Data processing terms

Last updated: 19 October 2026

These terms (Article 28 GDPR) apply whenever Agent002 processes personal data on behalf of a customer: mainly the answers people give to the customer’s forms. The customer is the controller, and LINK SOLUTIONS SRL, Str. Vlaicu Vodă 24, Bl. V79, Sc. A, Et. P, Ap. 2, 031248 Bucharest (Sector 3), Romania, registered with the Trade Register under J2023020286403 (EUID ROONRC.J2023020286403), fiscal code (CUI) 49017838 is the processor.

Subject matter and duration

Hosting forms, receiving, storing and delivering answers, for as long as the customer uses the service.

Nature and purpose

Collection through hosted forms, storage, display in the customer’s account, export, and delivery to destinations the customer configures (email to team members, Google Sheets, webhooks), then deletion.

Personal data and data subjects

Whatever the customer’s forms ask for, from the people who answer them. The customer decides this. No IP addresses or device identifiers are stored.

Our obligations

• We process only on the customer’s documented instructions, which include configuring the service. If we think an instruction breaks the law, we will say so.
• Everyone with access is bound to confidentiality.
• We apply the security measures in the annex below.
• We use only the sub-processors listed on the sub-processors page, under equivalent obligations. We announce changes there at least 30 days in advance, and customers may object.
• We help the customer answer data subject requests. The app can export and delete answers.
• We help with security, breach notification and impact assessments where relevant. We report personal data breaches without undue delay, and within 48 hours of becoming aware.
• At the end of the service, we delete the customer’s data, including from backups within 14 days, unless the law requires keeping it.
• We make available the information needed to show compliance and allow reasonable audits.

International transfers

We store and process data in the EU. Data leaves the EU only when the customer sends it to a destination outside the EU (for example Google Sheets or a webhook), on the customer’s own instruction and responsibility.

Annex: technical and organizational measures

• Encryption in transit (TLS) for all traffic. Integration secrets are encrypted at rest, with keys stored separately from the database.
• Each organization’s data is isolated in the application, enforced in one place and covered by automated tests.
• Minimal collection: no cookies on forms, no trackers, no IP addresses stored.
• Answers are deleted automatically after each form’s retention period.
• Spam and abuse protection: proof-of-work, rate limits, and blocking forms that ask for credentials.
• Access to production is limited to named staff using personal SSH keys, and to our automated deployment pipeline using a dedicated key. Database and encryption keys are backed up encrypted.
• Outbound connections to private networks are blocked (webhooks).
• Security fixes are applied promptly. Every code change runs automated tests and is reviewed before release.