Privacy Policy & Cookies

1. Who we are

Formsy® is a trading name of NCR Pads Ltd, registered in England and Wales under company number 08075765. In this policy, “Formsy”, “we”, “us” and “our” refer to NCR Pads Ltd trading as Formsy®.

Depending on the circumstances, we may act as a data controller (where we decide why and how personal information is used) or as a data processor for a Formsy customer (where we process information in forms on that customer's instructions).

2. Information we may process

The information we process depends on how you interact with us and how your organisation configures its forms. It may include:

• name, business name, job title and contact details;
• account and user information;
• billing, subscription and transaction records;
• enquiries, support messages and other communications;
• information entered into digital forms, including text, reference numbers, signatures, photographs or attachments where a form is configured to collect them;
• technical and usage information such as device, browser, IP address, login and security records; and
• cookie and similar technology information, where applicable.

Customers decide what information their forms collect. They should avoid collecting personal information that is unnecessary for their business purpose.

3. How and why we use personal information

Where we act as controller, we may use personal information to provide and administer Formsy®, create customer forms, manage accounts and subscriptions, respond to enquiries, provide support, maintain security, prevent misuse, meet legal and accounting obligations, improve our service and communicate with business customers.

Our lawful basis will depend on the activity. It may include performance of a contract, taking steps requested before entering a contract, compliance with a legal obligation, our legitimate interests in operating and protecting our business and service, or consent where consent is required.

If we ever process special category personal data as a controller, we will also identify an appropriate additional legal condition for that processing.

4. Information contained in customer forms

In that processor role, we process customer form data to provide the service and in accordance with the customer's documented instructions, our agreement with the customer and applicable data protection law.

If you are an individual whose information appears in a Formsy customer's form, requests about that information should normally be made to the organisation that collected it. We will assist our customer with appropriate requests where required.

5. Who we may share information with

We may use carefully selected service providers to help us operate Formsy®, for example hosting, infrastructure, communications, payment, security, support and professional services. We may also disclose information where required by law, to protect legal rights or in connection with a business sale or reorganisation.

Where a provider processes personal data for us, we require appropriate contractual and security protections. Where we act as a processor for a customer, our use of sub-processors is governed by our data processing obligations.

We do not sell personal information.

6. International transfers

Some service providers may process information outside the United Kingdom. Where personal information is transferred internationally, we will use an appropriate lawful transfer mechanism and safeguards where required by UK data protection law.

7. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including providing the service, meeting contractual commitments, maintaining appropriate business and security records and complying with legal, tax and accounting requirements.

Customer form data is retained in accordance with the customer's subscription, configuration and contractual arrangements. Different categories of information may therefore have different retention periods.

8. Security

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, loss or destruction. No internet-based service can guarantee absolute security, so customers and users must also protect account credentials and use the service responsibly.

9. Cookies and similar technologies

Our website may use cookies or similar technologies. Strictly necessary cookies may be used where required for the website or service to function, for security or to remember essential settings.

If we use analytics, advertising or other non-essential cookies that require consent, we will provide appropriate information and controls before setting them. You can also control cookies through your browser, although blocking essential cookies may affect functionality.

We will update this section and any cookie controls when the cookies used on the live website are finalised.

10. Your data protection rights

Depending on the circumstances, UK data protection law may give you rights to request access to your personal information, correction, deletion, restriction, objection, portability, and to withdraw consent where processing relies on consent. Some rights are subject to legal conditions and exceptions.

Where we process information only on behalf of a Formsy customer, we may refer your request to that customer as the relevant controller.

11. Contact, complaints and changes

For privacy questions or requests, please use our Contact page. You also have the right to complain to the UK Information Commissioner's Office if you are unhappy with how your personal information has been handled.

We may update this policy as Formsy®, our suppliers or legal requirements change. The latest version will be published on this page with an updated date.