This article explains in detail where Form Publisher's data is stored and how our processing complies with GDPR. It also explains our compliance with GDPR’s International Data Transfer clause.
Legitimacy of our data processing operations
We store and process your user and usage data (refer to article: [DATA STORAGE] What data is stored by Form Publisher and how is it used?) in Firebase, the Google cloud-hosted database.
The physical storage of Form Publisher data and processing is protected under Data Processing and Security Terms of Google Cloud Platform.
Form Publisher is GDPR compliant as we do not transfer any personal data. We never save your content or data of your google form or the documents generated out of your google form submission, in our database.
If a document approval workflow is setup, we do store the specific configuration data and the generated file information in Google Firebase. This data is absolutely essential for Form Publisher’s web app to trigger email notification and updation of the approval information in the Form responses spreadsheet whenever there is an approval action on the document flow.
Do we do international transfer of personal data?
We will never transfer, sell, make copies, or share any of your data stored by Form Publisher to third party services or companies.
Which Data Transfer mechanisms does Form Publisher rely on? Standard Clauses or Privacy Shield?
Upon completion of the DPA, it is stipulated that: The application of lawful data transfer mechanisms for our customers who wish to transfer personal data to a third country (outside the EEA) in accordance with Article 45 or 46 of the GDPR, relies on entering into Standard Contractual Clauses or offer any alternative transfer solution if requested (for example, the EU-U.S. Privacy Shield).
HIPAA and BAA
If you intend to use the Service for any purpose or in any manner involving Protected Health Information, as defined in the Health Insurance Portability and Accountability Act (“HIPAA”), it is your responsibility to (a) execute a Business Associate Agreement with Google related to your HIPAA data stored in your Google Drive, and (b) execute a Business Associate Agreement with us related to your HIPAA data stored by you on the Service. To check what data the Service stores, please refer to this page: FP. To request a BAA to us, please fill-in this Google Form and you will automatically receive our standard BAA to sign.