Pogodba o obdelavi podatkov
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Manu Shekhar, operating SignSpry ("SignSpry", "Processor"), and the organisation that uses SignSpry ("Customer", "Controller"). It applies to personal data that SignSpry processes on the Customer's behalf in providing the Service, and takes effect when the Customer accepts it on the Privacy & data page or otherwise agrees to the Terms.
1. Roles and scope
For personal data contained in documents, envelopes, templates, field values, attachments, recipient details and audit trails that the Customer and its users place in the Service ("Customer Personal Data"), the Customer is the controller (or, under India's Digital Personal Data Protection Act 2023, the Data Fiduciary) and SignSpry is the processor (Data Processor; under US state laws, the "service provider" or "processor"). For account, billing, website and security data about the Customer's own users, SignSpry acts as an independent controller under its Privacy Policy.
The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.
2. Instructions
SignSpry processes Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA and the Customer's use and configuration of the Service (for example sending an envelope, setting a retention policy or deleting an envelope) are the Customer's complete instructions. SignSpry will tell the Customer if, in its opinion, an instruction infringes applicable data protection law, and is not obliged to follow it.
3. Confidentiality
SignSpry ensures that everyone it authorises to process Customer Personal Data is bound by confidentiality obligations and accesses the data only as needed to provide, secure and support the Service.
4. Security
SignSpry maintains appropriate technical and organisational measures to protect Customer Personal Data, as summarised in Annex 2 and on its Trust & security page. SignSpry may update these measures provided the overall level of protection is not reduced.
5. Sub-processors
The Customer gives general authorisation for SignSpry to engage sub-processors. The current list is on the Trust & security page. SignSpry will give at least 30 days' notice of a new sub-processor by updating that list and emailing account administrators; the Customer may object on reasonable data protection grounds, and if the parties cannot resolve the objection the Customer may terminate the affected Service and receive a pro-rata refund of prepaid fees. SignSpry imposes data protection obligations on each sub-processor no less protective than this DPA and remains responsible for their performance.
6. Data subject requests
Taking into account the nature of the processing, SignSpry assists the Customer, by appropriate technical and organisational measures, to respond to requests from data subjects to exercise their rights. The Service lets the Customer find, export, correct and delete envelopes and their data. If SignSpry receives a request directly from a data subject about Customer Personal Data, it will forward the request to the Customer without undue delay and will not respond to it except to confirm it was forwarded, unless the Customer instructs otherwise or the law requires.
7. Personal data breaches
SignSpry will notify the Customer without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information the Customer reasonably needs to meet its own notification obligations, and will take reasonable steps to contain and remedy the breach.
8. Assistance
SignSpry provides reasonable assistance with the Customer's data protection impact assessments and prior consultations with supervisory authorities, to the extent they concern the Service and the information is not otherwise available to the Customer.
9. Deletion and return
During the subscription the Customer can export and delete its data at any time (Privacy & data). When the Customer's account is deleted, SignSpry deletes Customer Personal Data within the period described in the Privacy Policy (currently a 30-day grace period followed by purge, with encrypted backups expiring on their normal cycle), unless the law requires it to be kept. Financial records needed for tax law are kept as the Privacy Policy describes.
10. Audits and information
SignSpry makes available the information reasonably necessary to demonstrate compliance with this DPA, including written answers to security questionnaires. Where the law requires, and no more than once a year with at least 30 days' notice, the Customer may audit SignSpry's compliance through an independent auditor bound by confidentiality, at the Customer's cost, in a way that does not disrupt the Service or compromise other customers' data.
11. International transfers
Customer Personal Data is hosted in India. Where the processing involves a transfer of personal data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the parties agree that the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module Two: controller to processor, and Module Three where the Customer is itself a processor) are incorporated by reference, with the UK International Data Transfer Addendum and the Swiss adjustments where applicable; Annexes 1 to 3 of this DPA supply the information the Clauses require, the competent supervisory authority is that of the Customer's establishment, and the Clauses are governed by the law of Ireland. If those Clauses conflict with this DPA, the Clauses prevail.
12. US state privacy laws
Where US state privacy laws apply, SignSpry acts as the Customer's service provider or processor and will not sell or share Customer Personal Data, retain, use or disclose it for any purpose other than providing the Service, retain, use or disclose it outside the direct business relationship with the Customer, or combine it with personal data received from others except as those laws permit. SignSpry will comply with those laws, provide the same level of privacy protection they require, and notify the Customer if it can no longer meet its obligations.
13. India's DPDP Act
Where the Digital Personal Data Protection Act 2023 applies, SignSpry processes Customer Personal Data only as the Customer's Data Processor under a valid contract, implements reasonable security safeguards, informs the Customer of personal data breaches so that it can inform the Data Protection Board and affected Data Principals, and erases personal data when the Customer instructs or when the purpose has been served, subject to retention required by law.
14. Liability and precedence
Each party's liability under this DPA is subject to the limitations in the Terms of Service. If this DPA conflicts with the Terms, this DPA prevails as regards the processing of Customer Personal Data.
Annex 1 — Description of the processing
- Subject matter and duration: provision of the SignSpry electronic signature and agreement management service for the term of the Customer's subscription and until deletion as described in section 9.
- Nature and purpose: hosting, storing, transmitting, displaying, sealing and indexing documents; sending invitations, reminders and copies; collecting signatures, field values, attachments and payments; producing audit trails and certificates of completion; on-server summaries, clause review and search; support at the Customer's request.
- Categories of data subjects: the Customer's users; recipients, signers, witnesses and other parties to the Customer's envelopes; people named in documents.
- Types of personal data: names, email addresses, phone numbers, signatures and initials, IP addresses, device and browser details, timestamps and time zones, field values and attachments, payment references, and any personal data contained in documents the Customer uploads. The Customer should not upload special-category data unless the processing is lawful.
Annex 2 — Technical and organisational measures
- Encryption of data in transit (TLS) and of backups at rest (AES-256); secrets sealed at rest.
- Access control: role-based permissions enforced on the server, two-factor authentication, login rate-limiting and lockout, session management, security log.
- Integrity: PKCS#7 sealed PDFs with independent RFC 3161 timestamps; hash-chained audit trails; public verification.
- Availability: nightly encrypted off-site backups, restore drills, health monitoring, deployments that roll back automatically on failure.
- Data minimisation and retention controls, including customer-configured retention policies and deletion with a grace period.
- AI features computed on SignSpry's own servers; documents are never sent to outside models or used for training.
Annex 3 — Sub-processors
As listed on the Trust & security page at the date of acceptance: Amazon Web Services (hosting, storage, backups and email delivery, India), Razorpay (payment processing, India), and an RFC 3161 timestamp authority (receives document hashes only).