Last updated: 2026-10-20.
This Data Processing Addendum is part of the LeadForms terms of service, provided by Artem Gavrikov, individual entrepreneur registered in Georgia. It governs how we process the personal data you collect with your quizzes and forms. It applies automatically to every customer from the moment they sign up, with nothing extra to sign.
1. Roles of the parties
For your leads’ data, you are the controller: you decide what to ask, what the answers are used for and how long they are kept. LeadForms is the processor and processes that data only on your behalf.
We process the data of your own account (email, payments, use of the service) as a controller, as described in our privacy policy.
2. Subject matter and purpose
We process your leads’ data only to provide the service to you:
- hosting and displaying your quizzes on quiz.leadforms.org and on your own domains;
- receiving and storing the submissions your visitors leave;
- sending you notifications about new submissions;
- passing data to the integrations you have turned on.
3. Types of data and data subjects
Data subjects: visitors who answer your quizzes and forms.
Categories of data:
- whatever you ask for in the quiz, such as name, phone number, email address and answers to questions;
- technical data: IP address, user agent and UTM tags.
4. Duration and deletion
We process the data for as long as your account is active. If you delete a quiz or your account, we delete the related data within 30 days. Backups containing it are deleted within 90 days at most.
5. Our obligations as processor
- We process the data only on your instructions. Your instructions are this addendum and the settings you choose in your dashboard.
- Our staff with access to the data are bound by confidentiality.
- We apply security measures: encrypted connections (HTTPS/TLS), restricted and logged access to the data, and backups.
- We help you handle requests from people exercising their rights (access, correction, deletion and others). If someone contacts us directly about data collected by your quiz, we will direct them to you.
- If a security breach affects your leads’ data, we notify you without undue delay and no later than 72 hours after becoming aware of it.
- When the service ends, we delete or return the data, as you prefer, within the timelines in section 4.
6. Your obligations as controller
- Have a lawful basis for collecting and using your leads’ data.
- Show your own privacy policy in the quiz.
- Do not collect data prohibited by our acceptable use policy.
- Set up your integrations correctly. You are responsible for the data you send to third-party services through integrations (your CRM, webhooks, Zapier and others). Those services are not our subprocessors.
7. Subprocessors
We use the following providers to deliver the service:
| Provider | What it does |
|---|---|
| Timeweb Cloud, the Netherlands (European Union) | Servers for the leadforms.org website |
| Infrastructure provider | Servers for the dashboard and the quiz engine, where submissions are stored |
| UniSender | Email delivery of new submission notifications |
| TBC Bank (Georgia) | Payment processing (handles your payment data, not your leads’ data) |
| Crypto payment processor shown on the checkout page | Processing of cryptocurrency payments (handles your payment data, not your leads’ data) |
If we add a new subprocessor, we update this page at least 14 days before we start using it. You can object by emailing info@leadforms.org. If we cannot reach an agreement, you may terminate the contract.
8. International transfers
Your leads’ data may be processed outside the country where you or your visitors are located, in the countries of the providers listed above.
Some of our providers may process data outside the European Union and outside your country, including in countries that do not have an adequacy decision from the European Commission. In those cases we rely on contractual safeguards (standard contractual clauses) and technical measures: encryption of data in transit and restricted access.
9. Legal framework
This addendum is designed to meet the requirements that apply to the controller–processor relationship under, among other laws, Article 28 of the European Union General Data Protection Regulation (GDPR), Brazil’s Lei Geral de Proteção de Dados (LGPD) and Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP). It is governed by the laws of Georgia, without prejudice to any mandatory data protection rules that apply to you.
10. Changes
We may update this addendum. The current version is always published on this page with its update date.
11. Contact
Artem Gavrikov, individual entrepreneur registered in Georgia, identification code 345675717. Email: info@leadforms.org.
