CloudServe - Software's & Hosting
Effective date: 7 September 2026
Policy version: 1.0
Service: EasyForms by CloudServe
Operator: CloudServe
CloudServe Controller ID: C2026310
Privacy contact: Privacy@cloudservelive.co.uk
Privacy & GDPR Policy: https://cloudservelive.co.uk/easyforms-policies
EasyForms by CloudServe is an online form creation, management and data collection platform operated by CloudServe.
Registered and subscribed EasyForms users can create their own forms, determine the information requested by those forms, publish or distribute those forms, receive submissions, access submitted information and use that information for their own business, organisational or other lawful purposes.
Because EasyForms is used by independent subscribers to collect information for purposes chosen by those subscribers, responsibility for personal information is divided between the EasyForms Subscriber and CloudServe depending upon the particular processing activity.
This policy explains those respective responsibilities and describes how personal information submitted through EasyForms is hosted, stored and processed.
This policy is intended to operate in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018 and other applicable UK data protection and privacy legislation.
For this policy, “CloudServe”, “we”, “us” or “our” means CloudServe in its capacity as operator of EasyForms by CloudServe.
“EasyForms” means the EasyForms by CloudServe software platform and associated hosting and services.
“Subscriber” means an individual, business, company, charity, association, public body, community organisation or other person or organisation that registers for, purchases, subscribes to or operates an EasyForms account.
“Form Owner” means the Subscriber responsible for creating or operating a particular EasyForms form.
“Form Respondent” or “Data Subject” means an individual whose personal information is entered into or collected through an EasyForms form.
“Form Data” means information entered into, uploaded to, generated by or submitted through an EasyForms form.
“Personal Data” has the meaning given to it under applicable UK data protection legislation.
The parties acknowledge that the role of CloudServe depends upon the reason personal information is being processed.
Where a Subscriber creates and operates a form for its own purposes, the Subscriber will normally be the Data Controller.
This is because the Subscriber normally determines matters including what information the form requests, why that information is required, who is asked to complete the form, how the information will subsequently be used, who it may be disclosed to and how long the information should be retained.
CloudServe does not ordinarily determine those purposes.
For that Form Data, CloudServe acts as a Data Processor on behalf of the Subscriber by providing the EasyForms software, servers, databases, storage, backup systems and related technical infrastructure required to receive, transmit, host, maintain and make the information available to the Subscriber.
The fact that Form Data is physically or electronically stored on servers operated or managed for CloudServe does not mean that CloudServe determines the Subscriber's purpose for collecting that information.
CloudServe acts as a Data Controller in its own right where CloudServe determines the purposes for which personal information is processed.
This includes, where applicable, EasyForms account registration information, Subscriber contact details, billing and transaction records, administrative records, login information, security and fraud-prevention records, service logs, support requests, communications with CloudServe and information CloudServe must maintain for legal, regulatory, contractual or operational purposes.
Where CloudServe itself creates an EasyForms form for a CloudServe purpose and determines what information is collected and why, CloudServe will normally act as the Data Controller for that form.
Controller and processor status is determined by the actual processing activity rather than simply by the name given to a party in a contract. The ICO similarly distinguishes controllers by their decision-making over purposes and means, while processors act on a controller's behalf. (ICO)
Every Subscriber is responsible for ensuring that its use of EasyForms complies with applicable data protection and privacy law.
The Subscriber is responsible for the design, content and intended use of each form created through its account.
In particular, the Subscriber is responsible for determining and documenting an appropriate lawful basis for collecting and using personal information; collecting only information that is adequate, relevant and reasonably necessary; explaining clearly to Data Subjects why information is being collected; providing its own privacy information where required; determining appropriate retention periods; responding to requests from Data Subjects; controlling which authorised persons can access submissions; ensuring information obtained through EasyForms is not subsequently used unlawfully; obtaining valid consent where consent is relied upon; complying with direct-marketing requirements; protecting information downloaded or exported from EasyForms; and complying with any additional legal requirements applicable to sensitive, children's, employee, medical, financial or other regulated information.
Under UK GDPR transparency requirements, a controller is normally expected to tell individuals matters including its identity, purposes, lawful basis, recipients, retention arrangements and applicable rights. (ICO)
CloudServe cannot determine the correct lawful basis on behalf of each Subscriber because CloudServe does not know the Subscriber's individual purpose for every form.
Subscribers should provide Data Subjects with appropriate privacy information at or before the point personal information is collected where required by law.
An EasyForms Subscriber's privacy notice should identify the Subscriber rather than representing CloudServe as the organisation responsible for deciding how the submitted information will be used.
Where appropriate, the notice may also explain that the form is hosted using EasyForms by CloudServe and that CloudServe processes and stores the submitted information on behalf of the Form Owner.
CloudServe's own Privacy & GDPR Policy does not replace the Subscriber's privacy notice.
The EasyForms privacy notice informs users about CloudServe's role as platform provider. The Subscriber remains responsible for explaining the Subscriber's own collection and use of Form Data.
When CloudServe processes Form Data on behalf of a Subscriber, CloudServe will process that information only for purposes necessary to provide, operate, secure, maintain and support EasyForms or as otherwise required by applicable law.
CloudServe will not independently determine a new commercial purpose for Subscriber Form Data merely because that data is hosted on CloudServe infrastructure.
CloudServe will take reasonable steps to ensure that personnel authorised to access Form Data are subject to appropriate confidentiality obligations.
CloudServe will maintain technical and organisational security measures appropriate to the nature of the service and the risks associated with the processing.
CloudServe will provide reasonable assistance to Subscribers with applicable data protection obligations where that assistance relates to processing performed by CloudServe.
The ICO's Article 28 guidance requires controller/processor arrangements to address documented instructions, confidentiality, security, subprocessors, assistance with individuals' rights, end-of-contract treatment of data and appropriate audit provisions. (ICO)
CloudServe processes Form Data for the purpose of operating the EasyForms service.
Depending upon how a Subscriber configures EasyForms, processing may include receiving information submitted by a Data Subject, transmitting information between the Data Subject and EasyForms, storing database records, storing uploaded files, displaying submissions within the Subscriber's account, generating form notifications, sending configured emails, maintaining application logs, backing up information, recovering information following technical failure, securing EasyForms and enabling functionality selected by the Subscriber.
CloudServe's processing is undertaken to provide the service requested by the Subscriber.
Form Data may concern any individuals the Subscriber lawfully chooses to interact with through EasyForms.
This may include customers, prospective customers, employees, applicants, volunteers, members, suppliers, contractors, event attendees, service users, website visitors, clients or members of the public.
CloudServe does not determine which categories of individuals a Subscriber chooses to collect information from.
Because Subscribers design their own EasyForms forms, CloudServe cannot provide an exhaustive list of all information that may be submitted.
Depending upon the form, information may include names, email addresses, telephone numbers, postal addresses, business information, enquiry details, responses to questions, survey responses, booking information, application information, files or documents uploaded by the Data Subject, IP or technical information where collected, and other information deliberately requested by the Subscriber.
The Subscriber is responsible for ensuring that each requested field is appropriate and lawful.
EasyForms may technically permit Subscribers to create fields capable of collecting information that receives additional legal protection.
This does not mean CloudServe requires or recommends such information.
Where a Subscriber chooses to collect special-category personal data or other particularly sensitive information, the Subscriber is responsible for determining whether the collection is lawful and whether an additional UK GDPR condition, consent mechanism, Data Protection Impact Assessment or other safeguard is required.
CloudServe may restrict or prohibit particular uses of EasyForms where we reasonably believe that the proposed processing presents an unacceptable security, legal or regulatory risk.
Subscribers must take particular care before designing forms intended to collect personal information from children or young people.
The Subscriber is responsible for assessing whether the processing is appropriate, whether age verification or parental involvement is required, what information may lawfully be collected and how privacy information should be presented to younger users.
Subscribers should not use EasyForms to collect unnecessary information about children.
EasyForms Form Data is hosted and stored using infrastructure operated or arranged by CloudServe for the purpose of providing the EasyForms service.
CloudServe therefore has custody of Form Data at the infrastructure level while acting as the Subscriber's processor.
CloudServe's possession or storage of that data does not transfer ownership of the Subscriber's Form Data to CloudServe and does not remove the Subscriber's responsibility as Data Controller.
The Subscriber remains responsible for the purpose for which the information was originally collected and how that information is subsequently used.
CloudServe will take reasonable and proportionate technical and organisational measures designed to protect Form Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.
Security measures may include account authentication, access controls, administrative restrictions, server and application security, encryption where appropriate, logging, monitoring, backup procedures, vulnerability management and other measures appropriate to the nature and risk of the processing.
No internet-connected service can provide an absolute guarantee against every possible security incident.
Subscribers are responsible for maintaining the confidentiality of their EasyForms login credentials and for controlling access granted to users within their account.
CloudServe personnel will not routinely access Subscriber Form Data except where reasonably required to provide technical support, maintain or secure the service, investigate misuse, recover data, diagnose technical problems, comply with lawful instructions from the Subscriber or satisfy a legal obligation.
Access should be limited to personnel or service providers who reasonably require access for the relevant purpose.
Subscribers are responsible for deciding which of their own employees, representatives or users may access Form Data through their EasyForms account.
The Subscriber, as Data Controller, is responsible for determining an appropriate retention period for information collected through its forms.
CloudServe may retain Form Data while the Subscriber's EasyForms account remains active and for such periods as are reasonably required to operate the service, comply with Subscriber instructions, maintain backups or meet legal and security obligations.
When Form Data is deleted from the active EasyForms system, copies may remain temporarily within system backups or disaster-recovery systems until those copies are overwritten or expire through normal backup rotation.
Subscribers should not retain Form Data indefinitely simply because EasyForms makes storage available.
Subscribers may delete Form Data using available EasyForms functionality, subject to the technical operation of the service.
Following termination or expiry of an EasyForms subscription, CloudServe may delete Subscriber Form Data in accordance with the applicable subscription terms and retention procedures.
Subscribers are responsible for exporting any information they are legally required to retain before their account or service is terminated.
Where legally required, CloudServe may retain limited information after termination, for example security, billing, transaction, contractual or legal records. CloudServe acts as controller in relation to information it is independently required to retain for its own legal purposes.
Where a person requests access, rectification, erasure, restriction, portability or another applicable right relating to information submitted to a Subscriber's EasyForms form, the Subscriber remains primarily responsible for responding as Data Controller.
If such a request is sent directly to CloudServe and CloudServe can identify that the information is processed solely on behalf of a Subscriber, CloudServe may refer the request to the relevant Subscriber.
Where reasonably required, CloudServe will assist the Subscriber in responding to Data Subject requests insofar as the request relates to processing performed through EasyForms.
CloudServe will respond directly where the request concerns personal information for which CloudServe is itself the Data Controller.
CloudServe maintains procedures for responding to suspected personal data breaches affecting infrastructure under CloudServe's control.
Where CloudServe becomes aware of a personal data breach affecting Form Data that CloudServe processes on behalf of a Subscriber, CloudServe will notify the relevant Subscriber without undue delay where required by applicable law and provide information reasonably available to CloudServe to assist the Subscriber in assessing the incident.
As Data Controller, the Subscriber remains responsible for determining whether an incident must be notified to the Information Commissioner's Office or affected Data Subjects where the legal obligation rests with the controller.
Processors have a direct duty to inform controllers of personal data breaches without undue delay. (ICO)
Subscribers may be able to export, download, email, print, integrate or otherwise remove Form Data from the EasyForms environment.
Once a Subscriber exports or transfers Form Data to its own computer, email account, CRM system, spreadsheet, cloud service, third-party application or other destination, that copy may no longer be protected by CloudServe's EasyForms infrastructure.
The Subscriber is responsible for the security, retention, access, disclosure and lawful use of exported information.
EasyForms may permit Subscribers to connect forms to third-party products or services.
Where a Subscriber independently chooses to send Form Data to an external service, the Subscriber is responsible for determining whether that transfer is lawful, whether the receiving organisation is an appropriate processor or recipient and whether any necessary contractual, privacy or international-transfer safeguards are in place.
CloudServe is not responsible for the independent use of personal information by a third party selected and configured by the Subscriber, except to the extent CloudServe has its own legal obligations relating to the integration.
CloudServe may use third-party suppliers or infrastructure providers as sub-processors where reasonably necessary to provide EasyForms.
Where a provider processes Subscriber Personal Data on CloudServe's behalf, CloudServe will take appropriate steps to ensure that contractual and data protection obligations are imposed on that provider where required.
Where required by UK GDPR, CloudServe will obtain the appropriate general or specific authorisation for sub-processors and will remain responsible for ensuring required data protection obligations are passed down contractually.
UK GDPR requires processors to have appropriate authorisation before appointing sub-processors and to impose equivalent data-protection obligations. (ICO)
CloudServe will take appropriate steps where Form Data is subject to a restricted transfer outside the United Kingdom.
Where required, this may involve UK adequacy regulations, approved contractual safeguards, the UK International Data Transfer Agreement or Addendum, or another lawful transfer mechanism.
Subscribers are independently responsible for international transfers they initiate, for example by configuring EasyForms to send Form Data to an overseas third-party service.
The ICO confirms that responsibility for restricted transfers can arise whether an organisation acts as controller, processor or sub-processor. (ICO)
The Subscriber instructs CloudServe to process Form Data as reasonably necessary to provide the EasyForms functionality selected and used by the Subscriber.
The Subscriber's configuration and lawful use of EasyForms, together with the applicable subscription agreement, service terms and any written instructions accepted by CloudServe, constitute the Subscriber's documented instructions for the purposes of the service.
CloudServe will notify the Subscriber where, in CloudServe's reasonable opinion, an instruction would breach applicable data protection legislation, subject to any restriction preventing CloudServe from doing so.
CloudServe is not obliged to carry out unlawful instructions.
CloudServe will take reasonable steps to ensure that individuals authorised to process Subscriber Form Data are subject to appropriate duties of confidentiality.
Subscribers must similarly ensure that their own personnel who can access Form Data are authorised and subject to appropriate confidentiality requirements.
Where a Subscriber's intended use of EasyForms is likely to result in a high risk to individuals, the Subscriber is responsible for determining whether a Data Protection Impact Assessment is required.
CloudServe will provide reasonable information concerning EasyForms processing where necessary to assist the Subscriber with an appropriate DPIA, insofar as that information is available to CloudServe and relevant to CloudServe's processing.
CloudServe will make available reasonable information necessary to demonstrate compliance with its processor obligations where required under applicable law.
Any inspection or audit request must be reasonable, proportionate, subject to appropriate confidentiality protections and arranged so as to minimise unnecessary security risk or disruption to CloudServe or other Subscribers.
Nothing in this provision requires CloudServe to disclose information belonging to another Subscriber, compromise infrastructure security or disclose legally privileged material.
CloudServe may process or disclose personal information where required by applicable law, court order or other legally binding requirement.
Where CloudServe processes information to satisfy an independent legal obligation imposed directly upon CloudServe, CloudServe may act as a Data Controller in relation to that particular processing.
Where legally permitted and appropriate, CloudServe may inform the relevant Subscriber of a request relating to Subscriber Form Data.
As between CloudServe and the Subscriber, CloudServe does not claim ownership of the information submitted to forms merely because that information is hosted using EasyForms.
The Subscriber's rights in and responsibilities for its Form Data remain subject to applicable law, the rights of the individual Data Subjects and the EasyForms subscription terms.
Subscribers must not use EasyForms to collect or process personal information unlawfully.
CloudServe reserves the right to suspend, restrict or terminate access where we reasonably believe EasyForms is being used in breach of applicable law, in a manner creating a material security or privacy risk, or contrary to the EasyForms terms of service.
Such action does not transfer responsibility for the Subscriber's underlying processing to CloudServe.
A Subscriber who uses information collected through EasyForms for direct marketing is responsible for ensuring that such use is lawful.
A form submission does not automatically amount to valid marketing consent.
Where consent is required, the Subscriber is responsible for ensuring that consent is freely given, specific, informed, unambiguous and capable of being demonstrated, and for respecting subsequent withdrawals or objections.
EasyForms provides a platform for collecting and processing form information.
If a Subscriber uses Form Data in connection with profiling or automated decision-making that produces legal or similarly significant effects, the Subscriber is responsible for complying with any applicable transparency, lawful-basis and individual-rights requirements.
CloudServe does not become responsible for the Subscriber's independent decision-making process merely because information used in that process was originally collected through EasyForms.
CloudServe's processor responsibilities relate to personal data processed within or through infrastructure controlled by CloudServe.
Where a Subscriber copies, downloads, exports, forwards or otherwise transfers Form Data outside EasyForms, responsibility for the Subscriber's copy and subsequent use remains with the Subscriber.
CloudServe cannot control the security or subsequent use of information held exclusively in systems outside CloudServe's control.
CloudServe separately processes information relating to Subscribers for administration of the EasyForms service.
This may include registration details, account-holder names, email addresses, authentication records, subscription details, invoices, payment status, communications, support tickets, IP addresses and security logs.
CloudServe will normally act as Data Controller for this information because CloudServe determines why that information is required to operate, administer, secure and account for the EasyForms service.
CloudServe's general Privacy & GDPR Policy applies to that processing.
The fact that CloudServe has direct obligations as a processor does not relieve a Subscriber of its responsibilities as Data Controller.
Subscribers must exercise appropriate due diligence when selecting and using processors and must maintain appropriate contractual arrangements. The ICO specifically states that controllers remain responsible for choosing processors that provide sufficient guarantees and for monitoring processor compliance on an ongoing basis. (ICO)
Likewise, CloudServe remains responsible for obligations imposed directly upon it as a processor.
Nothing in this policy is intended to exclude responsibility where applicable law does not permit responsibility to be excluded.
Where CloudServe processes personal information on behalf of an EasyForms Subscriber, the parties intend the applicable EasyForms subscription agreement, these Data Processing Terms and any additional written Data Processing Agreement agreed between the parties to govern that processing.
The controller/processor relationship should expressly cover the subject matter and duration of processing, nature and purpose, categories of Personal Data and Data Subjects, controller rights and obligations, documented instructions, confidentiality, security, subprocessors, assistance with rights, end-of-contract deletion or return and audits.
These are core requirements identified by the ICO for Article 28 controller-processor contracts. (ICO)
If a separate signed Data Processing Agreement conflicts with this policy, the specific Data Processing Agreement should prevail in relation to the conflicting data-processing provision.
CloudServe will process Subscriber Form Data for the duration of the Subscriber's use of EasyForms and for any additional period reasonably required for deletion cycles, backups, security, dispute resolution or legal compliance.
Processing may end earlier where the Subscriber lawfully deletes relevant information or instructs CloudServe to do so and CloudServe is able and legally permitted to comply.
A person who has concerns about information submitted to a form should normally first contact the organisation identified as responsible for that form.
Where the complaint concerns CloudServe's own processing, the individual may contact:
CloudServe – Data Protection
Controller ID: C2026310
Email: Privacy@cloudservelive.co.uk
Individuals may also have the right to complain to the Information Commissioner's Office.
CloudServe may update this policy to reflect changes to EasyForms, security practices, service providers, data protection legislation or regulatory guidance.
Where a material change affects the way Subscriber Form Data is processed, CloudServe may provide additional notice through EasyForms, email or another appropriate method.
The current version will be published through the CloudServe Privacy & GDPR Policy page.
Questions about EasyForms privacy, GDPR or CloudServe's processing of Personal Data may be sent to:
CloudServe
EasyForms by CloudServe
Controller ID: C2026310
Privacy email: Privacy@cloudservelive.co.uk
Privacy & GDPR Policy: https://cloudservelive.co.uk/easyforms-policies
CloudServe - Software's & Hosting