This information is provided as-is, based on our best understanding of the information publicly available and our consultations with our legal counsel. This is not legal advice, and we cannot answer questions about your particular situation. You should consult with your own legal counsel if you have questions about your obligations under the GDPR.
If you are using FormAssembly to collect and process Personal Data of European Union data subjects, either as an organization established in the European Union (EU), or as an organization not established in the EU but offering goods or services directed at European Union data subjects, then the GDPR applies to you.
In this context, Personal Data means any information that can identify a person (the “data subject” in GDPR parlance) directly or indirectly. For instance, names, online identifiers, identification numbers, location data or any sufficiently specific combination of other data points.
For customers not established in the European Union, the scope and reach of the GDPR can be confusing and you will need to make your own determination as to whether this, in fact, applies to you. The concept of “offering” goods or services should be evaluated on a case-by-case basis. Merely having a website or a web form accessible from the European Union is unlikely to be sufficient to trigger the application of the GDPR. Offering a service targeted at European users, or of which a large portion of users are from the European Union, would on the other hand likely trigger the GDPR, even if you (or the data) are not located in the EU. You can refer to Articles 2 and 3, and Recital 23 of the GDPR for further information on the scope of the GDPR.
Next Step
If you’ve determined that the GDPR applies to you and your use of FormAssembly, you need to enter into an additional agreement (the Data Processing Addendum) with us. This addendum contractually binds us to meet our obligations as your Data Processor. You must review and sign the fully executed copy of the agreement to us by May 25th 2018. You can review and sign the agreement here.
While this agreement covers our mutual legal requirements, you can provide more information in our GDPR webinar recaps.
