Data Processing Agreement

Last Updated: November 2, 2026

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Hella Fast, LLC (“we”, “us”, or “Processor”) and you, the customer (“you” or “Controller”), for the Framer Forms Connect application and plugin (the “Service”). It applies whenever we process Personal Data on your behalf through the Service and Data Protection Laws apply to that processing. By using the Service you accept this DPA. If you need a countersigned copy, email annyeong@romans.design.

1. Definitions

Data Protection Laws: the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection (“FADP”), and any other data protection law that applies to the processing under this DPA.
Personal Data: any information relating to an identified or identifiable natural person that we process on your behalf in providing the Service.
Sub-processor: a third party we engage to process Personal Data.
Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of, or access to, Personal Data.
SCCs: the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
UK Addendum: the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B1.0) issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.

“Controller”, “processor”, “data subject” and “processing” have the meanings given in the GDPR.

2. Roles and Scope

You are the controller of the Personal Data that visitors to your website submit through forms connected to the Service, or a processor acting for your own client. We are your processor, or your sub-processor.
The details of the processing are set out in Annex I.
This DPA does not cover data we process as a controller to run our business, such as your account email, licence and billing details. Our Privacy Policy covers that data.
The services you connect to the Service (for example HubSpot, Mailchimp, Brevo, Slack or Discord) are chosen by you and receive data under your own agreements with them. They are not our Sub-processors.

3. Our Obligations

We will:

Process Personal Data only on your documented instructions, which are this DPA, the Terms of Service and the way you configure the Service, unless the law requires otherwise. In that case we will tell you before processing, unless the law prohibits it. We will tell you if we believe an instruction infringes Data Protection Laws.
Ensure that everyone authorised to process Personal Data is bound by an obligation of confidentiality.
Implement and maintain the technical and organisational measures described in Annex II.
Assist you, taking into account the nature of the processing, in responding to requests from data subjects exercising their rights. Because we do not store form submissions, we will usually hold no Personal Data about a given data subject. We will pass any request we receive to you and will not respond to it ourselves unless you ask us to.
Assist you with your obligations under Articles 32 to 36 of the GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the information available to us.
Make available to you the information needed to demonstrate compliance with this DPA, as described in section 8.

4. Your Obligations

You are responsible for the lawfulness of the processing, including having a lawful basis for it, giving your website visitors the information Data Protection Laws require, and obtaining any consent that is needed.
You will not use the Service to collect special categories of personal data (Article 9 GDPR) or data relating to criminal convictions and offences unless you have a lawful basis and appropriate safeguards for doing so.

5. Sub-processors

You give us general authorisation to engage Sub-processors. Our current Sub-processors are listed in Annex III.
We will give you at least 14 days’ notice before adding or replacing a Sub-processor, by updating this page and emailing the address associated with your licence. You may object on reasonable data protection grounds within that period. If we cannot resolve the objection, you may stop using the Service and terminate this DPA.
We will impose data protection obligations on each Sub-processor that are no less protective than those in this DPA, and we remain responsible to you for their performance.

6. Security Incidents

We will notify you without undue delay, and in any case within 48 hours of becoming aware of a Security Incident affecting your Personal Data. The notice will include what we know at the time: the nature of the incident, its likely consequences, and the measures we have taken or propose to take. We will provide further information as it becomes available. Notifying you of a Security Incident is not an acknowledgement of fault or liability.

7. International Transfers

Hella Fast, LLC is established in the United States. Our database is hosted in the European Union (Ireland), but Personal Data is processed by us and our Sub-processors and may be processed in the United States and other countries where they operate.
EEA: where Personal Data subject to the GDPR is transferred to us in a country without an adequacy decision, the SCCs are incorporated into this DPA by reference: Module Two (controller to processor) where you are a controller, and Module Three (processor to processor) where you are a processor. Clause 7 (docking clause) applies. In Clause 9, Option 2 (general written authorisation) applies, with the notice period in section 5. The optional language in Clause 11 does not apply. In Clause 13, the competent supervisory authority is determined as set out in Clause 13(a). In Clause 17, Option 1 applies and the governing law is the law of Ireland. In Clause 18, disputes are resolved by the courts of Ireland. Annexes I, II and III of the SCCs are completed by Annexes I, II and III of this DPA.
United Kingdom: where Personal Data subject to the UK GDPR is transferred to us, the SCCs as set out above apply as amended by the UK Addendum, which is incorporated into this DPA by reference. In Table 1, the parties’ details are those in Annex I. In Table 2, the Addendum EU SCCs are the SCCs with the modules and options set out above. In Table 3, the Appendix Information is in Annexes I, II and III of this DPA. In Table 4, neither party may end the UK Addendum under its Section 19.
Switzerland: where Personal Data subject to the FADP is transferred to us, the SCCs apply with the following changes: references to the GDPR include the FADP, the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority, and data subjects habitually resident in Switzerland may bring claims there.
If there is any conflict between this DPA and the SCCs or the UK Addendum, the SCCs and the UK Addendum prevail.

8. Audits

We will make available, on request, the information reasonably needed to demonstrate our compliance with this DPA. If that information is not sufficient, you or an independent auditor bound by confidentiality may audit our compliance no more than once a year, with at least 30 days’ written notice, during normal business hours and at your cost, unless a Security Incident or a supervisory authority requires an audit sooner. For our Sub-processors, we may meet audit requests by providing their current third-party certifications or audit reports.

9. Deletion and Return

Form submissions are not stored after they are delivered, so there is nothing to return once each submission has been sent to your connected service.
When the Service ends, or on your written request, we will delete the connection credentials and any other data we hold for you within 30 days, unless the law requires us to keep it.
Operational logs kept by our hosting provider are deleted automatically according to its retention schedule.

10. Liability, Term and Changes

Each party’s liability under this DPA is subject to the limitations in the Terms of Service, to the extent Data Protection Laws allow. Nothing in this DPA limits either party’s liability to data subjects under the SCCs.
This DPA stays in force for as long as we process Personal Data on your behalf.
If this DPA conflicts with the Terms of Service, this DPA prevails.
We may update this DPA to reflect changes in law or in our Sub-processors. We will notify you of material changes in the same way as Sub-processor changes in section 5.

Annex I: Description of the Processing

A. Parties

Data exporter: the customer using the Service, as identified by its licence and account details. Contact: the email address associated with the licence. Role: controller, or processor on behalf of its own client. Activities: using the Service to deliver its website’s form submissions to services it chooses. The data exporter accepts this DPA by using the Service.
Data importer: Hella Fast, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, United States. Contact: annyeong@romans.design. Role: processor. Activities: providing Framer Forms Connect. The data importer accepts this DPA by making it available with the Service.

B. Description of the Transfer

Data subjects: visitors to the data exporter’s website who submit a form connected to the Service.
Categories of personal data: the fields the data exporter includes in its forms, typically name, email address, phone number, company, job title and message, together with the address of the page the form was submitted from, and the IP address and browser information that reach our servers with each request.
Sensitive data: none intended. See section 4.
Frequency: continuous, each time a form is submitted.
Nature of the processing: receiving a form submission, checking the licence for its destination, formatting it, and sending it to the service the data exporter has connected; and storing the credentials the data exporter provides for those services.
Purpose: delivering the data exporter’s website form submissions to the services it connects.
Retention: form submissions are held in memory only while each request is processed and are not written to our database. Connection credentials are kept until the data exporter asks us to delete them or the Service ends. Operational logs are kept for a limited period set by our hosting provider.
Transfers to Sub-processors: to the Sub-processors in Annex III, for the same purpose and duration.

C. Competent Supervisory Authority

Determined in accordance with Clause 13 of the SCCs. For transfers under the UK Addendum, the UK Information Commissioner’s Office.

Annex II: Technical and Organisational Measures

Encryption in transit: all traffic between your website, our backend and your connected services uses HTTPS/TLS.
Encryption at rest: our database is encrypted at rest with AES-256 by our hosting provider.
Data minimisation: form submissions are not stored. Your Framer project and published site hold only an opaque connection ID, never the underlying API key or token.
Access control: the database tables that hold connection credentials and licences are protected by row-level security and can only be read by our server-side functions. The public key built into the plugin cannot read them. Production secrets are kept in our hosting provider’s secret store, not in source code. Administrative access is limited to authorised personnel.
Logging: our functions are designed not to record the contents of form submissions in their logs.
Hosting: our database runs on Amazon Web Services in the eu-west-1 (Ireland) region through Supabase, which maintains a SOC 2 Type 2 report.
Incident response and Sub-processor management: as described in sections 5 and 6.

Annex III: Sub-processors

Supabase, Inc. (United States): backend hosting, including our database and serverless functions, with infrastructure provided by Amazon Web Services. Processes form submissions in transit and stores connection credentials. The database is located in the EU (Ireland); serverless functions may run in the region nearest to each request.

To run our business we also use Stripe (payments) and Google (email). They process your account and billing details, not your website visitors’ form data, and are covered by our Privacy Policy.

Contact Us

If you have any questions about this DPA, please contact us at: annyeong@romans.design.