GDPR FAQs

What is GDPR?

The General Data Protection Regulation (GDPR) is a European Union (EU) privacy law that allows EU citizens and residents to have access and control over their personal data.

If your business is based in the European Union (EU), or you process the personal data of individuals in the EU, the General Data Protection Regulation (GDPR) affects you.

---

Is Formbricks a GDPR Compliant survey tool?

Formbricks is based in Germany (EU) and is GDPR compliant. This is how we comply:

• Transparency: Our privacy policy gives you all information about what data we collect, data retention and transfers, and outlines your data protection rights.
• Encryption: All Formbricks survey data is encrypted and stored in Germany (EU)
• Data accessibility: you have full control of the information you collect, store and manage with Formbricks.
• Data Processing Agreement (DPA): If you’d like to sign a DPA please email us at privacy@formbricks.com

---

Who is responsible for survey data?

Formbricks is the provider of a survey service, and not the owner of the collected survey responses. The creator of the survey (i.e. you) is responsible for the data they collect and is thereby the data controller of the respondent data.

This means that if you collect personal data from EU citizens it is your responsibility to assure their rights defined under the GDPR framework.

Formbricks is the data processor and stores information on behalf of the survey creator. As long as your account is active you have full control over the data you collect, and the time period for which you store the data.

You are able to delete or export survey responses from your account if it would be required to do so. All survey data which has been deleted by you is permanently deleted from our back-ups within 90 days.

---

How can I make my Formbricks survey GDPR compliant?

You (the survey creator) are the data controller of the personal data you collect from your respondents. Your Formbricks survey is not automatically GDPR compliant. If you collect personal data (name, email address, etc.) you should make sure that you comply with GDPR and here is how can make your survey GDPR compliant.

In short, you have to inform the respondents what data you store for how long, get their consent, and show them a way to request and delete their data you have stored. Here is a little guide (no legal advice)

---

How does Formbricks use personal data?

Formbricks acts as a data controller in the relationship between Formbricks and our users (everyone using the service under app.formbricks.com with an account). You give us personal data like registration information in order to use our service. Formbricks does not sell personal data to third parties or use it for marketing purposes or for serving advertisements.

We only share the minimum of your information neccessary with our service providers who help us operate our business, in which case those third parties are also complying with the GDPR law. You find a list of sub processors in our privacy policy.