Data Processing Agreement
Effective October 27, 2026. Published October 12, 2026.
1. Parties and subject matter
The controller is the customer using Gatherino. The processor is PIKASTORE s.r.o., Company ID 19693311, VAT ID CZ19693311, Rybná 716/24, Staré Město, 110 00 Praha 1, Czech Republic, registered with the Municipal Court in Prague, Section C, File 390268, info@gatherino.com. This agreement under Article 28 GDPR forms part of the Terms of Service and governs personal data processing in forms for the duration of service use.
2. Nature, purpose and scope
Processing includes form hosting, storing and displaying responses, generating PDFs and sending emails and webhooks according to customer settings. Data subjects are form respondents. Data types are whatever the customer collects in forms; special categories may only be collected with appropriate safeguards on the customer’s side. The controller is responsible for lawful collection, a legal basis and informing respondents.
3. Instructions and confidentiality
The processor processes data only on documented controller instructions, in particular service settings, including transfer instructions. If processing is required by law, the processor informs the controller beforehand unless prohibited by law. Authorised personnel are bound by confidentiality. The processor immediately informs the controller if it considers an instruction to infringe data protection rules.
4. Security
Technical and organisational measures include HTTPS/TLS, bcrypt password hashing, two-factor authentication (2FA), encrypted backups, encrypted file storage and restricted production access. Servers are in the EU, in Germany.
5. Sub-processors
The controller grants general authorisation for the sub-processors listed in Article 6 of the Privacy Policy: Netcup GmbH; Resend Inc.; Google Ireland Ltd. (Google Workspace / Gmail SMTP and Google Maps Platform); goQR.me / api.qrserver.com; Stripe Payments Europe Ltd.; Google LLC; Functional Software Inc. (Sentry). Their use and scope depend on service purposes and customer settings. The processor gives at least 14 days’ advance notice of intended changes by email or in the application, allowing the controller to object. The processor imposes the same data protection obligations on sub-processors and remains responsible to the controller for their performance.
6. Assistance and incidents
Taking account of the nature of processing, the processor assists with data subject requests, in particular through response export and deletion in the application. It assists with security, impact assessments and supervisory authority consultations under Articles 32–36 GDPR. It notifies the controller of personal data breaches without undue delay and no later than 48 hours after becoming aware, providing available details on their nature, consequences and measures, followed by further information as it becomes available.
7. Transfers outside the EU
Transfers outside the EU require appropriate safeguards, in particular Standard Contractual Clauses (SCC). The Privacy Policy lists Resend Inc. and Functional Software Inc. (Sentry) in the USA, and Google LLC for optional sign-in and Gmail/Sheets integrations. Where Google Ireland services (Workspace / Gmail SMTP, Maps) involve transfers outside the EU, the same safeguards requirement applies.
8. Termination and deletion
At the end of the service, the processor returns data (by export) or deletes it at the controller’s choice; it deletes available copies within 30 days and backups through rotation within 30 days, unless retention is required by law. The controller can export and delete responses in the application.
9. Compliance information, audit and governing law
The processor provides information needed to demonstrate compliance with Article 28 GDPR and allows and assists with audits, including inspections by the controller or its appointed auditor, subject to prior agreement on arrangements and timing. Czech law governs this agreement. Contact: info@gatherino.com.