1. Definitions

"GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data.
"Personal Data" means any information relating to an identified or identifiable natural person.
"Sub-processor" means any third party appointed by or on behalf of Processor to process Personal Data.

2. Processing of Personal Data

Processor shall process Personal Data only on documented instructions from Controller (the User), unless required to do so by applicable law. The subject matter of processing is the provision of the SignSurio electronic signature service. The duration of processing shall be for the term of the User's subscription.

3. Security Measures

Processor implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data at rest and in transit
• Ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems
• Regular testing, assessing, and evaluating the effectiveness of technical measures
• Role-based access controls and authentication mechanisms

4. Sub-processors

Controller grants general authorization for Processor to engage Sub-processors. Processor currently uses the following Sub-processors:

• Hosting Provider: Cloud infrastructure services
• Paddle: Payment processing and Merchant of Record
• Email Service Provider: Transactional emails

Processor remains fully liable for the performance of Sub-processors' obligations.

5. Data Subject Rights

Processor shall assist Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of Controller's obligation to respond to requests for exercising the data subject's rights under the GDPR (e.g., right of access, rectification, erasure).

6. Data Breaches

Processor shall notify Controller without undue delay after becoming aware of a Personal Data breach. Such notification shall include the nature of the breach, the categories of data involved, and the measures taken to mitigate the breach.

7. Deletion or Return of Data

Upon termination of services, Processor shall, at the choice of Controller, delete or return all Personal Data to Controller and delete existing copies unless applicable law requires storage of the Personal Data.

8. Audits

Processor shall make available to Controller all information necessary to demonstrate compliance with the obligations laid down in this DPA and allow for and contribute to audits, including inspections, conducted by Controller or an auditor mandated by Controller.