This Cordex-Forms Privacy & Data-Flow Statement forms part of the Cordex-Forms EULA.
Scope & roles
This statement explains what data Cordex-Forms stores, where it goes, and who is responsible for it. It forms part of the Cordex-Forms EULA and supplements our Privacy Policy.
For Customer Data, you decide what is collected and why, and you are responsible for it under privacy law. We are the provider of the Software. We do not host or receive your Customer Data through the Software.
What is stored, and where
- Your WordPress database: plugin settings, field mappings, the encrypted delivery queue and delivery logs.
- Your Dataverse environment: the records your forms create or update.
- Your web server: uploaded files while they are being sent, and any malware scanner you choose to install (for example a ClamAV adapter you install yourself).
What reaches us
For licence checks, the plugin sends us your licence key, the site address, the plugin version and the Plan. It does not send us form submissions, Dataverse records or your Dataverse credentials.
Third parties
- Microsoft (Dataverse / Entra ID): submissions and lookups, using your own tenant and app registration.
- Google reCAPTCHA (if you turn it on): visitor interaction signals, under Google’s terms.
- Your form plugin (for example WPForms), if you use one.
Each third party handles data under its own terms and privacy policy.
Security
We design the Software to keep Customer Data in your environment, use encrypted connections, sign licence tokens, and avoid storing secrets in the browser. You are responsible for the security of your devices, servers, tenants, accounts, keys and backups, and for the access you grant.
Retention & deletion
You control how long Customer Data is kept in your environment. Deactivating or deleting the plugin removes its settings and queue from WordPress. Records already in Dataverse stay there. Export or deliver any queued submissions before you uninstall.
We keep licence, account and billing records for as long as needed to provide the service and meet legal obligations (generally 7 years for tax records), then delete or de-identify them.
Your obligations
You must have a lawful basis and any required consents for the data you record, give any required notices, respond to access and correction requests, and meet the Australian Privacy Principles and any health records or sector laws that apply to you.
Overseas disclosure
Data in your environment stays where you host it. Our licensing and account records are held in Microsoft Azure in Australia. Payment providers and any AI provider you choose may process data overseas under their own terms.
Contact
MYITANDAPPS PTY LTD · ABN 82 659 633 888 · PO Box 7570, Redland Bay QLD 4165, Australia
Email: cordex-forms@myitandapps.com.au?subject=Cordex%20Forms%20OEM%20/%20Reseller%20enquiry