Data processing agreement

1. Parties and scope

This agreement is between you, the account holder, as controller, and Conrado Maggi, Málaga, Spain, trading as Digital Waivers, as processor. It covers personal data we process for you in the course of providing the service. It does not cover data we are responsible for ourselves, such as your account details and billing, which the privacy policy describes.

For customers subject to the California Consumer Privacy Act or another US state privacy law, this agreement is the written contract that law requires between a business and its service provider, and sections 3, 4, 6 and 9 contain the required restrictions. For customers subject to the GDPR or the UK GDPR, it is the contract Article 28 requires.

2. Details of the processing

• Subject matter and purpose. Publishing your waivers, collecting signatures, storing signed waivers, generating PDFs, emailing signed copies, check-in, exports, and syncing PDFs to a Google Drive you connect.
• Duration. For as long as you have an account, plus the deletion period in section 9.
• Data subjects. People who sign your waivers; children they sign for; the person who organizes a group; your staff.
• Categories of data. Names, email addresses, phone numbers, dates of birth, answers to the questions you add, signature images, the exact waiver text and consent statements shown, date and time, IP address and browser, check-in times, marketing opt-in choices, and the PDF made from all of this. For staff: name, email address and sign-in records.
• Sensitive data. The service is not designed for health information, payment card numbers, government ID numbers or other special categories of data. Do not ask for them in your waivers. If a medical question is essential to your activity, keep it to what you need and tell us so we can advise.

3. Processing on your instructions

• We process the data only on your documented instructions: these terms, the settings you choose in the app, and anything else you tell us in writing. We will tell you if we believe an instruction breaks data protection law.
• We do not sell the data, share it for advertising, combine it with data from other customers or other sources, or use it to train AI models. We do not use it for any purpose of our own beyond running and securing the service.
• We process the data only within the direct business relationship with you. If we are ever unable to meet these obligations we will tell you, and you may suspend the processing or close the account.
• You are responsible for the lawfulness of your instructions, for what your waiver asks, and for the notices you give your signers.

4. Confidentiality

Access to the data is limited to the operator and to anyone who must have it to run or support the service, each bound by a duty of confidentiality. We look at the content of an account only to fix a problem you reported, to deal with abuse, or when the law requires it.

5. Security measures

We keep the following in place and will not reduce them while this agreement runs:

• All traffic over TLS. Hosting, database and file storage in the European Union.
• Every record belongs to one account and is only served to that account's users. Signature images and PDFs are in private storage, not reachable by URL.
• Passwords and kiosk PINs stored as bcrypt hashes. Kiosk devices use a revocable token. Sessions expire after 2 hours of inactivity.
• Each PDF carries a SHA-256 fingerprint and a document ID, so changes to a file can be detected and a document can be checked without exposing its contents.
• Rate limiting on sign pages and sign-in. Security headers on every response. Sign pages marked so search engines stay out.
• Daily backups kept for 30 days, encrypted at rest.
• Server access limited to the operator, over key-based SSH, with software patched regularly.

6. Sub-processors

You authorize us to use the companies below to help provide the service. Each is bound by a written contract that imposes data protection obligations no weaker than ours to you, and we remain responsible to you for what they do.

Company	Purpose	Location	Transfer safeguard
DigitalOcean, LLC	Hosting, database and file storage	Frankfurt, Germany	Data stays in the EU
Mailgun Technologies, Inc. (Sinch)	Sends email: signed copies, verification codes, account notices	EU region	EU Data Privacy Framework and Standard Contractual Clauses
Stripe Payments Europe, Ltd.	Payments and invoices for paid plans. We never see or store card numbers.	Ireland	Stripe's own GDPR commitments
Simple Analytics B.V.	Cookieless visitor counts on the public website and the sign-up and login pages. Receives no personal data and does not track signers or the app.	Netherlands	Data stays in the EU
BunnyWay d.o.o. (Bunny Fonts)	Serves the web font. Receives your IP address when the font loads, sets no cookies.	Slovenia	Data stays in the EU
Google LLC	Only if you connect Google Drive: receives a copy of each signed PDF in your own Drive.	United States	EU Data Privacy Framework and Standard Contractual Clauses

We will email you at least 30 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we cannot resolve it, you may close your account and we will refund any prepaid fees for the unused period.

7. International transfers

The data is stored in the European Union. Where a sub-processor handles it outside the European Economic Area, the transfer is covered by the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses, as listed in the table above. If you are in the United States, note that your signers' data is stored outside the US.

8. Helping you with your obligations

• Requests from signers. The app lets you find any signature, download its PDF, export everything as CSV, and erase a signature in one step while keeping a record that you did. If a signer contacts us directly we pass the request to you within 5 business days and do not act on it ourselves unless the law requires us to.
• Breaches. If we become aware of a breach of security that affects your data, we tell you within 48 hours with what we know: what happened, which data and roughly how many people, what we have done, and what we suggest you do. We keep you updated as we learn more.
• Assessments. If you need to run a data protection impact assessment or answer a regulator, we give you the information about our processing that you reasonably need.

9. Returning or deleting the data

• While your account is open, you control what is kept: erase any signature by hand at any time. If a retention period is set for your account, signatures past it are erased every day. Erasing removes the personal data and the PDF and leaves only a record that the document existed and was erased.
• Before closing your account, export your signed waivers as CSV and download the PDFs you need. PDFs already synced to your Google Drive stay there.
• When you close your account we delete all the data within 30 days, and it is gone from backups within a further 30 days. On request before closing, we provide an archive of your PDFs within 30 days.
• We do not delete a suspended account without first emailing you so you can export its data.

10. Information and audits

We give you the information you need to show that we meet this agreement, including answering a reasonable security questionnaire. If that is not enough, you or an auditor you appoint may audit our processing with 30 days' notice, at most once a year, during business hours and without disrupting the service, at your cost. We will take part in good faith.

11. Liability, term and law

• Liability under this agreement is subject to the limitation of liability in the terms of service, except where data protection law does not allow it to be limited.
• This agreement applies for as long as we process data for you and is governed by the laws of Spain, with the courts of Málaga, Spain having jurisdiction, in the same way as the terms of service.
• If this agreement and the terms of service conflict about personal data, this agreement wins.
• Questions about this agreement, or a signed copy for your records: [email protected].