Data Processing Addendum (DPA)

Effective Date: July 4, 2026

This Data Processing Addendum ("DPA") governs the processing of personal data in connection with the nDBForms service. It is entered into by and between the Customer and nDBForms.

1. Definitions

The terms "Controller", "Processor", "Data Subject", "Personal Data", and "Processing" shall have the meanings given to them under EU Data Protection Laws (including the GDPR).

2. Scope and Role

Customer acts as the Data Controller of the data submitted to the forms, and nDBForms acts as the Data Processor. nDBForms only processes form submission data to transmit it to the Controller's authorized Notion database.

3. Processor Obligations

nDBForms agrees that it will:

  • Process personal data only on documented instructions from the Controller, including with respect to transfers of personal data.
  • Ensure that all personnel authorized to process personal data have committed themselves to confidentiality.
  • Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.
  • Assist the Controller in responding to Data Subjects' requests exercising their rights under GDPR.

4. Sub-processors

nDBForms utilizes sub-processors (such as Cloudflare Pages/Workers and Cloudflare D1) to host data and run services. We maintain strict agreements with all sub-processors to ensure data security and compliance.

5. Security Audits and Breaches

In the event of a confirmed security incident affecting Customer's personal data, nDBForms will notify Customer without undue delay (within 72 hours) and provide details of the breach and mitigation steps.