Data Processing Agreement

We process personal data contained in the documents, templates, contacts and recipient details you put into Signkoi, only to provide the service described in the Terms of Service. The DPA lasts as long as we process such data for you.

Purpose: hosting documents, sending them for signature, collecting signatures, producing signed PDFs, certificates and audit trails, and delivering related emails.

Data subjects: your users, your recipients and signers, and people named in your documents.

Categories of data: names, email addresses, optional phone numbers, signatures and initials, field values, IP addresses, user agents, timestamps, and any personal data contained in the documents you upload. You should not upload special categories of data unless you have a legal basis to do so.

We process personal data only on your documented instructions, which are given by these terms and by how you use the service, unless the law requires otherwise; in that case we will tell you before processing, unless the law forbids it.

We ensure that everyone authorised to process the data is bound by confidentiality.

We assist you, as far as reasonably possible, in responding to data subjects' requests, in carrying out data protection impact assessments and in consulting supervisory authorities.

We make available the information needed to demonstrate compliance with Article 28 and allow for audits, which may be satisfied by our current security documentation or third-party reports; on-site audits require reasonable notice and are at your expense.

Encryption in transit with HTTPS/TLS for all traffic; documents stored in private storage that is not publicly accessible.

Access control: every request is checked against the document's owner or a valid signing link; signing links are generated from 32 random bytes and stored only as hashes.

Passwords are hashed; optional recipient identity checks by access code or one-time code.

Tamper evidence: finished PDFs are digitally sealed and their SHA-256 fingerprints recorded; every view, signature and change is written to an audit trail.

Operational measures: least-privilege staff access, logging and monitoring, regular backups, dependency updates and an incident response process.

You give general authorisation for us to engage the sub-processors listed below. We impose data protection obligations on them that are at least as protective as this DPA, and we remain responsible for their performance.

We will announce new or replacement sub-processors at least 30 days in advance. You may object on reasonable data protection grounds; if we cannot resolve the objection, you may terminate the affected service.

Where personal data is transferred outside the EEA, the UK or Switzerland to a country without an adequacy decision, the transfer is covered by the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant), together with supplementary measures where needed.

We will notify you without undue delay, and in any case within 72 hours of becoming aware of a personal data breach affecting your data, with the information you need to meet your own notification obligations.

You can export or delete your documents at any time. When the agreement ends, we delete the personal data we process for you from our live systems within 30 days, and from backups within our normal backup cycle, unless the law requires us to keep it.

If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA prevails. If you need a countersigned copy, contact [Contact email].