personal data on behalf of the controller, as defined in Art. 4(8). Under this agreement that is us.

Personal data Any information relating to an identified or identifiable living person, as defined in Art. 4(1). In this agreement it means personal data we process on your behalf in delivering the Services, and nothing else.

Processing Any operation performed on personal data, as defined in Art. 4(2). It includes collection, storage, structuring, consultation, alteration, transmission, restriction and erasure. Simply holding data, or looking at it, is processing.

Data subject The identified or identifiable person the personal data relates to. Under this agreement, typically your customers, your leads, visitors to your website and members of your staff.

Personal data breach A breach of security leading to the accidental or unlawful destruction, loss or alteration of personal data, or to unauthorised disclosure of or access to it, as defined in Art. 4(12). A breach is not limited to an attack: an accidental disclosure or an irrecoverable deletion is one too.

Sub-processor Any third party we engage to process personal data on your behalf, as contemplated by Art. 28(2) and Art. 28(4). The ones you authorise today are listed in Annex III.

Services The services described in the applicable Statement of Work agreed under the Client Services Agreement, together with the standing terms that govern them.

Roles and Responsibility

You are the controller. You determine the purposes and the means of the processing, you decide what personal data enters the systems we build and run for you, and you decide what happens to it.

We are the processor. We process that personal data only to deliver the Services, and only on your instructions. Annex I describes the processing in the detail Art. 28(3) requires.

Where we process personal data about our own business relationship with you, including the contact details of your billing contact, the person who accepts a Statement of Work, and our correspondence with the people you nominate, we act as controller for that processing. Our Privacy Policy describes it, and it falls outside this agreement.

As controller you are responsible for having a lawful basis under Art. 6, and a further condition under Art. 9 where special category data is involved, for everything you ask us to process; for giving data subjects the information Arts. 13 and 14 require; for the accuracy and lawfulness of the data and instructions you give us; and for any consent the processing depends on. Consent for marketing messages is dealt with separately and more strictly under Automated Messaging: Your Compliance Obligations in the Client Services Agreement.

Each of us is responsible for its own compliance with data protection law. Art. 82 of the GDPR gives a data subject a right to compensation directly against a controller, and against a processor where the processor has not complied with obligations that data protection law directs specifically at processors or has acted outside or contrary to the controller’s lawful instructions. That right belongs to the data subject, is fixed by law rather than by contract, and cannot be limited by an agreement between us. Nothing here attempts to limit it.

As between us, each party bears the compensation, the administrative fine and the legal costs that result from its own breach of data protection law or of this agreement. Where one of us has paid a data subject more than its share of the responsibility, it may recover the excess from the other, as Art. 82(5) provides.

This section allocates responsibility. It sets no monetary limit of its own and it does not change the Limitation of Liability section of the Client Services Agreement, which continues to govern claims between us.

Processing on Your Instructions

We process personal data only on your documented instructions, including in relation to transfers to a country outside the European Economic Area, unless Union or Member State law to which we are subject requires otherwise. Where such a law applies, we tell you of that legal requirement before we process, unless that law forbids us from telling you on important grounds of public interest. A demand under the law of a country outside the European Union is not a ground under this paragraph for departing from your instructions.

Your documented instructions are this agreement and its annexes, the Client Services Agreement, the applicable Statement of Work, and any further instruction you give us in writing, which includes email. We act on a verbal instruction only once you confirm it in writing, which protects both of us from a dispute about what was asked for.

We tell you immediately if we consider that an instruction infringes the GDPR or another provision of data protection law, as the second paragraph of Art. 28(3) requires, and we may suspend that instruction until the point is resolved. Telling you is not legal advice, and it does not move responsibility for the instruction from you to us.

We do not use personal data we process for you for any purpose of our own. We do not sell it, we do not rent it, we do not use it to train models of our own, and we do not combine it with data belonging to another client. Where an automation we build sends personal data to an AI provider or another platform on your instruction, that provider is a sub-processor and is named either in Annex III or in your Statement of Work.

Confidentiality of Personnel

Access to personal data we process for you is limited to the people who need it in order to deliver the Services. Today that is the two people who run the studio, together with the sub-processors in Annex III acting within their own service.

Every person we authorise is bound by an obligation of confidentiality, whether under their contract with us or under a separate written undertaking, and that obligation continues after their work with us ends. This is the commitment Art. 28(3)(b) requires.

We make sure that each authorised person knows what this agreement requires of them, and what the systems they are working in contain, before they are given access.

Access is withdrawn as soon as it is no longer needed, and in every case when the engagement ends. Credentials you granted us are revoked at that point and deleted from our password manager, as the Domains, Hosting and Accounts section of the Client Services Agreement requires.

Security of Processing

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as Art. 32 of the GDPR requires, taking into account the state of the art, the cost of implementation, the nature, scope, context and purposes of the processing, and the risk to the rights and freedoms of data subjects.

The measures in place today are listed in Annex II. They are proportionate to what we actually hold for clients, which is business and customer contact details, enquiry content, project material and website usage data rather than large volumes of sensitive data.

We may change the measures as technology and risk change, provided that no change reduces the level of protection. Annex II is updated when they change, so that it stays a description of what is true rather than of what was true when this document was first published.

You decide whether the measures in Annex II are appropriate for the personal data you ask us to process, and you tell us before you send us data that needs more than they provide. We hold no security certification and we do not claim one. Where your risk assessment calls for a control we do not have, say so before the engagement starts and we will tell you plainly whether we can put it in place.

Sub-Processors

You give us general authorisation, within the meaning of Art. 28(2) of the GDPR, to engage the sub-processors listed in Annex III.

We notify you in writing at least 30 days before we add a new sub-processor or replace an existing one. The notice names the sub-processor, says what it will do, says where it will process, and names the transfer safeguard it relies on if it processes outside the European Economic Area.

You may object within those 30 days on reasonable grounds relating to data protection. We will work with you in good faith to resolve the objection, for example by proposing an alternative provider or by narrowing what the sub-processor would receive. While an objection raised in time is unresolved, we do not give the proposed sub-processor access to your personal data. If we cannot resolve it, you may terminate the affected part of the Services on written notice, without penalty: you pay for the work already performed, and we refund any prepayment that relates to Services we have not performed, other than a deposit that the Term and Termination section of the Client Services Agreement makes non-refundable, which that section continues to govern.

Before a sub-processor processes personal data for you, we impose on it, by written contract or by entering into the data processing terms it publishes, data protection obligations no less protective than those in this agreement, and in particular the obligations Art. 28(3) requires. We remain fully liable to you for a sub-processor’s performance of those obligations, as Art. 28(4) provides.

Where a provider is engaged directly by you and in your own name, as your hosting, analytics and third-party accounts are under the Client Services Agreement, that provider is your processor rather than our sub-processor, and its terms are between you and it. We will tell you which providers fall on which side of that line for your engagement.

We do not claim that a signed data processing agreement is already in place with every provider named in Annex III. Some of them serve our own systems rather than yours. On request we will tell you the position for any provider on the list, and we do not route personal data we process for you through a provider until the obligations described in this section are in place with it.

Requests from Data Subjects

If a data subject contacts us directly to exercise a right under Chapter III of the GDPR, we do not answer the substance of the request ourselves unless you instruct us to. We tell the person that we act on your behalf, and we forward the request to you without undue delay and in any event within 5 working days of receiving it.

We assist you in responding, by appropriate technical and organisational measures and so far as is possible, as Art. 28(3)(e) requires. In practice that means giving you the information we hold, and correcting, deleting, restricting, exporting or providing a copy of personal data on your instruction.

Reasonable assistance is included in the fees. Where a request, or a series of requests, would take disproportionate effort, we tell you before we begin and may charge our standard rates for the time beyond what is reasonable. We will not hold up work on a request while a fee is being discussed if the delay would put your statutory deadline at risk.

Personal Data Breach Notification

We notify you without undue delay, and in any event within 48 hours of becoming aware of it, of any personal data breach affecting personal data we process for you. Notice goes to the contact named in your Statement of Work, and to your data protection contact where you have given us one.

The notification describes, so far as we know it at the time: the nature of the breach, including where possible the categories and approximate number of data subjects and of personal data records concerned; the likely consequences; and the measures we have taken or propose to take, including any measure to mitigate the effects. Where we cannot give you everything at once, we give you the rest in phases without further undue delay rather than waiting for a complete picture.

The 48 hours is deliberately shorter than the 72 hours Art. 33(1) gives you for notifying your supervisory authority, so that the time you need to assess a breach and decide is not spent waiting for us.

We assist you with your own obligations under Arts. 33 and 34, including your notification to the supervisory authority and any communication to affected data subjects. We keep a record of breaches affecting personal data we process for you and make it available to you.

We do not notify a supervisory authority or a data subject on your behalf unless you instruct us in writing to do so. Whether a breach is notifiable, and to whom, is a decision for you as controller.

Impact Assessments and Prior Consultation

We provide reasonable assistance with data protection impact assessments under Art. 35, and with prior consultation of the supervisory authority under Art. 36, so far as the assessment relates to processing we carry out for you and taking into account the nature of the processing and the information available to us. This is the assistance Art. 28(3)(f) requires.

In practice that means describing the processing we perform, the systems and sub-processors involved, the data flows we have built, the retention we apply and the measures in Annex II. Whether an assessment is required, and what it concludes, are yours to decide as controller.

Assistance of this kind is included in the fees where it is proportionate to the engagement. Where it is not, the same rule applies as for data subject requests: we tell you before we begin and only then charge for the time beyond what is reasonable.

Information and Audits

We make available to you all the information necessary to demonstrate compliance with the obligations in Art. 28, and we allow and contribute to audits, including inspections, conducted by you or by an auditor you mandate. This is the obligation in Art. 28(3)(h).

Audits are subject to the following conditions:

• at least 30 days written notice, unless a personal data breach or a supervisory authority requires the audit sooner;
• during our normal business hours, and conducted so as not to disrupt our work unreasonably;
• no more than once in any 12 month period, unless a personal data breach has occurred or a supervisory authority or data protection law requires otherwise;
• subject to confidentiality, and not extending to another client’s data, to the systems of other clients, or to our commercial information;
• where you mandate a third-party auditor, that auditor is bound by confidentiality obligations no less protective than those in the Client Services Agreement;
• at your cost, except that where an audit finds a material breach of this agreement by us, we bear our own costs of cooperating and the cost of putting the breach right.

We may answer an audit request by providing a recent third-party audit report or certification covering the processing in question. We hold none today, so in practice we answer your questions directly and show you the evidence behind the answers.

International Transfers

We do not transfer personal data we process for you outside the European Economic Area, and we do not give access to it from outside the EEA, except as necessary to use the sub-processors listed in Annex III or on your documented instruction.

Where a transfer does take place, it is made under Chapter V of the GDPR and relies either on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework where the recipient is certified under it, or on Standard Contractual Clauses adopted by the European Commission, together with any supplementary measure that a transfer risk assessment shows to be necessary. The mechanism each recipient in Annex III relies on is named in that annex. Where a Statement of Work names a sub-processor that is not in Annex III and that processes outside the European Economic Area, that Statement of Work names the transfer safeguard it relies on, so that no recipient is authorised without its mechanism being stated somewhere.

If a mechanism we rely on is invalidated, withdrawn or ceases to cover a recipient, we tell you, and we either move that transfer onto a valid mechanism or stop it.

Copies of the Standard Contractual Clauses and the other transfer documentation we hold are available on request at privacy@forma.marketing.

Where you instruct us to place personal data on a platform outside the EEA that you have chosen, the transfer is made on your instruction and the assessment Chapter V requires is yours. We will tell you if we consider such an instruction unlawful, as the Processing on Your Instructions section provides.

Return and Deletion

At the end of the provision of the Services, and at your choice, we delete or return the personal data we process for you, and delete the existing copies, unless a law that applies to us requires us to keep it. Art. 28(3)(g) leaves that choice with you, and we do not make it for you.

Tell us which you want within 30 days of the engagement ending. We act on your choice within 30 days of receiving it. If we have heard nothing 30 days after the engagement ends, we return what is readily exportable and then delete the rest.

Return is made in the format the data is held in, or in a structured, commonly used and machine readable format where one is available. Handing back the accounts and credentials themselves is dealt with under Domains, Hosting and Accounts in the Client Services Agreement, and that obligation is not conditional on payment.

Two limits are worth stating plainly. Personal data may persist in routine backups after it has been deleted from live systems, until those backups expire on their normal cycle. While it is there it remains subject to this agreement, is not returned to live use, and is not accessed except to restore a system. And credentials and access you granted us are revoked and deleted at the end of the engagement in every case, whichever option you choose for the data.

Records we keep as controller for our own purposes, including invoices, contract records and correspondence with the people you nominate, are not covered by this section. They are kept for the periods set out in the Privacy Policy, some of which Romanian accounting law fixes rather than leaves to us.

Annex I: Details of the Processing

This annex records the detail Art. 28(3) requires a processor contract to state.

A Statement of Work may narrow or extend this description for the engagement it covers, and where it does it prevails over this annex on the description of the processing. It does not displace the obligations in the body of this agreement, which continue to apply to whatever the Statement of Work describes.

Annex II: Technical and Organisational Measures

These are the measures in place today, listed because Art. 32 requires them to be stated rather than assumed. Each one is a measure we actually operate. Nothing in this list is planned or aspirational. Where a measure applies only to engagements of a particular kind, the entry says so on its face rather than leaving it to be assumed.

1. Traffic between a browser and the systems we operate is encrypted in transit with TLS, and administrative access to those systems uses encrypted channels.
2. Multi-factor authentication is enabled on every account that holds client data or gives access to it.
3. Credentials a client grants us are held in a password manager, are never sent or stored in plain text over email or chat, and are revoked and deleted when the engagement ends.
4. Access is granted on a least-privilege basis and is limited to the two people who run the studio, together with the sub-processors in Annex III acting within their own service. Nobody else holds an account with us.
5. Every person with access is bound by an obligation of confidentiality that continues after their work with us ends.
6. The systems we control for our own operations are hosted inside the European Union, at netcup GmbH, Nürnberg, Germany.
7. Client work is kept separate. Hosting, analytics and third-party accounts for an engagement are held in the client’s own name under the Client Services Agreement, and we do not combine one client’s data with another client’s.
8. Log retention on the hosting we control is capped: access and connection logs are kept for a maximum of 14 days and are not copied anywhere that outlives them.
9. Where an engagement includes maintenance, platform and dependency security updates are applied as part of that engagement, on the schedule the Statement of Work sets.
10. We never store payment card data on our systems. Card payments taken through Stripe are handled inside Stripe’s checkout under their own terms and their own security controls; the card number never reaches us.
11. We keep a record of every personal data breach affecting personal data we process for a client. The record is held in our own systems, not with the provider whose systems the breach touched, and it states what happened, what we did about it, and when and how the client was told. It is made available to the client on request. The deadline, the recipient and the required content of a notification are fixed by Personal Data Breach Notification above.
12. Data, access and credentials are removed at the end of an engagement under Return and Deletion above.
13. This annex and the measures in it are reviewed at least once every 12 months, and again after any personal data breach. The date of each review is recorded, and where a review finds a measure no longer accurate or no longer sufficient, the measure and this annex are changed to match. This is the process Art. 32(1)(d) requires for evaluating whether the measures remain effective.

Two things this annex deliberately does not claim. We hold no security certification: no ISO 27001, no SOC 2, and no independent audit report. And we do not operate a tested restoration procedure of our own. The backups that exist are the ones our hosting provider takes; their frequency and their retention are set by that provider, are not contractually guaranteed to us, and we therefore do not promise you a restoration time or a recovery point. If your risk assessment needs one, say so before the engagement starts, because it is a control we would have to put in place rather than one we already have.

If your risk assessment requires a control that is not on this list, tell us before the engagement starts. We would rather say that we do not have it than list it here and breach this annex on the first day.

Annex III: Authorised Sub-Processors

These are the sub-processors you authorise under Sub-Processors above, with what each does, where it processes and the transfer safeguard it relies on. The list is maintained in one place with our Privacy Policy, so the two cannot drift apart. Providers that only ever process data from our own website, such as the service that relays our contact form, never touch your data and are therefore not sub-processors of yours; they appear in the Privacy Policy but not here. Not every entry here receives personal data in every engagement: which of them is involved depends on what your Statement of Work covers, and some of them serve our own systems rather than yours.

An engagement may need a sub-processor that is not on this list, for example a form or automation platform, an email sending service or an AI provider. Where it does, that sub-processor is named in your Statement of Work, and your acceptance of the Statement of Work is your authorisation for it. Any later addition or replacement follows the notification and objection process in Sub-Processors above.

A safeguard in this table is the mechanism the provider relies on today, checked against that provider’s own published terms and re-checked whenever this list changes. It is not a promise that the provider will not change it. If one changes, International Transfers above says what we do.