Data Processing Addendum (draft)
A draft addendum for GDPR Article 28. It has not been reviewed by counsel and is not executable in this form.
Proprietário editorial: Security + Growth. Última revisão 2026-09-20. Cadência de revisão: 90 days.
Status of this draft
This text is published early so that a privacy or procurement team can see the shape of the commitment before a call. It is a draft: it has not been reviewed by legal counsel, it is not an offer, and signing a copy of this page does not create an agreement.
It is also not legal advice. Your own counsel should decide whether these terms meet your obligations in your jurisdiction.
1. Roles and subject matter
You are the controller for the personal data you send through the platform. EndorsedSign is the processor and acts on your documented instructions. The subject matter is the provision of electronic signing, delivery, and record-keeping. Processing runs for the term of your subscription plus the retention period you configure.
2. Categories of data and data subjects
Data subjects are your staff and the recipients you invite to sign. Categories include identifiers such as name, email address, and phone number; the content of the documents you upload; signing event records such as timestamps, IP address, and user agent; and authentication data such as the result of a one-time passcode check. Special category data may be present in documents where your use case involves it, and you decide whether to send it.
3. Instructions and purpose limitation
We process personal data only to provide the service, to keep it secure, and to comply with law. We do not use your documents or your signers to train models, to build profiles, or for our own marketing. If an instruction appears to conflict with applicable law, we will raise it with you rather than act on it quietly.
4. Security measures
We apply appropriate technical and organisational measures. The measures currently implemented in the product are:
- Role-based access control, with a named permission checked before each action
- Multi-factor authentication, and OIDC single sign-on for staff accounts
- Tenant scoping on every tenant-owned record
- Encryption in transit, and encryption at rest for stored files
- Append-only audit records with correlation identifiers
- Short-lived access tokens with revocation
- Allowed-origins control per tenant
5. Sub-processors
We use the sub-processor functions published on the sub-processors page, and we impose data protection terms on each one that are no less protective than this addendum. Vendor identities are provided on request under a non-disclosure agreement. We will tell you about an addition and allow a reasonable period to object.
6. Assistance with data subject rights
The product provides subject-access export and per-tenant retention controls, so you can answer most requests without us. Where you cannot, we will assist within a reasonable period, taking the nature of the processing into account.
7. Personal data breach
We will notify you without undue delay after becoming aware of a personal data breach affecting your data, and provide the information you need for your own Article 33 and Article 34 notifications as it becomes available.
A documented incident response and breach notification procedure is still being written. Until it exists, this clause is a contractual undertaking rather than a rehearsed procedure, and we would rather write that here than imply a maturity we have not reached.
8. International transfers
Where personal data moves outside the EEA or the UK, the transfer relies on an adequacy decision or on the Standard Contractual Clauses, with a transfer impact assessment where required. EU-only residency can be configured for eligible plans and regulated workflows.
9. Deletion and return
On termination you can export your data. After the retention period you configure, or on your written instruction, we delete or return personal data unless law requires us to keep it. Deletion of protected health information follows the two-person process described in the business associate agreement.
10. Audits and information
We will answer reasonable security questionnaires and provide the documents in this trust centre. SOC 2 evidence and supporting materials are shared through procurement and security review under a non-disclosure agreement.
11. Precedence, and how to execute
Where this addendum conflicts with the terms of service, this addendum governs for the processing of personal data. To move from draft to signature, email partnerships@endorsedsign.com with your entity name, the jurisdictions involved, and any clauses you require. The executed version is countersigned and versioned rather than edited in place.