DraftNot yet reviewed by a lawyer. This text does not apply yet.
Data processing agreement
Draft of 21 September 2026
If you use Mark2Form for your own customers, we process data on your behalf. This draft describes the arrangements that come with that.
1.Subject, parties and term
This data processing agreement belongs with the terms of service. You — the maker — are the controller for your own customers' data. Mark2Form processes that data on your behalf and is the processor.
It runs for as long as you have an account and ends when the agreement ends.
[lawyer: decide the form — a separate agreement you sign, or an annex to the terms you accept when creating your account]
2.Nature and purpose of the processing
We process the data only to deliver the service: running the configurator inside your site, keeping designs, making production files and making them available, and counting the downloads that set your invoice.
We do not use the data for our own purposes and we do not sell it.
[lawyer: confirm this description covers what the software actually does once the portal is open]
3.Kinds of data and data subjects
Data subjects are the maker's customers and the people who sign in on the maker's behalf.
[to be filled in by Pascal and the portal lane: which fields the portal and the configurator record — for instance name, contact details, order details and uploaded files]
4.Obligations of the processor
We process the data only on your instruction and for the purpose above. Only people who need it get access, and they are bound to confidentiality.
We help you meet your own obligations: with requests from data subjects, with a data breach and with an assessment of the risks.
[lawyer: draft the instruction clause, with the exception for what the law requires of us]
5.Security
[to be filled in: the technical and organisational measures. They are deliberately absent here: naming a measure that is not in place yet is worse than having no list.]
6.Sub-processors
We use other providers to run the software. Below is which ones, and what we use them for.
[lawyer: arrange how a new sub-processor is announced and whether you can object to it]
Mark2Form's sub-processors, with their purpose and the country where they process the data
| Service | What for | Country |
|---|---|---|
| Vercel | Runs the site, the portal and the configurator. | [to check] |
| Supabase | Database and signing in. | [to check] |
| Cloudflare R2 | Storage of designs and production files. | [to check] |
| Resend | Sends our email. | [to check] |
| Stripe | Subscriptions and invoices. | [to check] |
| Trigger.dev | Runs jobs that happen outside the request. | [to check] |
| Sentry | Collects error reports from the software. | [to check] |
| PostHog | Measures how this site is used, only after the visitor consents. | [to check] |
This list is a draft and will change once the final list of services is settled.
7.Transfers outside the EEA
[lawyer: assess per sub-processor whether data ends up outside the European Economic Area, and on what legal basis]
8.Data breaches
If we find a data breach that touches your data, we report it to you without undue delay, with what we know at that moment. Reporting to the supervisory authority and to data subjects is yours to do: you are the controller.
[lawyer: set the deadline, the channel and the minimum contents of such a report]
9.Requests from data subjects
If one of your customers asks us something — access, correction, deletion — we pass it on to you and help you carry it out.
10.Checking
[lawyer: set out how you can check that we keep to these arrangements — for instance with a report, and on what conditions an on-site check is possible]
11.After it ends
When the agreement ends, we delete the data we process on your behalf, or return it to you.
[to be filled in: within what period, in what format, and what we are legally required to keep]