Back to Tools
Typeform logo

Typeform

GDPR Compliant

Spanish form and survey builder with a published DPA and sub-processor list, running on AWS with a US affiliate in the chain.

🇪🇸Spain🇪🇺EU Hosted🇪🇺 European

Subject to the US CLOUD Act: a US provider in this tool's processing chain can be compelled to disclose data it holds, including data stored in the EU. The vendor itself is European-owned.

Freemium
Typeform website screenshot

GDPR Compliance Data

Not independently verified
GDPR Status
GDPR Compliant
HQ CountrySpain
OwnershipEuropean-owned
Foreign Disclosure ExposureUS CLOUD Act / FISA 702
Data Hosting Location
European UnionPrivacy policy references the European Economic Area and Ireland as processing locations, and states Google Calendar OAuth data is "stored exclusively in a PostgreSQL database hosted on AWS RDS within our production VPC". Source: typeform.com/legal/privacy-policy (read 2026-08-24). No single authoritative region statement was found.
EU Servers Available
Data Processing AgreementView DPA
Sub-processor ListNot verified
Schrems II Risk
Medium Risk
SCCs in Place
Last Verified24 August 2026

How we reached this

Controller is TYPEFORM, S.L., "an entity incorporated in accordance with the laws of Spain", per the privacy policy. EU-owned. The published DPA states Typeform "shall be entitled to seek the assistance of its affiliates TYPEFORM US LLC, conducting business in the US" and its transfer clause covers sub-processors located outside the UK/EEA receiving personal data as an onward transfer, naming Amazon among them, under standard contractual clauses. Exposure is therefore US_CLOUD_ACT despite EU incorporation and an EEA primary region. Typeform publishes a DPA and maintains a sub-processor mailing list with a 15 calendar day objection window on changes, which is why this is COMPLIANT rather than PARTIAL.

About Typeform

Forms People Actually Finish

Typeform's whole design argument is one question per screen. Completion rates on longer forms tend to beat a conventional multi-field page, which is why it shows up in lead capture, onboarding surveys and research screeners rather than as a general form tool.

Logic jumps, hidden fields, calculated scores and recall of earlier answers cover most of what a marketing team needs without a separate survey platform, and the results feed CRM and email tools through native integrations or webhooks.

Spanish Company, American Sub-processor

The privacy policy names the controller as "an entity incorporated in accordance with the laws of Spain", TYPEFORM, S.L. That makes it European by ownership, which is more than can be said for several tools marketed as European alternatives.

The data path is more complicated than the incorporation. The DPA states that Typeform "shall be entitled to seek the assistance of its affiliates TYPEFORM US LLC, conducting business in the US", and the sub-processor annex covers onward transfers to processors outside the UK and EEA, Amazon among them. Ireland appears as a processing location. In practice: European company, European primary region, and a documented route by which US-based entities process personal data under standard contractual clauses.

That is a normal arrangement and it is properly documented, which is the point. Typeform publishes a DPA and maintains a sub-processor list customers can subscribe to, with a fifteen day window to object to changes. Compare that to the many vendors who publish neither.

What to Check Before Buying

If your requirement is that personal data never becomes reachable by a US entity, the US affiliate in the sub-processor chain is the thing to resolve before the pricing page, not after. If your requirement is a documented, GDPR-shaped transfer with SCCs and a right to object to new sub-processors, Typeform meets it.

More options in surveys and feedback.

Key Features

One-question-at-a-time form and survey builder
Conditional logic jumps and calculated scores
Hidden fields and answer recall for personalisation
Native CRM, email and spreadsheet integrations
Webhooks and REST API
Published DPA and subscribable sub-processor list

Pros & Cons

Spanish company, so European by ownership rather than just by marketing
Publishes a real DPA and a sub-processor list with an objection window
Completion rates on long forms generally beat a conventional layout
A US affiliate, TYPEFORM US LLC, sits in the standard sub-processor chain
Runs on AWS, so a US provider holds the data regardless of region
Pricing rises steeply once response volumes grow

Typeform GDPR & data protection: common questions

Is Typeform GDPR compliant?

Yes. On the evidence we checked, Typeform meets the requirements European businesses usually need. Typeform is a European company headquartered in Spain, data is hosted within the European Union, and a Data Processing Agreement is published.

Where does Typeform store data?

Typeform states: "Privacy policy references the European Economic Area and Ireland as processing locations, and states Google Calendar OAuth data is "stored exclusively in a PostgreSQL database hosted on AWS RDS within our production VPC". Source: typeform.com/legal/privacy-policy (read 2026-08-24). No single authoritative region statement was found.". Data is hosted within the European Union.

Does Typeform offer a Data Processing Agreement (DPA)?

Yes. Typeform publishes a DPA at https://www.typeform.com/legal/data-processing-agreement/. A DPA is required under Article 28 GDPR whenever a provider processes personal data on your behalf.

What a DPA has to cover →

Is Typeform a European company?

Yes. Typeform is headquartered in Spain and, as far as we can establish, European-owned.

Is Typeform subject to the US CLOUD Act?

Indirectly. Typeform itself is European-owned and headquartered in Spain, so the company is not subject to US jurisdiction. The exposure runs through a US provider in its processing chain, a host, CDN or other sub-processor, which can be compelled to disclose data it holds even when that data sits on EU servers. That is a narrower exposure than a US-owned vendor, and the compliance notes above say which provider it is. Standard Contractual Clauses are in place for transfers, which is the required safeguard but does not override a lawful US order.

Schrems II compliance checklist →

Spotted something wrong?

Martech moves fast. Vendors change hosting regions, get acquired, publish a new DPA or rewrite their pricing, and they rarely announce it. We check what we publish and date every compliance review, but some of what you see here will be out of date before we catch it.

If you work at Typeform and something on this page is wrong, tell us and we will fix it. Readers, same invitation. Pointing us at the page that proves it gets it changed fastest.