Data Processing Agreement

1. Conclusion and scope

This DPA forms part of the Terms and is concluded electronically when the customer accepts the Terms (Art. 28(9) GDPR).

It covers the personal data that the customer and its users put into SignBob or collect through it: documents sent for signature, signers and their signing data, case files, the client book and team members. For this data the customer is the controller and SignBob is the processor.

It does not cover data that SignBob processes as a controller for its own purposes, such as the customer's own account, billing contact and sign-in data, security logs and first-party product analytics; the Privacy Policy describes that processing. Paddle.com Market Ltd acts as merchant of record and processes payment data as an independent controller, not as a subprocessor.

2. Subject matter and duration

The subject matter is the provision of the SignBob electronic-signature service as described in the Terms: preparing, sending, signing, sealing, storing and verifying documents, together with the case-file, client-book, team and notification features the customer chooses to use.

The processing lasts for as long as the customer has an account, and afterwards until the data has been deleted under section 12.

3. Nature and purpose of the processing

Nature: collection, recording, storage, organisation, retrieval, consultation, transmission (by email, SMS or WhatsApp, as the customer chooses), sealing with a cryptographic digest and an audit trail, restriction and erasure.

Purpose: to let the customer obtain electronic signatures and keep evidence of them, to deliver signing links and signed copies to the people the customer names, to manage the customer's case files and contacts, and to let the customer's team work together on them. SignBob does not use this data for its own purposes, does not sell it and does not use it to train models.

4. Categories of data subjects and personal data

Data subjects: (a) signers and other recipients of documents; (b) the customer's contacts in the client book and the parties recorded in its case files (for example buyers, sellers, tenants, landlords and their representatives); (c) the customer's team members (users invited to the customer's account); and (d) any other person whose data appears in the documents the customer uploads.

Personal data: names, email addresses, phone numbers (optional), identity-card or passport numbers where the customer adds such a field, the values typed into document fields, signature images, IP address, browser user-agent and timestamps of each signing step, the contents of uploaded documents, notes and records in case files and the client book, and, where the customer requires it, a photograph of the signer's identity document and a selfie.

The identity photographs are kept as evidence for the sender only; SignBob performs no facial recognition, biometric matching or automated identity verification on them. The customer decides whether to require them and must not upload special categories of data (Art. 9 GDPR) or criminal-offence data (Art. 10 GDPR) unless it has a legal basis for doing so.

5. Documented instructions

SignBob processes the personal data only on the customer's documented instructions. The Terms and this DPA are the customer's complete instructions at the time of conclusion; the customer gives further instructions through its use of the app and its settings (for example who receives a document, which channel is used, whether ID photos are required and how long each document is retained). Other instructions must be given in writing or by email to privacy@signbob.com and are only binding if SignBob confirms them.

SignBob may process the data otherwise only where Union or Member State law to which it is subject requires it; in that case SignBob informs the customer of that requirement before processing, unless that law prohibits such information on important grounds of public interest.

SignBob informs the customer immediately if, in its opinion, an instruction infringes the GDPR or other data protection law. SignBob may suspend carrying out that instruction until the customer confirms or changes it.

6. Confidentiality

SignBob ensures that every person it authorises to process the personal data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality, and that access is limited to those who need it to run, support or secure the service. The obligation continues after their engagement ends.

7. Security of processing

SignBob implements the technical and organisational measures described in Annex 2, which are designed to ensure a level of security appropriate to the risk under Article 32 GDPR. SignBob may adapt the measures as technology develops, provided the overall level of protection is not reduced.

8. Subprocessors

The customer gives SignBob general authorisation to engage subprocessors. The subprocessors engaged at the date of this DPA are listed in Annex 1; some are used only when the customer turns on the related feature.

SignBob informs the customer by email at least 30 days before adding or replacing a subprocessor. The customer may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, the customer may terminate the affected service or its account with effect before the change takes effect; this is the customer's sole remedy for the objection.

SignBob imposes on each subprocessor, by contract, data-protection obligations that offer at least the same level of protection as this DPA, in particular sufficient guarantees for appropriate technical and organisational measures. SignBob remains liable to the customer for the performance of its subprocessors' obligations.

9. Assistance with data subject requests

Taking into account the nature of the processing, SignBob assists the customer with appropriate technical and organisational measures in fulfilling its obligation to respond to requests from data subjects exercising their rights under Chapter III GDPR.

The app provides the tools for this: the customer can view, download and export documents, signed copies, audit certificates and contacts, correct a signer's details on an unsigned document, and delete documents, case files, contacts and the whole account.

If a data subject contacts SignBob directly about data processed for a customer, SignBob does not answer the request itself (except to point the person to the customer) and forwards it to the customer within 5 working days.

10. Assistance with security, breach notification, impact assessments and consultation

Taking into account the nature of the processing and the information available to it, SignBob assists the customer in ensuring compliance with its obligations under Articles 32 to 36 GDPR: security of processing, notification of personal data breaches to the supervisory authority and to data subjects, data protection impact assessments and prior consultation of the supervisory authority. SignBob does this primarily by providing this DPA, its annexes and further information on request. SignBob may charge reasonable costs for assistance that goes beyond this information and is not caused by its own breach.

11. Personal data breaches

SignBob notifies the customer without undue delay after becoming aware of a personal data breach affecting the customer's data, with a target of 48 hours. The notice goes to the account owner's email address and describes, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information not yet available is provided as soon as it is.

SignBob takes reasonable steps to contain the breach and mitigate its effects. A notification is not an acknowledgement of fault or liability.

12. Deletion and return at the end of the service

During the service the customer can download its documents, signed copies and audit certificates and export its contacts at any time, which serves as the return of the data. Each document is also deleted automatically at the end of the retention period the sender chose for it (at most 10 years).

When the customer deletes its account, SignBob deletes the documents, files, case files, contacts and saved signatures held for it, unless Union or Member State law requires storage. Copies in backups and recovery storage are not restored for use and expire on their regular cycle, at the latest within 14 weeks.

To keep signed copies verifiable after deletion, SignBob retains only a verification record consisting of the document's cryptographic digest (hash) and the relevant dates. It contains no document content, no names and no contact details.

13. Information and audits

SignBob makes available to the customer, on request, the information necessary to demonstrate compliance with Article 28 GDPR, including this DPA, its annexes and answers to reasonable security questionnaires.

If that information is not sufficient, the customer, or an independent auditor bound to confidentiality and not a competitor of SignBob, may carry out one audit per calendar year, with at least 30 days' written notice, during normal business hours and without unreasonably disrupting SignBob's operations. The customer bears its own costs and SignBob's reasonable costs of the audit. Additional audits are possible where a supervisory authority requires them or after a personal data breach affecting the customer.

For the hosting infrastructure the customer may rely on the certifications and audit reports of Google Cloud (for example ISO/IEC 27001, 27017, 27018 and SOC 2), which SignBob will point to on request; on-site inspection of Google's facilities is not possible.

14. International transfers

The customer's documents and files are hosted in the European Union: the database in Google Cloud's eur3 multi-region and files and application servers in europe-west1 (Belgium).

SignBob is established in Israel, for which the European Commission has adopted an adequacy decision (2011, confirmed in 2024); access by SignBob from Israel, and the SMS provider InforU Ltd, rely on that decision.

Where a subprocessor in the United States or another third country processes personal data, the transfer is based on the EU-US Data Privacy Framework where the recipient is certified, or on the Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914), together with any supplementary measures required. Annex 1 states the safeguard for each subprocessor.

15. Liability, precedence and governing law

Liability under this DPA is governed by the liability provisions of the Terms, except where the GDPR requires otherwise (in particular Article 82 GDPR towards data subjects).

In the event of a conflict between this DPA and the Terms on the protection of personal data, this DPA prevails. In all other respects the Terms apply.

This DPA is governed by the same law, and subject to the same jurisdiction, as the Terms. If a provision is invalid, the remaining provisions remain in force.

Annex 2 – Technical and organisational measures (Art. 32 GDPR)

• Encryption in transit: all connections to SignBob use TLS.
• Encryption at rest: all stored data and files are encrypted with Google-managed keys.
• Data location: database, files and application servers in Google Cloud regions in the European Union.
• Signing links: each link carries an unguessable, single-purpose token for one signer and one document; the token is replaced when the signer's email address is corrected.
• Integrity and evidence: every file receives a SHA-256 digest; each signing step is recorded in a hash-chained audit trail that is sealed (PAdES seal) into the signed PDF or into the signed certificate that accompanies it, so any later change is detectable.
• Access control in the app: role-based access within a team (owner, manager, team lead, agent); users see only what their role permits.
• Administrative access: SignBob's admin console is limited to an allowlist of named staff accounts.
• Authentication: sign-in through Firebase Authentication, so SignBob never sees users' passwords; session cookies are httpOnly and expire after 30 days.
• Abuse protection: rate limiting of requests to the service.
• Availability and recovery: daily database backups kept for 7 days and weekly backups kept for 14 weeks; deleted files remain recoverable for 7 days (soft delete).
• Retention and deletion: a retention period chosen by the sender for each document (at most 10 years) with automatic deletion at its end; account deletion purges documents, files, case files, contacts and saved signatures.
• Data minimisation after deletion: only a verification record (hash and dates) survives, so a signed copy can still be verified without keeping its content.
• Identity photographs: visible only to the sending account; no facial recognition or biometric processing.
• No third-party tracking: product analytics are first-party and server-side, kept for 24 months; only strictly necessary cookies (session, language, sign-in state) are used.
• Personnel: confidentiality commitments for everyone with access; access granted on a need-to-know basis.
• Subprocessor management: written data-processing terms with every subprocessor; transfers outside the EU only with a safeguard under Chapter V GDPR.