SignFlow — Data Processing Addendum (DPA)

Last updated: 2026-10-23

DRAFT — not legal advice. This short DPA is a starting point for customers whose legal teams require one before connecting. Have counsel review and, for EU/UK data, attach the appropriate Standard Contractual Clauses.

This DPA forms part of the Terms of Service between SignFlow ("Processor") and the Customer ("Controller").

1. Subject matter

The Processor processes personal data on behalf of the Controller solely to provide the SignFlow service (sending e-signature envelopes via the Controller's DocuSign account).

2. Nature and purpose

Transmitting documents and recipient details to DocuSign to create and track signature envelopes, and storing send metadata and the Controller's encrypted DocuSign OAuth tokens.

3. Categories of data

• Data subjects: the Controller's signers/recipients and authorized users.
• Personal data: names, email addresses, document contents submitted for signing, and envelope status.
• Special categories: none intended; the Controller must not submit special category data unless separately agreed.

4. Duration

For the term of the subscription, plus any period required to return or delete data as set out below.

5. Processor obligations

The Processor will:

1. Process personal data only on the Controller's documented instructions (including via use of the service), unless required by law.
2. Ensure persons authorized to process data are bound by confidentiality.
3. Implement appropriate technical and organizational measures, including encryption of OAuth tokens at rest and access controls.
4. Not engage another sub-processor without general authorization; current sub-processors are listed in §8. The Processor will inform the Controller of intended changes and give an opportunity to object.
5. Assist the Controller, taking into account the nature of processing, with data subject requests and with security, breach-notification, and DPIA obligations.
6. Notify the Controller without undue delay after becoming aware of a personal data breach.
7. At the Controller's choice, delete or return personal data at the end of the service, subject to legal retention requirements.
8. Make available information needed to demonstrate compliance and allow reasonable audits.

6. Controller obligations

The Controller warrants it has a lawful basis and any necessary consents to process and send the personal data through the service, including for bulk sends.

7. International transfers

Where processing involves transfer of data across borders, the parties will put in place a lawful transfer mechanism (e.g., Standard Contractual Clauses) as an annex to this DPA.

8. Sub-processors

• DocuSign, Inc. — e-signature envelope delivery.
• Stripe, Inc. — payment processing (billing data only).
• Supabase — database and authentication.
• [Hosting provider, e.g. Vercel] — application hosting.

9. Liability

Liability under this DPA is subject to the limitations in the Terms of Service.

10. Contact

Data protection contact: [dpo@yourdomain.com]