Data Processing Addendum

1.Scope

This Data Processing Addendum (“DPA”) forms part of the Terms of Service (or other written agreement for eSignPro) between eSignPro (“we”) and the Customer (“you”). It applies whenever we process Customer Personal Data on your behalf in providing the Service.

If this DPA conflicts with the Terms, this DPA governs on data protection.

If you need a countersigned copy for your records, email legal@esignpro.net. The terms are the same.

2.Definitions

Customer Personal Data

Personal data in Customer Content (as defined in the Terms) that we process on your behalf, including data about your Users’ activity in documents and about your Signers.

Data Protection Laws

The US laws that apply to that processing, including the California Consumer Privacy Act (as amended by the California Privacy Rights Act) and similar US state privacy laws.

Security Incident

A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.

Subprocessor

A third party we engage to process Customer Personal Data.

3.Roles of the parties

You are the business, or controller, for Customer Personal Data, in the terms of the applicable US state privacy law (or a service provider acting for your own client, in which case you confirm your client has authorized your instructions, including the use of our Subprocessors). We are your “service provider” under the CCPA and your “processor” under the other US state privacy laws.

We decide for ourselves how to handle the personal data we need to run your account — your Users’ account details, billing and support — which our Privacy Policy covers, and this DPA does not.

4.Processing on your instructions

We process Customer Personal Data only on your documented instructions. The Terms, this DPA, and your use and configuration of the Service (including through the API) are your complete instructions at the date of this DPA; further instructions must be consistent with them. The details are in Annex 1.

We will tell you if we believe an instruction infringes Data Protection Laws, and if the law requires us to process Customer Personal Data otherwise, we will tell you first unless the law forbids it.

You are responsible for the lawfulness of your instructions, for having a lawful basis to send documents to your Signers, and for giving them any notices the law requires.

5.Our personnel

We give access to Customer Personal Data only to personnel who need it to provide, secure or support the Service, and who are bound by confidentiality obligations.

6.Security

We implement and maintain the technical and organizational measures in Annex 2, which are designed to provide the reasonable security US state privacy laws require. We may change them as technology and threats change, but we will not reduce the overall level of protection.

7.Subprocessors

You give us general authorization to engage Subprocessors. The current list is in Annex 3 and in the trust center.

• We will impose data protection terms on each Subprocessor that protect Customer Personal Data at least as well as this DPA, and we remain responsible to you for its performance.
• We will give you at least 30 days’ notice before a new Subprocessor starts processing Customer Personal Data. Email legal@esignpro.net to be put on the notice list.
• You may object on reasonable data protection grounds within that notice period. We will then work with you in good faith on an alternative. If we cannot find one, you may terminate the affected part of the Service and we will refund the fees you prepaid for it for the rest of the paid period.

Services you connect with your own credentials — your SMTP server or SMS account, your Stripe account for payments at signing, Google Drive, Dropbox, or your identity provider — are your own providers, not our Subprocessors.

8.Requests from individuals

The Service lets you find, correct, export and delete Customer Personal Data yourself. Where you cannot, we will help you respond to requests from individuals exercising their rights, taking into account the nature of the processing.

If an individual contacts us about Customer Personal Data, we will not answer the request ourselves, except to direct them to you, unless you ask us to or the law requires it. Where erasure is required, we can erase an individual’s personal data across your account by email address, retaining only the audit records of sent and completed documents that serve as evidence of their signing.

9.Security incidents

We will notify you without undue delay, and in any case within 48 hours, after we confirm a Security Incident affecting your Customer Personal Data. We will tell you, as far as we know it and as it becomes known: what happened, the categories and approximate number of individuals and records concerned, the likely consequences, and what we have done and will do about it.

We will take reasonable steps to contain and remedy the incident, and give you the information you need to meet your own obligations to notify regulators and individuals under US state data breach notification laws. Notifying you is not an admission of fault.

10.Data protection assessments

Taking into account the nature of the processing and the information available to us, we will give you reasonable help with the data protection assessments US state privacy laws require of you that relate to your use of the Service.

11.Return and deletion

While your account is open you can download your documents, audit certificates and other Customer Content at any time. When the Service ends, you can ask us for access to export it for 30 days. We then delete Customer Personal Data from our live systems within 60 days, and from backups as they expire, unless the law requires us to keep it. Anything we must keep stays protected by this DPA for as long as we hold it.

12.Information and audits

We will make available the information reasonably necessary to demonstrate our compliance with this DPA. We do not yet hold a third-party certification such as SOC 2 or ISO 27001 — the trust center shows where that stands — so, on request, we will send a written summary of our security controls and answer a reasonable security questionnaire once a year.

If that is not enough to meet a requirement of Data Protection Laws, or a regulator asks, you may audit our compliance through an independent auditor bound by confidentiality, on 30 days’ written notice, during business hours, no more than once in any twelve months (unless after a Security Incident), and at your cost.

13.US state privacy laws

Where the CCPA or a similar US state law applies, we will not:

• sell or share Customer Personal Data, as those laws define those terms;
• retain, use or disclose it for any purpose, including a commercial purpose, other than providing the Service to you, or outside our direct business relationship with you;
• combine it with personal information we receive from anyone else, except as those laws allow.

We will comply with those laws, give Customer Personal Data the same level of protection they require of you, and tell you if we can no longer meet our obligations under them. You may take reasonable steps to stop and remedy any unauthorized use.

14.Liability and term

Each party’s liability under this DPA is subject to the limits in the Terms, except where Data Protection Laws do not allow it. This DPA lasts for as long as we process Customer Personal Data.

Annex 1Details of processing

Subject matter and duration

Providing the Service under the Terms, for the term of the Terms and the deletion period that follows.

Nature and purpose

Hosting, storing and transmitting documents; sending signing requests, reminders and one-time codes; collecting signatures, form entries and payments; producing audit trails, completion certificates and verification records; and support.

Data subjects

Your Users; your Signers (signers, approvers and copy recipients); your contacts; and anyone whose details appear in documents you upload.

Categories of personal data

Names, email addresses and phone numbers; signatures and initials, drawn or typed; form field entries; consent records; IP addresses, user agents and timestamps of document events; decline reasons; payment amounts and status for payments at signing; and whatever personal data you include in documents.

Sensitive personal information

None required by the Service. If you include sensitive personal information in documents, you are responsible for giving the notices and obtaining the consents the law requires for it; Annex 2 applies to it.

Frequency

Continuous, for as long as you use the Service.

Retention

As you determine while your account is open, and as section 11 describes when it closes.

Annex 2Security measures

Encryption

• TLS for all traffic to the application, the signing pages and the API; session cookies are marked Secure.
• Stored credentials and secrets — authenticator secrets, customers’ SMTP and SMS credentials, OAuth tokens for connected services — encrypted with AES-256-GCM under keys derived with HKDF-SHA256, with versioned ciphertexts so keys can be rotated. The service will not start in production without an encryption key.
• Where files are held in S3-compatible object storage, they are written with server-side encryption (AES-256 by default).

Access control and authentication

• Every read and write of documents, recipients, templates and users is scoped to the requesting organization in the service layer.
• Role-based permissions within each organization; SAML single sign-on and SCIM provisioning; multi-factor authentication by authenticator app or text message; WebAuthn passkeys.
• Passwords hashed with bcrypt. API keys, signing links, refresh tokens, trusted-browser tokens and one-time codes stored only as SHA-256 hashes; an API key’s secret is shown once, at creation.
• Sign-in from an unrecognized browser requires a code sent by email. Rate limits on sign-in, token refresh, password reset and one-time codes, with lockout after repeated failed codes.

Integrity and evidence

• An append-only audit log for every document and account event, with IP address, user agent and time. Each entry’s checksum covers the previous one, so any insertion, deletion, reordering or edit is detectable.
• A SHA-256 hash of every completed document, checkable at a public verification link; optional PAdES digital sealing.
• Signers must accept an electronic records and signatures disclosure before the document is shown to them.

Operations and resilience

• Uploads are limited to 25 MB and checked against an allow-list of file types by their content, not their name.
• System logs are kept for 90 days and then deleted automatically.
• Personal data about an individual can be erased across the service by email address, with a report of what was erased and what was retained as evidence, and why.

Report a vulnerability to security@esignpro.net. The security page describes these measures for a general audience.

Annex 3Subprocessors

Changes to this list are made as section 7 describes, and are reflected in the trust center.