Skip to content
peachform

This English version is a translation for convenience: if it differs from the Spanish version, the Spanish one prevails.

Data processing agreement

Last updated: 2026-10-28

This agreement is part of the terms of use and complies with article 28 of the General Data Protection Regulation (GDPR). The parties are the customer who holds the account (controller) and the owner of Peachform (processor).

1. Subject matter, duration and nature

  • Subject matter: hosting the controller's forms, receiving and storing their responses and files, showing and exporting them, counting anonymously how far each visit gets and, if set up, keeping unfinished responses and sending responses by email (to their account or, as a copy, to the respondent), webhook or Google Sheets.
  • Duration: while the account exists.
  • Data subjects: the people who fill in the controller's forms.
  • Data: whatever the controller decides to ask for in their forms, including files and fields from the address. The controller must not ask for special categories of data unless they have a legal basis and appropriate measures.

2. Obligations of the processor

  1. Process the data only on the controller's instructions, which are those given by configuring and using the service, unless required by law.
  2. Ensure that the people authorised to process the data are bound by confidentiality.
  3. Apply the security measures of article 32 GDPR: encryption in transit, access control by account and team, isolation between accounts, logs without response content and file downloads only as attachments.
  4. Not use the data for its own purposes, sell it or disclose it to third parties other than the sub-processors listed below.
  5. Help the controller respond to data subjects' requests; the service lets them view, export and delete responses, and set a retention period on each form after which its responses and files are deleted automatically: 6 months by default and at most between 6 months and 2 years depending on the plan (deletion runs once a day).
  6. Notify the controller without undue delay, and in any case within 48 hours of becoming aware of it, of any security breach affecting their data, with the information available.
  7. When the service ends, delete the data: deleting the account removes forms and responses immediately and files within 24 hours. Technical backups are deleted at the end of their retention period.
  8. Make available to the controller the information needed to demonstrate compliance with these obligations.

3. Sub-processors

The controller gives general authorisation to the following sub-processors. We will notify by email at least 15 days before adding or replacing any of them, so the controller can object and, if necessary, cancel the service.

  • Cloudflare: Hosting of the application, database (D1), uploaded files (R2), anti-spam protection (Turnstile) and network. Database and files stored in the EU (European jurisdiction of D1 and R2); global network and company based in the US..
  • Resend: Sending emails: response notifications, copies for respondents, sign-in links, invitations and usage warnings. Sent from the EU (Ireland); account data in the US..
  • Stripe: Charging for paid plans, invoices and taxes (only data of the person who subscribes). EU and US..
  • Google (only if you choose to sign in with Google): Sign-in: it gives us your verified email. US..

4. Obligations of the controller

  • Have a legal basis for the data they ask for and inform the people who fill in their forms (for example, with a legal acceptance question linking to their own policy).
  • Ask only for the data needed and not use forms to obtain passwords or payment details.
  • Manage who in their team has access to the responses.

5. Contact

For any question about this agreement, write to hello@peachform.app.

Start for free