Data Processing AgreementRead

Legal/ Data Processing Agreement

Data Processing Agreement

Agreements

July 20, 2026

This policy was last updated on July 20, 2026, to clarify the identities of the data exporter and the data importer in Annex IV and to revise the technical and organisational measures in Annex II so they reflect the enhanced current practices.

This Data Processing Agreement entered into between you and TYPEFORM SL (the “Company”, “we”, or “us”) regulates the particularities of data processing in connection with your use of both the platform accessible through the www.typeform.com and www.videoask.com domain names (the “Site”) and the services we may offer through the Site from time to time, consisting in ‘typeform’ forms and other services (indistinctly referred to as the “Services”). If you are also subject to the CCPA, please check our ‘CCPA Notice’ here to learn which specific provisions apply to you.

Please, note that ‘Data controller’, ‘data processor’, ‘data subject’, ‘personal data’, ‘processing’ will have the meaning set forth in the GDPR or in any other applicable European data protection law. ‘GDPR’ shall be understood as (i) the Regulation (EU) 2016/679, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data; (ii) the GDPR as it forms part of UK law by virtue of section 3 of the UK European Union (Withdrawal) Act 2018 and the UK Data Protection Act 2018 (together, “UK Data Protection Laws”); (iii) any future laws that may amend them or complement them in the future.

For clarification purposes, under this DPA (i) the processing of data regulated hereunder shall take place for as long as there is a service agreement in place between you and we, or until you decide to terminate said agreement; (ii) the nature and purposes of the processing shall be the collection, saving, organization, hosting, and deletion of data, as well as making it available to you upon your request; and (iii) the types of personal data and the categories of data subjects that are likely to be used in our product are name, surname, email address, telephone number, other ID details belonging to employees, candidates, prospects, and clients.

1. Processing of data

We will process any personal data we may have access to because of the provision of the Services in accordance with the documented instructions provided by you from time to time. Should a Union or Member State law to which we are subject requires us to process personal data —including the international transfer of personal data—, we will inform you of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

Should we have reasonable grounds to believe that a documented instruction given by you infringes the GDPR or any other applicable EU data protection law or regulation, we will put said instruction on hold and immediately notify you. At your sole risk and without us being responsible or liable to you for any losses, you will be entitled to order us to perform any such instruction despite the concerns raised by us, as long as you reconfirm your instruction in writing.

For purposes of this DPA, it will be understood that a ‘documented instruction’ includes, without limitation, (i) any instruction delivered by you by means of any durable media, such as a letter or email; (ii) any instruction electronically sent by you when using the software provided as part of the Services (i.e. by using the interface part of the software and the features made available through it); or (iii) the provisions of the DPA.