DSV (DocSignVault) — Data Processing Agreement

Last updated: [DATE]. Version: draft 1 (2026-10-08).

This Data Processing Agreement ("DPA") is part of the Terms of Service between [COMPANY LEGAL NAME], [COMPANY ADDRESS] ("DSV", the Processor) and the Sender (the Controller). It applies when DSV processes personal data of Signers on the Sender's behalf. It is written to meet GDPR Article 28 and is adapted for UK, Swiss, Californian, Brazilian and Australian law in sections 14 to 17. If this DPA conflicts with the Terms on data protection, this DPA prevails.

1. Definitions

"Data Protection Law" means all privacy and data protection laws that apply to the processing, including GDPR (EU 2016/679), UK GDPR and the Data Protection Act 2018, the Swiss FADP, the CCPA as amended by the CPRA, Brazil's LGPD, and Australia's Privacy Act 1988. "Controller", "Processor", "personal data", "processing", "personal data breach", "data subject" and "supervisory authority" have the meanings given in GDPR. "Customer Personal Data" means personal data of Signers that DSV processes for the Sender. "Sub-processor" means a third party engaged by DSV to process Customer Personal Data.

2. Roles and scope

2.1 The Sender is the Controller (or "business") of Customer Personal Data. DSV is the Processor (or "service provider"/"operator").

2.2 For Sender account and billing data, DSV acts as an independent controller as described in the Privacy Policy. This DPA does not cover that data.

3. Details of processing (GDPR Art. 28(3))

3.1 No biometric processing by DSV. Face-with-ID photos contain facial images, which are biometric-adjacent data. DSV stores them as image files and shows them to the Sender. DSV performs no identity verification, no OCR, no face matching, no liveness detection, and creates no biometric template or identifier from any image. If this changes, DSV will give notice and obtain the Sender's agreement before any such processing starts. The Sender must not instruct DSV to perform biometric identification, and DSV has no feature that does.

4. Controller's instructions and responsibilities

4.1 DSV processes Customer Personal Data only on the Sender's documented instructions, which are the Terms, this DPA and the Sender's use of the product settings. DSV will tell the Sender if it believes an instruction infringes Data Protection Law.

4.2 The Sender is responsible for: having a lawful basis for collection (including for ID images and any special-category data); giving Signers required notices; reviewing ID photos itself; and setting retention rules appropriate to its legal duties.

5. Processor obligations

DSV will:

(a) process only as instructed (section 4), unless law requires otherwise, in which case DSV will inform the Sender first where permitted; (b) ensure everyone authorised to process Customer Personal Data is bound by confidentiality; (c) implement the security measures in Annex II; (d) respect the sub-processor conditions in section 6; (e) assist the Sender as set out in section 9; (f) delete or return data as set out in section 11; (g) make available information needed to show compliance and allow audits under section 12; (h) not sell or share Customer Personal Data, and not retain, use or disclose it outside the direct business relationship (see section 15).

6. Sub-processors

6.1 The Sender gives general authorisation for the Sub-processors listed in SUBPROCESSORS.md.

6.2 DSV will give at least 30 days' notice before adding or replacing a Sub-processor, by email to the account owner and by updating SUBPROCESSORS.md.

6.3 The Sender may object on reasonable data protection grounds within those 30 days. The parties will try to resolve it in good faith. If DSV cannot reasonably avoid the change, the Sender may terminate the affected service and receive a pro-rata refund of prepaid fees for the unused period. [Counsel: confirm.]

6.4 DSV will bind each Sub-processor to data protection terms no less protective than this DPA and remains liable for their performance.

7. Security

DSV maintains the measures in Annex II. They are reviewed as the service changes. DSV does not claim any security certification at the date of this draft. [Counsel: update if certifications are obtained.]

8. Personal data breach

8.1 DSV will notify the Sender without undue delay and in any case within 72 hours after becoming aware of a personal data breach affecting Customer Personal Data.

8.2 The notice will include, as far as known: the nature of the breach; categories and approximate numbers of data subjects and records; likely consequences; measures taken or proposed; and a contact point. Information may follow in phases.

8.3 DSV will take reasonable steps to contain and remediate the breach and will cooperate with the Sender's notifications to regulators and data subjects. The Sender decides on those notifications unless DSV is legally required to make them.

9. Assistance

DSV will, taking into account the nature of processing and the information available: (a) help the Sender respond to data subject requests (access, correction, deletion, portability, restriction, objection) through product features (records index, "Export everything", deletion tools) and by forwarding any request received directly, without responding itself except to say it was forwarded; (b) help with data protection impact assessments and prior consultations, on reasonable request; and (c) help with breach notification (section 8). Assistance beyond ordinary product features may be charged at reasonable rates if the Sender asks for substantial bespoke work. [Counsel: confirm.]

10. Retention locks and legal holds

The Sender may set minimum retention locks. Where a lock or the Sender's legal duty requires records to be kept, a Signer's deletion request may be limited. The Sender, as Controller, decides and responds. DSV will not delete locked records before the lock date except as required by law or a binding order.

11. Deletion and return

11.1 The Sender can export all data at any time using "Export everything" (PDFs, photos and the records index), including on a lapsed account.

11.2 On termination, DSV will keep the data available for export for the period in the Terms, then delete it, including from live systems, unless law requires storage. Backups are overwritten within 35 days.

11.3 DSV does not delete data because of non-payment.

11.4 On request DSV will confirm deletion in writing.

12. Audits

12.1 DSV will, on reasonable written request no more than once a year (or after a breach), provide information needed to show compliance, such as answers to a security questionnaire and summaries of testing.

12.2 If that is not sufficient, the Sender (or an independent auditor bound by confidentiality) may audit DSV on [30] days' notice, during business hours, without unreasonable disruption, at the Sender's cost, and without access to other customers' data. [Counsel: confirm scope, frequency, who pays.]

13. International transfers

13.1 Customer Personal Data is processed in the locations listed in SUBPROCESSORS.md. [Hosting regions to be selected at deployment.]

13.2 Standard Contractual Clauses. Where Customer Personal Data from the EEA is transferred to a country without an adequacy decision, the parties agree the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated: [Module Two (controller to processor) applies; Module Three (processor to sub-processor) applies to onward transfers]; Clause 7 docking clause: [included/omitted]; Clause 9(a) Option 2 general authorisation with the 30-day notice in section 6; Clause 11 optional redress: [omitted]; Clause 17 governing law: [EU MEMBER STATE]; Clause 18 courts: [EU MEMBER STATE]. Annex I (parties, description of transfer: see section 3; competent supervisory authority: [AUTHORITY]) and Annex III (Sub-processors: SUBPROCESSORS.md) are completed accordingly. Annex II is below. [Counsel to complete and attach the full text.]

13.3 Supplementary measures include the encryption described in Annex II, access controls, and logging of every photo access.

14. UK and Swiss addenda

14.1 UK. For transfers from the UK, the parties enter the [ICO International Data Transfer Addendum to the EU SCCs / International Data Transfer Agreement] version [B1.0], with the tables completed from this DPA. [Counsel to complete.]

14.2 Switzerland. For transfers subject to the Swiss FADP, the EU SCCs apply with these changes: references to GDPR mean the FADP; the competent authority is the Federal Data Protection and Information Commissioner; "Member State" includes Switzerland so that data subjects can enforce their rights there; and the SCCs also protect data of legal entities until the revised FADP makes that unnecessary. [Counsel to confirm and complete.]

15. United States: CCPA/CPRA service-provider terms

15.1 To the extent the CCPA applies, the Sender is the "business" and DSV is the "service provider". DSV will process Customer Personal Data only for the business purposes in section 3 and the Terms.

15.2 DSV will not: (a) sell or share Customer Personal Data; (b) retain, use or disclose it for any purpose other than the specified business purposes, or outside the direct business relationship; or (c) combine it with personal information from other sources, except as the CCPA permits.

15.3 DSV will comply with the CCPA as applicable to service providers, give the same level of privacy protection as the CCPA requires, and tell the Sender if it can no longer meet its obligations. The Sender may take reasonable steps to ensure DSV uses the data consistently with the Sender's obligations, and to stop and remediate unauthorised use. DSV will assist with consumer requests (section 9). Sub-processors are bound by written terms (section 6). DSV certifies that it understands and will comply with these restrictions.

15.4 Other US state privacy laws: the same restrictions apply as processor terms.

16. Brazil: LGPD operator terms

16.1 For Brazilian data, the Sender is the "controlador" and DSV the "operador" under LGPD (Lei 13.709/2018). DSV processes only on the Sender's lawful instructions (Art. 39).

16.2 DSV will keep records of processing (Art. 37), implement security measures (Art. 46), notify the Sender of security incidents so that the Sender can notify the ANPD and data subjects (Art. 48), and help with data subject rights under Art. 18.

16.3 International transfers follow Art. 33 and applicable ANPD standard contractual clauses. [Counsel: confirm mechanism; designate the encarregado (DPO) if required.]

17. Australia: APP note

For Australian personal information, the Sender is the "APP entity" responsible for compliance with the Australian Privacy Principles, including APP 8 (cross-border disclosure) and APP 11 (security and destruction). DSV will handle the information only to provide the service, apply the security measures in Annex II, and help the Sender meet its obligations, including notifiable data breaches (Part IIIC): a breach will be notified to the Sender within the time in section 8. [Counsel: consider whether further contractual terms are needed.]

18. Liability, term and order of precedence

18.1 Liability under this DPA is subject to the limitations in the Terms, except where Data Protection Law (or the SCCs) forbids it. [Counsel: confirm.]

18.2 This DPA lasts as long as DSV processes Customer Personal Data. 18.3 Order of precedence: SCCs, then this DPA, then the Terms.

19. Contact

Processor privacy contact: [DPO/PRIVACY CONTACT], [CONTACT EMAIL]. [EU/UK representative, if required: [DETAILS]].

Annex I — Parties and description

Controller: the Sender named in its account. Processor: [COMPANY LEGAL NAME], [COMPANY ADDRESS]. Description of processing: section 3. Competent supervisory authority: [AUTHORITY].

Annex II — Technical and organisational measures

This annex summarises the measures documented in DSV's security document. It describes implemented controls, not certifications.

1. Encryption of photos. ID and face-with-ID photos are stored in a separate private bucket, never public. Each file is encrypted in the application with AES-256-GCM using a per-file key; file keys are wrapped by a per-account data key, which is wrapped by a master key held in a cloud key management service in production. Bucket server-side encryption is also enabled.
2. Field-level encryption. Date of birth, address, ID numbers and similar sensitive text fields use AES-256-GCM with the account data key.
3. Access to photos. Short-lived signed links only (default 5 minutes). Each issued link writes an access-log record. Signers can reach only their own uploads during the flow.
4. Transport. TLS 1.2 or higher with HSTS.
5. Authentication. Senders: password (argon2id) plus mandatory authenticator-app code, with single-use backup codes; httpOnly, Secure, SameSite=Lax session cookies with hashed tokens and 30-day sliding expiry. Signers: random 32-byte link token plus six-digit one-time code, with expiry and attempt limits; only hashes stored.
6. Authorisation. Every Sender query is scoped to the account; team members cannot change billing; read-only mode for lapsed accounts.
7. Integrity. SHA-256 document hash, PDF certificate seal, RFC 3161 timestamp, Verify page.
8. Logging. Structured logs with redaction of passwords, tokens, codes, secrets, ID numbers and dates of birth; photo bytes never logged. Audit trail of signing events. Platform administrators use a separate login and all actions are logged.
9. Abuse controls. Rate limiting on sign-in, codes, uploads and verification; bot protection on signing links; "Report abuse" link.
10. Data minimisation. Metadata (such as EXIF location) stripped from uploaded images. No identity verification, OCR or face matching is performed.
11. Resilience. Daily encrypted backups, cross-region, 35-day restore window.
12. Retention. Sender-controlled retention, retention locks, and warnings before automatic deletion.
13. Testing. Dependency auditing and a penetration test of the signer flow, file access route, billing webhook and admin area are planned before launch. [Counsel: update with actual dates and results.]

Annex III — Sub-processors

See SUBPROCESSORS.md.

Signature

Signed by the parties' acceptance of the Terms of Service, or separately on request. Controller: ________ Processor: ________ Date: ________