Data processing agreement (DPA)

Deutsche Fassung

1. Parties and conclusion

This data processing agreement (DPA) applies between you as the controller ("Customer") and Mindcaptain Services OÜ, Ahtri tn 12, 15551 Tallinn, Harju County, Estonia as the processor ("we"). It sets out the duties under Art. 28 GDPR for personal data we process on your behalf. It is concluded by accepting the terms of service when using the services and applies to all apps operated under Smallwerk, currently Formlane.

2. Subject matter, nature and purpose

The subject matter is the Formlane form backend: receiving, storing, displaying, exporting (CSV) and deleting form submissions, spam and abuse checks (honeypot, keyword check, per-IP rate limit with a salted IP hash) and email notifications to the addresses you configure. The processing lasts for as long as your account exists, until you delete the account.

3. Types of data and data subjects

We process the contents of the form fields you define (e.g. name, email address, phone number, message and any other fields you create), submission metadata (time, salted IP hash, spam flag) and the recipient addresses of the notifications. Data subjects are the people who submit your forms and your staff who receive notifications. The service is not designed for special categories of personal data (Art. 9, 10 GDPR); you must not collect these through Formlane unless you have ensured their lawfulness yourself.

4. Instructions

The documented instructions are the terms, this DPA and your settings and actions in the app (creating or deleting forms and submissions, export, notification address, allowed domains, redirect). You give further instructions in text form to hello@smallwerk.com. If we consider an instruction to infringe data protection law, we inform you without undue delay (Art. 28(3) last sentence GDPR) and may suspend its execution until clarified. We process the data only on your instructions, unless we are required to process it under EU or member-state law; in that case we inform you beforehand, unless the law prohibits this.

5. Confidentiality

Persons authorised to process the data are bound to confidentiality.

6. Technical and organisational measures (Art. 32 GDPR)

We take the following implemented measures:

• Transport encrypted via HTTPS/TLS; in production the Content Security Policy additionally forces an upgrade to encrypted connections.
• Storage in a Supabase database in Frankfurt (eu-central-1); encryption at rest is provided by the provider.
• Database access only server-side via a service key; row level security is enabled with no public policies.
• Data is scoped per account.
• Sign-in via a one-time email link; we store no passwords.
• Content Security Policy with a per-request nonce and further security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy).
• Per-IP rate limits and spam checks.
• IP addresses only as a salted hash, deleted after 30 days.
• Deletion of individual submissions, whole forms and the whole account at any time in the app.
• No AI services, no tracking.

We may update these measures as long as the level of protection is not reduced.

7. Sub-processors

You grant general authorisation to use the following sub-processors. We inform you by email at least 30 days before adding or replacing a sub-processor; you may object and, if no solution is found, terminate. We bind sub-processors to equivalent obligations.

• Vercel Inc., USA — hosting and execution of the application; serverless functions in Frankfurt (fra1), static delivery/edge network worldwide. Transfer basis: EU-US Data Privacy Framework and/or standard contractual clauses.
• Supabase Inc., USA — database and sign-in; data stored in Frankfurt (eu-central-1). Data Privacy Framework/standard contractual clauses for any access from outside the EU.
• Resend (Plus Five Five, Inc.), USA — sending the notification and service emails (they contain the submission content and the recipient address); processing in the USA; Data Privacy Framework/standard contractual clauses.

Not sub-processors for submission data: Stripe (Stripe Payments Europe Ltd., Ireland; data is also processed by Stripe in the USA) processes only your own billing data, and ActiveCampaign (ActiveCampaign LLC, USA) only your own contact data and only with consent; for these we are the controller (see the privacy policy). Neither receives form submissions.

8. Third-country transfers

Transfers to third countries take place only under the conditions of Art. 44 et seq. GDPR (adequacy decision / Data Privacy Framework or standard contractual clauses).

9. Support of the customer

We help you with data subject requests (export and deletion in the app, otherwise on request) and with your obligations under Art. 32 to 36 GDPR, as far as this is appropriate and possible given the information available to us. Requests from data subjects that reach us are forwarded to you.

10. Personal data breaches

We notify you without undue delay after becoming aware of a personal data breach, where possible within 48 hours, with the information available under Art. 33(3) GDPR.

11. Audits and information

We provide the information necessary to demonstrate compliance. Inspections are possible after reasonable notice (at least 30 days), during business hours, without disrupting operations and at your cost, normally at most once a year. They may also be satisfied by current audit reports or certificates of our sub-processors.

12. Deletion and return

You can export submissions as CSV and delete data in the app at any time. When a subscription ends, your account drops to the Free plan; your data is kept until you delete it or your account. There is no automatic deletion after the contract ends. When you delete your account in the app, the data is removed immediately. Residual copies in the hosting provider's backups are removed in its regular backup cycle. There is no retention beyond that unless required by law.

13. Liability and final provisions

Liability is governed by terms § 8. In case of conflict this DPA prevails over the terms. Changes are made as for the terms (§ 9); the governing law is as in terms § 10.