Privacy Policy

ARCHIVED 2022-09-05, DATE APPROXIMATE · VERSION 20220905_rev01 · COMPARED WITH 20220801_rev01

Full text changes — 20220801_rev01 to 20220905_rev01

COLOUR MARKS THE SEVERITY OF A FLAGGED CLAUSE · + AND − MARK ADDED AND REMOVED

 - **Billing information.** If you make a payment to Jotform Inc., we require that you provide your billing details, including name, address, email address and financial information corresponding to your selected method of payment (e.g. a credit card number and expiration date or a bank account number). If you provide a billing address, we will regard that as the location of the account holder. Our integrations with third party payment gateways are for processing only. We don't store or log any sensitive cardholder data provided by you or your form users. We follow industry-standard best practices to protect the security of cardholder data during processing and transmission. Jotform Inc. is certified as a PCI DSS Level 1 Compliant Service Provider, and we perform annual audits to ensure that our handling of your credit card information aligns with industry guidelines. [Read more here](https://www.jotform.com/blog/314-JotForm-is-Now-PCI-DSS-Service-Provider-Level-I-Compliant).
 - **Account settings.** Our customers can set various preferences and personal details on pages, such as your [account settings page](https://www.jotform.com/myaccount/). For example, your default language, timezone and communication preferences (e.g. opting in or out of receiving marketing emails from us).
 - **Form data.** We store our customers' form data (questions and responses), in some cases using third party server providers such as Amazon Web Services and Google Cloud.
 - **Data you use to create forms is owned by you.** Jotform Inc. treats your forms as private, unless you make them available to members of the public. We don't sell or make forms you've created available to anyone, nor do we use the form responses you collect, for purposes unrelated to you or our services, except in a limited set of circumstances (e.g. Jotform Inc. is compelled by a subpoena or court order, or if you've given us permission to do so).
 - **Jotform safeguards responders' email addresses.** To make it easier for you to invite people to complete your forms via email, you may upload lists of email addresses, in which case we act as a mere custodian of that data. We don't sell these email addresses or make them available to others except as directed by you and in accordance with this policy. The same is true for any email addresses collected through your forms.
 - **Jotform Inc. holds your data securely.** Read our [Security Statement](https://www.jotform.com/security/) for more information.
+- **Form data is stored on servers located in the United States.** More information is available if you are located in Europe. Jotform Inc. will process your form data on your behalf and under your instructions and pursuant to this privacy policy.
+- **Form data is stored on servers located in the United States.** Our customers have the option to store their data in the EU. See [https://www.jotform.com/security](https://www.jotform.com/security) for more information.
 ### **From Visitors to Our Websites**
 - **Usage data.** We collect usage data when you interact with our services. This may include which web pages you visit, what you click on, when you performed those actions, and so on. Additionally, like most websites today, our web servers keep log files that record data each time a device accesses those servers. The log files contain data about the nature of each access, including originating IP addresses, internet service providers, the files viewed on our site (e.g., HTML pages, graphics, etc.), operating system versions, and timestamps.
 - **Device data.** We collect data from the device and application you use to access our services, such as your IP address, operating system version, device type, system and performance information, and browser type. We may also infer your geographic location based on your IP address.
 - **Referral data.** If you arrive at a Jotform website from an external source (such as a link on another website or in an email), we record information about the source that referred you to us.
 **To facilitate account creation and the logon process.** If you choose to link your Jotform account to a third party account, such as your Google or Facebook account, we use the information you allowed us to collect from those third parties to facilitate the account creation and login process.
 **To contact you about your service or account.** We will occasionally send you communications of a transactional nature (e.g. service-related announcements, billing-related matters, changes to our services or policies, a welcome email when you first register). You are prevented from opting out of this type of communication since it is required to provide our services to you.
 **To contact you for marketing purposes.** We will send you promotional emails only if you have consented to us contacting you for this purpose. You may opt out of these communications at any time by clicking on the "unsubscribe" link in them, or changing the relevant setting on your [My Account](https://www.jotform.com/myaccount/) page.
+### **Form responders**
+### **Legal Process and Law Enforcement Requests for Information**
+As a service provider, Jotform is legally required to turn over user data in our possession when we receive valid legal process from government authorities with proper jurisdiction. We strive to balance the needs of law enforcement and other legal process with the privacy of our customers and third parties who submit their information to our customers on their forms. Accordingly, we carefully review each legal and law enforcement request for information, and where we do produce personal information, we endeavor to produce only that information which is actually required.
+For parties in North America, disclosures are governed by U.S. law and the Federal Stored Communications Act ("SCA"), 18 U.S.C. §§ 2701-2712 . For parties outside the US, our disclosures are governed by the laws of the applicable jurisdiction. In general, we will turn over general information such as name, subscription inception date, information on form creation, email address, registration IP address, and, where we believe required, billing information. We require a valid subpoena, or a law enforcement request issued in connection with an official criminal investigation.
+### **Form Responders**
 Personal information a form responder includes in a form belongs to the responder, unless the responder has given rights in that information to the Customer who provided them with the form. Check with the Customer if you have questions about that. Form submission data is managed by the form creator (the Customer). Jotform treats that information as private unless the responder and/or Customer has made it publicly available. Please contact the form creator directly to understand how they use your form responses. Some form creators may provide you with a privacy policy or notice at the time you complete its form, and we encourage you to review that to understand how the form creator will handle your responses.
 We do not sell personal information gathered from form responses. We won't use any contact details collected in our customers' forms to contact form responders.
 See the section above for information on how we use data provided by our Customers or to which our Customers have given us access.
+### **Website visitors**
+### **Website Visitors**
 See the section above regarding information related to visitors to our websites. We use that information, including but not limited to cookies, customer data, usage data, device data, referral data and information from page tags, to manage and improve our services, to serve and support our Customers, for research purposes, and for the other various purposes described in this privacy policy.
 ### **No Sale or Leasing of Your Information**
 We will not sell or lease your personal information to any third party. We may disclose aggregate demographic and statistical information with our business partners, but this information is not specific to the identification of you as an individual.
 _Contractual obligations_. For the performance of contractual obligations between you and Jotform, including the Jotform Terms of Use and/or in our separate written contract with you.
 _Consent_. Where required by law, we may process your personal information in some cases for marketing purposes on the basis of your consent (which you may withdraw at any time after giving it, as described in this privacy policy).
 See our GDPR page at [https://www.jotform.com/gdpr-compliance/](https://www.jotform.com/gdpr-compliance/).
+### Transfer Impact Assessment
+Please see our [transfer impact assessment page](https://www.jotform.com/tia/) for information that may assist you in assessing potential transfers of data to the United States from within the EU or UK.
 ### **Your Rights**
 #### **Deletion of Personal Information**
 You may be entitled to request that we delete your personal information in certain specific circumstances. If you wish to exercise this right, please submit your request using [this form](https://www.jotform.com/privacyconcerns/). We will consider all such requests and provide our response within a reasonable period (but no longer than one calendar month from our receipt of your request unless we tell you that we are entitled to a longer period under applicable law). We may require you to verify your identity before we respond to your request. Certain personal information may be exempt from such requests in certain circumstances, including as provided for in this privacy policy.
 Use of our websites is intended for adults at least eighteen (18) years of age. We do not knowingly collect personally-identifying information from children under the age of thirteen (13).
 #### **Complaints**
 You also have the right to lodge a complaint before a supervisory data protection authority regarding our data processing. If you are in Europe, an up to date list of data protection authorities is available at [https://edpb.europa.eu/about-edpb/board/members\_en](https://edpb.europa.eu/about-edpb/board/members_en). If you are in the UK, the data protection authority is the UK Information Commissioner's Office available at [https://ico.org.uk/](https://ico.org.uk/).
+## **PRIVACY SHIELD**
+### **Privacy Shield**
+Despite the July 12, 2016 decision of the European Commission's Decision (EU) 2016/1250 regarding Privacy Shield, Jotform continues to comply with the EU-U.S. Privacy Shield Framework and Swiss-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union and Switzerland to the United States. Jotform has certified to the U.S. Department of Commerce that it adheres to the Privacy Shield Principles. If there is any conflict between the terms in this privacy policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield program, and to view our certification, please visit [https://www.privacyshield.gov/](https://www.privacyshield.gov/)
+Despite the July 12, 2016 decision of the European Commission's Decision (EU) 2016/1250 regarding Privacy Shield, the U.S. Department of Commerce still requires adherence to Privacy Shield Principles. As such, Jotform continues to comply with those principles and to remain certified by the U.S. Department of Commerce. Where applicable, Jotform has committed to refer unresolved Privacy Shield complaints to JAMS, an alternative dispute resolution provider located in the United States. If you do not receive timely acknowledgment of your complaint from us, or if we have not addressed your complaint to your satisfaction, please visit [https://www.jamsadr.com/eu-us-privacy-shield](https://www.jamsadr.com/eu-us-privacy-shield) for more information. Jotform is committed to abiding by the Privacy Shield Principles of Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement, and Liability.
+In compliance with the Privacy Shield Principles, Jotform commits to resolve complaints about our collection or use of your personal information. EU and Swiss individuals with inquiries or complaints regarding our Privacy Shield policy should first contact Jotform via [this form](https://www.jotform.com/privacyconcerns/).
+### **How to Contact Us Regarding Your Personal Information**
+Jotform has further committed to refer unresolved Privacy Shield complaints to JAMS, an alternative dispute resolution provider located in the United States. If you do not receive timely acknowledgment of your complaint from us, or if we have not addressed your complaint to your satisfaction, please visit [https://www.jamsadr.com/eu-us-privacy-shield](https://www.jamsadr.com/eu-us-privacy-shield) for more information or to file a complaint. The services of JAMS are provided at no cost to you. You may also submit a claim for binding arbitration against Jotform with JAMS (see the above website) in the event that your concerns are not satisfactorily resolved.
+Jotform commits to cooperate with applicable data protection authorities and to comply with the advice given by such authorities with regard to transfers of personal data. Jotform has certified that it adheres to and will abide by the Privacy Shield Principles of Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement, and Liability.
+Jotform is subject to the investigatory and enforcement powers of the FTC (U.S. Federal Trade Commission).
+## **HOW TO CONTACT US REGARDING YOUR PERSONAL INFORMATION**
 If you have any questions about this privacy policy, you may contact us using [this form](https://www.jotform.com/privacyconcerns/).
+### **Representation for data subjects in the EU**
+### **Representation for Data Subjects in the EU**
 We value your privacy and your rights as a data subject and have therefore appointed Prighter as our privacy representative and your point of contact.
 Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative Prighter or make use of your data subject rights, please visit: https://prighter.com/q/11830216921
+Last Update: May 20, 2022
+Last Update: Aug 18, 2022