Data processing agreement (DPA)

Preamble and conclusion of the agreement

This data processing agreement (hereinafter "DPA") specifies the data protection obligations of the parties arising from the contract for the use of the SmartDocs platform (hereinafter "Main Contract", cf. the General Terms and Conditions). It is concluded between the customer as controller within the meaning of Art. 4 (7) GDPR (hereinafter "Controller") and

SmartDocs, owner Ahmet Zambak
Sömmeringstraße 18
10589 Berlin
Germany

as processor within the meaning of Art. 4 (8) GDPR (hereinafter "Processor"). The DPA is concluded in electronic form (Art. 28 (9) GDPR) upon completion of registration and forms part of the Main Contract. The version published on this page at the relevant time applies; changes are announced in accordance with § 10 of the GTC.

§ 1 Subject matter and duration of the processing

(1) The Processor processes personal data on behalf of the Controller in order to provide the SmartDocs platform for electronic signature requests. The subject matter, nature and purpose of the processing, the categories of personal data and the categories of data subjects are set out in Annex 1.

(2) The duration of the processing corresponds to the term of the Main Contract. § 8 (Deletion and return) remains unaffected.

§ 2 Controller's right to issue instructions

(1) The Processor processes personal data exclusively on documented instructions from the Controller, unless it is required to do so by Union or Member State law; in such a case, the Processor informs the Controller of that legal requirement before processing, unless that law prohibits such information (Art. 28 (3) (a) GDPR).

(2) Instructions are generally given through the use of the functions of the platform (in particular creating, sending, completing and deleting signature requests). Instructions going beyond this require text form.

(3) The Processor informs the Controller without undue delay if, in its opinion, an instruction infringes the GDPR or other data protection provisions.

§ 3 Confidentiality

The Processor ensures that the persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28 (3) (b) GDPR).

§ 4 Technical and organizational measures

(1) The Processor takes the technical and organizational measures pursuant to Art. 32 GDPR described in Annex 2 and develops them further in line with the state of the art. Any reduction of the level of protection is excluded.

(2) If special categories of personal data under Art. 9 GDPR are processed on behalf of the Controller (for example health data in consent forms or medical history questionnaires), the measures in Annex 2 also apply to this data. Ensuring a legal basis under Art. 9 (2) GDPR is the responsibility of the Controller.

§ 5 Subprocessors

(1) The Controller grants general authorization (Art. 28 (2) GDPR) for the engagement of the subprocessors listed in Annex 3.

(2) The Processor informs the Controller in text form at least four weeks before adding or replacing a subprocessor. The Controller may object to the change for an important reason relating to data protection law; in the event of an objection, both parties have an extraordinary right to terminate the Main Contract.

(3) The Processor imposes on each subprocessor by contract the same data protection obligations as are set out in this DPA (Art. 28 (4) GDPR). For transfers to third countries, the Processor ensures appropriate safeguards under Chapter V GDPR (in particular EU Standard Contractual Clauses or an adequacy decision such as the EU-US Data Privacy Framework).

§ 6 Assistance to the Controller

(1) The Processor assists the Controller by appropriate technical and organizational measures in responding to requests from data subjects under Chapter III GDPR (access, rectification, erasure, restriction, data portability, objection) (Art. 28 (3) (e) GDPR). The Processor forwards requests from data subjects that it receives directly to the Controller without undue delay.

(2) Taking into account the nature of the processing and the information available to it, the Processor assists the Controller in complying with the obligations under Art. 32 to 36 GDPR (data security, notification of breaches, data protection impact assessment, prior consultation) (Art. 28 (3) (f) GDPR).

§ 7 Notification of personal data breaches

The Processor notifies the Controller of any personal data breach affecting data processed on behalf of the Controller without undue delay after becoming aware of it (Art. 33 (2) GDPR). Where available, the notification contains the information pursuant to Art. 33 (3) GDPR.

§ 8 Deletion and return

(1) During the term of the contract, the Processor deletes data processed on behalf of the Controller when the Controller initiates this via the platform functions or instructs it in text form.

(2) After termination of the Main Contract, the Processor makes the Controller's documents and evidence data available to the Controller for export for a period of 30 days. After this period has expired, all personal data processed on behalf of the Controller is deleted, unless Union law or Member State law requires storage (Art. 28 (3) (g) GDPR). Data in backup copies is overwritten or deleted in the regular backup cycle.

§ 9 Evidence and audits

(1) The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR (Art. 28 (3) (h) GDPR), in particular this version of the agreement, the TOM documentation (Annex 2) and the list of subprocessors (Annex 3).

(2) The Controller may carry out audits, including inspections, or have them carried out by a suitable auditor bound to confidentiality. Audits take place after reasonable advance notice, during normal business hours and no more than once a year, unless a specific reason justifies a more frequent audit. Priority is given to existing evidence (certificates of the data center operators, audit reports, documentation).

§ 10 Liability and final provisions

(1) § 8 of the GTC applies to liability; Art. 82 GDPR remains unaffected.

(2) In the event of contradictions between this DPA and the Main Contract, the provisions of this DPA take precedence in matters of data protection law.

(3) The law of the Federal Republic of Germany applies. Should individual provisions be invalid, the validity of the remaining provisions remains unaffected.

Annex 1: Subject matter of the processing

Subject matter and purpose:

Provision of a platform for creating, sending, carrying out and managing electronic signature requests, including identity verification by one-time code (OTP), evidence documentation (audit trail) and document management.

Nature of the processing:

Collection, storage, display, transmission to signers, sending of notifications and one-time codes, logging, deletion.

Categories of data subjects:

• employees and agents of the Controller (user accounts, operators),
• signers (customers, patients, contractual partners of the Controller),
• other persons whose data is contained in the processed documents.

Categories of personal data:

• master data (name, email address, mobile phone number),
• document content and field data entered by signers,
• signature images,
• evidence and log data (IP address, timestamp, device data, delivery and open events, one-time code verification, version of the notice texts displayed),
• depending on the document content, special categories under Art. 9 GDPR (in particular health data, for example in consent forms and medical history questionnaires).

Annex 2: Technical and organizational measures (Art. 32 GDPR)

1. Encryption and pseudonymization

• Transport encryption of all connections via TLS.
• Encryption of server storage media (encryption of data at rest).
• Object storage (Cloudflare R2) with server-side encryption of data at rest.
• Passwords are stored exclusively as cryptographic hashes (bcrypt).
• Document access via short-lived, signed URLs.

2. System and data access control

• Administrative server access exclusively via SSH keys, restricted to the owner; no password login.
• Role-based permissions in the platform (owner, admin, member) per organization; tenant separation at the organization level.
• API keys can be revoked at any time.
• Authentication tokens are stored in secure storage on end devices (iOS Keychain / Android Keystore); no documents or signature data remain on kiosk devices after a signature request has been completed.

3. Integrity and traceability

• Tamper-evident audit trail: log events are chained via a cryptographic hash chain (SHA-256); subsequent changes are detectable.
• Completed documents are referenced with checksums (SHA-256).
• Logging of security-relevant events.

4. Availability and resilience

• Regular automated, encrypted data backups.
• Operation in an ISO 27001 certified data center in Germany (Nuremberg).
• Recovery procedures in the event of incidents.

5. Procedures for regular review

• Continuous updating of the software and dependencies used.
• Regular review of the measures in this annex and of the subprocessors.
• Deletion policy: deletion after the end of the contract in accordance with § 8; log data is automatically deleted after a short time.

Annex 3: Subprocessors

• Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany: hosting of the application and database (Nuremberg data center). Processing in Germany.
• Cloudflare, Inc. (USA): Cloudflare R2 object storage for document files with a storage location in the European Union, as well as delivery of the website. Third-country safeguards: EU Standard Contractual Clauses, EU-US Data Privacy Framework.
• Netlify, Inc. (USA): delivery of the web interfaces; for the signing interface, forwarding of the API calls. Third-country safeguards: EU Standard Contractual Clauses.
• AC PM LLC (Postmark), an ActiveCampaign, LLC company (USA): email delivery (invitations, status notifications, account notifications). Third-country safeguards: EU-US Data Privacy Framework, EU Standard Contractual Clauses.
• seven communications GmbH & Co. KG (seven.io), Willestraße 4-6, 24103 Kiel, Germany: SMS delivery of one-time codes (OTP). Processing in Germany.

We answer questions about this DPA at kontakt@smartdocs.de. On request, we also provide this DPA as a countersigned document.