Data-processing terms.

Scope and roles

These terms form part of our service terms when Vlomkat Solutions FZ-LLC processes personal information in forms and inquiries for an account owner. That owner is the controller, or a processor authorised by its own controller; we act as processor or subprocessor accordingly. Account administration, our own support correspondence and security purposes for which we are controller are described in the privacy notice.

Where inquiry data needs an EU or UK transfer safeguard, the Standard Contractual Clauses and UK Addendum below apply.

Processing instructions and duration

Our subject matter is collecting, storing, displaying, delivering, exporting and deleting contact-form inquiries and survey responses and, where the owner turns them on, translating, summarising and spam-checking them with AI, suggesting and translating replies, and filtering blocked senders. Processing lasts while we provide the service, followed by the restricted retention described below. The account owner instructs processing through its form settings, recipients, notification content, alerts and webhooks, AI feature settings, blocked senders, retention, authorised API calls and documented support requests. Members the owner adds act for the owner when they use these settings. We will process only on those instructions, including for transfers, unless law requires otherwise; we will inform the owner of a legal requirement unless prohibited.

The people concerned are form visitors, contacts and people whose information they include. Data includes names, email addresses, phone numbers, configured field values, optional photos or PDFs, timestamps, link labels and inquiry status, and, where the owner uses them, the results of AI features and salted hashes of blocked email addresses or domains. Owners must not use forms for payment-card details, passwords, identity documents, health records or other sensitive data. The owner remains responsible for lawful collection, notices and the legality of its instructions. We will tell the owner if an instruction appears to breach applicable data-protection law.

If the owner acts as a processor, it must identify its controller and provide that controller's documented instructions and authorisation for our processing before sending its data. Additional instructions from the owner must not conflict with the controller's instructions.

Confidentiality and security

We limit authorised access to people with an operational need and require confidentiality. We use HTTPS, managed storage encryption, account-scoped authorisation and database row-level security, private attachment access, separate development and production credentials, scoped service identities, spam and rate controls, and separate recovery copies. These measures reduce risk; they are not a guarantee that incidents cannot occur.

Inquiry contents and credentials must not be placed in routine logs. Operational access is limited to authorised people signing in with Microsoft Entra, and sensitive support actions in the product are recorded. Recovery must reapply deletion and restriction instructions before accounts are reopened.

• Account separation and access: authenticated requests are scoped to the account and permitted forms; database row-level policies enforce account boundaries. Connected apps use selected-form permissions and revocable credentials. Verification of a notification email does not grant inbox access. If a form is set to include inquiry details, its notification emails carry the answers to the verified recipients’ mailboxes, where our retention and deletion controls don’t reach them. Alerts the owner sends to a chat channel, and Pro webhooks, contain the form and project names, the time, identifiers and a private link that needs sign-in. If the owner includes inquiry details in a Slack or Microsoft Teams alert, it also carries the visitor’s answers (not files) to that channel, where our retention and deletion controls don’t reach them. An AI summary the owner chooses to include in emails or alerts is carried the same way.
• Files and transport: public web and API connections use HTTPS. Attachments are kept in private Azure storage and served through authorised access checks. Azure Storage encrypts stored attachments at rest. This is not end-to-end encryption; authorised service processing and support can access information when needed.
• Validation and abuse controls: form definitions, submitted fields, file types and sizes are validated. Origin, verification, rate and usage controls limit unauthorised or abusive submissions. Where the owner blocks a sender or turns on an AI spam check, the messages they catch go to Spam. The owner can restore them until Spam is deleted after 30 days. The AI check can misjudge a genuine message. Uploaded files can be checked automatically by Microsoft’s security services for malware and for illegal or harmful images. No control guarantees that every unwanted submission is blocked.
• Recovery and deletion: recovery archives are kept separately from ordinary customer access. Deletion and restriction actions are recorded for replay; a restore must apply them before reopening access. The retention schedule distinguishes active records, files and recovery copies. A privacy restriction prevents ordinary access while the request is resolved.
• Rights assistance: owners can export inquiry records and delete inquiries or forms. File information in an export does not include the attachment bytes; files can be downloaded separately. Verified correction, restriction and other requests that the product cannot fulfil directly go through privacy support. We assist with the information and controls available to us, and record sensitive support actions.

Assistance and incidents

Taking account of the processing and information available to us, we will assist the owner with rights requests, security duties, breach notifications, impact assessments and consultation with regulators. We will forward a request about customer-controlled inquiries to the owner rather than independently change its purposes.

We will notify the owner without undue delay after becoming aware of a personal-data breach affecting its inquiry data. We will provide available facts about the incident, likely impact and mitigation, update the owner as more becomes known, and cooperate with its response. The owner remains responsible for its own regulatory and affected-person notices where required.

Subprocessors

An owner acting as controller generally authorises the subprocessors identified in the provider register for the listed tasks. We will require equivalent data-protection obligations for delegated processing and remain responsible for our subprocessors’ obligations to us. The register explains change notice and the opportunity to object. Paddle’s independent buyer relationship is not an inquiry-processing delegation. Mailboxes, chat tools and other destinations or apps that the owner chooses receive information as the owner’s own recipients, not as our subprocessors. Where the owner is a processor, the underlying controller's authorisation is required; the owner's acceptance alone does not replace it.

Return, deletion and recovery

Owners can export inquiries and instruct deletion during use. At the end of service, at the owner’s choice, we will return or delete personal information processed for it, unless law requires retention. Use export before deleting an account; support can help with a request the product cannot fulfil directly. The retention schedule describes active removal, attachment soft deletion, recovery archives and journals. Recovery copies are restricted from ordinary use and deleted under that schedule; required deletion actions must be reapplied on restore.

Information and audits

We will make information needed to demonstrate compliance with these processing duties available to the owner, and allow and contribute to audits, including inspections by the owner or its mandated independent auditor. Coordinate through privacy@vlomkatsolutions.com. We will first provide documentation, which may answer the request. Audits take place on at least 30 days’ written notice, at most once in any 12 months and during normal business hours. These limits do not apply where there are indications of non-compliance, after a personal-data breach affecting the owner’s data, or where a supervisory authority requires an audit. Each party bears its own costs. Reasonable arrangements may protect other customers’ information, security and service availability; they must not prevent a required audit or regulatory access.

These processing terms take precedence over conflicting service terms on processing duties. Mandatory data-protection law and, where they apply, the Standard Contractual Clauses and UK Addendum below take precedence over both.

International transfers: Standard Contractual Clauses

Vlomkat Solutions FZ-LLC processes inquiry data from the UAE. For transfers within the scope of Article 1 of Commission Implementing Decision (EU) 2021/914, its standard contractual clauses (the Clauses) are incorporated with the selections and schedule below. The owner is the data exporter and Vlomkat Solutions FZ-LLC is the data importer. Both parties accept the Clauses and the schedule when the owner accepts these terms, at sign-up or when they change. We have not appointed an EU or UK representative.

• Modules: Module Two (controller to processor) where the owner is a controller; Module Three (processor to processor) where the owner processes for another controller.
• Clause 7: the docking clause applies.
• Clause 9(a): Option 2, general written authorisation. We inform the exporter under Module Two, or the underlying controller under Module Three, in writing of intended additions or replacements of subprocessors at least 30 days in advance. For Module Three, the owner emails the controller’s name and contact for these notices to privacy@vlomkatsolutions.com. See the provider register for the notice and objection process.
• Clause 11(a): the optional independent dispute resolution body does not apply.
• Clause 13: the competent supervisory authority is the one determined under Clause 13(a), normally that of the EU or EEA country where the owner is established.
• Clauses 17 and 18: the Clauses are governed by the law of Ireland, and the courts of Ireland resolve disputes arising from them.

Schedule

• Annex I.A, parties: the exporter is the owner, with the business name, address and contact details it gives in its account; its acceptance of these terms is its signature, dated when given. The importer is Vlomkat Solutions FZ-LLC, FDRK0890, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates, privacy contact privacy@vlomkatsolutions.com, which provides makeform.live.
• Annex I.B, transfers: the people, data, processing and instructions described in Processing instructions and duration. Transfers are continuous while forms are used; the chosen retention and the recovery schedule apply. Special categories are not permitted.
• Annex I.C, supervision: the authority under Clause 13 above.
• Annex II, measures: the controls and assistance in Confidentiality and security, and the measures in our transfer assessment.
• Subprocessors: those in the provider register, under Clause 9(a) Option 2.

For UK restricted transfers using this safeguard, the ICO International Data Transfer Addendum B1.0 (in force from 21 March 2022) is incorporated. The schedule above completes Tables 1 and 3, and the module and selections above complete Table 2. For Table 4, neither party may end the Addendum under Section 19. The mandatory clauses govern the UK adaptations, including England and Wales law and courts.

Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.

The paragraph above incorporates the ICO's Alternative Part 2 Mandatory Clauses by reference; it does not replace the completed tables or change the approved mandatory text.

If these terms conflict with the Clauses or the Addendum, the Clauses and the Addendum prevail. We have documented a transfer assessment of the law and practice in the UAE and the measures we apply. Ask privacy@vlomkatsolutions.com for a copy, or for a signed copy of the Clauses with your schedule.