Last updated: May 8, 2026
Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of the agreement between LeadForm and the account holder ("you") and applies whenever we process personal data on your behalf. It is a template overview and should be reviewed by your legal counsel before relying on it.
1. Roles and scope
When you build forms and collect responses through LeadForm, you act as the controller and we act as your processor. We process personal data only to provide the service and on your documented instructions, which include the configuration choices you make in the product.
2. Details of processing
- Subject matter: provision of the LeadForm form and lead-capture platform.
- Duration: for the term of your account, plus any short retention window described in our Privacy Policy.
- Nature and purpose: hosting forms, storing submissions, analytics, and routing leads to your integrations.
- Data subjects: the end users who submit your forms, and your own team members.
- Categories of data: the fields you choose to collect, plus technical metadata such as timestamps and drop-off step.
3. Sub-processors
We use the vetted sub-processors listed in our Privacy Policy, each bound by data-protection terms consistent with this DPA. We will give you notice of any intended change so you can object.
4. Security measures
We maintain appropriate technical and organisational measures, including encryption in transit and at rest, row-level tenant isolation, encrypted integration credentials, access controls, and support for two-factor authentication. Further detail is available in our Privacy Policy.
5. Data subject requests
We provide tools in the dashboard that let you access, export, and delete submission data so you can meet data-subject requests. Where you need our help, we will provide reasonable assistance taking into account the nature of the processing.
6. International transfers
Where personal data is transferred outside its country of origin, we rely on Standard Contractual Clauses or another lawful transfer mechanism, as described in our Privacy Policy.
7. Audits
On reasonable written request, and subject to confidentiality, we will make available the information necessary to demonstrate compliance with this DPA.
8. Return and deletion
On termination of your account, we will delete or return personal data in line with the retention periods in our Privacy Policy, except where storage is required by law.
9. Contact
To put a signed DPA in place or ask a question, reach the LeadForm team via our contact form.
