FluidForms Data Processing Agreement
Last Updated: November 20, 2025
USING THIS DPA
This DPA has 2 parts: (1) the Key Terms on this Cover Page and (2) the Common Paper DPA Standard Terms Version 1 posted at commonpaper.com/standards/data-processing-agreement/1.1 (“DPA Standard Terms”), which is incorporated by reference. If there is any inconsistency between the parts of the DPA, the Cover Page will control over the DPA Standard Terms. Capitalized and highlighted words have the meanings given on the Cover Page. However, if the Cover Page omits or does not define a highlighted word, the default meaning will be “none” or “not applicable” and the correlating clause, sentence, or section does not apply to this Agreement. All other capitalized words have the meanings given in the DPA Standard Terms or the Agreement. A copy of the DPA Standard Terms is attached for convenience only.
Key Terms
The key legal terms of the DPA are as follows:
Agreement
Reference to sales contract will be set when sending agreement
Approved Subprocessors
https://fluidforms.ai/legal/subprocessors
Provider Security Contact
Security Policy
Provider will use commercially reasonable efforts to secure the Service from unauthorized access, alteration, or use and other unlawful tampering.
Changes to the Agreement
Service Provider Relationship
To the extent California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq (“CCPA”) applies, the parties acknowledge and agree that Provider is a service provider and is receiving Personal Data from Customer to provide the Service as agreed in the Agreement and detailed below (see Nature and Purpose of Processing), which constitutes a limited and specified business purpose. Provider will not sell or share any Personal Data provided by Customer under the Agreement. In addition, Provider will not retain, use, or disclose any Personal Data provided by Customer under the Agreement except as necessary for providing the Service for Customer, as stated in the Agreement, or as permitted by Applicable Data Protection Laws. Provider certifies that it understands the restrictions of this paragraph and will comply with all Applicable Data Protection Laws. Provider will notify Customer if it can no longer meet its obligations under the CCPA.
Restricted Transfers
Governing Member State
- EEA Transfers: Ireland
- UK Transfers: England and Wales
Annex I(A) List of Parties
Data Exporter
- Name: the Customer signing this DPA
- Activities relevant to transfer: See Annex 1(B)
- Role: Controller
Data Importer
- Name: the Provider signing this DPA
- Contact person: Privacy Officer
- Address: 732 S 6th St, Ste N, Las Vegas, Nevada 89101, USA
- Activities relevant to transfer: See Annex 1(B)
- Role: Processor
Annex I(B) Description of Transfer and Processing Activities
Service
The Service is: FluidForms is a data collection and workflow automation platform. The Service enables Customers to build forms, conversational agents, and workflows to capture and process data from their end-users.
Categories of Data Subjects
- Customer's end users or customers
- Customer's employees
Categories of Personal Data
- Name
- Contact information such as email, phone number, or address
- Professional or biographic information such as resume or CV
- User activity and analysis such as device information or IP address
- Any other Personal Data submitted by Data Subjects via the forms, conversational agents, or workflows designed by the Customer.
Special Category Data
Is special category data (as defined in Article 9 of the GDPR) Processed? No
Frequency of Transfer
Continuous
Nature and Purpose of Processing
- Receiving data, including collection, accessing, retrieval, recording, and data entry
- Holding data, including storage, organization, and structuring
- Using data, including analysis, consultation, testing, automated decision making, and profiling
- Sharing data, including disclosure, dissemination, allowing access, or otherwise making available
- Erasing data, including destruction and deletion
Duration of Processing
Provider will process Customer Personal Data as long as required (i) to conduct the Processing activities instructed in Section 2.2(a)-(d) of the Standard Terms; or (ii) by Applicable Laws.
Annex I(C)
Competent Supervisory Authority
The supervisory authority will be the supervisory authority of the data exporter, as determined in accordance with Clause 13 of the EEA SCCs or the relevant provision of the UK Addendum.
Annex II
Technical and Organizational Security Measures
See Security Policy.
Provider and Customer have not changed the DPA Standard Terms except for the details on the Cover Page above. By signing this Cover Page, each party agrees to enter into this DPA as of the last date of signature below.
PROVIDER: Palette Ventures LLC, d/b/a FluidForms
Legal Notice Address: legal@fluidforms.ai
STANDARD TERMS
This DPA incorporates the Common Paper DPA Standard Terms Version 1 posted at commonpaper.com/standards/data-processing-agreement/1.1, which is incorporated by reference.