Sub-processors
We take data security and privacy seriously. This page provides information about third party companies and services that we use and share data with. We never share data unnecessarily, and make sure to choose partners who meet our privacy and security standards.
When sharing personal data, sometimes we need to transfer it outside of the European Union. We make a serious effort to protect this data: we follow GDPR regulations, and we want to keep our customers informed at all times.
Any provider we share our data with is thoroughly assessed, and subject to contract terms designed to ensure the proper processing of personal data.
The following lists shows the service providers (sub-processors) and subsidiaries we use to deliver our services (i.e. sub-processors), where they are located, and a description of their purpose and the tasks they carry out.
You can sign up to our newsletter to get notified of any changes regarding these sub-processors to this page here.
How do we deal with international data transfers? SCCs and supplementary measures
We use Data Protection Agreements (DPAs) with all our subprocessorsthe recipients of personal data (our providers). Where they involve international data transfersT they always include the latest Standard Contractual Clauses (SCCs) or any otheras the valid legally valid transfer mechanism, to provide appropriate safeguards that ensure rights and effective legal remedies are available for individuals.
Where SCCs safeguards can’t provide an equivalent level of protection for data transferred to third countries, Typeform has included supplementary security measures to cover the risks identified in said countries.
Typeform enforces a security and privacy program that addresses the treatment of data from its collection, to the end of its lifecycle. We adopt a risk management cycle to properly identify, correct, remediate and learn of any issue as swiftly as possible.
We encourage you to visit our Security at Typeform page for more information about our Security program and the frameworks we are certified in.
We just don’t share response data
We don’t share any response data of your typeforms with anyone except with the sub-processors identified and as further detailed in the following two lists: (i) sub-processors that process response data and (ii) sub-processors that could process response data - optional services.
However, all our data is encrypted in transit and at rest, so not even our providers are able to access this data.
For more information on security measures at Typeform, you can visit our Security at Typeform page.
List of third party services we use
Below you can find all the companies we may share data with when acting on your behalf, with an explanation of why. If you have any more questions about the data we share, please get in touch by clicking the Contact Support button at the bottom of this page.
- Respondent: anyone answering a typeform created by a customer
- Response data: responses provided by a respondent and collected by a customer via a typeform
- Customer: anyone with a Typeform account using Typeform services
- Prospect: a potential Typeform customer
Sub-processors that process response data
| Sub-processor | Purpose | Personal Data | Location | Transfer Tool |
| Amazon Web Services Inc. (dba AWS) |
Storage, data management
|
Response data collected while answering a typeform built by a customer (the type of personal data depends on each customer and form). | US, EU (for EU data hosting customers) | Adequacy decision and SCCs |
| Snowflake Computing Netherlands B.V. | Used as our data warehouse and for data processing | Response data collected while answering a typeform built by a customer (the type of personal data depends on each customer and form). | US | Adequacy decision and SCCs |
Sub-processors that could process response data - optional services
| Sub-processor | Purpose | Personal Data | Location | Transfer Tool |
|
Amazon Web Services Inc. ( dba AWS)⏎
|
In the case that you use Optional Features, AI services for form building and analysis | Response data collected while answering a typeform built by a customer (the type of personal data depends on each customer and form). | US, EU (for EU data hosting customers) | Adequacy decision and SCCs |
| FullContact Inc. | In the case that you use data enrichment to obtain additional demographic and professional data. | Email address (response data) collected via a typeform. | US | SCCs |
| Google (Gmail) | In the case that you contact Customer Support, to resolve queries or security concerns of the platform or about the responses received. | Email address, any data provided by customer to solve the query, including response data as per customer’s request. | EU | N/A |
| Mailgun Technologies, Inc. | In the case you use our feature to send emails through the platform containing respondent data. | Response data as long as the customer includes it in the subject or body of the message. | EU | N/A |
| Mux, Inc. | In the case you use our feature to process video questions and video answers. | Recordings and response data provided in video format. | US | SCCs |
| OpenAI Ireland Ltd | In the case that you use Optional Features, AI services aimed at form building and results analysis. | Response data collected while answering a typeform built by a customer (the type of personal data depends on each customer and form). | US | SCCs |
| Zendesk, Inc. | In the case that you contact Customer Support, to resolve queries or security concerns of the platform or about the responses received. | Any data provided by customer to solve the query, including response data as per customer’s request. | US | SCCs |
| ZOOMINFO TECHNOLOGIES LLC | In the case that you use data enrichment to obtain additional demographic and professional data. | Email address (response data) collected via a typeform | US | SCCs |
Sub-processors that process customer data
| Sub-processor | Purpose | Personal Data | Location | Transfer Tool |
| APIHub Inc. (dba Clearbit) | Target marketing campaigns at relevant audience and profiling | Email address | US | SCCs |
| Gainsight, Inc. (formerly known as InSided) | In the case that you participate in our community, to support account creation and user interaction in our community, as available at https://community.typeform.com/ | Name, surname, email address | EU | N/A |
| Google (Gmail) | Customer Services: Provide a support service for the reception, and communication with all Typeform customer enquiries and requests, in accordance with the procedures specified by Typeform. | Name, surname, email address, billing details, other information related to queries raised by customers | EU | N/A |
| Liveblocks, Inc. | In the case that you activate our commenting services, to support the commenting experience and real time interaction in our platform | Input provided by a user when interacting with another user | US | SCCs |
| Mailgun Technologies, Inc. | In the case you use our feature to send emails through the platform containing customer data. | Any data as long as the customer includes it in the subject or body of the message. | EU | N/A |
| Okta, Inc. | Create a single sign-on system for login and authentication on the Typeform platform (also supports MFA) | Email address, IP address | US, EU | SCCs |
| OpenAI Ireland Ltd | In the case that you use Optional Features, AI services aimed at form building and results analysis. | Any data as long as the customer includes it in the body of the input / background provided to the AI. | US | SCCs |
| Pinecone Systems, Inc. | In the case that you use Optional Features, AI services aimed at form building and results analysis. | Any personal data only as long as the customer includes it in the knowledge base or the questions of the form. | US | SCCs |
| PowerPlay GmbH (dba as Cello.so) | In the case that you use our referral services, to identify and process the referral | Name, surname, email address, phone number, country | EU | N/A |
| Salesforce Systems Spain, S.L (Slack) | Customer Services: Provide a support service for communication of all Typeform customer enquiries and requests, in accordance with the procedures specified by Typeform. | Name, surname, email address, billing details, other information related to queries raised by customers | EU | SCCs |
| TYPEFORM DE GmbH | Customer Services: Provide a support service for the reception, assessment, or dispatch of all Typeform customer enquiries and requests, in accordance with the procedures specified by Typeform. | Name, surname, email address, billing details, other information related to queries raised by customers | EU | N/A |
| TYPEFORM UK Ltd |
Customer Services:
Provide a support service for the reception, assessment, or dispatch of all Typeform customer enquiries and requests, in accordance with the procedures specified by Typeform. |
Name, surname, email address, billing details, other information related to queries raised by customers | UK | SCCs |
| TYPEFORM US LLC | Customer Services: Provide a support service for the reception, assessment, or dispatch of all Typeform customer enquiries and requests, in accordance with the procedures specified by Typeform. | Name, surname, email address, billing details, other information related to queries raised by customers | US | SCCs |
| Zendesk Inc. | Customer Services: Provide a support service for the reception, assessment, or dispatch of all Typeform customer enquiries and requests, in accordance with the procedures specified by Typeform. | Name, surname, email address, billing details, other information related to queries raised by customers | US | SCCs |