Data Processing Agreement

1. Scope and roles

For personal data that the Customer uploads or manages in its workspaces (“Customer Personal Data”), the Customer is the controller (or business) and the Company is the processor (or service provider). For account, billing and Platform-operation data, the Company is a controller; the Privacy Policy covers that data.

The subject matter is provision of the Platform. The duration is the term of the Customer’s account plus the periods in the Retention and Deletion Policy. The nature is hosting, storage, display, transmission, signing and, on request, AI-assisted analysis of workspace content. The categories of data subjects are the Customer’s personnel, counterparties and other people named in documents. The categories of data are those the Customer chooses to upload, together with names, email addresses and signing evidence. The Customer should not upload special-category data (such as health, biometric or religious data) unless it is necessary and lawful, and must tell us first if it will.

2. Our obligations

We process Customer Personal Data only on the Customer’s documented instructions, which are these Terms, the DPA and the Customer’s use of the Platform’s features, unless the law requires otherwise; in that case we will tell the Customer first where the law allows.

We ensure that people who handle Customer Personal Data are bound by confidentiality. Staff can see workspace content only after the workspace owner approves a read-only support session, which is limited to 2 hours and logged.

We help the Customer, taking into account the nature of the processing and at the Customer’s reasonable cost where the work goes beyond the normal functions of the Platform, to answer data-subject requests, to carry out data-protection assessments and to consult regulators.

3. Security

We implement the measures described in Annex 2 and in the Security and Responsible Disclosure Policy. They are measures appropriate to the risk, and they are not a guarantee against every incident. We may improve them from time to time, and we will not materially reduce the level of protection.

4. Personal data breach

We will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, giving the information then available, and will cooperate in containment and reporting. We aim to do so within 72 hours, and in any case within any shorter or longer period that the law applying to the Customer requires. Where CERT-In directions require us to report an incident within 6 hours, we will do so. Our hosting provider has agreed to notify us without undue delay but has not set a number of hours, so our notice to the Customer depends on when the provider tells us.

5. Sub-processors

The Customer gives general authorisation for the sub-processors listed on our Sub-processors page, which includes our hosting provider and the cloud, database, edge, AI, search, payment and email providers named there. Our hosting provider’s own agreement binds its sub-processors to data-protection obligations, and we remain responsible to the Customer for the sub-processors we use, as the law requires.

We will give notice on the Sub-processors page before we add or replace a sub-processor we choose, and we aim to give 30 days’ notice. Our hosting provider’s own sub-processors are listed in its register and are changed under its agreement. The Customer may object on reasonable data-protection grounds. If we cannot reasonably accommodate the objection, the Customer may stop using the affected feature or end the account, and the Terms govern what follows.

6. International transfers

Customer Personal Data is stored in the United States (see the Data Transfer Notice). Where personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, the Standard Contractual Clauses (Commission Decision 2021/914) and the UK International Data Transfer Addendum apply and are incorporated here: Module 2 (controller to processor) between the Customer and the Company, and Module 3 (processor to processor) between the Company and its sub-processors; the docking clause (Clause 7) is included; Clause 9(a) option 2 applies with 30 days’ notice; Clause 17 option 1 applies, with the law of Ireland; and Clause 18(b) selects the courts of Ireland. Annexes 1 to 3 below form the annexes to those Clauses. If the Clauses conflict with this DPA, the Clauses prevail.

7. Return and deletion

The Customer can export its Content before deletion. When the Customer deletes a workspace or the account, we follow the Retention and Deletion Policy: a 30-day hold, after which an authorised administrator can permanently delete the data from live systems. Copies in our hosting provider’s backups expire on the provider’s schedule, and a copy can remain for up to about one year; we do not restore deleted Customer Personal Data from backups except to recover from a failure. We keep the records that the law requires, and Executed Documents are a shared record of every party who signed them, as set out in the Terms.

8. Audit and information

On written request, not more than once a year unless a regulator or a breach requires more, we will give the Customer reasonable information about how we meet this DPA, such as our security descriptions and links to our hosting provider’s published documents. We do not hold a SOC 2 or ISO 27001 certificate. If the Customer needs an on-site audit, the parties will agree its scope, timing and cost in advance, and the audit must not put other customers’ data at risk.

9. Liability and order of precedence

Each party’s liability under this DPA is subject to the limits in the Terms. If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA prevails.

Annex 1: Details of processing

• •Parties: the Customer (data exporter, controller) and Millennia Technologies (data importer, processor)
• •Contact for the Company: support@kpiandsla.com
• •Data subjects: the Customer’s personnel, counterparties, advisers and other people named in uploaded documents
• •Data: names, email addresses, roles, document content, comments, approvals, signing evidence (time, IP address, device, consent, document fingerprint)
• •Special categories: not intended
• •Frequency: continuous while the account is active
• •Purpose: provide the Platform
• •Retention: as in the Retention and Deletion Policy
• •Supervisory authority for exports from the EU: the authority of the exporter’s country; for the Company’s own role, the Data Protection Board of India

Annex 2: Security measures

• •Encryption in transit; encryption of the database and its backups at rest by the hosting provider with provider-managed keys (confirmed in writing by the provider; a formal attestation has been requested); customer-managed keys are not offered
• •Server-side access checks; organization isolation; role-based permissions; counterparties do not receive the other side’s internal notes
• •Sign-in with a password and an emailed verification code (with an optional 30-day trusted device); rate limiting and account lockout; one active session per account; a 15-minute access token and automatic sign-out after 30 minutes of inactivity; HttpOnly, Secure, SameSite=Strict session cookies; CSRF protection
• •Invitation links do not sign anyone in
• •Audit trail of important actions
• •Support access to workspace content only after the workspace owner approves, read-only, limited to 2 hours, and logged
• •Before each release, an automated check that routes require sign-in or are on an approved public list, and checks from outside the service
• •Uploaded files are accepted without malware scanning and are labelled until scanning is introduced
• •Backups on the provider’s rolling schedule; no restore drill has been run yet
• •A second master administrator for two-person approval of wallet corrections is not yet in place; corrections are logged and reviewed by the owner

Annex 3: Sub-processors

See the Sub-processors page for the current list, locations and the notice process.