Jotform Privacy Policy changes — 20230207_rev01

1

## Privacy Policy

2

1

3

This privacy policy explains how Jotform handles your personal information and data, and applies to all of the products, services and websites offered by Jotform Inc., Jotform Ltd, Jotform Pty Ltd and their affiliates (collectively, "Jotform"), except where otherwise noted. Jotform products, services and websites are collectively referred to as the "services" in this policy. Unless otherwise noted, all services are provided by Jotform Inc., which is based in the United States.

2

4

3

5

In this policy, "you" refers to those who use and/or interact with any or all of our products, services, and websites, and "we", "us", and "our" refer to Jotform. "Customer"(s) refers specifically to those who use Jotform services. "Form Responders" refers to those who fill in and/or submit forms used by our Customers.

4

6

5

7

## INFORMATION WE COLLECT

6

8

7

9

### **From Our Customers**

8

10

9

11

- **Registration information.** When you register for an account with us so you can create and/or use forms, we collect your username, password and email address.

10

- **Billing information.** If you make a payment to Jotform Inc., we require that you provide your billing details, including name, address, email address and financial information corresponding to your selected method of payment (e.g. a credit card number and expiration date or a bank account number). If you provide a billing address, we will regard that as the location of the account holder. Our integrations with third party payment gateways are for processing only. We don't store or log any sensitive cardholder data provided by you or your form users. We follow industry-standard best practices to protect the security of cardholder data during processing and transmission. Jotform Inc. is certified as a PCI DSS Level 1 Compliant Service Provider, and we perform annual audits to ensure that our handling of your credit card information aligns with industry guidelines. [Read more here](https://www.jotform.com/blog/314-JotForm-is-Now-PCI-DSS-Service-Provider-Level-I-Compliant).

12

- **Billing information.** If you make a payment to Jotform Inc., we require that you provide your billing details, including name, address, email address and financial information corresponding to your selected method of payment (e.g. a credit card number and expiration date or a bank account number). If you provide a billing address, we will regard that as the location of the account holder. Our integrations with third party payment gateways are for processing only. We don't store or log any sensitive cardholder data provided by you or your form users. We follow industry-standard best practices to protect the security of cardholder data during processing and transmission. Jotform Inc. is certified as a PCI DSS Level 1 Compliant Service Provider, and we perform annual audits to ensure that our handling of your credit card information aligns with industry guidelines. [Read more here](https://www.jotform.com/blog/pci-dss-service-provider-level-i-compliant/).

11

13

- **Account settings.** Our customers can set various preferences and personal details on pages, such as your [account settings page](https://www.jotform.com/myaccount/). For example, your default language, timezone and communication preferences (e.g. opting in or out of receiving marketing emails from us).

12

14

- **Form data.** We store our customers' form data (questions and responses), in some cases using third party server providers such as Amazon Web Services and Google Cloud.

13

15

- **Data you use to create forms is owned by you.** Jotform Inc. treats your forms as private, unless you make them available to members of the public. We don't sell or make forms you've created available to anyone, nor do we use the form responses you collect, for purposes unrelated to you or our services, except in a limited set of circumstances (e.g. Jotform Inc. is compelled by a subpoena or court order, or if you've given us permission to do so).

14

16

- **Jotform safeguards responders' email addresses.** To make it easier for you to invite people to complete your forms via email, you may upload lists of email addresses, in which case we act as a mere custodian of that data. We don't sell these email addresses or make them available to others except as directed by you and in accordance with this policy. The same is true for any email addresses collected through your forms.

15

17

- **Jotform Inc. holds your data securely.** Read our [Security Statement](https://www.jotform.com/security/) for more information.

16

- **Form data is stored on servers located in the United States.** Our customers have the option to store their data in the EU. See [https://www.jotform.com/security](https://www.jotform.com/security) for more information.

18

- **Form data is stored on servers located in the United States.** Our customers have the option to store their data in the EU. See [https://www.jotform.com/security/](https://www.jotform.com/security/) for more information.

17

19

18

20

### **From Visitors to Our Websites**

19

21

20

22

- **Usage data.** We collect usage data when you interact with our services. This may include which web pages you visit, what you click on, when you performed those actions, and so on. Additionally, like most websites today, our web servers keep log files that record data each time a device accesses those servers. The log files contain data about the nature of each access, including originating IP addresses, internet service providers, the files viewed on our site (e.g., HTML pages, graphics, etc.), operating system versions, and timestamps.

21

23

- **Device data.** We collect data from the device and application you use to access our services, such as your IP address, operating system version, device type, system and performance information, and browser type. We may also infer your geographic location based on your IP address.

22

24

- **Referral data.** If you arrive at a Jotform website from an external source (such as a link on another website or in an email), we record information about the source that referred you to us.

+## Privacy Policy
 This privacy policy explains how Jotform handles your personal information and data, and applies to all of the products, services and websites offered by Jotform Inc., Jotform Ltd, Jotform Pty Ltd and their affiliates (collectively, "Jotform"), except where otherwise noted. Jotform products, services and websites are collectively referred to as the "services" in this policy. Unless otherwise noted, all services are provided by Jotform Inc., which is based in the United States.
 In this policy, "you" refers to those who use and/or interact with any or all of our products, services, and websites, and "we", "us", and "our" refer to Jotform. "Customer"(s) refers specifically to those who use Jotform services. "Form Responders" refers to those who fill in and/or submit forms used by our Customers.
 ## INFORMATION WE COLLECT
 ### **From Our Customers**
 - **Registration information.** When you register for an account with us so you can create and/or use forms, we collect your username, password and email address.
+- **Billing information.** If you make a payment to Jotform Inc., we require that you provide your billing details, including name, address, email address and financial information corresponding to your selected method of payment (e.g. a credit card number and expiration date or a bank account number). If you provide a billing address, we will regard that as the location of the account holder. Our integrations with third party payment gateways are for processing only. We don't store or log any sensitive cardholder data provided by you or your form users. We follow industry-standard best practices to protect the security of cardholder data during processing and transmission. Jotform Inc. is certified as a PCI DSS Level 1 Compliant Service Provider, and we perform annual audits to ensure that our handling of your credit card information aligns with industry guidelines. [Read more here](https://www.jotform.com/blog/314-JotForm-is-Now-PCI-DSS-Service-Provider-Level-I-Compliant).
+- **Billing information.** If you make a payment to Jotform Inc., we require that you provide your billing details, including name, address, email address and financial information corresponding to your selected method of payment (e.g. a credit card number and expiration date or a bank account number). If you provide a billing address, we will regard that as the location of the account holder. Our integrations with third party payment gateways are for processing only. We don't store or log any sensitive cardholder data provided by you or your form users. We follow industry-standard best practices to protect the security of cardholder data during processing and transmission. Jotform Inc. is certified as a PCI DSS Level 1 Compliant Service Provider, and we perform annual audits to ensure that our handling of your credit card information aligns with industry guidelines. [Read more here](https://www.jotform.com/blog/pci-dss-service-provider-level-i-compliant/).
 - **Account settings.** Our customers can set various preferences and personal details on pages, such as your [account settings page](https://www.jotform.com/myaccount/). For example, your default language, timezone and communication preferences (e.g. opting in or out of receiving marketing emails from us).
 - **Form data.** We store our customers' form data (questions and responses), in some cases using third party server providers such as Amazon Web Services and Google Cloud.
 - **Data you use to create forms is owned by you.** Jotform Inc. treats your forms as private, unless you make them available to members of the public. We don't sell or make forms you've created available to anyone, nor do we use the form responses you collect, for purposes unrelated to you or our services, except in a limited set of circumstances (e.g. Jotform Inc. is compelled by a subpoena or court order, or if you've given us permission to do so).
 - **Jotform safeguards responders' email addresses.** To make it easier for you to invite people to complete your forms via email, you may upload lists of email addresses, in which case we act as a mere custodian of that data. We don't sell these email addresses or make them available to others except as directed by you and in accordance with this policy. The same is true for any email addresses collected through your forms.
 - **Jotform Inc. holds your data securely.** Read our [Security Statement](https://www.jotform.com/security/) for more information.
+- **Form data is stored on servers located in the United States.** Our customers have the option to store their data in the EU. See [https://www.jotform.com/security](https://www.jotform.com/security) for more information.
+- **Form data is stored on servers located in the United States.** Our customers have the option to store their data in the EU. See [https://www.jotform.com/security/](https://www.jotform.com/security/) for more information.
 ### **From Visitors to Our Websites**
 - **Usage data.** We collect usage data when you interact with our services. This may include which web pages you visit, what you click on, when you performed those actions, and so on. Additionally, like most websites today, our web servers keep log files that record data each time a device accesses those servers. The log files contain data about the nature of each access, including originating IP addresses, internet service providers, the files viewed on our site (e.g., HTML pages, graphics, etc.), operating system versions, and timestamps.
 - **Device data.** We collect data from the device and application you use to access our services, such as your IP address, operating system version, device type, system and performance information, and browser type. We may also infer your geographic location based on your IP address.
 - **Referral data.** If you arrive at a Jotform website from an external source (such as a link on another website or in an email), we record information about the source that referred you to us.

Privacy Policy

Full text changes — 20221206_rev01 to 20230207_rev01