Data Processing Agreement (DPA)

1. Parties

The controller is the customer using a Business account (the "Customer"). The processor is the operator of signhere (the "Provider"):

2. Subject matter and duration

The Provider makes the signhere platform available to the Customer to upload PDF documents, send them to signers by link, email or SMS, have them signed electronically and returned. Processing takes place solely to provide this service.

The agreement runs for the duration of the Business subscription. When the subscription ends, all documents are deleted according to the agreed retention periods (see section 9).

3. Nature and purpose of processing

Storing, displaying, modifying (inserting the signature, ID pages, signature certificate), transmitting to the recipients named by the Customer, logging the signing process and deleting the documents.

The sole purpose is obtaining and evidencing electronic signatures (simple electronic signature under eIDAS) on behalf of the Customer.

4. Types of data

Document contents (PDF), name and email address, optionally the mobile number of signers, signature image, timestamps, hashed IP address and browser identifier in the signature certificate, optionally ID photos where the Customer requests them, customer master data in the Customer's address book (name, contact details, notes) and account data of the Customer's users.

Special categories of personal data (Art. 9 GDPR) are not subject to this agreement; the Customer ensures that documents containing such data are only sent where a legal basis exists.

5. Categories of data subjects

Customers, tenants, contractual partners, prospects, employees and applicants of the Customer, and the Customer's own users.

6. Processing on instructions

The Provider processes personal data only on documented instructions from the Customer. Using the platform (uploading, sending, deleting, account settings) counts as an instruction. Instructions beyond the platform's functions are given in text form.

If the Provider considers an instruction unlawful, it informs the Customer without delay and may suspend execution until clarified.

7. Confidentiality

All persons at the Provider with access to Customer data are bound to confidentiality. The Provider does not open document contents unless the Customer expressly asks for it in a support case.

8. Technical and organisational measures

Transport encryption (TLS) for all connections; encrypted storage at the hosting providers; documents are reachable only through unguessable, signed links, optionally password-protected in addition; download links expire.

Access to the operating environment only for the operator with password and second factor; logging of all signing steps with hashed IP address; separate storage per account and team; daily automatic deletion of expired documents; rate limits and bot protection against abuse.

The Provider reviews these measures regularly and adapts them to the state of the art. A current description is available on request.

9. Deletion and return

Signed documents are kept for the period defined by the plan (Business: one year by default, up to ten years on request) and deleted automatically afterwards. Unsigned documents are deleted 30 days after the link expires; ID photos after seven days at the latest.

The Customer can delete or download documents at any time. After the agreement ends, all Customer data is deleted within 30 days unless a statutory retention obligation applies.

10. Assistance to the Customer

The Provider assists the Customer with data subject requests (access, rectification, erasure), data protection impact assessments and the notification of personal data breaches. It notifies the Customer of personal data breaches without undue delay, at the latest within 48 hours of becoming aware.

11. Audit rights

The Customer may verify compliance with this agreement. The Provider supplies the necessary information; on-site audits take place after notice with reasonable lead time during normal business hours.

12. Liability

Liability is governed by Art. 82 GDPR and the signhere terms of service. The Provider is liable only for damage caused by processing where it has not complied with its obligations under the GDPR or this agreement.

13. Final provisions

Amendments to this agreement require text form. Should a provision be invalid, the remainder of the agreement stays in force. The law at the Provider's registered seat applies.

14. Sub-processors

The Customer consents to the following sub-processors. The Provider announces changes by email at least 30 days in advance; the Customer may object for good cause.

15. Execution

Business customers receive this agreement with the parties filled in as a PDF and sign it through signhere; the Provider countersigns the same day. Both sides receive the signed copy with the signature certificate.