Privacy Policy

Your privacy is important to us

This policy was last updated on March 14, 2024.

1. General

This Privacy Policy describes how we collect, use, store, share and protect your personal information in connection with your use of both the platform accessible through the www.typeform.com and www.videoask.com domain names (the “Site”) and the services offered by us consisting in the creation of forms and any other services that may be offered by us from time to time (indistinctly referred to as the “Services”). In addition, this Privacy Policy also describes how we process information about other people that are directly or indirectly providing us services, or from people that, despite not using the Services, have contacted us or that we need to contact because of a conflict or issue with the Services or our Company.

If you are between 16 and 18 years old, you will be subject to the same data processings as detailed below. We encourage you to read our plain English version of this Privacy Policy if you prefer an easier and more readable approach. In any case, you are always welcome to ask any questions you may have by sending an email to gdpr@typeform.com.

We have structured this Privacy Policy based on the role you play when you interact with us. This way we can offer the information that is the most relevant to you and have a meaningful conversation. So, let’s get to know each other, who are you:

1. Respondent - I have responded to a Typeform or VideoAsk

Respondents

If you are a respondent (i.e. someone that has answered a form —i.e. a form, quiz or questionnaire created on our platform), please note that we are not the entity responsible for the processing of data, but a mere provider rendering services to the person or company that sent you the form at issue.

We suggest you carefully read the terms and conditions and privacy policy of the company or person that sent you the form, as those are the ones governing the processing of your personal data. If you have any doubts, please contact that person or company. Also, depending on how the person or company that sent you a form configured that form, your data may be shared or made public. To find out more, please contact the entity or person sending you the form.

On our side, please note that this policy is drafted both in plain and legal versions. In case of any discrepancies, the legal version included herein shall prevail and take precedence with respect to the plain version.

2. Customer - I have a Typeform or VideoAsk account.

2.1. All Customers, except US Customers

The following provisions apply to all Customers except those whose registered address is in the United States.

Customers

How are we processing respondents' personal data on your behalf? Typeform as data processor.

If you are using our Services and you are interested in learning how we are processing any personal data that we collect on your behalf, please check our Data Processing Agreement out in the following link. Please note that in this case you are the Data Controller and we are the Data Processor as further elaborated within the DPA.

How are we processing your data as our Customer? Typeform as data controller.

As mentioned above, if you use our Services or Site because you have created an Account with us, this Privacy Policy sets forth how we are processing your personal data. You are not required to provide any personal information when using the Site, unless you choose to access features that require such information (as, by way of example, subscribing to any newsletter). The use of the Services, however, requires that you sign up and create an account as described in more detail in the Service Terms and Conditions.

Personal information you provide us when using the Site and/or the Services is subject to this Privacy Policy, and you will be prompted to read and accept it. In addition, if you are a California resident, please click here and refer to the ‘CCPA Notice’ section for additional California-specific privacy disclosures that address the collection, use, disclosure and other processing of personal information that supplement this Privacy Policy and may fall outside its scope.

Who processes personal information? (who is the ‘Data controller’)

Your personal information is processed by us, an entity incorporated in accordance with the laws of Spain with the following contact details:

TYPEFORM, S.L.
Via Augusta 29 - 31, 08006 – Barcelona (Spain)
Contact email and Form:
https://www.typeform.com/help/contact/
support@videoask.com.
https://www.videoask.com/fn5pz0q1v

Contact details for our Data Protection Officer: gdpr@typeform.com

What are we processing your data for and why are we processing it? (‘Purposes of data processing’, ‘legal basis of the data processing’ and ‘storage periods’)

Based on our contract or future contract with you: we will process your data when we have to perform a contract, and we will be processing your data as long as the contractual relationship with you is in force and during the five years following the end of said relationship. This results in us having to process your data for purposes of (i) providing you with both the Services, as well as to (ii) perform our obligations under the Services Terms and Conditions.

Based on your consent: subject to obtaining your consent, and as long as you do not withdraw any such consent, we may also process your data for the following purposes:

a) To send you electronic commercial communications (if you subscribe to a newsletter) or to answer the requests you may address us when contacting us;

b) For profiling and analytics purposes based on your behavior and how you browse the Site and use the Services, which pages you have visited, and to build audiences by means of cookies, as described in detail in the Cookie Policy, and subject to the terms set forth therein. In those cases, your acceptance of the installation and use of cookies results in a data processing for profiling purposes, as described in this paragraph.

c) If you opt to sign in by means of a third party social media platform, we may obtain ID confirmation and other information from that third party, as mentioned in each case. Should you decide to use the 'follow-up messages' functionality with your Google Inc. email account, Google Inc. will share with us your email address (email address only) and your Google identifier (Opaque ID). Said data provided by Google Inc. will only be used to provide you with the Service, and more specifically with the aforementioned functionality.

Calendar block
Should you decide to use the 'calendar block' functionality with your Google Inc. email account, Google Inc. will share with us your email address and whether it is verified or not, your full name, calendar names, IDs, access roles, calendar time zone and available slots, but no specifics of your appointments (name, content, or attendees) will be shared. Said data provided by Google Inc. will only be used to provide you with the Service, and more specifically with the aforementioned functionality, and will be deleted as soon as you cease using it. In both cases, we guarantee the confidentiality, integrity and security of your data along all this processing by implementing technical and organizational measures that align with industry standards and data protection laws and regulations.

Google user data accessed by our Google Calendar scheduler block (OAuth access and refresh tokens, the connected account's email and display name) is stored exclusively in a PostgreSQL database hosted on AWS RDS within our production VPC. All data at rest is encrypted with AES-256, using keys managed by AWS Key Management Service (KMS); encrypted backups follow the same controls and a 15-day retention policy. As an additional defense-in-depth measure, OAuth tokens are envelope-encrypted with AWS KMS at the application layer before they are written to the database, so direct database access alone is not sufficient to use the tokens.

All communication with Google APIs, and all internal service-to-service communication within our infrastructure, is encrypted in transit using TLS 1.2 or 1.3. Every endpoint that uses Google user data requires a signed Typeform JWT and an explicit form-level authorization check; OAuth tokens are used server-side only and are never returned to the frontend, logged in plaintext, or exposed to respondents. Operational access by Typeform personnel requires SSO with enforced MFA, is granted on a least-privilege basis, and is logged and audited.

These controls are part of our platform-wide security program, which is certified under SOC 2 Type II, ISO/IEC 27001:2022, ISO/IEC 27017, ISO/IEC 27018, ISO/IEC 27701, CSA STAR, and HIPAA, and is GDPR-compliant. Additional security documentation, audit reports, and certifications are available at https://trust.typeform.com.

For further information on what personal data we receive from third parties, see below;

d) We may enrich the data we have about you by obtaining information from a select third party for data enrichment purposes, provided that you have given us prior permission. Enriching data allows us to analyze a deeper subset of data from which we may present personalized content.

Based on a legal obligation: When we have to comply with a legal obligation applicable to us from time to time, such as those set forth in tax and anti-money laundering laws and regulations (such as Act no. 58/2003, dated December 17, on Taxes; Act no. 27/2014, dated November 27, on corporate taxes; Act no. 10/2010, dated April 28, for the prevention of money laundering and financing or terrorism; or Organic Act no. 10/1995, dated November 23, on Criminal Code). In any such cases, the data will be processed only during the periods set forth by said laws, being deleted thereafter.

Based on our legitimate interest: Finally, we may also process your data to protect our legitimate interests, as long as said data is strictly necessary to review and monitor your activity for purposes of investigating and analyzing how to improve the Services and/or the Site, as well as to keep our Services and the Site secure and operational and prevent abusive activity (e.g. fraud, spam, phishing activities, etc.). This may include sending you forms to assess any problems you may have experienced in the service or know how to improve your user experience. The interests at stake are ensuring a correct and safe environment for both other users and us, taking those interests prevalence over your legitimate interests (we need to create and maintain an environment which is in accordance with the law, the legitimate interests of other parties, what other users may expect from our end, and to protect other users’ security when accessing the Site and using the Services).

To which extent do we require to have access to your personal data?

We need to process your personal data to perform the legal and contractual obligations mentioned above. Otherwise, we are not able to provide you with the Services and/or access to the Site. On the other hand, for data processing which depends on your consent or on our legitimate interests, the data processing is not legally required.

Which companies or entities will have access to your personal information?

We share your information with our service providers who help us to provide the Services to you, in which case those third parties are required to comply with our internal standards, policies, and technical and organizational measures that ensure that your data is protected and kept confidential at all times, and only in accordance with and to the extent authorized by this Privacy Policy.

We share your profile information with other users to permit and facilitate that you collaborate with them, and work across multiple workspaces and organizations. This information includes your name, account email, as well as things like the forms that you have created or removed, the time they were edited, or usage activity. As a result, the administrator of the organization or workspace where you collaborate may be able to access or export logs of your activity.

When you authorize us to do so, we may also share your data with other companies so that they can process the data for other purposes, as explained more in detail when we request your prior consent. In addition, if you provide consent for the installation of cookies, your data may be processed by third companies for the purposes and in the territories mentioned in the Cookie Policy.

We may also share your information with competent courts and authorities, when we are legally required to do so (for instance, to allow such bodies to investigate, prevent, or take action against illegal activities), or we have to take action to protect our rights or any third party rights.

The categories of recipients of personal data are: (i) hosting and infrastructure providers; (ii) providers of audience analytics tools; (iii) providers of product and user experience analytics tools; (iv) providers of security of our systems; (v) providers of subscription, accounting and billing management; (vi) auditing and consulting services providers; (vii) providers of marketing campaign management; (viii) providers of electronic communication management; (ix) providers that supports customer relationship management; (x) providers of SSO services; and (xi) our affiliates. A detailed and up-to-date description of the companies we may share data with could be found here for Typeform and here for VideoAsk.

Finally, please note that you may opt for creating a form and share publicly the results that are displayed not in an aggregated manner but by providing the particular responses provided by respondents. In those cases, if you opt to create a form having this functionality, the said results will be shared with those third parties you opt to share them with. Please bear in mind that, depending on what you intend to do with your data, you may be required to inform or comply with further legal requirements vis-à-vis respondents.

In which territories may your personal information be processed?

Your data may be transferred, processed, and stored in countries that do not have data protection laws as protective as those in your jurisdiction. Your agreement to the terms of this Privacy Policy, followed by your submission of information in connection with the Service, represents your agreement to this international transfer of personal data.

For clarification purposes, we will process information from the European Economic Area. In some cases, data may also be processed from other countries, including the UK, in which case we will implement the security measures required by law. In particular, we will be signing Standard Contractual Clauses to ensure that the information is protected at all times and applying additional technical and organizational measures to ensure that the information is protected at all times.

For further information on the security measures we apply at Typeform, please check our help center.

A detailed and up-to-date description of the companies we may share data with could be found here for Typeform and here for VideoAsk. You will observe a clear description on the territories of those companies and the measures implemented to keep your data safe.

What other information we may be processing from you that has not been obtained directly from you?

When you create an Account helped by your existing accounts with the third parties detailed below, we will be using your contact details (i.e. name, email address, language preference and profile picture) as you consent to be shared with us to ease the creation of your Account and the sign-up process.
Microsoft Corporation, dba. Microsoft - for further information on their Privacy Policy click here.
Google Ireland Limited, dba. Google - for further information on their Privacy Policy click here.
Automattic Inc., dba. Gravatar - for further information on their Privacy Policy click here.

In the event you leverage your account with these third parties to create an account with us, the rest of the provisions of this Privacy Policy will apply to you as if you have created on your own.

When you expressly consent to data enrichment, we will be using the information collected from you to customize your experience and our services so they are adapted to what is more relevant to you.

Miscellanea. Updating your information

You can update any information we may have from you by means of the account settings area or by sending us a written communication as described in section 5 below. Please remember that it is your duty to keep information updated so we can correctly provide you with the Services, and you undertake to verify the information you have handed us from time to time to make sure that it is accurate.

Commercial communications: as explained in this policy, you are entitled to ask us, now or at any moment, not to send you any kind of emails or commercial communications. To that extent, you can either change the communication preferences in your account settings page or contact us as described in section 5 below. Note that this will not prevent the sending of emails or other communications related to the Services (i.e transactional messages), as those communications are necessary to perform the contractual relationship we have with you.

This is the case, for instance, of messages concerning new features that we may roll out, or bugs impacting the availability of our services.

Our analytics: Upon anonymizing your data - this means that such data will no longer be possible to be associated to you or to any other person - we may perform statistical and other analysis on such information (technical and metadata) to analyze and measure aggregated user behavior and trends, to understand how people use our services, in order to improve and optimize our performance of such services, and to publish any findings.

Your rights.

You have the right to withdraw your consent at any time. You also have the right to request access to, and rectification of, or erasure of your personal data, or restriction of processing, or to object to processing, as well as the right to data portability. Please note that if you choose to cancel your data as a customer, your account will be deleted and all data in your account will be permanently deleted from our systems. In some cases, we may refuse to delete all the data if we are not allowed under the laws or for purposes of the establishment, exercise or defense of legal claims. In such latter cases your data will be processed on a restricted basis, and only as long and to the extent required by law.

You can always lodge a complaint at any time with the Spanish Data Protection Agency.

You can exercise the above-mentioned rights at any time by sending an email to gdpr@typeform.com, or by sending a letter addressed to our Data Protection Officer to Via Augusta 29 - 31, 08006 – Barcelona (Spain).

How to contact us

Send a request via our Typeform Contact Form or VideoAsk Contact Form. In the Help Center click on the Contact Support link at the bottom of any article. You can always contact us at gdpr@typeform.com for any privacy-related matters.

Changes to the privacy policy

We may amend this Privacy Policy from time to time. We may also notify you of material changes to this Privacy Policy, before the effective date of the changes, by sending an email, through in-app notices or otherwise. If you do not agree to any substantial change to this Privacy Policy, you should stop using and eliminating your Account.

Prevalence

This policy is drafted both in plain and legal versions. In case of any discrepancies, the legal version included herein shall prevail and take precedence with respect to the plain version.

2.2. US Customers

The following provisions apply to Customers whose registered address is in the United States.

How are we processing respondents' personal data on your behalf? Typeform SL as data processor.

If you are using our Services and you are interested in learning how we are processing any personal data that we collect on your behalf, please check our Data Processing Agreement out in the following link. Please note that in this case you are the Data Controller and we (Typeform SL) are the Data Processor as further elaborated within the DPA.

How are we processing your data as our Customer? Typeform as data controller.

As mentioned above, if you use our Services or Site because you have created an Account with us, this Privacy Policy sets forth how we are processing your personal data. You are not required to provide any personal information when using the Site, unless you choose to access features that require such information (as, by way of example, subscribing to any newsletter). The use of the Services, however, requires that you sign up and create an account as described in more detail in the Service Terms and Conditions.

Personal information you provide us when using the Site and/or the Services is subject to this Privacy Policy, and you will be prompted to read and accept it. In addition, if you are a California resident, please click here and refer to the ‘CCPA Notice’ section for additional California-specific privacy disclosures that address the collection, use, disclosure and other processing of personal information that supplement this Privacy Policy and may fall outside its scope.

Who processes personal information? (who is the ‘Data controller’)

Your personal information is processed by Typeform SL, and, in some cases, jointly by Typeform US LLC and Typeform SL.

For the activities to offer and sell you the plan and following-up with the commercial relationship with you, both Typeform SL and Typeform US LLC act jointly and severally, as joint data controllers. On the contrary, for providing the services only, Typeform SL is the entity acting as sole data controller.

Find below the details to contract both entities:

TYPEFORM Group
Via Augusta 29 - 31, 08006 – Barcelona (Spain)
Contact email and Form:
https://www.typeform.com/help/contact/
support@videoask.com.
https://www.videoask.com/fn5pz0q1v

Contact details for our Data Protection Officer: gdpr@typeform.com

What are we processing your data for and why are we processing it? (‘Purposes of data processing’, ‘legal basis of the data processing’ and ‘storage periods’)

Based on our contract or future contract with you: we will process your data when we have to perform a contract, and we will be processing your data as long as the contractual relationship with you is in force and during the five years following the end of said relationship. This results in us having to process your data for purposes of (i) providing you with both the Services, as well as to (ii) perform our obligations under the Services Terms and Conditions.

Based on your consent: subject to obtaining your consent, and as long as you do not withdraw any such consent, we may also process your data for the following purposes:

a) To send you electronic commercial communications (if you subscribe to a newsletter) or to answer the requests you may address us when contacting us;

b) For profiling and analytics purposes based on your behavior and how you browse the Site and use the Services, which pages you have visited, and to build audiences by means of cookies, as described in detail in the Cookie Policy, and subject to the terms set forth therein. In those cases, your acceptance of the installation and use of cookies results in a data processing for profiling purposes, as described in this paragraph.

c) If you opt to sign in by means of a third party social media platform, we may obtain ID confirmation and other information from that third party, as mentioned in each case. Should you decide to use the 'follow-up messages' functionality with your Google Inc. email account, Google Inc. will share with us your email address (email address only) and your Google identifier (Opaque ID). Said data provided by Google Inc. will only be used to provide you with the Service, and more specifically with the aforementioned functionality.

Google Calendar

Should you decide to use the 'calendar block' functionality with your Google Inc. email account, Google Inc. will share with us your email address and whether it is verified or not, your full name, calendar names, IDs, access roles, calendar time zone and available slots, but no specifics of your appointments (name, content, or attendees) will be shared. Said data provided by Google Inc. will only be used to provide you with the Service, and more specifically with the aforementioned functionality, and will be deleted as soon as you cease using it. In both cases, we guarantee the confidentiality, integrity and security of your data along all this processing by implementing technical and organizational measures that align with industry standards and data protection laws and regulations.

Google user data accessed by our Google Calendar scheduler block (OAuth access and refresh tokens, the connected account's email and display name) is stored exclusively in a PostgreSQL database hosted on AWS RDS within our production VPC. All data at rest is encrypted with AES-256, using keys managed by AWS Key Management Service (KMS); encrypted backups follow the same controls and a 15-day retention policy. As an additional defense-in-depth measure, OAuth tokens are envelope-encrypted with AWS KMS at the application layer before they are written to the database, so direct database access alone is not sufficient to use the tokens.

All communication with Google APIs, and all internal service-to-service communication within our infrastructure, is encrypted in transit using TLS 1.2 or 1.3. Every endpoint that uses Google user data requires a signed Typeform JWT and an explicit form-level authorization check; OAuth tokens are used server-side only and are never returned to the frontend, logged in plaintext, or exposed to respondents. Operational access by Typeform personnel requires SSO with enforced MFA, is granted on a least-privilege basis, and is logged and audited.

These controls are part of our platform-wide security program, which is certified under SOC 2 Type II, ISO/IEC 27001:2022, ISO/IEC 27017, ISO/IEC 27018, ISO/IEC 27701, CSA STAR, and HIPAA, and is GDPR-compliant. Additional security documentation, audit reports, and certifications are available at https://trust.typeform.com.

For further information on what personal data we receive from third parties, see below;

d) We may enrich the data we have about you by obtaining information from a select third party for data enrichment purposes, provided that you have given us prior permission. Enriching data allows us to analyze a deeper subset of data from which we may present personalized content.

Based on a legal obligation: When we have to comply with a legal obligation applicable to us from time to time, such as those set forth in tax and anti-money laundering laws and regulations (such as Act no. 58/2003, dated December 17, on Taxes; Act no. 27/2014, dated November 27, on corporate taxes; Act no. 10/2010, dated April 28, for the prevention of money laundering and financing or terrorism; or Organic Act no. 10/1995, dated November 23, on Criminal Code). In any such cases, the data will be processed only during the periods set forth by said laws, being deleted thereafter.

Based on our legitimate interest: Finally, we may also process your data to protect our legitimate interests, as long as said data is strictly necessary to review and monitor your activity for purposes of investigating and analyzing how to improve the Services and/or the Site, as well as to keep our Services and the Site secure and operational and prevent abusive activity (e.g. fraud, spam, phishing activities, etc.). This may include sending you forms to assess any problems you may have experienced in the service or know how to improve your user experience. The interests at stake are ensuring a correct and safe environment for both other users and us, taking those interests prevalence over your legitimate interests (we need to create and maintain an environment which is in accordance with the law, the legitimate interests of other parties, what other users may expect from our end, and to protect other users’ security when accessing the Site and using the Services).

To which extent do we require to have access to your personal data?

We need to process your personal data to perform the legal and contractual obligations mentioned above. Otherwise, we are not able to provide you with the Services and/or access to the Site. On the other hand, for data processing which depends on your consent or on our legitimate interests, the data processing is not legally required.

Which companies or entities will have access to your personal information?

We share your information with our service providers who help us to provide the Services to you, in which case those third parties are required to comply with our internal standards, policies, and technical and organizational measures that ensure that your data is protected and kept confidential at all times, and only in accordance with and to the extent authorized by this Privacy Policy.

We share your profile information with other users to permit and facilitate that you collaborate with them, and work across multiple workspaces and organizations. This information includes your name, account email, as well as things like the forms that you have created or removed, the time they were edited, or usage activity. As a result, the administrator of the organization or workspace where you collaborate may be able to access or export logs of your activity.

When you authorize us to do so, we may also share your data with other companies so that they can process the data for other purposes, as explained more in detail when we request your prior consent. In addition, if you provide consent for the installation of cookies, your data may be processed by third companies for the purposes and in the territories mentioned in the Cookie Policy.

We may also share your information with competent courts and authorities, when we are legally required to do so (for instance, to allow such bodies to investigate, prevent, or take action against illegal activities), or we have to take action to protect our rights or any third party rights.

The categories of recipients of personal data are: (i) hosting and infrastructure providers; (ii) providers of audience analytics tools; (iii) providers of product and user experience analytics tools; (iv) providers of security of our systems; (v) providers of subscription, accounting and billing management; (vi) auditing and consulting services providers; (vii) providers of marketing campaign management; (viii) providers of electronic communication management; (ix) providers that supports customer relationship management; (x) providers of SSO services; and (xi) our affiliates. A detailed and up-to-date description of the companies we may share data with could be found here for Typeform and here for VideoAsk.

Finally, please note that you may opt for creating a form and share publicly the results that are displayed not in an aggregated manner but by providing the particular responses provided by respondents. In those cases, if you opt to create a form having this functionality, the said results will be shared with those third parties you opt to share them with. Please bear in mind that, depending on what you intend to do with your data, you may be required to inform or comply with further legal requirements vis-à-vis respondents.

In which territories may your personal information be processed?

Your data may be transferred, processed, and stored in countries that do not have data protection laws as protective as those in your jurisdiction. Your agreement to the terms of this Privacy Policy, followed by your submission of information in connection with the Service, represents your agreement to this international transfer of personal data.

For clarification purposes, we will process information from the European Economic Area and the US. In some cases, data may also be processed from other countries, including the UK, in which case we will implement the security measures required by law. In particular, we will be signing Standard Contractual Clauses to ensure that the information is protected at all times and applying additional technical and organizational measures to ensure that the information is protected at all times.

For further information on the security measures we apply at Typeform, please check our help center.

A detailed and up-to-date description of the companies we may share data with could be found here for Typeform and here for VideoAsk. You will observe a clear description on the territories of those companies and the measures implemented to keep your data safe.

What other information we may be processing from you that has not been obtained directly from you?

When you create an Account helped by your existing accounts with the third parties detailed below, we will be using your contact details (i.e. name, email address, language preference and profile picture) as you consent to be shared with us to ease the creation of your Account and the sign-up process.
Microsoft Corporation, dba. Microsoft - for further information on their Privacy Policy click here.
Google Ireland Limited, dba. Google - for further information on their Privacy Policy click here.
Automattic Inc., dba. Gravatar - for further information on their Privacy Policy click here.

In the event you leverage your account with these third parties to create an account with us, the rest of the provisions of this Privacy Policy will apply to you as if you have created on your own.

When you expressly consent to data enrichment, we will be using the information collected from you to customize your experience and our services so they are adapted to what is more relevant to you.

Miscellanea. Updating your information

You can update any information we may have from you by means of the account settings area or by sending us a written communication as described in section 5 below. Please remember that it is your duty to keep information updated so we can correctly provide you with the Services, and you undertake to verify the information you have handed us from time to time to make sure that it is accurate.

Commercial communications: as explained in this policy, you are entitled to ask us, now or at any moment, not to send you any kind of emails or commercial communications. To that extent, you can either change the communication preferences in your account settings page or contact us as described in section 5 below. Note that this will not prevent the sending of emails or other communications related to the Services (i.e transactional messages), as those communications are necessary to perform the contractual relationship we have with you.

This is the case, for instance, of messages concerning new features that we may roll out, or bugs impacting the availability of our services.

Our analytics: Upon anonymizing your data - this means that such data will no longer be possible to be associated to you or to any other person - we may perform statistical and other analysis on such information (technical and metadata) to analyze and measure aggregated user behavior and trends, to understand how people use our services, in order to improve and optimize our performance of such services, and to publish any findings.

Your rights.

You have the right to withdraw your consent at any time. You also have the right to request access to, and rectification of, or erasure of your personal data, or restriction of processing, or to object to processing, as well as the right to data portability. Please note that if you choose to cancel your data as a customer, your account will be deleted and all data in your account will be permanently deleted from our systems. In some cases, we may refuse to delete all the data if we are not allowed under the laws or for purposes of the establishment, exercise or defense of legal claims. In such latter cases your data will be processed on a restricted basis, and only as long and to the extent required by law.

You can always lodge a complaint at any time with the Spanish Data Protection Agency.

You can exercise the above-mentioned rights at any time by sending an email to gdpr@typeform.com, or by sending a letter addressed to our Data Protection Officer to Via Augusta 29 - 31, 08006 – Barcelona (Spain).

How to contact us

Send a request via our Typeform Contact Form or VideoAsk Contact Form. In the Help Center click on the Contact Support link at the bottom of any article. You can always contact us at gdpr@typeform.com for any privacy-related matters.

Changes to the privacy policy

We may amend this Privacy Policy from time to time. We may also notify you of material changes to this Privacy Policy, before the effective date of the changes, by sending an email, through in-app notices or otherwise. If you do not agree to any substantial change to this Privacy Policy, you should stop using and eliminating your Account.

Prevalence

This policy is drafted both in plain and legal versions. In case of any discrepancies, the legal version included herein shall prevail and take precedence with respect to the plain version.

3. Professionals and other contacts

If you are a professional working for us, or you have contacted us or we need to contact you because of a conflict, please be informed that this Privacy Policy sets forth how we are processing your personal data.

Who processes personal information? (who is the ‘Data controller’)

Personal information is processed by us, an entity incorporated in accordance with the laws of Spain with the following contact details:

TYPEFORM, S.L.
Via Augusta 29 - 31, 08006 – Barcelona (Spain)
Contact email:
gdpr@typeform.com

Contact details for our Data Protection Officer: gdpr@typeform.com

What are we processing your data for and why are we processing it? (‘Purposes of data processing’, ‘legal basis of the data processing’ and ‘storage periods’)

Based on our contract or future contract with you: For professionals working with us (other than users of the Site), we will process your data to perform a contract, and we will be processing your data as long as the contractual relationship with you or the entity for which you are working for is in force and during the five years following the end of said relationship.

Based on your consent: For other people contacting us, we will be processing data based on your consent and your request to contact you back and answer a petition initially addressed to us.

Based on a legal obligation: In addition to the legal basis mentioned above, we may also need to process both professionals’ and people’s contacting us data to comply with a legal obligation. This is the case of storing data about the contractual relationship we have with a professional working for us, because of the tax and anti-money laundering laws and regulations, or, when it comes to people contacting us, you report some suspicious activities that need further investigation and action under criminal law (such as Act no. 58/2003, dated December 17, on Taxes; Act no. 27/2014, dated November 27, on corporate taxes; Act no. 10/2010, dated April 28, for the prevention of money laundering and financing or terrorism; or Organic Act no. 10/1995, dated November 23, on Criminal Code). In any such cases, the data will be processed only during the periods set forth by said laws, being deleted thereafter.

Based on our legitimate interests: Finally, we may also process data from people we need to contact because of a conflict or a breach of our rights or other situations. This processing will take place on the basis of our legitimate interests, as long as said data is strictly necessary to review, monitor, investigate, and analyze a conflict and how to protect our assets, rights, and users. The interests at stake are ensuring the protection of both our users and us, taking those interests prevalence over your legitimate interests (we need to abide by the law, the legitimate interests of other parties, what other users may expect from our end).

To which extent do we require to have access to your personal data?

We need to process your personal data to perform the legal and contractual obligations mentioned above. On the other hand, for data processing which depends on your consent or on our legitimate interests, the data processing is not legally required.

Which companies will have access to your personal information?

We share your information with our service providers who help us operate our business, in which case those third parties are required to comply with our internal standards, policies, and technical and organizational measures that ensure that your data is protected and kept confidential at all times, and only in accordance with and to the extent authorized by this Privacy Policy.

In particular, these third parties helping us out in operating our business belong to the following categories: (i) consultancy and audit service providers; (ii) electronic communications management tools providers; (iii) contract management tools providers; (iv) accounting and billing tools providers;
(v) Public authorities; and (vi) our affiliates.

In addition, if you browse our Site and you provide consent for the installation of cookies, your data may be processed by third companies for the purposes and in the territories mentioned in the Cookie Policy.

We may also share your information with competent courts and authorities, when we are legally required to do so (for instance, to allow such bodies to investigate, prevent, or take action against illegal activities), or we have to take action to protect our rights or any third party rights.

In which territories may your personal information be processed?

Your data may be transferred, processed, and stored in countries that do not have data protection laws as protective as those in your jurisdiction. Your agreement to the terms of this Privacy Policy, followed by your submission of information in connection with your request, represents your agreement to this international transfer of personal data.

For clarification purposes, we will process information from the European Economic Area. In some cases, data may also be processed from other countries, including the UK, in which case we will implement the security measures required by law. In particular, we will be signing Standard Contractual Clauses to ensure that the information is protected at all times and applying additional technical and organizational measures to ensure that the information is protected at all times.

For further information on the security measures we apply at Typeform, please check our help center.

Your rights.

You have the right to withdraw your consent at any time. You also have the right to request access to, and rectification of, or erasure of your personal data, or restriction of processing, or to object to processing, as well as the right to data portability. Please note that if you choose to request the deletion of your data, we may refuse if we are not allowed under the laws or for purposes of the establishment, exercise or defense of legal claims. In such latter cases your data will be processed on a restricted basis, and only as long and to the extent required by law.

You can always lodge a complaint at any time with the Spanish Data Protection Agency.

We allow you to exercise the above-mentioned rights at any time by sending an email to gdpr@typeform.com, or by sending a letter addressed to our Data Protection Officer to Via Augusta 29 - 31, 08006 – Barcelona (Spain).

How to contact us

Send a request via our Typeform Contact Form or VideoAsk Contact Form. In the Help Center click on the Contact Support link at the bottom of any article. You can always contact us at gdpr@typeform.com for any privacy-related matters.

Changes to the privacy policy

We may amend this Privacy Policy from time to time. We may also notify you of material changes to this Privacy Policy, before the effective date of the changes, by sending an email or otherwise. If you do not agree to any substantial change to this Privacy Policy, you may terminate the Service Terms and Conditions.

Prevalence

This policy is drafted both in plain and legal versions. In case of any discrepancies, the legal version included herein shall prevail and take precedence with respect to the plain English version.