Privacy Policy

Scope
Personal Information Forma Collects
How We Use Your Personal Information and Our Legal Bases for Processing It
How We Disclose Your Personal Information
How Long We Keep Your Personal Information
International Transfers
Cookies
Security
Your Rights and Choices
Children's Personal Information
Changes to this Privacy Policy
Contact Us
Additional Information for California Residents

Last Updated: July 31, 2026

This Privacy Policy (“Privacy Policy”) describes how Twic Inc. dba Forma and its affiliates (“Forma,” “we,” “us,” and/or “our”) collects and processes your personal information for our own purposes when you interact with Forma and our websites, services, content, and any related software, mobile applications, and other applications (collectively, “Services”).

When you access or use Forma’s Services, you acknowledge that you have read this Privacy Policy and understand its contents. Your use of the Forma Services and any dispute over privacy is subject to this Privacy Policy. We recommend that you read this Privacy Policy in its entirety to ensure you are fully informed.

1. Scope

This Privacy Policy applies to the personal information Forma collects and processes when you:

create or administer your Forma account;
visit, interact with, or use any Forma Services or websites that link to this Privacy Policy;
complete a questionnaire, support ticket, or other informational request forms;
receive communications from, or otherwise interact or communicate with Forma, including via email, phone, mail, support chat, or using websites that link to this Privacy Policy; or
engage in a contracting process with Forma.

Forma also creates and uses de-identified data in some instances. De-identification standards vary by jurisdiction and local law may continue to treat certain de-identified data as personal data subject to privacy protections. Where Forma maintains de-identified data, we apply appropriate safeguards consistent with applicable laws in your jurisdiction.

2. Personal Information Forma Collects

The personal information Forma collects depends on the context of your interactions with Forma and the choices you make, the Services and features you use, your location, and applicable laws, but can include the following:

Information You Provide to Us. Forma collects personal information you provide to us, such as when you complete a form on our website, or create a Forma account. This information may vary depending on how you interact with the Forma Services, and may include:

Account information: your email address, password, and any authentication and security credential information used to create and administer your Forma account.

Contact and professional information: your name, address, phone number, email address, company name, job title/level, department, and industry.

Contract and payment information: your signature, credit card and bank account information, VAT numbers and other tax identifiers that you use to pay for Forma Services.

Personal identification information: government-issued identification documents and photos to comply with global anti-money laundering (“AML”) and know your customer (“KYC”) obligations, in addition to fraud and risk monitoring.

Communications information: your feedback on the Forma Services and other communications with us (including when you interact with our customer service and support teams), any queries you raise (including when you fill out a form on our website), and chat, email, or call history with our support and sales teams, including interactions with AI-powered support features. This includes information as to how you contact us, and the channel of communication that you use, as well as any information that you send to us.

Benefits administration information: we may collect your (and your dependents’) identification information, social security number, and claim information, and any other information necessary to provide the Forma Services to our customer.

Financial information: such as your bank routing and account information, bank statements and transaction history, and verification of bank account ownership to conduct KYC and other regulatory clearance and underwriting processes in connection with your organization’s application for certain Forma Services, and for internal reporting purposes for certain Forma Services.

Advertising and marketing information: such as your interests based on your use of our Services and other websites and online services, your preferences in relation to receiving marketing materials from us, communication preferences, and your preferences for particular products or services.

Providing your personal information is optional. You are not under a legal duty to provide your personal information, but it may be necessary for certain Forma Services, such as account registration. In such cases, if you do not provide your personal information, we may not be able to provide you with the requested Forma Services.

Information We Collect Automatically. We automatically collect certain types of information when you interact with the Forma Services, such as when you visit our website or log into your account. We use common information gathering tools, such as tools for collecting usage data, cookies, web beacons and similar tracking technologies to automatically collect information that may contain personal information from your computer or mobile device as you navigate our Services or interact with emails we have sent you. This information includes:

Usage and interaction information. The full Uniform Resource Locators (URL) clickstream to, through, and from our website (including date and time) and Services, content you viewed or searched for, page response times, download errors, length of visits to certain pages, searches, interactions with AI-powered features (including session frequency, feature usage, and conversation metadata), actions taken within our Services, and page interaction information (such as scrolling, clicks, and mouse-overs).

Log data and device information. IP address, information about your Internet service provider, computer and device information including device, application, or browser type and version, browser plug-in type and version, operating system, or time zone setting, authentication and security credential information, access dates and times, occurrences of technical errors, diagnostic reports, your settings preferences, backup information, API calls, and other logs.

Inferred location information. We may collect geolocation data, such as the location of your device or computer determined from your IP address or mobile device’s GPS depending on your device settings.

Information We Collect from Other Sources. Depending on how you use the Forma Services, we may collect information about you from other sources and combine this information with personal information that you provide. These sources include:

Your employer and their partners. We may receive information about you, such as benefits information, from your employer and their service providers or authorized representatives to provide certain Forma Services.

Third-party service providers and business partners. We may collect information about you and your use of the Forma Services from our financial partners such as banks, card networks, payment processors, money transmitters, and other partners that provide or support delivery of Forma Services.

Public and third-party sources for marketing. To the extent permitted by applicable laws, we collect information about prospective and existing users of our Services from publicly and commercially available services including aggregators and social media networks, as well as through third-party marketing initiatives, such as events where we are a sponsor. We may use this information to enrich or update the information we hold about you, such as verifying or supplementing your contact and professional information. This information may include marketing and sales generation information such as your social profile (e.g. LinkedIn), name, email address, physical address, phone number, and professional information.

3. How We Use Your Personal Information and Our Legal Bases for Processing It.

Our purposes and legal bases for using personal information depend on the context of your interactions with Forma and the choices you make, the Forma Services and features you use, and your location, but can include those set out below, as permitted by applicable laws.

In jurisdictions where applicable law distinguishes between primary processing purposes and ancillary processing purposes, our advertising and marketing is considered an ancillary purpose, while all other processing purposes described in this section are primary purposes.

Purpose / Activity	Description	Types of Personal Information	Legal Basis for Processing
Register and administer your account	Create, maintain and administer your Forma account	Account information Contact and professional information Communications information Usage and interaction information Log and device information Inferred location information Other identifiers and information contained in cookies and similar tracking technologies	Performance of a contract with you Consent (where required under applicable laws)
Process transactions	Process any transactions for Forma Services (including registrations, purchases,and payments)	Contract and payment information Identification information Communications information Log and device information	Performance of a contract with you Consent (where required under applicable laws)
Providing Forma’s Services	Operate, provide, deliver, and assess eligibility for our Services	Account information Contact and professional information Contract and payment information Personal identification information Benefits information Financial information Contractor and vendor information Usage and interaction information Log and device information Inferred location information Other identifiers and information contained in cookies and similar tracking technologies Other information as may be required to provide the Services requested	Performance of a contract with you to provide the Services Legitimate interests (to operate and provide our Services) Consent (where required under applicable laws)
Communicate with you	Communicate with you regarding our Services via different channels (e.g., by phone, email) or AI-powered support features, send you service updates, confirmations, invoices, technical notices, updates, security alerts, support and administrator messages, and respond to your inquiries, requests, or complaints	Account information Contact and professional information Communications information Contractor and vendor information	Performance of a contract with you to provide the Services Legitimate interests (to operate, provide, and improve our Services; to communicate with you – where our communications are not necessary to perform or enter into a contract with you) Consent (where required under applicable laws) Compliance with legal obligations and the exercise of our legal rights
Measure, troubleshoot,develop, and improveour Services and ourbusiness	Provide, maintain, improve, and develop our Services, including by measuring their use, analyzing their performance, quality and safety, and fixing errors	Account information Contact and professional information Communication information Contractor and vendor information Advertising and marketing information Usage and interaction information Log and device information Inferred location information Other identifiers and information contained in cookies and similar tracking technologies	Legitimate interest (to improve our business and Services) Consent (where required under applicable laws)
Recommendationsand personalization	Recommend Forma Services that might be of interest to you, identify your preferences, and personalize your experience with Forma Services	Account information Contact and professional information Communications information Contractor and vendor information Advertising and marketing information Usage and interaction information Log and device information Inferred location information Other identifiers and information contained in cookies and similar tracking technologies	Legitimate interests (to operate, provide, and improve our business; to use the insights to improve or develop marketing activities and promote our Services) Consent (where required under applicable laws)
Data enrichment and verification	Supplement, verify, or update the information we hold about you using data from publicly available and third-party commercial sources, to keep your information accurate and current and to improve our ability to provide and personalize our Services	Contact and professional information Advertising and marketing information Other identifiers	Legitimate interests (to maintain accurate records and improve our Services and marketing activities)
Advertising andmarketing	Send you promotional messages, messages, marketing, advertising, and other information based on your preferences and usage patterns, and personalize, measure, and improve our advertising. We may also use personal information to administer referral programs, rewards, surveys, sweepstakes, contests, or other promotional activities or events sponsored or managed by Forma or its third-party partners, and to invite you to events and relevant opportunities. For more information about your choices relating to our marketing activities, see Your Rights and Choices section below.	Account information Contact and professional information Communications information Contractor and vendor information Advertising and marketing information Usage and interaction information Log and device information Inferred location information Other identifiers and information contained in cookies and similar tracking technologies	Legitimate interests (to operate, provide, and improve our business; to communicate with you and develop marketing activities and promote our Services) Consent (where required under applicable laws)
Prevent and investigate security and fraud issues	Prevent, detect, mitigate, and investigate potential security issues, as well as fraudulent or illegal activity on our Services, or to comply with legal obligations	Account information Contact and professional information Contract and payment information Personal identification information Communications information Benefits information Financial information Contractor and vendor information Advertising and marketing information Usage and interaction information Log and device information Inferred location information Other identifiers and information contained in cookies and similar tracking technologies Other information as may be required to protect our business interests and comply with applicable laws	Legitimate interests (to protect our business interests) Compliance with legal obligations and the exercise of our legal rights Consent (where required under applicable laws)
Comply with legal and regulatory obligations	Comply with, and enforce our rights under, any applicable laws, including but not limited to AML and KYC laws. This includes complying with our obligations to respond to your requests under applicable data protection laws.	Account information Contact and professional information Contract and payment information Personal identification information Communications information Benefits information Financial information Contractor and vendor information Advertising and marketing information Usage and interaction information Log and device information Inferred location information Other identifiers and information contained in cookies and similar tracking technologies Other information as may be required to protect our business interests and comply with applicable laws	Compliance with legal obligations and the exercise of our legal rights Consent (where required under applicable laws)

‍

4. How We Disclose Your Personal Information.

Maintaining your trust over your personal information is a vital part of our relationship with you, and we disclose your personal information only as described below.

With others in your organization. If you are the administrator for your organization, we may disclose your information to other users in your organization in accordance with your account settings and preferences. If you are a user, we may disclose certain information, including information about your account settings and your use of the Forma Services, to your organization and its administrator(s).

Service providers. We engage third party service providers and individuals to perform certain functions on our behalf. This may include cloud computing and storage services, payments processing, identity verification, event services, customer support, call recording, data analytics, benefits administration, artificial intelligence and machine learning services, and marketing services. These third party service providers have access to personal information needed to perform their functions and may not personal information for other purposes.

Financial partners. We disclose your personal information to financial partners such as banks, card networks, and payment processors for a variety of reasons, including supporting their customer identification, risk, and compliance obligations, so they, or us, can determine eligibility for, and provide, Services. This information also enables these partners to deliver card, payment and transfer capabilities through our Services.

Third-party advertising services. We provide information (such as your internet or other similar network activity, identifiers such as your name and email address, location information, and inferences about your interests) to third parties, including advertising networks that allows them to serve you with more useful and relevant Forma ads and to measure their effectiveness. For more information about your choices relating to our advertising, see “Your Rights and Choices” section below.

Protection of us and others. We may disclose your personal information if we believe disclosure is appropriate to comply with applicable laws, enforce or apply our terms or agreements (including to collect amounts owed to us), protect the rights, property, or safety of Forma, or our employees, customers, users, and others or to respond to requests from courts, law enforcement agencies, regulatory agencies, and other public and government authorities. We may also disclose your personal information in connection with investigating and preventing fraud or security issues relating to our Services.

Affiliates. We may disclose your personal information to our affiliates within the Forma corporate group as well as companies we may acquire in the future when they become part of the Forma corporate group in accordance with this Privacy Policy.
With your consent. We may disclose personal information to third parties when we have your consent to do so.

For further information on the recipients of your personal information, please contact us at the address stated under the Contact Us section below.

5. How Long We Keep Your Personal Information

We keep your personal information for as long as it is required to fulfill the relevant purposes described in this Privacy Policy, or for other essential purposes such as complying with our legal obligations, resolving disputes and enforcing our agreements.

These needs may vary for different data types in the context of different Services, and actual retention periods can vary significantly. We determine the appropriate retention period for personal information based on the amount, nature, and sensitivity of your personal information processed, the potential risk of harm from unauthorized use or disclosure of your personal information and whether we can achieve the purposes of the processing through other means, as well as applicable legal requirements (such as applicable statutes of limitation).

Our retention obligations may require us to retain your personal information after your relationship with us has ended. These retention obligations may also prohibit us in some cases from deleting personal information after you have asked us to delete your personal information. After expiry of the applicable retention periods, your personal information will be deleted, de-identified, anonymized, or otherwise irreversibly destroyed in accordance with applicable laws. If there is any data that we are unable, for technical reasons, to delete entirely from our systems, we will put in place appropriate measures to prevent any further use of that data.

For further information on applicable data retention periods, please contact us at the address stated under the Contact Us section below.

6. International Transfers

Personal information we collect may be stored and processed in your region, in the United States or in any other country where we or our affiliates or service providers maintain facilities. We maintain primary data centers in the United States. We take steps designed to ensure that the personal information we collect under this Privacy Policy is processed as described in this Privacy Policy and according to any applicable laws. As a result, your personal information may be subject to the laws of foreign jurisdictions, including laws that permit or require the disclosure of information to law enforcement or national security authorities upon request.

When transferring personal information from a jurisdiction restricting such exports, we rely on appropriate legal mechanisms, which may include:

Standard Contractual Clauses (SCCs). For transfers of personal information from the European Economic Area, United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses and equivalent terms for the United Kingdom (including the UK Addendum to the EU SCCs) and Switzerland, as applicable.

Adequacy decisions. Where the European Commission or another relevant authority has determined that the destination country ensures an adequate level of data protection, we may rely on that adequacy decision as the basis for the transfer.

Other lawful mechanisms. Where required or permitted by applicable law, we may rely on other appropriate safeguards, including derogations for specific situations (such as your explicit consent or the performance of a contract with you), or other legally recognized transfer mechanisms.

Forma complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Forma has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. Forma has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) Program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

Forma remains responsible and liable under the E.U.-U.S. DPF Principles, the UK extension to the E.U.-U.S. DPF, and/or the Swiss-U.S. DPF Principles if third-party agents that it engages to process the personal data on its behalf do so in a manner inconsistent with the Principles unless Forma proves that it is not responsible for the event giving rise to the damage. Twic, Inc. dba Forma is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC).

If you have any questions about this Privacy Policy, please do not hesitate to contact us at privacy@joinforma.com.

7. Cookies

We use cookies and similar technologies to enable our systems to recognize your browser or device, to provide the Forma Services, and to improve your experience, as described in Information We Collect Automatically.

8. Security

We design our systems and the Forma Services with your security and privacy in mind.

We maintain a wide variety of compliance programs that validate our security controls, which can be found in the Forma Trust Center.

We protect the security of your information during transmission to or from Forma by using encryption protocols and software.

We maintain technical, physical, and organizational safeguards in connection with the collection, storage, and disclosure of personal information. Our security procedures mean that we may request proof of identity before we disclose personal information to you.

Although we strive to use commercially recognized means to protect your personal information, we cannot guarantee absolute security. You are solely responsible for protecting your password, limiting access to your devices, and signing out of websites after your sessions.

If you have any questions about the security of our websites, please contact us at the address stated under the Contact Us section below.

9. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information. To exercise your rights, please contact us as described under the Contact Us section below, or as otherwise described in this Privacy Policy. Subject to applicable law, you may have the right to:

inquire whether we hold personal information about you, and request copies of any such personal information and information about how it is processed;

request information about our processing of your personal information, including information about third parties to whom we disclose personal information and why we process your personal information;

request that personal information about you is corrected;

request deletion of your personal information;

request us to restrict the processing of your personal information where the processing is inappropriate;

request that we inform any third parties to whom we’ve disclosed your personal information of your correction, deletion, or restriction requests;

object to certain processing of your personal information;

request portability of personal information that you have provided to us;

if we have collected and processed your personal information with your consent, withdraw your consent. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent. However, please note that the withdrawal of your consent may affect our ability to continue to provide you with the Forma Services because the continued use and disclosure of your personal information is necessary to make the Forma Services available to you;

submit a complaint to a data protection authority about our collection and use of your personal information. A full list of European Economic Area (“EEA”) data protection authorities by country is here. The UK Information Commissioner’s Office can be contacted here. The Office of the Australian Information Commissioner can be contacted here.

10. Children's Personal Information

We do not provide our Services to children. We do not knowingly collect personal information from children under the age of 16 (or other minimum age of minors in your jurisdiction) without the consent of the child’s parent or guardian. If you are a parent or guardian and you learn that your children have provided us with personal information, please contact us at the address stated under the Contact Us section below.

11. Changes to this Privacy Policy

Forma periodically updates this Privacy Policy to reflect changes to legal and regulatory requirements. Forma reserves the right to update or modify this Privacy Policy at any time. This Privacy Policy was last updated to be effective as of the “Last Updated” date indicated at the top.

12. Contact Us

If you have any questions about this Privacy Policy or wish to contact our data protection officer in regions where we have appointed one, please contact us at privacy@joinforma.com, by filling out this form, or by mailing us at the below address:

Forma

c/o Data Protection Officer

47000 Warm Springs Blvd., Suite 1-170

Fremont, CA 94539

USA

‍

When you contact us, please indicate in which country and/or state you reside.

If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third party dispute resolution provider (free of charge) at TRUSTe.

If your DPF complaint cannot be resolved through the above channels, under certain conditions you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. With respect to personal data received or transferred pursuant to the Data Privacy Framework.

We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy. If, however, you believe that we have not been able to assist with your complaint or concern, and you are located in the European Economic Area or the United Kingdom, you have the right to lodge a complaint with the competent supervisory authority. If you work or reside in a country that is a member of the European Union or that is in the EEA, you may find the contact details for your appropriate data protection authority on the following website.

13. Additional Information for California Residents

Below are the additional disclosures for California residents that are required by the California Consumer Privacy Act and the California Privacy Rights Act (together, the "CCPA"), effective as of January 1, 2024. These disclosures supplement the rest of this Privacy Policy.

Categories of personal information we collect. The personal information that we have collected from consumers in the preceding twelve months, fall into the following categories established by the CCPA:

identifiers, such as your name, email, address, phone numbers, or IP address;

personal information as described in subdivision (e) of Section 1798.80 of the California Civil Code, such as a credit card number;

characteristics of protected classifications under California or US federal law, such as age or gender, for example if you participate in a benefit program through your employer where your employer is using Forma’s Services;

commercial information, such as purchase activity;

internet or other electronic network activity information, including content interaction information, such as content downloads, streams, and playback details;

geolocation data, such as the location of your device or computer determined from your IP address or mobile device’s GPS depending on your device settings;

audio, visual, electronic or other similar information, including when you communicate with us by phone or otherwise;

professional or employment-related information, for example data you may provide about your business;

inference data, such as information about your preferences; and

sensitive personal information, such as government-issued identification documents to comply with global AML and KYC obligations.

Categories of personal information disclosed for a business purpose. The personal information that we disclosed about consumers for a business purpose in the preceding twelve months fall into the following categories established by the CCPA, depending on how you engage with us:

identifiers, such as your name, email, address, phone numbers, or IP address;

personal information as described in subdivision (e) of Section 1798.80 of the California Civil Code, such as a credit card number;
characteristics of protected classifications under California or US federal law, such as age or gender, for example if you participate in a benefit program through your employer where your employer is using Forma’s Services;

commercial information, such as purchase activity;

internet or other electronic network activity information, including content interaction information, such as content downloads, streams, and playback details;

geolocation data, such as the location of your device or computer determined from your IP address or mobile device’s GPS depending on your device settings;

audio, visual, electronic or other similar information, including when you communicate with us by phone or otherwise;

professional or employment-related information, for example data you may provide about your business;

inference data, such as information about your preferences; and

sensitive personal information, such as government-issued identification documents to comply with global AML and KYC obligations.

Categories of personal information “sold” and “shared.” We use cookies and similar technologies to understand how well our online advertising works, and deliver more targeted online advertising and marketing campaigns. Over the past twelve months, we may have disclosed your internet or other similar network activity, identifiers and location information, and inferences about your interests to third parties, including, advertising networks, data analytics providers, social networks and advertising partners. The CCPA may consider our disclosures of this information to third parties as “sales” or “sharing” of personal information. Forma does not have actual knowledge that it “sells” or “shares” the personal information of individuals under 16 years of age.

Sensitive personal information. The categories of data that Forma collects and discloses for a business purpose include "sensitive personal information" as defined under the CCPA. Forma does not use or disclose sensitive personal information for any purpose not expressly permitted by the CCPA.

Your Rights. Under CCPA, you may have rights to ask us to:

provide descriptions of the personal information we hold about you;

provide access to certain personal information we hold about you, in some cases in a portable format, if technically feasible;

update or correct your personal information;

delete certain personal information we hold about you; an

opt out of our “sale” and “sharing” of your personal information, as those terms are defined in the CCPA. To exercise these rights, please complete this form.

No discrimination. We will not discriminate against any consumer for exercising their rights under the CCPA.