Data Processing Agreement

1. Scope

This DPA applies where VedaSign processes personal data on behalf of the customer in connection with the VedaSign document signing service.

2. Data We Process

On your behalf we process: names and email addresses of document recipients, signed document content, IP addresses and timestamps in audit trails.

3. Our Obligations

• Process data only on your documented instructions
• Ensure data is processed only in the UK
• Implement appropriate technical and organisational security measures
• Assist you in responding to data subject requests
• Delete or return data upon termination of the service

4. Security Measures

• 256-bit AES encryption at rest
• SSL/TLS encryption in transit
• Access controls and authentication
• Regular security monitoring

5. Sub-processors

We use the following sub-processors: Stripe Inc (payment processing), Maileroo (transactional email delivery). We will notify you of any changes to sub-processors.

6. Data Retention

We retain your data for the duration of your subscription. Upon cancellation you have 30 days to download your documents. After 30 days all data is permanently deleted.

7. Governing Law

This DPA is governed by the laws of England and Wales.

Contact

privacy@vedasign.uk