Data Processing Addendum

1. Roles and scope

The Controller determines the purposes and means of processing personal data in Customer Data. The Processor processes it only on the Controller's documented instructions, which consist of the Terms, this DPA, and the Controller's use of the Service's features and API.

The Processor will tell the Controller if, in its opinion, an instruction infringes applicable data protection law, and may suspend that instruction until it is resolved.

"Applicable law" includes the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, and U.S. state privacy laws including the CCPA/CPRA, each to the extent it applies.

2. Processor obligations

• Process personal data only on documented instructions, including for transfers.
• Ensure personnel authorised to process personal data are bound by confidentiality and trained appropriately.
• Implement the technical and organisational measures in Annex II.
• Engage subprocessors only under section 4.
• Assist the Controller, taking account of the nature of processing, with data subject requests, security, breach notification, data protection impact assessments, and prior consultation.
• At the Controller's choice, delete or return personal data at the end of the Service, subject to section 7.
• Make available the information needed to demonstrate compliance and allow audits under section 8.

3. Data subject requests and breaches

The Service gives the Controller self-serve tools to access, export, correct, and erase personal data, including a Workspace-owner erasure action that anonymises a data subject across signers, customers, and pending invitations and records the action in the audit trail. Where the Controller cannot resolve a request with those tools, the Processor will assist at the Controller's reasonable cost. If the Processor receives a request directly from a data subject, it will not respond substantively and will refer it to the Controller without undue delay.

The Processor will notify the Controller of a personal data breach affecting Customer Data without undue delay and in any event within 72 hours of becoming aware, including the nature of the breach, the categories and approximate number of records affected, the likely consequences, and the measures taken. Breach contact: [email protected].

4. Subprocessors

The Controller gives general authorisation for the Processor to engage the subprocessors listed in Annex III. The Processor imposes data protection obligations on each of them no less protective than this DPA and remains fully liable for their performance.

The Processor will give at least 30 days' notice by email to Workspace owners before adding or replacing a subprocessor. The Controller may object on reasonable data protection grounds within that period; if the parties cannot agree a resolution, the Controller may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees.

Where the Controller configures its own storage bucket or connects a third-party account, that provider is the Controller's own processor, not a subprocessor of AnySign.

5. International transfers

For transfers of personal data from the EEA to a country without an adequacy decision, the parties incorporate the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914): Module Two where the Controller is a controller, and Module Three where the Controller is itself a processor. Annexes I, II, and III of this DPA populate the corresponding SCC annexes. In clause 7 the docking clause applies; in clause 9 option 2 applies with the 30-day notice in section 4; in clause 11 the optional redress body is not used; in clause 17 the governing law and in clause 18 the forum are those stated in Annex I.

For UK transfers, the International Data Transfer Addendum (version B1.0) applies to those clauses, with the tables completed by this DPA and neither party permitted to end the Addendum under section 19 other than as provided there. For Swiss transfers, references to the GDPR are read as the FADP and the Federal Data Protection and Information Commissioner is the competent authority.

6. California

Where the CCPA/CPRA applies, the Processor is a service provider. It will not sell or share personal information, will not retain, use, or disclose it for any purpose other than performing the Service or as permitted by the CCPA, will not combine it with personal information from other sources except as permitted, and certifies that it understands and will comply with these restrictions.

7. Deletion and return

On termination the Controller may export Customer Data through the Service or the API for 30 days. After that the Processor deletes it within 90 days, except that: records required by law are retained for the statutory period, and tamper-evident audit records are anonymised rather than deleted, because deleting an entry would destroy the integrity of the evidence chain the Controller and third parties rely on. Backups age out on their normal cycle and are not selectively edited.

8. Audits

The Processor will make available its current security documentation and third-party assurance reports where held, and will respond to reasonable security questionnaires. Where that is not sufficient to demonstrate compliance, the Controller may audit no more than once in any 12-month period, on 30 days' written notice, during business hours, subject to confidentiality, at the Controller's cost, and without access to other customers' data or to systems where access would compromise security. A regulator may audit where applicable law requires.

9. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Terms, except where applicable law does not permit that. If this DPA conflicts with the Terms, this DPA prevails on data protection matters; if the Standard Contractual Clauses conflict with this DPA, the Clauses prevail.

Annex I — Details of processing

Annex II — Technical and organisational measures

• Encryption — TLS in transit; server-side encryption at rest for stored documents; AES-256-GCM encryption of Controller-supplied storage credentials; Argon2id password hashing; session tokens stored only as hashes.
• Access control — per-Workspace data isolation enforced at the data layer; role-based access within a Workspace; scoped API keys that can be revoked individually; least-privilege administrative access with per-account brute-force lockout and logging of every administrative action.
• Integrity — database-enforced append-only audit trail; tamper-evident PDF sealing with optional trust-anchored certificates and RFC 3161 timestamps; idempotency keys on write endpoints.
• Resilience and availability — stateless application tier, managed Postgres with backups, health checks, rate limiting, and a maximum in-flight request cap.
• Monitoring — application performance monitoring, structured logging with trace correlation, error alerting.
• Secure development — code review, automated test gate covering unit, integration, and browser end-to-end tests, and dependency vulnerability scanning before release.
• Organisational — confidentiality obligations for personnel, background-appropriate onboarding and offboarding, written security policies, and documented incident response.

The Processor may update these measures provided the level of protection is not reduced.

Annex III — Subprocessors

Where a Workspace configures its own storage bucket, documents for that Workspace are stored there instead of in the platform bucket.