AidaForm – Data Processing Agreement (DPA)

Last updated: November 3, 2026

This Data Processing Agreement (“DPA”) is entered into between you (the “Customer”, “you”) and Komorebi GmbH, a limited liability company under German law, registered with the Commercial Register of the District Court (Amtsgericht) of Bonn under HRB 28210, Im Uckerfeld 14, 53127 Bonn, Germany, operating the AidaForm service (“AidaForm”, “we”, “us”).

1. Conclusion and scope

1.1 This DPA applies to the processing of Personal Data by us on your behalf in connection with your use of the AidaForm online form builder, available at my.aidaform.com and accessible via the website aidaform.com and its language versions, and related services (the “Services”) under our Terms of Use.

1.2 This DPA forms part of the agreement for the Services. It is concluded electronically when you accept it during account registration or afterwards in your account; no signature is required (Art. 28(9) GDPR). On request, we provide a copy signed by us.

1.3 A German version of this agreement (Auftragsverarbeitungsvertrag) is available for customers in Germany, Austria and Switzerland. The version you accepted applies to you.

2. Definitions

2.1 “Data Protection Laws” means all data protection laws applicable to the processing under this DPA, in particular: (a) Regulation (EU) 2016/679 (“GDPR”); (b) the GDPR as it forms part of UK law (“UK GDPR”) and the UK Data Protection Act 2018; (c) the Swiss Federal Act on Data Protection (“FADP”); and (d) the US State Privacy Laws listed in Annex 6.

2.2 “Controller”, “Processor”, “Data Subject”, “Personal Data”, “Processing” and “Personal Data Breach” have the meanings given in the GDPR. Equivalent terms under other Data Protection Laws (e.g. “business” and “service provider” under the CCPA) are to be read accordingly.

2.3 “Customer Data” means Personal Data that you or your form respondents submit to the Services and that we process on your behalf, including form content, uploaded files and the data of your account users.

2.4 “Sub-processor” means a third party engaged by us to process Customer Data.

3. Subject matter, duration, nature and purpose

3.1 You are the Controller and we are the Processor of Customer Data. Where you are yourself a Processor acting for a third party, we act as your Sub-processor, and you warrant that your instructions are authorised by that third party.

3.2 We process Customer Data only to provide the Services. The categories of data and Data Subjects, the nature and purpose of the processing and the data locations are described in Annex 1.

3.3 This DPA applies for as long as we process Customer Data for you. Ending a paid subscription does not end this DPA if you continue to use the Services under a free plan.

4. Instructions

4.1 We process Customer Data only on your documented instructions, including with regard to transfers to third countries, unless EU or EU Member State law to which we are subject requires otherwise. In that case, we inform you of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.

4.2 Documented instructions are: (a) this DPA; (b) your use and configuration of the Services, including the settings you choose (such as the data centre selected for a form); and (c) instructions sent by you in text form, e.g. by email.

4.3 If we believe that an instruction infringes Data Protection Laws, we will inform you without undue delay and may suspend carrying out that instruction until you confirm or change it in text form.

5. Your obligations

5.1 As Controller, you are responsible for the lawfulness of the processing, in particular for having a legal basis, informing Data Subjects (e.g. your form respondents) and, where required, obtaining their consent.

5.2 You decide what data you collect through your forms. You must not use the Services to process protected health information within the meaning of the US Health Insurance Portability and Accountability Act (HIPAA) unless a separate Business Associate Agreement has been concluded with us.

5.3 You inform us without undue delay if you find errors or irregularities in the processing.

6. Confidentiality

We ensure that all persons authorised to process Customer Data are bound by written confidentiality obligations or are under an appropriate statutory obligation of confidentiality, which continue after the end of their engagement.

7. Security

7.1 We implement the technical and organisational measures described in Annex 2 to ensure a level of security appropriate to the risk (Art. 32 GDPR).

7.2 We may update these measures to reflect technical progress, provided the overall level of protection is not reduced.

8. Sub-processors

8.1 You give us general authorisation to engage Sub-processors. The Sub-processors engaged at the time of conclusion are listed in Annex 3 and are hereby approved.

8.2 We inform you by email at least thirty (30) days in advance of any intended addition or replacement of a Sub-processor.

8.3 You may object to the change in text form within fifteen (15) days of our notice, on reasonable data protection grounds. If we cannot resolve the objection, either party may terminate the affected Services with effect from the date the new Sub-processor is engaged.

8.4 We impose on each Sub-processor, by contract in writing (including in electronic form), data protection obligations that offer the same level of protection as this DPA, including sufficient guarantees for appropriate technical and organisational measures. We remain responsible to you for the performance of our Sub-processors’ obligations.

9. Data location and international transfers

9.1 Customer Data is stored and processed in the AWS regions described in Annex 1, depending on your country and the data centre you select for each form.

9.2 Where Customer Data is transferred to a country outside the EU/EEA without an adequacy decision, the transfer is based on appropriate safeguards under Chapter V GDPR, in particular the Standard Contractual Clauses (“SCCs”) or the EU-US Data Privacy Framework. Details, including the UK and Swiss requirements, are set out in Annex 4.

10. Data Subject rights

10.1 Taking into account the nature of the processing, we assist you by appropriate technical and organisational measures in responding to requests from Data Subjects. You can access, export and delete Customer Data directly in your account. To preserve their integrity, submitted form data cannot be edited; where a Data Subject requests rectification, you can delete the submission and collect the corrected data again.

10.2 If a Data Subject contacts us directly, we forward the request to you without undue delay. We do not respond to the request ourselves, other than to refer the Data Subject to you.

11. Assistance and Personal Data Breaches

11.1 Taking into account the nature of the processing and the information available to us, we assist you in complying with your obligations under Articles 32 to 36 GDPR, in particular data protection impact assessments and prior consultations.

11.2 We notify you of any Personal Data Breach affecting Customer Data without undue delay and no later than 48 hours after becoming aware of it. The notice contains, as far as available, the information required by Art. 33(3) GDPR. Information that is not yet available is provided as soon as it is.

11.3 We take reasonable measures to contain the breach and mitigate its effects, and support you in investigating it.

11.4 You, as Controller, are responsible for notifying the competent supervisory authorities and affected Data Subjects of Personal Data Breaches where required by applicable law. We provide you with the information described above to enable you to do so.

12. Deletion and return

12.1 You can export Customer Data from your account at any time before deletion. By doing so, you exercise your right to have Customer Data returned.

12.2 If you delete your account, all Customer Data is deleted from our production systems immediately. Deleted data is not restored. A request to delete your account is a request to delete Customer Data under this section.

12.3 If you terminate the agreement by notice sent by email, we confirm receipt of your notice and delete Customer Data within two (2) days after the termination date.

12.4 Deleted data remains in encrypted backups until these are automatically deleted, no later than 35 days after deletion.

12.5 Sections 12.2 to 12.4 do not apply where EU or Member State law requires us to retain the data.

12.6 Form submissions are automatically deleted five (5) years after receipt, unless you delete them earlier.

13. Audits

13.1 We make available to you all information necessary to demonstrate compliance with this DPA, in particular our TOMs and, on request, answers to reasonable security questionnaires.

13.2 If this information is not sufficient, you may carry out an audit, or have it carried out by an independent auditor bound to confidentiality, at most once per year, unless there are justified indications of a breach of this DPA or a supervisory authority requires an audit.

13.3 Audits must be announced at least thirty (30) days in advance, take place during normal business hours and must not unreasonably disrupt our operations. Audits of AWS data centres are replaced by AWS’s certifications and audit reports.

13.4 You bear the costs of the audit unless it reveals a material breach of this DPA by us.

14. Changes to this DPA

14.1 We may amend this DPA, in particular to reflect changes in law, in the Services or in the TOMs. We notify you of material changes by email at least thirty (30) days before they take effect. If you object, you may terminate the Services with effect from the date the change takes effect.

14.2 Changes required by law or by a supervisory authority may take effect earlier. Changes to the list of Sub-processors follow section 8.

15. Governing law and precedence

15.1 This DPA, including its Annexes, is governed by German law. The courts of Bonn, Germany, have exclusive jurisdiction, to the extent permitted by law. This does not apply where the SCCs or the UK International Data Transfer Addendum mandatorily provide otherwise.

15.2 In case of conflict, the following order of precedence applies: (1) the SCCs, where applicable; (2) Annexes 5 and 6 for the jurisdictions they cover; (3) this DPA; (4) the Terms of Use.

15.3 If any provision of this DPA is invalid, the remaining provisions remain valid.

Annex 1 – Description of the processing

Data location

Annex 2 – Technical and organisational measures (TOMs)

1. Scope

These technical and organisational measures (“TOMs”) are an annex to the Data Processing Agreement between Komorebi GmbH, operating the AidaForm service (“AidaForm”, “we”), and the Customer. They describe how we protect Personal Data processed on the Customer’s behalf, in accordance with Art. 32 GDPR and Art. 8 Swiss Federal Act on Data Protection (FADP/DSG).

Hosting and data location. AidaForm runs on the cloud infrastructure of Amazon Web Services (“AWS”). Our contracting party is Amazon Web Services EMEA SARL, Luxembourg, together with its German branch in Munich. The location of Customer data depends on the Customer’s country and the data centre selected for each form:

• Customers in the EU/EEA, UK and Switzerland: account data and form data are stored and processed in eu-central-1 (Frankfurt, Germany), unless the Customer selects “Global” for a form.

• Customers in other countries: account data may be stored and processed in the AWS region(s) us-east-1 (N. Virginia, USA), eu-west-1 (Ireland). For each form, the Customer selects the data centre:

  • “Germany”: form data is stored and processed in eu-central-1 (Frankfurt, Germany);

  • “Global”: form data may be stored and processed in us-east-1 (N. Virginia, USA), eu-west-1 (Ireland).

• Backups are stored in the EU eu-west-1 (Ireland) region.

• Where data is stored outside the EU/EEA, transfers are based on an adequacy decision (including the EU-US Data Privacy Framework) or the Standard Contractual Clauses included in the AWS Data Processing Addendum.

• Services used: EC2, S3, DynamoDB, Lambda, Cognito, Amazon SES.

We maintain an Information Security Program (“ISP”) designed to (i) protect Personal Data against accidental or unlawful loss, access or disclosure; (ii) identify reasonably foreseeable internal and external risks; and (iii) minimise security risks through risk assessment and regular testing. We will not materially reduce the overall level of security during the term of this DPA.

2. Information security organisation

• Information security policies are documented, approved by management, communicated to all staff and reviewed at least annually.

• Security and data protection roles and responsibilities are defined and assigned. Responsibility lies with the Managing Director. Data protection contact: support@aidaform.com.

• We assess information security risks at least annually and before significant changes.

• A record of processing activities carried out on behalf of controllers is maintained (Art. 30(2) GDPR).

3. Physical access control

• AidaForm operates no own data centres or server rooms. All production systems are hosted in AWS data centres, which are certified to ISO/IEC 27001, 27017 and 27018 and protected against unauthorised entry and environmental hazards (fire, water, power failure, overheating).

• Access to AidaForm’s office premises is restricted to authorised persons.

• Access rights are granted only on a legitimate business need and revoked promptly when no longer needed.

4. System access control

• Every user account is personal and uniquely assigned to one individual; no shared accounts.

• Access to production systems and administrative consoles requires multi-factor authentication.

• Password rules and protection against repeated failed login attempts protect against guessing and brute-force attacks (managed by AWS Cognito and AWS WAF).

• Default passwords and accounts are changed or disabled before systems go live.

• Authentication data is protected in transit and at rest.

• All access rights are revoked promptly when an employee or contractor leaves.

5. Data access control

• Permissions follow the least-privilege and need-to-know principles.

• Granting and changing access rights is documented and approved by a second person (four-eyes principle). Approval is given by the Managing Director; changes to the Managing Director’s own access rights are approved by the technical lead.

• Access rights are reviewed at least annually and whenever staff join, leave or change roles, and are adjusted where necessary.

• Access to production Customer data is limited to a small number of designated persons with an operational need, plus documented emergency access.

• AidaForm staff access Customer data only where necessary to provide the service, provide support at the Customer’s request, or comply with law.

6. Transfer control and encryption

• All data transmitted over public networks is encrypted using TLS 1.2 or higher.

• Data at rest (databases, file storage, backups) is encrypted with AES-256 using AWS KMS.

• Only secure, uncompromised cryptographic algorithms and trusted certificate authorities are used. Certificates are issued, renewed and revoked under a defined process.

• Access to production resources is restricted by AWS IAM policies with least-privilege permissions and, where applicable, VPC and security group rules permitting only required connections.

• Form submission notifications are sent by email only to recipients configured by the Customer. Notifications may contain the submitted form data. The Customer can disable email notifications at any time and access submissions in its account instead.

7. Input control and logging

• Security-relevant system events and administrative actions are logged (AWS CloudTrail and AWS CloudWatch). Logs are protected against manipulation and retained for 90 days.

• Logs are reviewed continuously via automated alerts.

• Where consent is collected through AidaForm forms, the submission is stored with a timestamp so the Customer can evidence it.

• System capacity and availability are monitored with AWS CloudWatch Alarms.

8. Separation control

• Data of different Customers is logically separated by account ID enforced in the application and database; a Customer can access only its own data.

• Production, test and development environments are separated. No development or testing is performed on production systems, and production Customer data is not used for testing.

9. Availability and resilience

• Backups are created daily, encrypted, and stored separately from the primary data in the EU region.

• Backups are retained for 35 days and then deleted.

• Restoration from backup is tested at least annually.

• We maintain a risk-based business continuity and disaster recovery plan covering restoration of systems and data, emergency operation and communication with Customers. The plan is reviewed and tested at least annually.

• Production infrastructure uses redundant AWS components.

10. Secure development, change and vulnerability management

• Software is developed following secure development best practices.

• Changes are tested for functionality and security vulnerabilities and approved before deployment to production.

• Systems are hardened: only services and functions required for operation are enabled.

• Systems and third-party dependencies are regularly scanned for known vulnerabilities. Identified vulnerabilities are assessed and remediated within defined timeframes based on their severity.

• Security patches are applied promptly after release.

11. Incident management

• A documented incident response process covers detection, assessment, containment, recovery and documentation of incidents.

• All staff follow a uniform procedure for reporting suspected incidents internally.

• Personal data breaches affecting Customer data are reported to the Customer without undue delay, and no later than 48 hours after we become aware of them. The notice includes the information required by Art. 33(3) GDPR, as far as available.

• We support the Customer in meeting its own notification and documentation obligations.

12. Sub-processor control

• Sub-processors are engaged only under an agreement in writing (including in electronic form) imposing data protection obligations equivalent to those in the Data Processing Agreement, including security requirements and a right to audit.

• Sub-processors are selected with due diligence on their security measures and certifications and are reviewed annually.

• The current list of sub-processors is set out in Annex 3 to this DPA. All sub-processors are established in the EU.

• Where Customer data is stored outside the EU/EEA (see section 1), transfers are based on an adequacy decision or the Standard Contractual Clauses included in the AWS Data Processing Addendum.

13. Data protection by design and by default

• Processes and systems are designed so that collection and processing are limited to what is necessary for the stated purpose.

• Customers can access, export and delete form data in their account, and restrict or stop processing, so they can respond to data subject requests.

• We process Personal Data only on the Customer’s documented instructions.

• A deletion concept defines retention periods. Deleted Customer data is removed from production systems and is not restored; encrypted backups are automatically deleted after 35 days.

• Customer data is stored only on AWS infrastructure; it is not stored on removable media. Temporary files are deleted after processing.

14. Personnel security and end devices

• All employees and contractors are bound by written confidentiality obligations that continue after the end of their engagement.

• Staff receive security and data protection awareness training at onboarding and at least once per year.

• Laptops and mobile devices are protected by full-disk encryption and screen lock, so that data on lost or stolen devices cannot be accessed.

• Use of USB and other removable storage media for Customer data is prohibited.

• Devices must not be left unattended in public places.

15. Review, certifications and changes

• These measures are reviewed at least annually and updated where necessary, in particular after significant changes or incidents. Changes are documented.

• AidaForm does not currently hold its own information security certification. Our infrastructure provider AWS is certified to ISO/IEC 27001, 27017 and 27018 and audited regularly by independent third parties.

• On request, we provide the Customer with information needed to demonstrate compliance with these measures.

• We may update these TOMs to reflect technical progress, provided the overall level of protection is not reduced.

Annex 3 – Sub-processors

Annex 4 – International transfers

1. Transfers to Customers outside the EU/EEA

1.1 Where you are established in a country outside the EU/EEA that is not covered by an adequacy decision, and Customer Data is made available to you from the EU (e.g. through your account or email notifications), the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Four (Processor to Controller), are incorporated into this DPA by reference.

1.2 For the purposes of these SCCs: (a) we are the data exporter and you are the data importer; (b) Clause 7 (docking clause) does not apply; (c) the optional wording in Clause 11 does not apply; (d) Clause 17: the SCCs are governed by German law; (e) Clause 18: disputes are resolved by the courts of Bonn, Germany; (f) the information required in Annex I of the SCCs is set out in Annex 1 of this DPA.

2. Onward transfers to AWS regions outside the EU/EEA

Where Customer Data is stored in an AWS region outside the EU/EEA (see Annex 1), the transfer is based on the AWS Data Processing Addendum, which incorporates the SCCs (Module Three, Processor to Processor) and the corresponding UK and Swiss transfer mechanisms. Amazon Web Services, Inc. is also certified under the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework.

3. United Kingdom

3.1 Transfers of Customer Data from the UK to the EU/EEA are covered by the UK adequacy regulations.

3.2 Where UK Customer Data is transferred to a third country not covered by UK adequacy regulations, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner applies in addition to the SCCs referred to above. References to the GDPR are to be read as references to the UK GDPR.

4. Switzerland

Where Customer Data is subject to the FADP, the SCCs apply with the following amendments: (a) the Federal Data Protection and Information Commissioner (FDPIC) is the competent supervisory authority insofar as the transfer is governed by the FADP; (b) references to the GDPR are to be read as references to the FADP; (c) the term “Member State” must not be interpreted so as to exclude Data Subjects in Switzerland from bringing claims at their place of habitual residence.

Annex 5 – Swiss addendum

This addendum applies where the processing of Customer Data is subject to the Swiss Federal Act on Data Protection (FADP).

1. This DPA constitutes a contract on processing by a processor within the meaning of Art. 9 FADP. Terms used in this DPA are to be read in line with the corresponding FADP terms (e.g. “Processor” as “Auftragsbearbeiter”).

2. We implement data security measures in accordance with Art. 8 FADP and the Swiss Data Protection Ordinance, as described in Annex 2.

3. We engage Sub-processors only with your prior general authorisation in accordance with section 8 (Art. 9(3) FADP).

4. We notify you of any breach of data security as soon as possible (Art. 24(3) FADP), and in any event within the period set out in section 11.2.

5. Transfers of Customer Data abroad take place only in accordance with Art. 16 and 17 FADP, as set out in Annex 4.

6. The competent supervisory authority for matters under the FADP is the Federal Data Protection and Information Commissioner (FDPIC).

Annex 6 – US state privacy addendum

This addendum applies where the processing of Customer Data is subject to the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”) or another comprehensive US state privacy law, including those of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states with comparable laws (together “US State Privacy Laws”). For these purposes, you are the “business” or “controller”, and we are your “service provider” or “processor”.

We will:

1. process Customer Data only for the limited and specified business purpose of providing the Services as described in Annex 1, and not for any other purpose;

2. not sell or share Customer Data, as these terms are defined in the CCPA;

3. not retain, use or disclose Customer Data outside the direct business relationship with you, including for targeted or cross-context behavioural advertising;

4. not combine Customer Data with personal information we receive from or on behalf of another person or collect from our own interactions with consumers, except as permitted by US State Privacy Laws;

5. comply with applicable US State Privacy Laws and provide the same level of privacy protection as required by them;

6. notify you if we determine that we can no longer meet our obligations under US State Privacy Laws;

7. permit you to take reasonable and appropriate steps to ensure that we use Customer Data consistently with your obligations, and to stop and remediate unauthorised use, including through the information and audit rights in section 13;

8. engage Sub-processors only under a written contract imposing the same obligations, and notify you in accordance with section 8;

9. assist you in responding to consumer requests in accordance with section 10;

10. delete or return Customer Data at the end of the Services in accordance with section 12.

We certify that we understand and will comply with the restrictions in this addendum.

Protected health information under HIPAA may only be processed under a separate Business Associate Agreement (section 5.2).