Data Processing Agreement

Version 1.0, effective 3 November 2026

This agreement forms part of the DulySign Terms of Service between P3 Technologies Ltd (company number 17180916), registered ("the Processor") and the business using DulySign ("the Controller"). It sets out the terms required by Article 28 of the UK GDPR.

1. Definitions

1.1"Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended or replaced.

1.2"Personal Data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in Data Protection Law.

1.3"Customer Data" means the Personal Data the Processor processes on the Controller's behalf when providing DulySign.

2. Details of the processing

• Subject matter: providing the DulySign electronic signature service.
• Duration: for as long as the Controller uses DulySign, and afterwards until deletion under clause 9.
• Nature and purpose: storing documents, sending signing requests and reminders, sending and checking one time codes, capturing signatures, recording an audit trail, producing signed copies and certificates, and emailing copies.
• Data subjects: the Controller's clients, customers and other people the Controller asks to sign, and anyone named in the documents the Controller uploads.
• Types of Personal Data: names, email addresses, mobile numbers, signature images, IP addresses, device and browser details, dates and times of actions, and any personal data contained in the documents.
• Special category data: DulySign is not designed for special category or criminal offence data. If the Controller uploads documents containing it, the Controller is responsible for having a lawful basis and condition to do so.

3. Processor obligations

3.1The Processor will process Customer Data only on the Controller's documented instructions, which are given by the Controller's use of DulySign and by this agreement, unless the law requires otherwise. If so, the Processor will tell the Controller first unless the law prevents it.

3.2The Processor will tell the Controller if it believes an instruction breaks Data Protection Law.

3.3The Processor will make sure anyone authorised to process Customer Data is bound by confidentiality.

3.4The Processor will take the security measures described in the Schedule.

3.5The Processor will help the Controller, taking into account the nature of the processing, to respond to requests from data subjects exercising their rights, and to meet its obligations on security, breach notification, data protection impact assessments and prior consultation.

3.6The Processor will make available the information needed to show compliance with this agreement and allow for audits by the Controller or an auditor it appoints, on reasonable notice, no more than once a year unless there has been a personal data breach.

4. Sub-processors

4.1The Controller gives general authorisation for the Processor to use the sub-processors listed below. The Processor will give at least 30 days' notice by email of any new sub-processor. The Controller may object on reasonable data protection grounds, and if the parties can't resolve it the Controller may cancel and receive a refund of any prepaid fees for the period after cancellation.

4.2The Processor will put a written contract in place with each sub-processor giving the same level of protection as this agreement, and remains liable for their performance.

5. International transfers

5.1Where Customer Data is transferred outside the UK, the Processor will make sure the transfer is covered by UK adequacy regulations or appropriate safeguards, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses or the UK Extension to the EU-US Data Privacy Framework.

6. Personal data breaches

6.1The Processor will notify the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will include what is known about the nature of the breach, the data and people affected, likely consequences and the steps taken.

7. Controller obligations

7.1The Controller is responsible for having a lawful basis for the processing, for giving data subjects any information required by Data Protection Law, and for the accuracy of the Customer Data it provides.

8. Liability

8.1Each party's liability under this agreement is subject to the limits in the DulySign Terms of Service.

9. Return and deletion

9.1When the Controller stops using DulySign, the Controller can download its documents for 90 days. After that the Processor will delete Customer Data from the live service, and from backups within a further 35 days, unless the law requires it to be kept.

10. Law

10.1This agreement is governed by the law of England and Wales.

Schedule: security measures

• All data encrypted in transit (TLS) and at rest.
• Each customer's data is separated at database level, so one firm can never see another firm's documents.
• Documents are held in private storage and only shared through short-lived signed links.
• Signers must confirm a one time code by text or email before a document opens. Codes expire after 10 minutes and lock after 5 wrong tries.
• Signing links are random, stored only in hashed form, and expire. A reminder replaces the old link.
• The audit trail is append only, hash chained and checked before every certificate is sealed. Records cannot be edited or deleted.
• A fingerprint (SHA-256) of each original and signed file is recorded.
• Staff access to production systems is limited to named people with two factor authentication.
• Daily backups by the hosting provider.