1. About Form2
The Form2 Services enable our Clients to, among other things, create and distribute Forms to collect specific data. We also provide other related services, such as real-time data analytics.
“Client” is any organisation or individual who purchases, or is granted, a licence to use Form2 as a Software as a Service
“User” is a person a Client may add to the system through our Services with the purpose of collecting data from them. For example, if you are a Client, a student or staff member added to your Instance of Form2 would be a User
“Personal Information” means any information that identifies or can be used to identify a Client, a User, or a Visitor, directly or indirectly. Examples of Personal Information include, but are not limited to, first and last name, date of birth, email address, gender, occupation, or other demographic information.
“Website(s)” means any website(s) we own and operate (such as www.fromsquared.com).
An “Instance” is a dedicated instance of the Form2 service which is managed and maintained solely by a single Client and only accessible to Users that are added by that Client. Form2 staff may access the Instance for the proposes of resolving issues when requested to do so by the Client.
“Visitor” means any person who visits any of our Websites.
A “Data Controller” determines the purposes and means of processing personal data as defined by the GDPR Regulations
A “Data Processor” is responsible for processing personal data on behalf of a controller as defined by the GDPR Regulations
A “System Administrator” is an individual nominated by a Client who is responsible for managing their Instance of the Service on behalf of the Client.
A “Local’ account is a User account on the Service that is held solely on Form2 and does not require authentication through a third-party system
A “Remote” account is where your email and password is validated via a third-party service such as Shibboleth using Security Assertion Markup Language (SAML)
2. Visitor Privacy
This section applies to Personal Information that we collect and process through our Websites and in the usual course of our business, such as in connection with our support, sales and marketing activities.
The University of Manchester is committed to looking after any information that is made available to us when you visit our websites in accordance with data protection law.
This notice outlines what categories of information we retain and how we use it. Our other privacy notices are also available from this website.
2.1 Personal data
You don’t have to create an account or provide us with any personal information to access Form2 websites. However, we may ask for some personal details if you wish to gain more information about our services.
In this case the only personal data we store and process is your contact details specifically your name and email address.
We will ensure that all personal data you supply is held in accordance with data protection law. We do not sell or otherwise transfer personal data to any third parties unless you have consented to this or this is permitted by law.
2.2 Visits to Form2 websites
When you visit any of the Form2 websites the following information is received and stored by our web servers: anonymised details of your IP address, browser type and operating system; and the web pages you visited. This data is known as web server logs. We use this information strictly to analyse how the Form2 websites are used by our visitors and we may archive this information in an anonymous form for historical records.
Our websites use ’cookies’ which are text files placed on your computer when you visit a site which help us understand how you use our websites. Cookies don’t collect personal data from your computer, only the data created by your browsing. Some cookies remain on your computer after you leave the website; these are called ‘persistent’ cookies. Others are deleted automatically when you close your browser and others simply expire. We use the following cookies on our websites:
2.3.1 Analytics cookies and advertising cookies set by Google Analytics
We may collect non-person-identifying information relating to your use of our sites via Google Analytics technology. This may include: which pages you see; how long you stay; what you click on our pages; if you visit the website again; which country and city you are browsing from; etc. This data is collected for the purpose of monitoring and understanding the effectiveness of our websites. We also collect data relating to the demographics and interests of our users via Google Analytics and cookies set by Google advertising networks. This data is used in aggregated form to help improve the site and the University’s marketing efforts.
Further information and instructions for opting out of Google Analytics tracking
2.4 How to delete and manage cookies in your browser
You can choose not to accept cookies and delete existing cookies on your computer or mobile device using your browser settings. Please use the links below to find out how to do this for your browser:
For browsers not listed here, please refer to the manufacturer’s website.
2.5 Protection Rights
You have the following data protection rights:
- To access, correct, update, or request deletion of your Personal Information: Form2 takes reasonable steps to ensure that the data we collect is reliable for its intended use, accurate, complete, and up to date. You may contact us directly at any time about accessing, correcting, updating, or deleting your Personal Information, or altering your data or marketing preferences by emailing us at email@example.com We will consider your request in accordance with applicable laws.
- In addition, if you are a resident of the EEA, you can object to processing of your Personal Information, ask us to restrict processing of your Personal Information or request portability of your Personal Information. Again, you can exercise these rights by emailing us at firstname.lastname@example.org
We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws. We may ask you to verify your identity in order to help us respond efficiently to your request.
3. Client Privacy
This section applies to the Personal Information we collect and process from a Client or potential Client through the provision of the Services.
3.1. Information We Collect
The Personal Information that we may collect broadly falls into the following categories:
3.1.1 Information you provide to us:
In the course of engaging with our Services, you may provide Personal Information about you and your Organisation. Personal Information is often, but not exclusively, provided to us when you sign up for and use the Services, consult with our Staff, send us an email, integrate the Services with another service (for example, when you use the SAML Provision), or communicate with us in any other way.
By giving us this information, you agree to this information being collected, used and disclosed as described in your Licence Agreement signed when you purchase Form2
This information may include:
- Registration information: You need a System Administrator account to use the Services as a Client. When you purchase an Instance, you will be asked to provide certain basic information, specifically the name and email address of the System Administrator. These will be used to set up the Instance
- Billing and communications information: If you purchase our Services, you may also need to provide us with contact details of your Finance department. All financial transactions and communications are carried out through the University of Manchester Purchasing Department and no financial data such as credit card or bank details are held in the Form2
3.1.2 Information we collect automatically:
When you use the Services, we may automatically collect certain information about your device and usage of the Services. We use this in order to resolve any technical issues with the Service
This information may include:
- Device information: We collect information about the device and applications you use to access the Services, such as your IP address, your operating system, your browser ID, and other information about your system and connection.
- Log data: Our web servers keep log files that record data each time a device accesses those servers and those log files contain data about the nature of each access, including originating IP addresses.
- Product usage data: We collect usage data about you whenever you interact with our Services, which may include the dates and times you access the Services and your browsing activities. We also collect information regarding the performance of the Services, including metrics related to the deliverability of emails and other communications you send through the Services. This information allows us to improve the content and operation of the Services, and facilitate research and analysis of the Services.
3.1.3 Information from the use of our mobile app:
- Device information: We may collect information about the type of device and operating system you use. We do not ask for, access, or track any location-based information from your mobile device at any time while downloading or using our mobile apps or Services.
3.2. Use of Personal Information
We may use the Personal Information you provide for a range of reasons, including:
- To bill and collect money owed to us by you. This includes sending you emails, invoices, receipts, quotes, licences, etc
- To communicate with you about your account and provide customer support.
- Other purposes. To carry out other legitimate business purposes, as well as other lawful purposes about which we will notify you.
- For marketing. We may occasionally contact you to inform you of new features or products available through the University of Manchester. You have the right to opt-out of any such emails simply by emailing us at any point. We may also ask to use your organisation’s name and logo in our own marketing literature or material, but will never do so without your explicit written consent in each individual case.
3.3. Data Protection Rights
You and your Users may have the following data protection rights:
- To access, correct, update or request deletion of Personal Information. Form2 takes reasonable steps to ensure that the data we collect is reliable for its intended use, accurate, complete and up to date. As a Client, you can ask us to update the System Administrator details at any point by emailing us.
- You can also manage information about your Users within the Administration page of the Form2 Service to assist you with responding to requests to access, correct, update or delete information that you receive from your Users.
- In addition, individuals who are residents of the EEA can object to processing of their Personal Information, ask to restrict processing of their Personal Information or request portability of their Personal Information. If any of your Users wishes to exercise any of these rights, they should contact you directly.
- Similarly, if Personal Information is collected or processed on the basis of consent, the data subject can withdraw their consent at any time. Withdrawing consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your Personal Information conducted in reliance on lawful processing grounds other than consent. If, as Client, you receive these requests from Users you should comply immediately.
- The right to complain to a data protection authority about the collection and use of Personal Information. For more information, please contact your local data protection authority. Contact details for data protection authorities in the EEA are available here.
4. User Privacy
4.1. Information Form2 Collect and how we use it
The Personal Information that we may collect or receive about you broadly falls into the following categories:
4.1.1 Information we receive about Users to set up an account:
A Client will need to add your email address and name to the Services in order to create a User account. You may have the opportunity to update this information by logging in to the system and amending your profile settings. If you have a “Local’ account, then the Service will hold an encrypted password for your account that can be amended by you in your profile page on Form2. If you hold a “Remote” account then only your email and name will be held on the Service.
If you wish to amend or remove your details you should contact the Client organisation to which you belong.
We use this Information solely to authenticate your identity when logging into the Service or Form2 app
4.1.2 Information we collect automatically:
- Device information: We collect information about the device and applications you use to access emails sent through our Services, such as your IP address, your operating system, your browser ID, and other information about your system and connection.
4.2. Information Collected by the Client
All Information collected by a Client and stored on the Service is stored securely according to Industry best practice.
5. Form2 Security
Form2 is aware of its obligation to keep your data as safe as possible. Under the GDPR https://www.eugdpr.org/ it is each Client’s responsibility, as Data Controllers, to ensure they are satisfied that any personal and sensitive data is stored and processed securely. The following document is designed to support this decision, by providing information about security measures that Form2 employs to reduce the risk of data breaches.
5.1 Form2 Security Details
5.1.1 Cloud Hosting
Form2 is hosted on Amazon Web Services (AWS)
Form2 uses AWS Servers hosted in the European Union (Ireland)
AWS Complies with all Industry Security Standards and offers a range of security features
As an IaaS (Infrastructure as a Service) provider, AWS comply with CISPE
Our Virtual Private Cloud (VPC) uses an infrastructure-level firewall to protect our instances.
Access to our AWS account is protected by multi-factor authentication (MFA).
5.1.2 Data Storage
Live data is stored on AWS’s Elastic Block Store (EBS), Relational Database Service (RDS) and Simple Storage Service (S3).
Our RDS instances provide up to 35 days of automated backups, with restoration possible to a specific second.
All data stored in EBS, RDS and S3 is encrypted, with keys managed by AWS.
Access to our instances is limited to 3 individuals, with access controlled using private key authentication.
Client’s data is only accessed by the Form2 developer with the explicit permission of the Client in order to resolve technical issues or restore backups
Data is stored on Form2 within AWS until it is deleted by the Client
5.1.3 Form2 App
Form2 uses TLS encryption to protect data transferred from the iOS App on user devices to the Form2 application on AWS
All data stored on the device is deleted automatically each time the user logs out of the App
5.1.4 User access
Form2 provides a SAML provider service to link to Clients own authentication system, such that no passwords are stored on Form2
Local Accounts in Form2 enforces a minimum password length of 8 characters
Form2 provides MFA authentication as additional security. This can be applied by the client to system administrators or to all users. Form2 recommend applying MFA to system administrators as a minimum.
5.1.5 Security and Back Up Policies
Form2 maintains server software and security patches – either via AWS’s automated patching updates or through regular maintenance – to reduce the risk of malware or security breaches
Form2 retains encrypted backups for 35 days. For data stored in RDS, this can be restored to a specific second. Clients can request data to be restored from the back-ups as a charged service.
If Form2 staff need to access data either via the database or the web-application in order to diagnose or resolve a technical issue, they will seek the permission of the Client before doing so.
In the unlikely event of a data breach, Form2 will inform Clients as soon as they are aware of it. Form2 will work with the Client in order to identify and address any such data breach. The GDPR defines a data breach as: “Data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed”
A Web Application Vulnerability Assessment was carried out by an Independent company on the Form2 application in 2017 with no serious risks identified. All other (medium) risks associated with the application have now been addressed. Clients are welcome to carry out their own Penetration tests or vulnerability assessments on Form2 but must provide at least 4 weeks’ notice in writing.
5.1.6 Data Transfer
Form2 provides an API service that follows a RESTful approach, with JSON as the serialisation format. Access control is managed using the OAuth 2.0 Client Credentials Grant.
Form2 will never download or transfer data to another system or storage device unless asked to do so, in writing, by the Client as Data Controller.