Data processing agreement

This data processing agreement ("DPA") is part of the terms of service and applies automatically to every sender that uses Psygned for a business, organisation or profession ("you", the "controller"). It sets out how Toarc United LLC, trading as Psygned ("we", the "processor"), processes personal data on your behalf. No signature is needed; if you require a signed copy for your records, email [email protected] and we will return a countersigned PDF of this text. Where this DPA and the terms conflict on the handling of personal data, this DPA prevails.

1. Definitions

"Data protection law" means the EU General Data Protection Regulation 2016/679 (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and any other law that applies to the personal data processed under this DPA, including US state privacy laws where they apply. "Personal data", "controller", "processor", "processing", "data subject" and "personal data breach" have the meanings given in the GDPR. "Signer data" means the personal data of the people you invite to sign, and the evidence record created when they do.

2. What is processed

3. Your instructions

We process personal data only on your documented instructions. Your instructions are: these terms, this DPA, the privacy policy, and the actions you take in the application or through the API (uploading, sending, reminding, voiding, downloading, closing the account). If the law requires us to process personal data otherwise, we will tell you before doing so unless the law forbids it. If we believe an instruction breaks data protection law, we will tell you.

4. Confidentiality

Every person we authorise to process personal data is bound by a duty of confidentiality. Access to production data is limited to what is needed to run and support the service and is logged.

5. Security

We maintain the technical and organisational measures described on the security page, which forms part of this DPA. In summary: encryption in transit and at rest, private file storage reachable only through short lived signed links, row level access control in the database, hashed credentials and signing tokens, optional two step verification for sender accounts, tamper evident records with file fingerprints, nightly encrypted backups, monitoring with alerts, and a vulnerability disclosure route. We may improve these measures over time and will not reduce the overall level of protection during the term.

6. Subprocessors

You authorise us to use the providers listed on the subprocessors page. Each is bound by a written contract with data protection obligations no less protective than this DPA, and we remain responsible to you for their performance. We will tell you by email at least 30 days before adding or replacing a subprocessor. If you object on reasonable data protection grounds and we cannot resolve the objection, you may close your account before the change takes effect and we will refund unused credits.

7. Helping you with data subject requests

If a signer or any data subject contacts us about personal data we process for you, we will pass the request to you without undue delay and, taking into account the nature of the processing, help you respond. The application lets you download or delete your documents yourself. The evidence record of a completed document is designed to be unalterable; where a request would require altering it, we will explain the position so you can decide how to respond.

8. Personal data breaches and assistance

If we become aware of a personal data breach affecting your data, we will tell you without undue delay and in any case within 48 hours of becoming aware, at the email address on your account, with what we know about the nature of the breach, the data and data subjects concerned, the likely consequences and the measures taken. We will then keep you informed as we learn more. Taking into account the information available to us, we will help you meet your obligations to conduct data protection impact assessments and to consult supervisory authorities where the processing under this DPA requires it.

9. Deletion and return

You can download every completed document and certificate at any time. When your account is closed, we delete the personal data we hold for you within 30 days, except where the law requires us to keep it (purchase records, typically 7 years). Encrypted backups are overwritten within a further 30 days. On request before closure we will provide an export of your documents and their event records.

10. Information and audits

On request, no more than once a year unless a supervisory authority or a personal data breach requires otherwise, we will provide the information reasonably needed to show compliance with this DPA, including our security description, subprocessor contracts summaries and, when we hold them, third party audit reports. Where that information is not enough, you or an auditor you appoint (bound by confidentiality and not a competitor of ours) may audit our compliance at reasonable notice, during business hours, at your cost, without disrupting the service or accessing other customers' data.

11. International transfers

Documents and account data are stored in Ireland (EU). Some subprocessors are established in the United States or operate a global network. Where personal data subject to the GDPR, UK GDPR or Swiss law is transferred to a country without an adequacy decision, the transfer is made under the EU standard contractual clauses (Commission Decision 2021/914), Module 2 (controller to processor) between you and us and Module 3 (processor to processor) between us and our subprocessors, with the UK International Data Transfer Addendum and the Swiss amendments where they apply, or under the EU-US Data Privacy Framework where the recipient is certified. The clauses are incorporated by reference into this DPA with you as data exporter, us as data importer, the annexes completed by section 2 (description of processing), the security page (technical and organisational measures) and the subprocessors page, the optional docking clause included, option 2 for clause 9 with 30 days notice, the governing law and forum being Ireland, and the supervisory authority being the one competent for you. A signed copy of the clauses is available from [email protected].

12. Liability, term and law

Each party's liability under this DPA is subject to the limitations in the terms of service, except that nothing limits liability to data subjects under data protection law. This DPA lasts as long as we process personal data for you. It is governed by the same law and courts as the terms of service, except that for the standard contractual clauses the law and courts of Ireland apply as stated in section 11.

13. Contact

Toarc United LLC, trading as Psygned. 312 W 2nd St, Unit #A4993, Casper, WY 82601, United States. [email protected].