This Data Processing Agreement ("DPA") forms part of the Terms and conditions between Zsámboki Zoltán ev. (Forms Bridge, 5600 Békéscsaba, Kvasz András utca 25., Hungary; tax number 66563051-1-24; EU VAT number HU66563051; hello@forms-bridge.com), the processor, and the developer or agency using Forms Bridge, the controller. It applies automatically when you use Forms Bridge; no signature is needed. If you need a signed copy, email us.

1. What is processed

Forms Bridge processes personal data only to provide the service you use:

  • About your clients: their name (optional) and Google account email, the Webflow form names and the IDs of the spreadsheet and script created in their Google account.
  • Briefly, during setup: a Google access token for your client's account, kept only in an encrypted cookie in their browser for about an hour.
  • About you: your account details, project settings, an encrypted Google Sheets key if you connect it, and your purchases and billing details.

Form submissions are not processed by Forms Bridge. Webflow sends them directly to a script in your client's own Google account, which writes them into your client's own spreadsheet. Forms Bridge never receives or stores them.

2. Purpose and instructions

We process the data only to create and run your clients' connections, show you their progress, and bill you, as described in the Terms and our Privacy policy. Your use of the app (creating projects, adding forms, deleting projects) is your instruction. We don't use the data for anything else and don't sell it.

3. Confidentiality and security

Only the operator of Forms Bridge has access to the data, under a duty of confidentiality. We apply the measures described on our Security page, including encryption of stored Google keys (AES-256-GCM), encryption in transit (HTTPS), a secret key per connection, minimal Google permissions and rate limits.

4. Sub-processors

You authorise the sub-processors listed on our Security page (Cloudflare, Clerk, Stripe, Google, Billingo, Purelymail). We'll announce new sub-processors on that page and by email before they start; you may object, and if we can't resolve it you may stop using the service. Each sub-processor is bound by data protection terms at least as protective as this DPA.

5. Transfers outside the EU

Some sub-processors are in the United States. Transfers rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

6. Helping you

We help you answer your clients' data protection requests (access, correction, deletion) and with security, breach notification and impact assessments where the data we process is involved. Write to hello@forms-bridge.com.

7. Personal data breaches

If a breach affects data we process for you, we'll tell you without undue delay, and within 72 hours of becoming aware of it, with what we know and what we're doing about it.

8. Deletion

Deleting a project removes it from Forms Bridge. When you close your account, we delete your data within 30 days, except invoices and purchase records we must keep by law (8 years under Hungarian accounting law). Your clients' spreadsheets and scripts are in their own Google accounts and stay theirs.

9. Audits

We'll give you the information needed to show we comply with this DPA, including our providers' certifications, on request. Reasonable on-site audits are possible with 30 days' notice, at your cost.

10. Term and law

This DPA lasts as long as we process data for you. It's governed by Hungarian law and the GDPR. If it conflicts with the Terms on data protection, this DPA prevails.