Data Processing Agreement (DPA)

1. Introduction and Scope

This DPA is entered into between SparkRelay Tech Services ("Processor," "Company," "we," or "us"), with registered address at 2000 Hogback Rd, Suite 6, Ann Arbor, MI 48105-9735, USA, and each customer that subscribes to the MultiSigner service and processes personal data of data subjects through the Service ("Controller," "Customer," or "you"). This DPA applies to the processing of personal data by the Processor on behalf of the Controller under the Terms and Conditions, and reflects the parties' obligations under the EU General Data Protection Regulation (Regulation (EU) 2016/679), the UK GDPR, and, where applicable, the Swiss Federal Act on Data Protection, together with other applicable data protection laws.

2. Definitions

• "Personal Data," "Data Subject," "Processing," "Controller," "Processor," "Personal Data Breach," and "Supervisory Authority" have the meanings given in the GDPR / UK GDPR.
• "Subprocessor" means any third-party processor engaged by the Processor to process personal data on behalf of the Controller under this DPA.
• "Standard Contractual Clauses" or "SCCs" means the applicable standard contractual clauses approved by the European Commission or the UK Information Commissioner's Office for international transfers of personal data.
• "Services" means the MultiSigner electronic document signing service.

3. Roles of the Parties

The parties acknowledge and agree that, with respect to the personal data described in Annex 1:

• the Controller determines the purposes and means of processing (including deciding which documents to sign, which data subjects are involved, and the lawful basis for processing); and
• the Processor processes personal data on the Controller's documented instructions solely to provide the Services.

4. Details of Processing

The subject matter, nature and purpose, duration, categories of data subjects, and types of personal data processed are set out in Annex 1. The Processor shall process personal data only: (a) on the documented instructions of the Controller, including as necessary to provide the Services; and (b) as required by applicable law. The Processor shall promptly inform the Controller if it believes an instruction infringes applicable data protection law.

5. Processor's Obligations

The Processor shall:

• process personal data only on documented instructions and for the purposes described in Annex 1;
• ensure that persons authorized to process personal data are bound by appropriate confidentiality obligations;
• implement and maintain appropriate technical and organizational measures as described in Annex 3 (and further detailed in our Encryption and Access Control document);
• engage Subprocessors only in accordance with Section 7;
• assist the Controller, where feasible and taking into account the nature of the processing, in fulfilling the Controller's obligations to respond to data subject requests and to comply with security, breach notification, impact assessment, and prior-consultation obligations;
• notify the Controller of a Personal Data Breach in accordance with Section 10 and our Incident Notification Procedures;
• delete or return all personal data upon termination of the Services in accordance with Section 15; and
• make available to the Controller information necessary to demonstrate compliance with this DPA and allow for audits in accordance with Section 13.

6. Controller's Obligations

The Controller represents and warrants that: (a) it has a lawful basis for processing the personal data it submits to the Services (including any documents it uploads that contain personal data); (b) its instructions to the Processor comply with applicable data protection law; and (c) it has provided any necessary notices to, and obtained any necessary consents from, data subjects. The Controller is responsible for the accuracy, quality, and legality of the personal data and the means by which it was obtained.

Additional obligations where signature flows are used. Where the Controller uses signature flows, the Controller additionally represents and warrants that: (d) it has a lawful basis for processing each signer's personal data, including the signer's name, email address, IP address, IP-derived geolocation, and device data; (e) it has informed each signer that an acceptance video recording their face and voice will be made and stored as evidence, and has obtained any consent or applied any other Article 9 GDPR (or equivalent) condition required for that recording; (f) it will only send documents to individuals it is lawfully entitled to contact for that purpose; (g) it is responsible for the accuracy of the email addresses it supplies, since an incorrect address may disclose documents to an unintended recipient; and (h) it will handle any request, objection, or complaint received from a signer, with the Processor assisting as required by Section 9.

The Controller requires the evidence; the Processor only provides the method. The Controller acknowledges and agrees that the acceptance video, the reading-acceptance records, and the traceability data (IP address, IP-derived geolocation, and device data) are collected at the Controller's requirement and on the Controller's instructions, as evidence of its signers' acceptance. The Processor does not require, need, or use that evidence for its own purposes. In relation to it, the Processor acts solely as the technical tool that provides the method of collecting and temporarily holding the evidence on the Controller's behalf. The evidence and the signed documents belong to the Controller and are controlled by the Controller.

Controller's duty to safeguard the evidence. The Controller is solely responsible for retrieving, safely storing, and protecting the evidence once it downloads it — the acceptance videos, the traceability records, and the signed documents — and for keeping it secure and confidential and available for as long as the Controller needs it for its own legal, evidentiary, or compliance purposes. The Processor is not the custodian or archivist of the evidence, does not provide archival storage, and accepts no responsibility for its safekeeping after download, nor for any evidence the Controller failed to download.

Deletion after a reasonable retention period. Personal data, including signed documents and flow evidence, is retained only for a reasonable, limited retention period (currently thirty (30) days), which is set to give the Controller sufficient time to download it, and is then automatically and permanently deleted in accordance with Section 15 and the Privacy Policy. Retention is never indefinite or permanent. The Processor has no obligation to notify the Controller before deletion, to restore deleted data, or to retain it beyond that period.

Access restriction during the retention period. While flow documents and evidence are retained, the Processor restricts access to them as follows: (a) the Controller, and only the Controller among customers, has full access to the documents, signed documents, acceptance videos, and traceability records of its own flows, scoped to the Controller's account, so that no other customer and no user of any other account can see, list, or download them; (b) an invited signer can access only the specific documents they must read and sign, only through their own single-use tokenized link, and only for the duration of their step, that access ending automatically when they sign because the link is invalidated; and (c) the Processor's designated system administrators may access a flow only for strictly limited operational purposes, namely platform administration, support requested by the Controller, security and abuse investigation, compliance with a legal obligation, or executing a deletion requested by the Controller, subject to administrator authentication and the measures in Annex 3. The Processor does not publish, share, sell, or otherwise disclose flow documents or evidence to any other party, and maintains no public listing, public URL, or directory of flows.

7. Subprocessors

The Controller grants the Processor a general authorization to engage Subprocessors to provide the Services, subject to the following:

• the Subprocessors engaged as of the effective date are listed in Annex 2;
• the Processor will impose on each Subprocessor data protection obligations at least as protective as those in this DPA, limited to the processing necessary to perform their functions;
• the Processor will inform the Controller of any intended addition or replacement of Subprocessors by updating Annex 2 and, where required by law, by notice; the Controller may object on reasonable data protection grounds within fourteen (14) days of notice;
• the Processor remains liable to the Controller for the acts and omissions of its Subprocessors to the extent required by applicable law.

Where the Services require international transfers of personal data to Subprocessors, the Processor shall ensure appropriate safeguards in accordance with Section 11.

8. Security Measures

The Processor has implemented and will maintain appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing. These measures are described in Annex 3 and further detailed in our Encryption and Access Control document.

9. Data Subject Requests

Taking into account the nature of the processing, the Processor will assist the Controller by appropriate technical and organizational measures, insofar as possible, to fulfill the Controller's obligation to respond to requests by data subjects exercising their rights under applicable data protection law. The Controller is responsible for handling such requests. If the Processor receives a data subject request directly, it will promptly forward it to the Controller (where identifiable) without responding on the Controller's behalf unless authorized to do so.

10. Personal Data Breach Notification

The Processor shall notify the Controller without undue delay and, where feasible, within forty-eight (48) hours after becoming aware of a Personal Data Breach affecting the Controller's personal data. The notification shall include the information described in our Incident Notification Procedures to the extent available at the time, and shall be supplemented as further information becomes available. The Processor shall take reasonable steps to contain and mitigate the breach.

11. International Transfers

Personal data may be processed and stored on the Processor's automatically load-balanced infrastructure across servers located in the United States and Canada. Where personal data originating in the EEA, UK, or Switzerland is transferred to a country that does not provide an adequate level of protection, the parties agree that the transfer shall be governed by the appropriate Standard Contractual Clauses (or an applicable adequacy decision), which are incorporated by reference into this DPA, with the Processor acting as "data importer" and the Controller as "data exporter" where applicable.

12. Confidentiality

The Processor shall ensure that any person it authorizes to process personal data is subject to a duty of confidentiality (whether contractual or statutory). The Processor shall treat personal data as confidential and shall not disclose it except as necessary to provide the Services, as required by law, or as otherwise permitted under this DPA.

13. Audits and Inspections

The Processor shall make available to the Controller information reasonably necessary to demonstrate compliance with this DPA. At the Controller's written request (no more than once per calendar year, and with at least thirty (30) days' notice), the Processor shall allow an independent, mutually agreed auditor under confidentiality obligations to audit the Processor's compliance with its security obligations, during normal business hours and without unreasonable disruption. Any such audit shall be at the Controller's cost. The Processor may satisfy this obligation by providing relevant third-party certifications or audit reports where available.

14. Liability

Each party's liability arising out of or related to this DPA shall be subject to the limitations and exclusions of liability set out in the Terms and Conditions, except to the extent such limitation is prohibited by applicable data protection law. Nothing in this DPA limits either party's liability for matters that cannot be limited by law.

15. Term, Termination, and Return/Deletion of Data

This DPA takes effect on the date the Controller first uses the Services and continues until the termination of the Services under the Terms and Conditions. Upon termination, the Processor shall, at the Controller's choice, delete or return all personal data processed on the Controller's behalf, and shall delete existing copies unless retention is required by law. The Processor may retain personal data to the extent and for the period required by applicable law, subject to continuing confidentiality.

16. Governing Law

This DPA is governed by the laws of the State of Michigan, United States, without regard to conflict-of-law principles, except that any provisions required to be governed by the laws of an EEA/UK member state under mandatory data protection law shall be governed accordingly. To the extent applicable, the terms of the Standard Contractual Clauses shall govern the parties' obligations in relation to international transfers.

17. Contact

For questions regarding this DPA, please contact:

SparkRelay Tech Services
2000 Hogback Rd, Suite 6, Ann Arbor, MI 48105-9735, USA
Email: info@multisigner.vip
Website: https://multisigner.vip