Data Processing Agreement

This Data Processing Agreement (“DPA”) applies when PocketESign processes Personal Data on behalf of a customer in connection with the PocketESign service. It supplements the Terms of Service.

1. Parties and roles

“Customer” means the organization or person using PocketESign to send documents. “PocketESign” means the service operated by PocketESign. For Personal Data contained in customer documents and recipient workflows, Customer generally acts as Controller or Business and PocketESign generally acts as Processor or Service Provider, as those concepts are defined by applicable data-protection law.

2. Subject matter and duration

PocketESign processes Personal Data to prepare, transmit, render, sign, track, complete and return electronic documents and related audit information, and to provide associated support and security. Processing lasts for the term of the customer's use of PocketESign and for any additional retention period required or permitted by applicable law and documented retention policies.

3. Categories of data subjects

• Customer employees, contractors and authorized users.
• Recipients, signers, approvers and other people identified in customer documents.
• Individuals whose personal information is contained in uploaded documents.

4. Types of Personal Data

• Names, email addresses and recipient metadata.
• Electronic signatures, initials and field values.
• IP addresses, timestamps, browser/device information and audit events.
• Document content and attachments.
• Support and account information where processed on Customer's behalf.

5. Customer instructions

PocketESign will process Personal Data on Customer's documented instructions as reflected in the Terms, this DPA, the customer's configuration and lawful use of the service, unless applicable law requires otherwise. Customer is responsible for the lawfulness and accuracy of its instructions and for providing required notices or obtaining required permissions.

6. Confidentiality and security

PocketESign will limit access to Personal Data to people and providers who need it to deliver or secure the service and who are subject to appropriate confidentiality obligations. PocketESign will maintain technical and organizational measures appropriate to the nature of the service and risk, including access controls, credential protection, secure transport, auditability and use of specialized signing infrastructure.

7. Subprocessors

Customer gives general authorization for PocketESign to use subprocessors necessary to provide the service. The current list is maintained at Subprocessors. PocketESign will require relevant subprocessors to protect Personal Data through contractual or equivalent obligations appropriate to the services they provide.

8. International transfers

Where Personal Data is transferred to a country that requires a transfer safeguard, the parties will rely on a lawful transfer mechanism appropriate to the applicable law. Firma.dev currently states that its primary document and signer storage is in the European Union and that certain downstream providers may process limited data outside the EU under appropriate safeguards.

9. Data-subject requests

Taking into account the nature of processing, PocketESign will provide reasonable assistance to Customer with requests by data subjects to exercise applicable privacy rights. If PocketESign receives a request relating principally to Personal Data processed on behalf of Customer, PocketESign may refer the request to Customer unless law requires a different response.

10. Security incidents

PocketESign will notify Customer without undue delay after becoming aware of a confirmed Personal Data breach affecting Customer Personal Data where notification is required by applicable law, and will provide information reasonably available to PocketESign to assist Customer with its obligations.

11. Return and deletion

At termination or on a valid deletion request, PocketESign will delete or return Customer Personal Data as required by applicable law and PocketESign's documented retention practices, subject to lawful retention obligations, audit requirements and technical backup cycles. Where provider-side deletion is appropriate, PocketESign will coordinate the request with the relevant signing-infrastructure provider.

12. Assistance and compliance information

PocketESign will provide information reasonably necessary to demonstrate compliance with applicable processor obligations and will cooperate with reasonable assessments proportionate to the risk and nature of the service, subject to confidentiality, security and cost controls.

13. Conflict

If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA controls to the extent of the conflict. Liability remains subject to the applicable liability provisions of the Terms except where law prohibits that limitation.