Data processing agreement

This agreement is part of the terms of service between Blok Consulting BV, Boomlaarstraat 75B, 2500 Lier, Belgium, enterprise and VAT number BE 0767.642.063 ("we", the processor) and the organization that uses BlokCms ("you", the controller). It applies whenever we process personal data on your behalf, and takes effect when you accept the terms. If you need a signed copy, write to privacy@blokcms.app.

1. Definitions

Words such as personal data, processing, controller, processor, data subject and personal data breach mean what they mean in the General Data Protection Regulation (EU) 2016/679 ("GDPR"). "Your data" means the personal data in what your organization stores in BlokCms, including the submissions of your forms.

2. Roles and instructions

• You are the controller of your data and we process it as your processor, only on your documented instructions. Those are the terms, this agreement, and how you set up and use BlokCms: the forms you create and their retention periods, the people you invite, the integrations and AI features you switch on.
• We tell you if we believe an instruction breaks data protection law.
• You make sure you may collect and use your data, for example by telling your website's visitors about your forms in your own privacy notice. BlokCms isn't designed for special categories of data (such as health data); if your forms collect them, the legal basis for that is yours to provide.

3. What we process

The subject, purpose, kinds of data and data subjects are described in Annex 1.

4. Confidentiality

Everyone we allow to process your data is bound to keep it confidential.

5. Security

We protect your data with the technical and organizational measures in Annex 2, and keep them appropriate to the risk as BlokCms changes.

6. Sub-processors

• You authorize the sub-processors in Annex 3.
• We tell your organization's admins by email at least 30 days before we add or replace one. If you object for reasonable data protection reasons and we can't solve it, you may end the terms before the change.
• Each sub-processor is bound by data protection obligations like those in this agreement, and we remain responsible to you for its work.

7. Where your data is

Your data is stored in Cloudflare's EU jurisdiction. Content you publish for the public is also cached on Cloudflare's network worldwide, so websites load fast. AI features, which you switch on per space, may process content outside the EU. Where your data leaves the European Economic Area, the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework protect it.

8. Requests from data subjects

BlokCms lets you answer them yourself: you can find and erase everything one email address sent through your forms, export a space's content and delete content. If a data subject contacts us about your data, we pass the request on to you and don't answer it ourselves. We help you further where you reasonably need it.

9. Personal data breaches

We tell you without undue delay, and at the latest within 48 hours after we become aware of a breach that affects your data. We include what you need to notify the authorities and the people concerned (what happened, which data and how many people, the likely consequences and what we're doing about it), and we send what we don't know yet as soon as we do.

10. Other assistance

We help you, as far as reasonably needed, with data protection impact assessments and consultations with a supervisory authority that concern BlokCms.

11. Deletion and return

• You can export your content at any time.
• When you delete a space or your organization, it goes offline right away and its content, files and backups are erased within a day. Recovery copies our hosting provider keeps expire within 30 days after that.
• When the terms end, export what you want to keep and delete your organization. We erase anything left the same way, unless the law requires us to keep it.

12. Information and audits

We give you the information you need to show that this agreement is followed. You may have it audited once a year, with 30 days' notice, at your own cost, by an independent auditor bound to confidentiality, in a way that doesn't give access to other customers' data. Where possible, an audit relies on the reports of our hosting provider, Cloudflare, which holds ISO/IEC 27001 and SOC 2 Type II.

13. Term, liability and precedence

This agreement applies as long as we process your data. Liability is limited as in the terms. Where this agreement and the terms conflict on data protection, this agreement applies. Belgian law governs it, and disputes go to the courts of Antwerp, Mechelen division.

Annex 1: Details of the processing

• Subject and purpose: hosting, editing, publishing and delivering your websites' content; receiving your forms' submissions, storing them and notifying you of them; the AI features you switch on.
• Duration: as long as the terms apply, then until erased as in section 11.
• Nature: storage, organization, retrieval, delivery through our APIs, email notifications, webhooks and integrations you set up, and erasure.
• Data subjects: visitors who send your forms; people mentioned or shown in your content; your team members as authors of content and comments.
• Kinds of data: what your forms ask for (for example names, email addresses, phone numbers, messages and uploaded files), with the page and language a form was sent from, the browser's user agent and the consent wording a visitor agreed to; IP addresses are not stored. Content about people, such as names, photos and biographies. Comments and mentions.
• Retention: form submissions as long as you set per form (one year unless you choose otherwise), spam 30 days; content until you delete it; backups up to 30 days.

Annex 2: Technical and organizational measures

• Location and separation: databases and files in Cloudflare's EU jurisdiction; every space in its own database.
• Encryption: TLS for all traffic, encryption at rest for all stored data.
• Access control: roles per organization and space (admin, editor, author, viewer and custom roles, limited to folders or content types); form submissions only for people allowed to read them; access tokens stored only as hashes; preview tokens separate from public ones.
• Authentication: sign-in through a specialized provider (Clerk); session tokens checked on every request.
• Traceability: a history of changes and activity per space; operational logs without email addresses or content, kept up to 30 days.
• Availability: nightly backups (the last 14 kept) and point-in-time recovery for 30 days; published content served from caches worldwide.
• Abuse protection: request limits per person, token and form visitor; spam protection on forms (Cloudflare Turnstile, a hidden trap field and flood limits).
• Erasure: per form retention periods, erasure by email address, and erasure of deleted spaces and organizations as in section 11.
• Development and operations: changes are reviewed and tested before they're deployed; access to production is limited to our administrators.

Annex 3: Sub-processors

• Cloudflare, Inc. (United States): hosting, databases, file storage, content delivery, email sending (form notifications) and logs; Workers AI for the AI features you switch on. Data at rest in the EU jurisdiction.
• Microsoft Ireland Operations Ltd (Microsoft 365): support email, only for personal data you send us in a support request.

Clerk, Inc. handles BlokCms accounts and sign-in. We are the controller of that account data (see our privacy policy); Clerk doesn't receive your data.