Data processing agreement

How we process answers on your behalf

Last updated 26 October 2026. Part of the terms of service for every workspace. Business customers can have it signed: ask us.

1. The parties and the roles

This agreement is between the organiser (the person or organisation whose workspace it is: “you”, the controller) and GESTURELOOP LIMITED, company no. 792165, 44 Cluain Droichead, Sixmilebridge, Co. Clare, V95 HD62, Ireland (“we”, the processor). It covers the personal data in the answers people give to your forms and competitions, the files they upload, and the payments lists you upload. It is written to meet Article 28 of the GDPR.

2. What the processing is

• Subject matter and purpose: storing, showing you, and sending on the answers to your forms and the entries in your competitions, so you can collect and use them.
• Nature: storage, display, search, export, correction on your instruction, sending to the destinations you set (an email address, a webhook, a channel), deletion, and backup.
• Duration: while your workspace exists and for the deletion period in section 8.
• Kinds of data: whatever your forms ask. Typically names, contact details, free text, choices, dates, amounts, addresses, files, signatures; for competitions, names, phone numbers, picks and payment status.
• People concerned: whoever fills in your forms or enters your competitions.

3. Your instructions

We process the data only on your documented instructions, which are: these terms, the settings you choose in the product (where responses are sent, who is in your workspace, what is deleted), and anything else you ask us for in writing. We’ll tell you if we think an instruction breaks the law. We don’t use the data for any purpose of our own.

4. Our people

Only people who need access to run the service have it, and each is bound to confidentiality. We don’t look at your responses except to fix a problem you’ve asked us to look at or to investigate misuse of the service.

5. Security

We take the measures a service like this should, including:

• everything travels over HTTPS; passwords are stored scrambled with a modern algorithm;
• servers are in the EU (Finland) with access by key only, kept up to date, and watched;
• every answer is checked before it is stored, uploads are checked by content, and a form in another workspace can’t be reached from yours;
• nightly backups, checked for integrity, kept in the EU;
• every organiser action is logged with who did it and when.

6. Sub-processors

You authorise us to use these sub-processors, each only for the job named, under contracts that bind them to equivalent terms:

• Hetzner Online GmbH (Germany): servers and backup storage, in Finland.
• Resend: email delivery, EU region (each response to a form if you ask for it; your account’s emails).
• Stripe Payments Europe, Ltd. (Ireland): your workspace’s billing (not respondents’ data).
• Yohanun and Anthropic: AI drafting of forms (your descriptions and questions only); and, on a form you set to be answered as a conversation, reading what the respondent types so it can be checked and kept as their answers. Neither keeps the conversation; responses to every other form are never sent.

Services you connect yourself (webhooks, chat channels, Zapier, Make, n8n, your analytics tag) are your own processors, not ours. If we add or change a sub-processor we’ll email workspace owners at least 30 days before, and you can object; if we can’t resolve an objection you can end the service and we’ll refund any period paid for and not used.

7. Helping you with your duties

• People’s rights: the product lets you find, export, correct and delete a person’s answers yourself. If a request reaches us instead, we’ll pass it to you without undue delay and help as needed.
• Breaches: if we become aware of a personal data breach affecting your data, we’ll tell you without undue delay and within 48 hours of becoming aware, with what we know, and keep you updated so you can meet your own 72-hour duty.
• Impact assessments and the regulator: we’ll give you the information you reasonably need, taking into account what we know.

8. Deletion and return

You can export responses as Excel or CSV, and files one by one, at any time. Deleting a form deletes its responses and files at once. When your workspace is closed we delete everything in it within 30 days. Copies in backups are overwritten within 12 months and are never restored to the live service except to recover from a failure of the service itself, after which the same deletions are applied again.

9. Showing we comply

We’ll give you the information needed to show that this agreement is met, and answer reasonable questions about our measures. If you need an audit, we’ll agree a time and a scope that doesn’t disrupt the service or expose other customers, at most once a year unless a regulator requires more; you cover the cost.

10. Transfers

The data is stored and processed in the EU. Where a sub-processor is established outside the EU, or could be asked for data from outside it, the transfer is covered by the European Commission’s standard contractual clauses in that sub-processor’s terms, and we’ll help you with any transfer assessment you need.

11. Liability and law

Liability under this agreement is subject to the limits in the terms of service, except where the GDPR says otherwise. This agreement is governed by the law of Ireland. If it conflicts with the terms, this agreement wins for anything about processing personal data.