1. Parties and purpose
Controller: the customer who has subscribed to ProdForm. Processor: ProdForm. The agreement governs how ProdForm processes personal data about participants on behalf of the customer, and is subject to GDPR Art. 28. ProdForm processes personal data only on documented instructions from the customer. Those instructions consist of this agreement, the Terms, and the choices the customer makes in the platform: which tests are created, which questions are asked, who is invited and which features are used. If ProdForm considers an instruction to infringe data protection law, the customer is notified without undue delay. Transfers outside the EEA occur only as described in section 8, unless ProdForm is legally required to do otherwise; in that case the customer is notified before the transfer, unless the law prohibits such notice.
2. Nature of processing and data categories
Purpose: product testing, participant management, data collection and reporting on behalf of the customer. Data categories: participant test responses, optional demographic fields, participant code or email if the test requires identification, and technical metadata (IP, browser, device type), and location data if the customer turns on location collection. Processing continues for as long as the customer has an active subscription, and ends on termination as set out in section 5.
3. Subprocessors
ProdForm uses sub-processors to deliver the service. An up-to-date list including purpose, data location and data type is available at prodform.com/subprocessors and is updated when changes occur. All sub-processors have signed data processing agreements. ProdForm imposes the same data protection obligations on its sub-processors as follow from this agreement, and remains fully liable to the customer for their performance, cf. GDPR Art. 28(4). By accepting this agreement, the customer consents to the sub-processors listed on that page. New sub-processors are notified at least 30 days in advance via email to the customer's contact address. If the customer objects within the notice period, the parties shall seek a solution in good faith within 30 days; failing that, the customer may terminate the agreement for the affected service without charge for the remaining period.
4. Security
ProdForm uses encryption in transit (TLS 1.2 or later) and at rest (AES-256 on database files, indexes and write-ahead logs). Internal access to personal data is role-based, and changes made by administrators are logged with user, timestamp and action. Isolation between customers is enforced in the application layer, with Row Level Security in the database as an additional layer on queries made directly from the browser. Access to customer data is limited to ProdForm's owners, who are bound by confidentiality through this agreement. Should anyone else be given such access — employee, contractor or sub-processor — it is granted only after a written confidentiality undertaking. Technical and organisational measures are reviewed continuously against the risk of the processing (GDPR Art. 32).
5. Deletion and return of data
While the subscription is active, the customer may export their data from the platform at any time. On termination, Customer Data is provided on written request within 30 days. Customer Data is then deleted within 30 days of a written request, and no later than 60 days after termination, unless the law requires us to retain it. Deletion is carried out by ProdForm and confirmed in writing. Backups are not deleted individually: they are overwritten in line with the database provider's fixed rotation, and are not available for ordinary use until then. In closed tests, participant responses with personal identifiers are anonymised automatically 24 months after the test is closed, so the link between answers and person is permanently severed. Anonymised aggregate data may be retained without time limit.
6. Assistance to the controller
ProdForm assists the customer in fulfilling GDPR obligations, including responding to participant requests for access, rectification and erasure (Art. 15-22), conducting data protection impact assessments (DPIAs, Art. 35), carrying out prior consultation with the Norwegian Data Protection Authority (Art. 36) and notifying breaches. Assistance is provided at no additional charge for requests of reasonable scope. The customer is primarily responsible for responding to participant requests; self-service tools in the platform cover access and deletion for participants with email association.
7. Breach notification
If ProdForm becomes aware of a personal data breach affecting customer data — including through a sub-processor — the customer is notified without undue delay and no later than within 24 hours. This is shorter than the customer's own 72-hour deadline to the supervisory authority, so the customer retains time to assess and report. The notice describes the nature, scope, measures taken and a contact point for further information, in accordance with GDPR Art. 33.
8. Transfers outside the EEA
Primary data is stored in the EU: database and files with Supabase (Stockholm) and error logging with Sentry (EU region). Two vendors process data in the US: Anthropic when the customer uses the AI features, and Resend, which sends email from Ireland but stores account data, email metadata and logs in the US. The transfer to Anthropic relies on the EU Commission's Standard Contractual Clauses (SCCs), and the transfer to Resend on the EU–US Data Privacy Framework and the Standard Contractual Clauses. The technical measure supplementing them is that participant identifiers are not sent: the AI features receive test text, responses and demographic groups, not names, email addresses or participant codes. Anthropic stores received data for up to 30 days for abuse monitoring and does not use it to train models. Customers should be aware that open free-text fields may contain information participants choose to write themselves. ProdForm reviews transfers continuously against current case law.
9. Audit and documentation
The customer may request documentation of security measures, certifications and risk assessments. The customer, or an auditor appointed by the customer and bound by confidentiality, may carry out an audit on written request with reasonable notice, normally once a year. The customer bears its own costs. If the audit reveals material deviation from this agreement, ProdForm bears the cost of the audit and of any follow-up review. ProdForm maintains records of processing activities on behalf of the customer and can share relevant excerpts on request.
10. Duration and governing law
The agreement applies for as long as ProdForm processes personal data on behalf of the customer. Termination of the Terms also terminates this agreement. The agreement is governed by Norwegian law. Disputes are resolved through negotiation; the venue is Oslo District Court.