Tools and automation
GDPR Typeform
In an indie stack, Typeform is used for Forms. Entity cited: Typeform SL. The sections repeat what the vendor publishes, without filling a gap. Last update of the facts: October 4, 2026. Verified on October 4, 2026.
Translation of the French sheet. The facts do not change. The date is the date the official pages were read.
DPA Typeform
Yes. Public Data Processing Agreement. The exporter there is TYPEFORM, S.L., Via Augusta 29-31, 08006 Barcelona, NIF B65831836.
Stated role
For respondent data collected through the services, the customer is controller and Typeform SL is processor. For the customer's account and commercial relationship, Typeform acts as controller. For customers in the United States, Typeform SL and Typeform US LLC are joint controllers of the offering and sale of the plan, and Typeform SL is solely controller of the provision of the services.
Personal data
Last name, first name, email, phone, other identifiers of employees, candidates, prospects, and customers, browsing and usage data used for cookies and profiling, Google Calendar scheduler data (OAuth tokens, email, and display name of the connected account).
Sub-processors of Typeform
Help article listing the companies with which data is shared.
Transfers outside the EU
Hosting / location
Typeform states that it processes information coming from the EEA and, for US customers, also from the United States, and in some cases from other countries including the United Kingdom. The sub-processor list places Amazon Web Services in the United States and, for customers on EU hosting, in the EU.
EU–United States Data Privacy Framework
Official search for “Typeform”, “Typeform SL”, and “Typeform Inc”: no participant. Not registered.
Cookies
Cookies are used for profiling and for analysis of browsing and use of the site and the services, according to the Cookie Policy, and only if the user accepts them.
Typical use, written by StackLégal and not by the vendor: Forms.
History
Last update: October 4, 2026.
First publication. The facts come from the official pages cited in the sources. Anything not stated there remains "not disclosed".
Clause to paste
Place it in the sub-processor section of your privacy policy. Review it: a “not disclosed” field must be completed before publication.
Sub-processor clause
Sources
Verified on October 4, 2026.
Frequently asked questions
Is Typeform a processor within the meaning of the GDPR?
For respondent data collected through the services, the customer is controller and Typeform SL is processor. For the customer's account and commercial relationship, Typeform acts as controller. For customers in the United States, Typeform SL and Typeform US LLC are joint controllers of the offering and sale of the plan, and Typeform SL is solely controller of the provision of the services.
What DPA does Typeform publish?
Yes. Public Data Processing Agreement. The exporter there is TYPEFORM, S.L., Via Augusta 29-31, 08006 Barcelona, NIF B65831836. https://www.typeform.com/legal/data-processing-agreement
Which further sub-processors does Typeform publish?
Help article listing the companies with which data is shared. https://help.typeform.com/hc/en-us/articles/360029617191-What-other-companies-do-we-share-data-with
Where does Typeform state that it processes data, including outside the EU?
Typeform states that it processes information coming from the EEA and, for US customers, also from the United States, and in some cases from other countries including the United Kingdom. The sub-processor list places Amazon Web Services in the United States and, for customers on EU hosting, in the EU.
Is Typeform registered under the EU–United States Data Privacy Framework?
Official search for “Typeform”, “Typeform SL”, and “Typeform Inc”: no participant. Not registered.
Which personal data does Typeform mention?
Last name, first name, email, phone, other identifiers of employees, candidates, prospects, and customers, browsing and usage data used for cookies and profiling, Google Calendar scheduler data (OAuth tokens, email, and display name of the connected account).
Often in the same stack
These sheets come up in searches for a Next.js SaaS. Next.js itself is not a processor: GDPR Next.js.
Related tools
Full pack, from 39 € incl. VAT
The clause above covers only one tool. StackLégal generates the legal notices, terms of use, terms of sale, privacy policy, Article 28 DPA, and the public list, naming only the boxes that are checked. One-time payment via Gumroad. This is not legal advice.