Data Processing Agreement

For the personal data contained in the documents you upload and for the data you enter about your recipients, signers, clients and members ("Customer Data"), you are the controller and we are the processor. The details of the processing are set out in Annex I (section 11).

We are a separate controller of account, billing, security and audit data, as described in our Privacy Policy. This DPA does not apply to that processing.

We process Customer Data only on your documented instructions, including with regard to transfers to a third country, unless we are required to do so by Union or Czech law; in that case we inform you of the legal requirement before processing, unless the law prohibits it. Your instructions are these Terms, this DPA, and the actions you and your members take in the service (for example uploading a document, sending it for signature, enabling the automatic organization signature, configuring a webhook, or scheduling deletion).

We inform you without delay if, in our opinion, an instruction infringes the GDPR or other data-protection law, and we may suspend the execution of that instruction until you confirm or amend it.

Every person authorised to process Customer Data on our behalf is bound by a contractual or statutory obligation of confidentiality and processes Customer Data only to the extent needed to provide and support the service.

We implement the technical and organizational measures set out in Annex II (section 12) and keep them under review, taking into account the state of the art, the costs of implementation and the risks of the processing. We may update the measures provided the level of protection does not decrease.

You give general authorisation to the sub-processors listed on our Sub-processors page. We will give you at least 30 days' notice before adding or replacing a sub-processor, by e-mail to the account owner and by updating that page. You may object on reasonable data-protection grounds within that period. If we cannot offer a reasonable alternative, you may terminate the affected service; we will refund the fees paid for the remainder of the paid period.

We impose on each sub-processor, by written contract, data-protection obligations that provide the same level of protection as this DPA, and we remain fully liable to you for the performance of their obligations.

We process Customer Data in the European Union. Where a sub-processor is affiliated with an entity outside the European Economic Area and access from a third country cannot be excluded, the transfer is made under the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), module three (processor to processor) or module two as applicable, which are incorporated into our contracts with those sub-processors, together with supplementary measures. A transfer impact assessment is available on request.

Taking into account the nature of the processing, we assist you with appropriate technical and organizational measures in fulfilling your obligation to respond to data-subject requests. The service lets you access, export, rectify and delete Customer Data yourself; where a request cannot be handled in the service, we assist on request. If a data subject contacts us directly about Customer Data, we refer them to you and inform you.

We assist you in complying with Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the information available to us.

We notify you without undue delay, and no later than 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notification describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point, and is supplemented as further information becomes available.

You can export Customer Data as a ZIP archive from the settings at any time during the term and during the 30-day grace period after you schedule deletion. At the end of the contract, deletion follows the schedule in our Privacy Policy, which you hereby instruct: a 30-day grace period, then erasure of all document files, unsigned documents, templates, client records and branding, then retention of the signing evidence of signed documents (signer name, e-mail address, IP address, browser identifier, time and document hash, and recipient name and e-mail address) together with the tamper-evident audit log for 7 years, after which it is erased. This retention serves your and our legitimate interest in being able to evidence a concluded signature. We provide written confirmation of deletion on request.

We make available to you the information necessary to demonstrate compliance with Article 28 GDPR and allow audits, including inspections, by you or an auditor you mandate and we do not reasonably object to, on 30 days' written notice, during business hours, no more than once per year unless a breach or a supervisory authority requires otherwise. We may satisfy an audit request with a current written description of our measures or a third-party report where one is available. You bear the costs of an audit unless it reveals a material breach of this DPA.

Each party is liable to the other in accordance with Article 82 GDPR and the Terms of Service, and the limitation of liability in the Terms applies to this DPA, except for liability that cannot be limited under the GDPR or Czech law.

This DPA lasts as long as we process Customer Data on your behalf. It is governed by the law of the Czech Republic. It is published in Czech and English; the Czech version prevails.

• Subject matter: provision of secure document sharing, electronic signature collection, form filling, client workspaces, templates, API access and audit logging.
• Duration: the term of the subscription, plus the deletion schedule and retention periods in section 9.
• Nature and purpose: storage, transmission, rendering, one-time-code delivery, e-mail notification, application of signatures and field values, generation of signed PDFs and certificates, delivery of webhook events to endpoints you configure, and tamper-evident audit logging, solely to provide the service to you.
• Types of personal data: names, e-mail addresses, IP addresses, browser identifiers, signature images and typed signatures, values entered into document fields, language preference, and any personal data you include in uploaded documents or client records (which may include special categories if you choose to upload them; you are responsible for having a lawful basis).
• Categories of data subjects: your members and personnel, your clients and their personnel, and the recipients and signers you invite.
• Sub-processors: as listed on the Sub-processors page.

• Confidentiality (Article 32(1)(a)-(b)): TLS encryption in transit; encryption at rest by our hosting provider; strict tenant isolation — every database query is scoped to the organization by the server-validated session; role-based access (owner, admin, member) enforced server-side; share tokens, one-time codes, session tokens and API keys stored only as hashes; external file access exclusively through an access-controlled stream, never direct storage links; a strict Content Security Policy; least-privilege database roles for the application and for maintenance.
• Integrity (Article 32(1)(b)): append-only audit log enforced by the database and hash-chained per organization; the SHA-256 hash of each document version is pinned when it is shared and verified before signing; signed documents are stored as immutable separate objects and cannot regress in status; signing is transactional and protected against concurrent submissions.
• Availability and resilience (Article 32(1)(b)-(c)): managed PostgreSQL and object storage in EU regions with provider-level redundancy; deletion runs verify erasure from storage before removing records; rate limiting on authentication, one-time codes and the API.
• Regular testing (Article 32(1)(d)): automated test suites for tenant isolation, signing, retention and billing logic run before every deployment; a security review of every change; dependency updates.
• Organizational: access to production limited to the persons operating the service, with individual credentials and secrets kept server-side only; sub-processors bound by written data-processing terms; data-protection requests handled within the statutory deadlines.