Information about our privacy & General Data Protection Regulation efforts
The European General Data Protection Regulation (“GDPR”) legislation introduces a new set of rules for the processing of personal data.
GDPR is the most modern and fully integrated legislation on data privacy, and the applicability of the GDPR does not stop at the borders of the European Economic Area (“EEA”).
Swiftforms has embraced the requirements of GDPR, and we consider GDPR to be the benchmark for our privacy and data protection efforts.
Below you’ll find information about GDPR, as well as answers about data protection and privacy at Swiftforms, for your convenience.
You should also consult our Privacy Policy and Terms of Use for further details on these topics.
Common questions about GDPR and privacy at Swiftforms
What is GDPR?
“GDPR” or “General Data Protection Regulation “(EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC) is the new European privacy legislation.
It aims to harmonise legislation throughout the EU with the intention to:
Where/when does GDPR apply?
GDPR went into effect on 25 May 2018 and applies to:
– all organisations established in the European Economic Area (“EEA”)
– to organisations, whether or not established in the EEA, that process personal data in connection with either the offering of goods or services to natural persons in the EEA or the monitoring of behaviour that takes place within the EEA.
Thus from the moment there is processing of personal data in the EEA, or from the moment a person located in the EEA is referenced, GDPR will apply (regardless of whether the processing entity is located in the EEA).
Swiftforms provides a solution for rapidly creating data-driven business apps on mobile and desktop devices, all with no programming required.
This enables businesses to reduce paper, enhance productivity and improve accuracy in a wide variety of industries and field usage scenarios.
Swiftforms platform provides an “end to end” platform for creating custom business apps, securely capturing and accessing data through these apps, safe cloud-based storage of data, and connection/integration of data with other external services.
Swiftforms is offered as “Software as a Service” (“SaaS”), which is a licensing and delivery model where software is centrally hosted and made available to multiple customers over a network, including through interacting applications (including mobile/desktop apps, web browser, and/or connectors to third-party systems).
Personal Data (as defined by GDPR) is only processed by Swiftforms under the control and direction of Swiftforms customers.
Swiftforms customers decide the nature of data being captured and stored, and they choose which individuals interact with the Swiftforms Platform (thus in turn whose personal data is captured and processed).
It is thus you, as a Swiftforms customer, that legally acts as the “Controller” as defined under GDPR.
Swiftforms provides the means (the Swiftforms Platform) for Swiftforms customers to capture data and interact with their respective users, clients and other parties.
As such, Swiftforms is only processing personal data for, and on behalf of, Swiftforms customers as a “Processor”, as defined under GDPR.
The only case where Swiftforms acts as a Controller is during a limited set of direct interactions with Swiftforms customers (these being governed by the Swiftforms Privacy Policy).
What is Swiftforms doing to meet GDPR requirements?
Swiftforms has undertaken a number of initiatives to meet GDPR requirements:
Hosting of EEA customers exclusively within EU data centres
All data for customers identified as being located in the EEA is hosted within our cloud partner’s (Microsoft Azure) West Europe (Amsterdam) and North Europe (Dublin) data centres.
Encryption of data at rest and in transit
All data stored within the Swiftforms Platform is encrypted on our servers, be this within a database, storage service or file backups.
All data transport between servers, services and/or devices (both internally and externally) occur exclusively over SSL encrypted transport protocols.
Dedicated GDPR and Privacy Information page
We have created a dedicated webpage with detailed information about Swiftforms’ privacy efforts at https://www.Swiftforms.co.uk/gdpr.
Data Protection Officer (DPO)
The Swiftforms DPO supervises our entire data privacy program and works in close conjunction with Swiftforms team members on matters relating to security, data protection and privacy.
Data Processing Addendum (DPA)
On request, Swiftforms can provide a standard DPA which is a self-serve and easy-to-execute document pre-signed by a Swiftforms director. The DPA clearly outlines the data processing terms between Swiftforms and a customer, and it only requires a Swiftforms customer’s electronic signature to complete.
This allows Swiftforms’ European customers to provide the signed DPA to auditors demonstrating that the Swiftforms Platform is used to process data in a way that meets their GDPR compliance obligation.
“Is Personal Data” flags for data entities in the platform (e.g. forms and data sources)
The Swiftforms Platform now provides new checkbox options to allow Swiftforms customers to flag/identify data fields that contain personal data.
This, in turn, allows the Swiftforms Platform to anonymise these fields when data leaves the Swiftforms Platform (e.g. via manual export, connector integrations, and/or the Swiftforms Platform API).
Careful vetting of sub-processors
Each sub-processor of Swiftforms is vetted by our team in the areas of security, contractual terms, data processing agreements, and EU standard contractual clauses / Privacy Shield.
Up-to-date contractual documents/privacy policies
Our contractual documents have been updated to contain necessary GDPR provisions.
Product Development
All new Swiftforms Platform functionality that is introduced from May 2018 onwards will include consideration of the following:
What is a Data Processing Addendum (DPA) and does Swiftforms provide this?
If Swiftforms’ processing of personal data for your organisation falls within the material and/or territorial scope of GDPR (articles 2 & 3), the legislation (GDPR article 28) requires that this processing occurs under a Data Processing Addendum (DPA).
The Swiftforms DPA incorporates with our Terms of Use so, by having acknowledged our Terms of Use and continuing to use Swiftforms, you’re already accepting our DPA. You can reference our DPA if you need to show auditors that your use of Swiftforms meets your GDPR obligations in terms of the data that we process on your behalf.
If your organisation requires that you execute an explicitly signed data processing agreement with Swiftforms, then send an email to support@swiftforms.co.uk to request one.
We’ll promptly counter-sign and return a digital copy to you for your records.
What types of Personal Data does the Swiftforms Platform process?
For registered users on the platform, basic contact information is processed (i.e. direct identifiable personal data such as e-mail addresses or name) as well as minimal device information, connection information and geolocation.
Other personal information may also be processed by the Swiftforms Platform through data captured and stored by Swiftforms customers.
While it’s not up to us to control what data we receive, this can include items such as contact information, IP addresses, and other data.
We process customer-submitted data as part of our contractual obligation to our customers, and in accordance with applicable laws, including the GDPR.
We use certain sub-processors to assist in providing the Swiftforms platform to customers. A sub-processor is a third-party data processor engaged by Swiftforms, that has or potentially will have access to or process customer data (which may include personal data).
How long does personal data remain on the Swiftforms Platform?
Swiftforms production (live) environments
Swiftforms backups
Backups are performed on a regular basis and are kept in encrypted, secure storage for up to 60 days.
This means that items deleted in production environments are available for restoration from backups for up to 60 days thereafter.
Swiftforms test/development environments
Data is occasionally extracted from production to development/testing environments for support, testing and debugging purposes.
When this occurs, personal data is anonymised in order to assure privacy.
Personal data stored on the Swiftforms Platform may be visible to:
Access only occurs to the extent and limited to, such personal data as necessary for that specific purpose of the respective party.
The Swiftforms Platform is hosted in 3 regions (“nodes”) across the world – specifically USA, Europe and Australia.
All customers that identify themselves as being located within Europe are hosted exclusively within our West Europe (Amsterdam & Dublin) datacenters.
As such, all data captured and/or stored on the Swiftforms Platform for European customers will remain within the EEA by default.
Swiftforms only exports personal data outside of the European Economic Area (“EEA”) if and when required by:
Where data export occurs, Swiftforms ensures that such export occurs under the adequacy decisions as allowed by GDPR (EU-US Privacy Shield, binding corporate rules, applicable EU standard contractual clauses, such other methods as allowed per the GDPR), and keeps the exported data to a minimum as necessary.
Swiftforms also provides software features to Swiftforms customers which allows them to anonymise personal data upon export out of the Swiftforms Platform.
Registered administrator users may be contacted by Swiftforms with news or offers about the Swiftforms Platform.
This communication can be unsubscribed at any time by the user.
Swiftforms does not use personal data processed through the Swiftforms Platform for direct marketing purposes, nor does the Swiftforms Platform employ automated decision-making processes/techniques which create or deny rights to individual persons.
We only process personal data under instruction and under control of the Swiftforms customer for the purpose of the Swiftforms Platform solution.