Data Processing Agreement
Last updated: [DATE]
This Data Processing Agreement ("DPA") forms part of the Terms of Service between [STARSTORM LEGAL ENTITY NAME] ("Starstorm", the processor) and the customer that uses Intake (the controller). It applies automatically when you accept the Terms; nothing needs signing. If you need a signed copy, email intake@starstorm.dev. Where this DPA and the Terms differ on data protection, this DPA wins.
1. Definitions
"Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and, where they apply to you, the EU GDPR and other applicable laws. "Personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings in Data Protection Law. "Customer Personal Data" means personal data in form submissions, uploaded files and follow-up messages that Starstorm processes for you through Intake.
2. Processing on your instructions
2.1 You are the controller of Customer Personal Data and Starstorm is your processor.
2.2 Starstorm processes Customer Personal Data only on your documented instructions. These are the Terms, this DPA, and how you configure Intake (your forms, actions, integrations, retention and settings). If the law requires other processing, Starstorm will tell you first unless the law forbids it.
2.3 Starstorm will tell you if, in its opinion, an instruction breaks Data Protection Law.
2.4 You are responsible for having a lawful basis for collecting Customer Personal Data, for giving data subjects the information the law requires, and for the destinations you send data to.
3. Confidentiality
Starstorm ensures that everyone authorised to process Customer Personal Data is bound by a duty of confidentiality and has access only as far as needed.
4. Security
Starstorm maintains the technical and organisational measures in Annex 2. They may be updated over time, but not in a way that lowers the overall level of protection.
5. Sub-processors
5.1 You give general authorisation for Starstorm to use the sub-processors listed on the sub-processors page.
5.2 Starstorm will give at least 30 days' notice of a new or replacement sub-processor. If you object on reasonable data protection grounds and Starstorm cannot reasonably address the objection, you may end the affected subscription and receive a pro-rata refund of prepaid fees.
5.3 Starstorm imposes data protection terms on each sub-processor at least as protective as this DPA, and remains liable to you for their performance.
6. International transfers
Customer Personal Data is stored in the United Kingdom. Starstorm transfers it outside the UK only with a safeguard Data Protection Law accepts, such as UK adequacy regulations or the ICO's International Data Transfer Agreement or Addendum.
7. Assistance
7.1 Taking into account the nature of the processing, Starstorm helps you respond to data subjects exercising their rights. Intake's search, export and deletion let you do most of this yourself. Starstorm will pass on any request it receives directly, without responding to it unless you ask.
7.2 Starstorm gives reasonable help with your security obligations, data protection impact assessments and consultations with a supervisory authority, where they relate to Intake.
8. Personal data breaches
Starstorm will notify you without undue delay, and in any case within [48] hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will include what Starstorm knows of its nature, the data and data subjects likely affected, likely consequences, and the measures taken or proposed. Information may be provided in stages as it becomes available.
9. Deletion and return
You can export Customer Personal Data at any time. When a workspace is deleted, Starstorm deletes Customer Personal Data after a 30-day grace period, during which you can ask for it to be restored. Copies in backups are overwritten within [BACKUP RETENTION]. Data the law requires Starstorm to keep is retained only for that purpose.
10. Information and audits
Starstorm makes available the information reasonably needed to demonstrate compliance with this DPA. It allows audits, including inspections, by you or an independent auditor you appoint. These take place on reasonable notice, during business hours, no more than once a year (unless a supervisory authority requires it or a breach has occurred), at your cost, and under a confidentiality agreement. Starstorm may first answer with documentation that addresses the audit's purpose.
11. Liability and term
Each party's liability under this DPA is subject to the limits in the Terms. This DPA lasts as long as Starstorm processes Customer Personal Data for you.
Annex 1: Details of processing
| Subject matter | Providing the Intake form backend service |
|---|---|
| Duration | The term of the Terms, plus the deletion period in section 9 |
| Nature and purpose | Receiving, storing, displaying, exporting and delivering form submissions and files as configured by the customer; carrying messages between the customer and anonymous reporters where the customer turns on follow-up; spam filtering; backups |
| Types of personal data | Whatever the customer's forms collect (typically names, contact details and messages; possibly special category data where the customer chooses), plus metadata: time, origin domain, and the visitor's IP address and browser only where the customer turns that on |
| Data subjects | People who fill in the customer's forms |
| Special category data | Only if the customer's forms collect it. End-to-end encrypted forms are recommended for it: Starstorm then stores only ciphertext it cannot read. |
Annex 2: Security measures
- Encryption in transit (HTTPS) for every connection to the service
- Optional end-to-end encryption of submissions in the visitor's browser; Starstorm never holds the means to decrypt them
- Integration credentials (webhook passwords, tokens, mail server logins) encrypted at rest, with key rotation
- Workspace isolation enforced in the database (row-level security) as well as in the application
- Passwords hashed with Argon2id; optional two-factor sign-in and single sign-on; session rotation; sign-in rate limiting
- Role-based access within workspaces (owner, admin, member, viewer, optionally limited to some forms) and an audit log of sensitive actions
- Outbound requests to customer-supplied addresses checked so they cannot reach internal networks
- Optional virus scanning of uploaded files; strict content security policies on every page
- Retention limits per plan, enforced daily; backups [DESCRIBE: frequency, encryption, location]
- Staff access to production limited to [DESCRIBE]
Annex 3: Sub-processors
As listed on the sub-processors page, which forms part of this DPA.