GDPR compliance

1. Roles

When you use Formblyt to collect responses from your respondents, you act as the data controller for the personal data you collect, and Formblyt acts as your data processor. For account data you provide directly to Formblyt (name, email, billing), Formblyt is the data controller.

2. Lawful basis

We process personal data on the lawful bases described in our Privacy Policy: performance of contract, legitimate interests, consent, and legal obligation. You are responsible for identifying the lawful basis for the data you collect from your own respondents.

3. Data subject rights

• Right of access, rectification, and erasure.
• Right to restrict or object to processing.
• Right to data portability.
• Right to withdraw consent at any time.
• Right to lodge a complaint with a supervisory authority.

You can exercise these rights against Formblyt by emailing privacy@formblyt.com. For responses collected via your forms, please contact the form owner directly.

4. International transfers

Some sub-processors may host or process data outside the UK/EEA. Where this occurs, we rely on an adequacy decision, Standard Contractual Clauses, or another lawful safeguard.

5. Sub-processors

We use vetted sub-processors for hosting, database, authentication, email delivery, analytics, and payment processing. A current list is available on request.

6. Data processing agreement

Business customers who require a Data Processing Agreement (DPA) can request one by emailing privacy@formblyt.com. Our DPA incorporates the EU Standard Contractual Clauses where applicable.

7. Security

See our Security page for details on encryption, access control, monitoring, and responsible disclosure.

8. Contact

Data protection enquiries: privacy@formblyt.com.