GDPR, Privacy and Data Protection at ILG Forms

Information about our privacy & General Data Regulation efforts

The European General Data Protection Regulation (“GDPR”) legislation introduces a new set of rules for the processing of personal data. GDPR is the most modern and fully integrated legislation on data privacy, and the applicability of the GDPR does not stop at the borders of the European Economic Area (“EEA”).

ILG Forms has embraced the requirements of GDPR, and we consider GDPR to be the benchmark for our privacy and data protection efforts. Below you’ll find information about GDPR, as well as answers about data protection and privacy at ILG Forms, for your convenience.

You should also consult our Privacy Policy for further details on these topics.

Why GDPR should matter to you

GDPR modernises outdated privacy laws and impacts your organisation if you collect or process data in or from Europe. If you’re based in Europe, or you work with persons that are in Europe, then you likely need to comply with GDPR. Significant fines of up to €20,000,000 or 4% of global annual turnover, whichever is greater, could be levied on you if your organisation is impacted and is not GDPR compliant.

How to prepare for GDPR

If your organisation is impacted by GDPR, then you need to make sure you are compliant with the legislation before it commences on 25 May 2018. The good news is that we make it easy to use ILG Forms in a GDPR-compliant way!

The following steps are recommended as a means to achieving compliance. NOTE: We’re not lawyers! If you’re unsure about your compliance status, seek legal advice.

Review your vendors and data flows Make a list of your software and other vendors, and document the data flows across your business, what type of personal data you collect and who has access. It’s likely that you will need to put in place agreements that assure data protection with any vendors you submit personal data to.

Review the ILG Forms DPA if applicable If you’re an ILG Forms customer and are considered to be a data controller under GDPR, then you should review our Data Processing Addendum (DPA) as it applies to you. The ILG Forms DPA incorporates with our Terms of Use so, by having acknowledged our Terms of Use and continuing to use ILG Forms, you’re already accepting our DPA.

Identify and mitigate your risks Perform a risk assessment within your business to identify any gaps that need to be addressed for meeting GDPR compliance.

Implement your compliance ongoing Plan and implement your GDPR compliance activities ahead of the May 25, 2018 deadline, and then ensure that compliance continues thereafter as an ongoing discipline for your organisation.

Common questions about GDPR and privacy at ILG Forms

➢ What is GDPR?

“GDPR” or “General Data Protection Regulation “(EU Regulation 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC) is the new European privacy legislation.

It aims to harmonise legislation throughout the EU with the intention to:

increase the general awareness of data privacy,

allow individuals to take control over their privacy and their fundamental rights, and,

strengthen security requirements throughout companies and organisations.

➢ Where/When does GDPR apply?

GDPR goes into effect on 25 May 2018 and applies to: – all organisations established in the European Economic Area (“EEA”) – to organisations, whether or not established in the EEA, that process personal data in connection with either the offering of goods or services to natural persons in the EEA or the monitoring of behaviour that takes place within the EEA.

Thus, from the moment there is processing of personal data in the EEA, or from the moment a person located in the EEA is referenced, GDPR will apply (regardless of whether the processing entity is located in the EEA).

What does the ILG Forms Platform do?

ILG Forms provides a solution for rapidly creating data-driven business apps on mobile and desktop devices, all with no programming required.

This enables businesses to reduce paper, enhance productivity and improve accuracy in a wide variety of industries and field usage scenarios.

ILG Forms platform provides an “end to end” platform for creating custom business apps, securely capturing and accessing data through these apps, safe cloud-based storage of data, and connection/integration of data with other external services.

ILG Forms is offered as “Software as a Service” (“SaaS”), which is a licensing and delivery model where software is centrally hosted and made available to multiple customers over a network, including through interacting applications (including mobile/desktop apps, web browser, and/or connectors to third-party systems).

Personal Data (as defined by GDPR) is only processed by ILG Forms under the control and direction of ILG Forms customers.

➢ Who is a “Controller” or a “processor” under GDPR?

ILG Forms customers decide the nature of data being captured and stored, and they choose which individuals interact with the ILG Forms Platform (thus in turn whose personal data is captured and processed). It is thus you, as an ILG Forms customer, that legally acts as the “Controller” as defined under GDPR.

ILG Forms provides the means (the ILG Forms Platform) for ILG Forms customers to capture data and interact with their respective users, clients and other parties. As such, ILG Forms is only processing personal data for, and on behalf of, ILG Forms customers as a “Processor”, as defined under GDPR.

The only case where ILG Forms acts as a Controller is during a limited set of direct interactions with ILG Forms customers.

What is ILG Forms doing to meet GDPR requirements?

ILG Forms has undertaken a number of initiatives to meet GDPR requirements:

Hosting of EEA customers exclusively within EU data centers All data for customers identified as being located in the EEA is hosted within our cloud partner’s (Microsoft Azure) West Europe (Amsterdam) and North Europe (Dublin) data centers.

Encryption of data at rest and in transit All data stored within the ILG Forms Platform is encrypted on servers, be this within a database, storage service or file backups. All data transport between servers, services and/or devices (both internally and externally) occur exclusively over SSL encrypted transport protocols.

Data Protection Officer (DPO) The ILG Forms DPO supervises our entire data privacy program and works in close conjunction with ILG Forms team members on matters relating to security, data protection and privacy.

Data Processing Addendum (DPA) ILG Forms provides a standard DPA which is a self-serve and easy-to-execute document pre-signed by an ILG Forms director. The DPA clearly outlines the data processing terms between ILG Forms and a customer, and it only requires an ILG Forms customer’s electronic signature to complete. This allows ILG Forms European customers to provide the signed DPA to auditors demonstrating that the ILG Forms Platform is used to process data in a way that meets their GDPR compliance obligation.

“Is Personal Data” flags for data entities in the platform (e.g. forms and data sources) The ILG Forms Platform now provides new checkbox options to allow ILG Forms customers to flag/identify data fields that contain personal data. This, in turn, allows the ILG Forms Platform to anonymise these fields when data leaves the ILG Forms Platform (e.g. via manual export, connector integrations, and/or the ILG Forms Platform API).

Careful vetting of sub-processors Each sub-processor of ILG Forms is vetted by our team in the areas of security, contractual terms, data processing agreements, and EU standard contractual clauses / Privacy Shield.

Up-to-date contractual documents/privacy policies Our contractual documents have been updated to contain necessary GDPR provisions, including data processing addendum, end-to-end confidentiality and privacy policies.

Product Development All new ILG Forms Platform functionality that is introduced from May 2018 onwards will include consideration of the following:

• the GDPR principles of “privacy by design” and “privacy by default”,

• giving flexibility to all customers while remaining within GDPR guidelines

• keeping all changes as simple as possible

What is a Data Processing Addendum (DPA) and does ILG Forms provide this?

If ILG Forms’ processing of personal data for your organisation falls within the material and/or territorial scope of GDPR (articles 2 & 3), the legislation (GDPR article 28) requires that this processing occurs under a Data Processing Addendum (DPA).

The ILG Forms DPA is provided and incorporates with our Terms of Use so, by having acknowledged our Terms of Use and continuing to use ILG Forms, you’re already accepting our DPA. You can reference our DPA if you need to show auditors that your use of ILG Forms meets your GDPR obligations in terms of the data that we process on your behalf.

What types of Personal Data does the ILG Forms Platform process?

For registered users on the platform, basic contact information is processed (i.e. direct identifiable personal data such as e-mail addresses or name) as well as minimal device information, connection information and geolocation.

Other personal information may also be processed by the ILG Forms Platform through data captured and stored by ILG Forms customers.

While it’s not up to us to control what data we receive, this can include items such as contact information, IP addresses, and other data. We process customer-submitted data as part of our contractual obligation to our customers, and in accordance with applicable laws, including the GDPR.

Does the ILG Forms Platform utilise sub-processors? Show me the list?

We use certain sub-processors to assist in providing the ILG Forms platform to customers. A sub-processor is a third-party data processor engaged by ILG Forms, that has or potentially will have access to or process customer data (which may include personal data).

ILG Forms Sub-processors

Last updated 15 May 2018.

ILG Forms uses certain sub-processors to assist in providing the ILG Forms Platform to customers.

A sub-processor is a third-party data processor engaged by ILG Forms, that has or potentially will have access to or process customer data (which may contain personal information).

ILG Forms engages different types of sub-processors to perform various functions as explained in the list below. If you have any questions about these companies or ILG Forms’ relationships with them, please contact our app support team.


Sub-Processor Name County of Processing Purpose
Microsoft Azure Netherland and Ireland for EU Customer accounts Cloud services, data storage, computation and backup
Google USA Analytics and device push notifications
Apple USA Device push notifications
Freshdesk USA Helpdesk and knowledgebase
SendGrid USA Email delivery
Pin Payments Australia Subscription payments
Stackify USA Service monitoring
ActiveCampaign USA Customer Relationship Management


How long does personal data remain on the ILG Forms Platform?

ILG Forms production (live) environments

Registered Users:

All personal data relating to a user is either deleted or anonymised within 7 days of the user deletion action. The 7-day period allows for fast recovery if the deletion was accidental.

For the avoidance of doubt, deactivation of a user account does not remove the account or it’s personal data; the account is simply archived.

All other data entities:

This is determined and configured by ILG Forms’ customers, based on their own agreements with data subjects in turn. The ILFG Form Platform provides customers with functionality to delete data entities as needed.

ILG Forms backups

Backups are performed on a regular basis and are kept in encrypted, secure storage for up to 60 days. This means that items deleted in production environments are available for restoration from backups for up to 60 days thereafter.

ILG Forms test/development environments

Data is occasionally extracted from production to development/testing environments for support, testing and debugging purposes. When this occurs, personal data is anonymised in order to assure privacy.

Who has access to personal data stored on the ILG Forms Platform?

Personal data stored on the ILG Forms Platform may be visible to:

ILG Forms’ Customers

Depending on their assigned access permissions, users can view, and access personal data collected and/or stored within their ILG Form customer account.

ILG Forms’ employees & contractors

All employees & contractors are trained and contractually committed to following ILG Forms’ privacy, security and data protection practise.

Sub Processors

We work with carefully selected services to provide aspects of the ILG Forms platform and may process data with these services as necessary to provide ILG Forms platform services.

Other third parties if required by applicable law or where ILG Forms has a good-faith belief that such disclosure is reasonably necessary to:

(a) Protect the safety of any person from death or serious bodily injury, or

(b) Prevent fraud or abuse

Access only occurs to the extent and limited to, such personal data as necessary for that specific purpose of the respective party.

➢ Where is personal data stored? Does it leave the European Economic Area?

The ILG Forms Platform is hosted in 3 regions (“nodes”) across the world – specifically USA, Europe and Australia.

All customers that identify themselves as being located within Europe are hosted exclusively within our West Europe (Amsterdam & Dublin) datacenters.

As such, all data captured and/or stored on the ILG Forms Platform for European customers will remain within the EEA by default.

ILG Forms only exports personal data outside of the European Economic Area (“EEA”) if and when required by:

. a respective sub-processor for the correct functioning of the service they offer (e.g. push notifications)

. other recipients, only to the extent required to support the correct and/or compliant functioning of the ILG Forms Platform.

Where data export occurs, ILG Forms ensures that such export occurs under the adequacy decisions as allowed by GDPR (EU-US Privacy Shield, binding corporate rules, applicable EU standard contractual clauses, such other methods as allowed per the GDPR), and keeps the exported data to a minimum as necessary.

ILG Forms also provides software features to ILG Forms customers which allows them to anonymise personal data upon export out of the ILG Forms Platform.

Is data processed by ILG Forms used for direct marketing or automated decision making?

Registered administrator users may be contacted by ILG Forms with news or offers about the ILG Forms Platform. This communication can be unsubscribed at any time by the user.

ILG Forms does not use personal data processed through the ILG Forms Platform for direct marketing purposes, nor does the ILG Forms Platform employ automated decision-making processes/techniques which create or deny rights to individual persons. We only process personal data under instruction and under control of the ILG Forms customer for the purpose of the ILG Forms Platform solution.