Data processing terms

FormSide processes organiser booking and camp-administration data to provide the workspace, public booking journey, capacity controls, confirmations, payment-status tracking and related support for the term of the organiser agreement and any documented deletion or return period after it ends.

FormSide processes controller data only on documented instructions contained in the organiser agreement, product configuration, authorised support request and lawful use of the service. FormSide will promptly inform the organiser if it believes an instruction infringes applicable data-protection law, unless prohibited from doing so.

If law requires processing outside those instructions, FormSide will inform the organiser before processing unless the law prohibits that notice for an important public-interest reason.

FormSide ensures that people authorised to process controller data are bound by confidentiality and receive access only where needed for their role. The organiser is responsible for its own users, role assignments, leaver removal and appropriate staff confidentiality.

• Tenant-scoped access controls and row-level database policies.
• Private organiser media storage and controlled public delivery for published camp images.
• Opaque private booking links and QR identifiers that do not embed sensitive details.
• Role separation that keeps finance summaries away from medical and emergency details.
• Verified payment webhooks, idempotent booking operations and append-only payment/booking events.
• Limited transactional-email payloads that exclude participant, medical, emergency and consent data.
• Production secrets kept server-side and managed through deployment configuration.

Security is proportionate to risk and is reviewed as the service changes. These controls do not replace the organiser's obligation to secure its devices, accounts, exports and offline processes.

The organiser gives general written authorisation for the providers listed on the subprocessors page. FormSide will require equivalent data-protection obligations and remains responsible for subprocessor performance to the extent required by law.

Before adding or replacing a material subprocessor, FormSide will give every affected organiser reasonable notice. The organiser may object on reasonable data-protection grounds; the parties will try to resolve the concern, and termination of the affected service may be the final remedy where no reasonable alternative exists.

FormSide will not make a restricted transfer without a lawful transfer mechanism. Depending on provider location, this may be a UK adequacy regulation, the UK International Data Transfer Agreement or Addendum, plus any required transfer risk assessment and supplementary measure.

Taking account of the nature of processing, FormSide will provide reasonable assistance for data-subject requests, data-protection complaints, impact assessments and prior consultation. The organiser remains responsible for deciding the lawful response as controller. Additional work outside standard product tools may be chargeable only where agreed and lawful.

FormSide will notify the organiser without undue delay after becoming aware of a personal data breach affecting controller data and provide available information needed for the organiser's assessment and notification duties. The organiser decides whether it must notify the ICO within 72 hours or inform affected people, unless FormSide has its own controller duty for the same incident.

At the end of the service, FormSide will, at the organiser's choice and subject to product capability, return or delete controller data and delete copies unless law requires retention. Protected backups may remain until their normal secure expiry and will not be restored for ordinary use. Legal holds and FormSide-controlled audit or billing records are handled under the privacy notice.

FormSide will make available information reasonably necessary to demonstrate Article 28 compliance and allow proportionate audits by the organiser or its mandated auditor. Audits must protect other customers, confidentiality and security, use existing independent reports first where suitable, and avoid unreasonable disruption. The parties will agree scope, timing and costs in advance unless a regulator or substantiated serious incident requires otherwise.

If these terms conflict with general organiser terms on processor obligations, these terms take priority. Privacy and DPA questions can be sent to privacy@formside.app.