Data Processing Agreement

1.1 Definitions. "Customer" means the organisation that accepts these terms and the sender terms. "OctoDoc" means the operating entity described in the status block above. "Service" means the OctoDoc platform. "Controller", "Processor", "Personal Data", "Processing", "Data Subject", "Personal Data Breach" and "Supervisory Authority" have the meanings given in Article 4 of Regulation (EU) 2016/679 ("GDPR"). "Data Protection Law" means, as applicable to a party, the GDPR, the UK GDPR and the Data Protection Act 2018, the Swiss FADP, Directive 2002/58/EC as implemented in each member state, the California Consumer Privacy Act as amended by the CPRA, other US state privacy statutes, and the Illinois Biometric Information Privacy Act ("BIPA").

1.2 The verbal system used here is the product's own and is used consistently. The object signed is a file. The PDFs inside it are documents. The fields placed on them are marks. The people who sign are signers, non-signing parties are on copy, and all of them are parties. The terminal state is sealed. The signer-facing AI is the Margin. The share-and-track link is a read link and it produces a reading log. The evidence bundle is the proof file.

1.3 The Customer is the Controller of the file, of every document inside it, of the marks placed on it, of the party details the Customer supplies or imports, and of the evidence record generated by the signing of that file. OctoDoc is the Processor of that Personal Data and processes it only as set out in section 3.

1.4 OctoDoc is an independent Controller for a narrow set of processing that is outside this agreement: the account, authentication and billing data of the Customer's own administrators and senders; product and marketing telemetry on the public marketing surface; and support correspondence initiated by the Customer's personnel. That processing is governed by OctoDoc's privacy notice, not by this agreement, and it never includes the contents of a Customer's documents.

1.5 The friction map and reading analytics are post-v1. If either is made available, a Customer's index is derived only from that Customer's own files, for that Customer, under the Customer's controllership, with OctoDoc acting as Processor. Cross-tenant aggregation would require a written amendment, a documented lawful basis, a purpose statement in the signer privacy notice and a working opt-out.

1.6 Under the CCPA as amended, OctoDoc acts as a "service provider". OctoDoc does not sell or share Personal Data, does not retain, use or disclose it for any purpose other than performing the Service, and does not combine it with Personal Data received from another source except as the statute permits for a service provider.

1.7 The Customer is responsible for the lawfulness of the Personal Data it puts into the Service, for the notices and consents its own transactions require, and for its instructions. OctoDoc is responsible for processing only on those instructions and for the measures in section 5.

1.8 This agreement forms part of, and is subject to, the sender terms. In a conflict about the processing of Personal Data, this agreement prevails over the sender terms; the Standard Contractual Clauses prevail over both.

This section is the Article 28(3) and SCC Annex I.B specification. It describes the v1 Service and labels post-v1 processing separately; it does not establish current production use.

3.1 OctoDoc processes Customer Personal Data only on the Customer's documented instructions, including as to transfers to a third country. The documented instructions are: this agreement, the sender terms, the Customer's configuration of the Service, and the API calls and interface actions the Customer's authorised users make. Nothing else is an instruction.

3.2 OctoDoc will not process Customer Personal Data for its own purposes, and will not use it to develop, train, fine-tune or evaluate any model. Model providers used by the Service are engaged under a contractual prohibition on training, with retention governed by the provider agreement. OctoDoc does not claim zero data retention with any model provider, and will not, until a retention addendum naming each surface used is executed and filed with the trust materials. Any earlier statement of zero retention would be wrong and is not made here.

3.3 Where OctoDoc is required by Union, member state or other applicable law to process Customer Personal Data beyond the Customer's instructions, OctoDoc will inform the Customer of that legal requirement before processing, unless the law prohibits that information on important grounds of public interest.

3.4 If OctoDoc considers an instruction infringes Data Protection Law, it will tell the Customer without undue delay and may suspend performance of that instruction, and only that instruction, until the parties resolve it. OctoDoc is not obliged to give legal advice and its silence is not an opinion that an instruction is lawful.

3.5 The policy engine that refuses statutorily excluded document types is a control OctoDoc operates for its own risk, not a warranty about the Customer's transactions and not a legal opinion. The Customer remains responsible for what it sends. When that engine is made available, its versioned ruleset will be published and the ruleset version recorded against each decision.

3.6 The Margin processes document content only where the Customer enables it, and only for the file on which a signer asks a question. It is extractive with citations, it refuses to apply law to a signer's facts, and nothing it produces enters the signed byte range, the Seal or the certificate of signing. Account, template, file and jurisdiction-level switches to disable it are part of the design and attach when the Margin is made available.

3.7 The Customer may issue an instruction to erase, export, restrict or correct Personal Data through the interfaces the Service provides or, where no interface exists, in writing to the contact in section 15. OctoDoc will confirm execution.

4.1 OctoDoc ensures that every person authorised to process Customer Personal Data is bound by a written obligation of confidentiality, or is under an appropriate statutory obligation of confidentiality, and that the obligation survives the end of their engagement.

4.2 Access is granted on a need-to-know basis, is scoped to a role, and is removed on role change or departure. Personnel receive data-protection and security training appropriate to their access before it is granted.

4.3 There is one platform operator today, identified by a single constant in the codebase. Operator status gates operator-only product surfaces. The operator console may count closed operational metadata across tenants, but it cannot select a tenant or target identifier, personal data, document content, payloads, hashes, IP addresses or user agents. Operator status does not decrypt document bytes, grant access to a tenant's rows, or replace authentication.

4.4 Any access by OctoDoc personnel to a Customer's content for support is a break-glass flow with four elements: the Customer's recorded consent, a bounded scope and duration, an audit record of every read, and notice to the Customer after the fact. OctoDoc commits that no personnel access to Customer content occurs outside that flow. The tooling that automates the audit record and the notice has not shipped; until it has, the commitment stands and the consent and scope are recorded in writing.

4.5 OctoDoc will not disclose Customer Personal Data to any third party except a sub-processor engaged under section 6, or where compelled by law and subject to section 9.5.

Article 32 requires measures appropriate to the risk, and a DPA that describes measures it does not operate is a false statement to a Controller. So this Annex separates the two.

"In service" means the measure is operating today on the surface that exists. "Specified, not in production" means OctoDoc commits to implement and maintain it, and it is designed and written down, but it is not running and must not be relied on as though it were. "Committed before launch" means it is a condition OctoDoc undertakes to satisfy before the Service processes a Customer's file.

OctoDoc will maintain each measure below at no less than the standard described, will not degrade a measure in a way that materially reduces security, and will update this Annex when a status changes.

6.1 The Customer gives OctoDoc a general written authorisation to engage sub-processors, on the conditions in this section. This is SCC Clause 9, option 2.

6.2 OctoDoc imposes on each sub-processor, by written contract, data-protection obligations no less protective than those in this agreement, and remains fully liable to the Customer for the performance of each sub-processor's obligations as if they were its own.

6.3 OctoDoc will give the Customer at least 30 days' notice before adding or replacing a sub-processor, by email to the Customer's designated administrative address and by updating the register.

6.4 Within those 30 days the Customer may object on reasonable grounds relating to data protection. The parties will discuss the objection in good faith. If OctoDoc cannot accommodate it — by an alternative sub-processor, a change of configuration or a workaround — the Customer may terminate the affected part of the Service on written notice and receive a pro-rata refund of prepaid fees for the terminated part. Termination on those grounds is not a breach by either party.

6.5 In an emergency, OctoDoc may engage a replacement sub-processor before the 30 days elapse where necessary to maintain the Service or to remedy a security risk, and will give notice as soon as possible with the reason. The right to object in 6.4 still applies.

6.6 Until a versioned register page is published, Annex III below is the authoritative sub-processor list. When the register page is published, it becomes authoritative and this section will point at it.

6.7 A sub-processor marked "not yet engaged" holds no Customer Personal Data today and will not before the Service is made available. The row is published in advance so a reviewer can object before engagement rather than after.

7.1 Taking into account the nature of the processing, OctoDoc assists the Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Customer's obligation to respond to requests to exercise rights of access, rectification, erasure, restriction, portability and objection, and rights relating to automated decision-making.

7.2 OctoDoc will not respond substantively to a Data Subject request concerning Customer Personal Data. If such a request reaches OctoDoc directly, OctoDoc will acknowledge it, tell the individual that the Customer is the Controller, and pass it to the Customer without undue delay and in any event within five business days, unless applicable law requires OctoDoc to respond itself.

7.3 OctoDoc commits to a 30-day response for its own assistance to the Customer, running from receipt of a complete request from the Customer. That commitment covers access, rectification and erasure. Where a request touches sealed evidence, section 8 governs what erasure can and cannot achieve, and OctoDoc will give the Customer the plain-English explanation in 8.4 so the Customer can answer its own data subject.

7.4 OctoDoc also assists the Customer, taking into account the nature of processing and the information available to OctoDoc, with the Customer's obligations under Articles 32 to 36 — security of processing, breach notification to a Supervisory Authority and to data subjects, data protection impact assessments, and prior consultation.

7.5 Where a self-serve export or deletion interface exists, the Customer uses it. Where one does not yet exist, OctoDoc performs the operation on written instruction. The runbook that governs this is documented; the tooling that automates it lands with the capabilities it operates on.

8.1 This is the section a Controller has to be able to explain to its own data subject, so it says exactly what happens and exactly what does not.

8.2 On the Customer's instruction, OctoDoc erases Customer Personal Data unless applicable law requires retention or Article 17(3)(e) applies for the establishment, exercise or defence of legal claims.

8.3 V1 signed artifacts are stored in private Supabase Storage. They are administrator-removable and do not sit under Object Lock, so this agreement makes no WORM or physical-undeletability claim.

8.4 If a lawful retention ground applies, OctoDoc restricts the retained data to that purpose and deletes it when the ground expires. The Customer remains responsible for identifying and documenting its legal-claims basis.

8.5 Per-file encryption, crypto-shredding, public erased-state verification, and AWS Governance-mode Object Lock are post-v1 designs. They do not limit a v1 deletion instruction and create no current retention promise.

8.6 Users are never kept as active accounts merely because their identity is evidence that a human confirmed a mark. Personal account fields may be tombstoned while the minimum evidentiary reference is retained where law permits.

8.7 No foreign key in the schema is permitted to make a data subject undeletable in substance.

9.1 In v1 the Service processes and stores Customer Personal Data in the United States: application data, authentication and private object storage through Supabase, and document-plane compute in Fly.io's Seattle region. There is no EU or UK data-residency option, and none is offered. A Customer that requires EU residency should not treat this agreement as providing it.

9.2 For transfers of Personal Data from the EEA to OctoDoc in the United States, the parties incorporate by reference the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914: Module Two (controller to processor) where the Customer is a Controller, and Module Three (processor to processor) where the Customer is itself a Processor acting for a third-party Controller. The SCCs form part of this agreement and take effect when the entity described in the status block executes them.

9.3 The SCC options are elected as follows. Clause 7 (docking) applies. Clause 9 option 2 (general written authorisation) applies, with the 30-day notice period in section 6. Clause 11(a) optional independent dispute-resolution body is not adopted. Clause 17 option 1: the SCCs are governed by the law of Ireland. Clause 18(b): disputes under the SCCs are resolved before the courts of Ireland. Annex I.A is filled in from the parties' details on execution; Annex I.B is section 2; Annex I.C is the last row of section 2; Annex II is section 5; the sub-processor list required by Clause 9 is Annex III in section 6.

9.4 For transfers from the United Kingdom, the parties incorporate the ICO's International Data Transfer Addendum to the SCCs, with the SCCs as the approved clauses and the tables filled in by reference to this agreement. For transfers from Switzerland, references to the GDPR are read as references to the FADP, the Federal Data Protection and Information Commissioner is the competent authority, and the clauses protect data of legal entities until Swiss law provides otherwise.

9.5 OctoDoc will maintain a transfer impact assessment covering the United States legal regime relevant to the sub-processors in Annex III, including FISA section 702 and Executive Order 12333, the categories of data transferred, the practical likelihood of an access request given OctoDoc's size and sector, and the supplementary measures relied on — per-file encryption keys, encryption at rest and in transit, minimisation of what leaves the platform, and the commitments in 9.6. That assessment is a condition of accepting the first EEA Customer and has not yet been finalised.

9.6 If OctoDoc receives a legally enforceable demand from a public authority for Customer Personal Data, it will notify the Customer, unless prohibited by law, and in that case will use reasonable efforts to obtain a waiver of the prohibition and will provide the general information it is permitted to provide. OctoDoc will challenge a request that is unlawful under applicable law or that is overbroad, will provide only the minimum permissible, and grants no public authority direct, unmediated access to Customer Personal Data, no back door and no dedicated access channel.

9.7 OctoDoc has not appointed an Article 27 representative in the EU or the UK, because the operating entity does not yet exist. Appointment is a condition of offering the Service to EEA or UK Controllers.

10.1 OctoDoc makes available to the Customer the information necessary to demonstrate compliance with Article 28 and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor it mandates.

10.2 The parties will satisfy that right in this order, and the Customer will accept a lower step where it reasonably meets the need: (a) the current independent audit report, once one exists; (b) this agreement's Annex II together with OctoDoc's answers to the Customer's security questionnaire; (c) a remote audit interview with the engineer responsible for the control in question; (d) an on-site or remote inspection.

10.3 An inspection under 10.2(d) is subject to reasonable bounds: no more than once in any 12-month period, unless a Personal Data Breach affecting the Customer has occurred or a Supervisory Authority requires it; on at least 30 days' written notice; during normal business hours; conducted so as not to disrupt the Service or other customers; scoped to the processing of the Customer's own Personal Data; conducted by an auditor bound by confidentiality obligations at least as protective as this agreement and who is not a competitor of OctoDoc; and with the Customer bearing its own and OctoDoc's reasonable costs, save where the audit reveals material non-compliance, in which case OctoDoc bears its own.

10.4 No audit may include a test that would access, expose or risk the data of another customer. A tenancy-isolation test is performed by OctoDoc's own independent penetration tester against a dedicated environment, and the summary report is available to the Customer under 10.2(b).

10.5 OctoDoc holds no SOC 2 report, no ISO certification and no finished penetration test today, and claims none. An independent penetration test covering the web application, the API and the signing pipeline, including tenancy isolation, is committed before the Service is made available to paying customers. A SOC 2 Type II report scoped to the Security criteria is committed on the timeline OctoDoc publishes in its trust materials.

10.6 Nothing in this section limits a Supervisory Authority's own powers of audit or inspection, and OctoDoc will cooperate with them.

11.1 OctoDoc notifies the Customer of a Personal Data Breach affecting Customer Personal Data without undue delay after becoming aware of it, and in any event within 48 hours of becoming aware. Notice goes to the Customer's designated security contact and administrative address.

11.2 The notice describes, to the extent known at the time: the nature of the breach, including the categories and approximate number of data subjects and of records concerned; the file identifiers affected, where identifiable; the likely consequences; the measures taken or proposed to address it and to mitigate its effects; and a contact point at OctoDoc for further information. Where the information cannot all be provided at once, it is provided in phases without further undue delay, and OctoDoc will say what is still unknown rather than omit it.

11.3 OctoDoc assists the Customer with the Customer's own obligations under Articles 33 and 34, including by providing the information the Customer needs for its notification to a Supervisory Authority and, where the Customer instructs, supporting notification to data subjects.

11.4 OctoDoc will not notify the Customer's data subjects or any Supervisory Authority on the Customer's behalf unless the Customer instructs it in writing or applicable law requires OctoDoc to do so, in which case OctoDoc will inform the Customer first where permitted.

11.5 A notice under this section is not an acknowledgement of fault or liability by OctoDoc.

11.6 Unsuccessful attempts that do not compromise the security of Personal Data — network scans, blocked log-in attempts, denied requests, rejected traffic — are not Personal Data Breaches and are not individually notified. They are covered in aggregate under 10.2(b) where relevant.

12.1 At the Customer's choice, expressed on or before termination, OctoDoc returns or deletes all Customer Personal Data at the end of the provision of the Service. The Customer has 30 days from termination to export its data through the interfaces provided. Where the Customer chooses deletion, or makes no choice within those 30 days, OctoDoc deletes the data and existing copies within a further 60 days, unless applicable law requires storage.

12.2 A signed artifact or Ledger record may persist after termination only for the published v1 retention period or where applicable law requires storage or Article 17(3)(e) applies. V1 objects do not sit under Object Lock and remain technically deletable.

12.3 Where data is retained under 12.2, it remains subject to every confidentiality and security obligation in this agreement and is not used for any purpose other than restricted storage and lawful production.

12.4 Deletion propagates through backup media on the ordinary backup cycle rather than by selective restoration. Data remaining in a backup is isolated, is not processed for any purpose, and is deleted when the backup expires. The maximum period is the backup retention window, which OctoDoc publishes in its trust materials once the backup regime is verified.

12.5 On written request, OctoDoc provides written confirmation of deletion, identifying what was deleted, what was retained under 12.2, and the date the retained material is scheduled for destruction.

13.1 Liability under this agreement is governed by the limitation of liability in the sender terms, as modified by this section. This section states which cap applies, because that is the question a procurement reviewer asks and it should not require a cross-reference to answer.

13.2 A breach of this agreement by OctoDoc sits under the super-cap, not the general cap. The super-cap is three times the fees paid by the Customer in the 12 months preceding the event giving rise to the claim, subject to a floor of US$250,000. The same super-cap applies to a breach of confidentiality and to a security incident caused by OctoDoc's negligence.

13.3 The general cap in the sender terms — the greater of the fees paid in the preceding 12 months or US$1,000 — does not apply to a claim under this agreement.

13.4 Statutory data-protection fines and regulatory penalties are carved out of the general cap and sit under the super-cap.

13.5 The indemnities OctoDoc gives for breach of this agreement and for a security incident caused by OctoDoc's negligence also sit under the super-cap, not the general cap.

13.6 Nothing in this agreement or in the sender terms limits either party's liability for fraud, wilful misconduct, gross negligence, death or personal injury caused by negligence, payment obligations, or OctoDoc's own intellectual property indemnity. Those are uncapped.

13.7 The caps in this section allocate liability between the parties. They do not affect a data subject's rights under Clause 12 of the SCCs, and they do not limit any liability that applicable law does not permit to be limited.

13.8 The US$250,000 floor is a contractual commitment. Insurance sized to it has not been bound, because the operating entity does not exist and cannot bind a policy. Until cover is in place, the floor is supported by the entity's own balance sheet and nothing else. A Customer relying on the floor should request the certificate before relying on it.

14.1 This agreement is governed by the laws of the State of Delaware, without regard to its conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

14.2 The state and federal courts located in Delaware have exclusive jurisdiction over any dispute arising out of or relating to this agreement. Each party consents to personal jurisdiction in those courts and waives any objection to venue and any argument of forum non conveniens.

14.3 There is no arbitration clause in this agreement and there is no class-action waiver. Disputes go to court. Neither party gives up a procedural right by accepting this agreement, and nothing in it should be read as an agreement to arbitrate.

14.4 The one exception is the Standard Contractual Clauses. Clauses 17 and 18 of the SCCs govern claims brought under the SCCs: Irish law, Irish courts. Section 14.1 and 14.2 do not displace them, and nothing in this agreement deprives a data subject of the third-party beneficiary rights in Clause 3 of the SCCs.

14.5 Order of precedence, highest first: the Standard Contractual Clauses; this agreement; the sender terms; any other document.

14.6 If a provision of this agreement is held unenforceable, it is severed to the minimum extent necessary and the rest remains in force. An amendment is effective only in writing agreed by both parties, except that OctoDoc may update Annex II in section 5 and Annex III in section 6 as provided in those sections.

Until the operating entity exists, these addresses reach the founder directly. There is no data protection officer and no EU or UK representative; both are conditions of offering the Service to EEA or UK Controllers rather than roles that already exist.