Data Processing Agreement (DPA)
Language: This text is available in German and English. The German version is legally binding. The English version is a translation for your convenience.
Last updated: 18.10.2026 · Version 1.0
This Data Processing Agreement under Art. 28 GDPR is part of the Terms of Service between you (the Customer, controller) and signround – Inh. Eray Yilmaz, Europaring 90, 53757 Sankt Augustin, Germany (signround, processor). It applies when you use signround for business and signround processes personal data on your behalf. You accept it together with the Terms. No separate signature is needed.
1. Subject and duration
signround processes personal data to provide the signing service described in the Terms. This DPA runs as long as signround processes personal data for you. Details are in Annex 1.
2. Instructions
- signround processes personal data only on your documented instructions. The Terms, this DPA and your settings and actions in the app are your instructions. This includes transfers to third countries, unless EU or member state law requires otherwise (Art. 28(3)(a) GDPR).
- signround tells you without delay if it believes an instruction breaks data protection law.
3. Confidentiality
Everyone at signround with access to the data is bound to confidentiality.
4. Security
signround takes the technical and organisational measures in Annex 2 (Art. 32 GDPR). It may update them if the level of protection does not go down.
5. Subprocessors
- You give general permission to use subprocessors. The current list is at Subprocessors.
- signround announces new or replaced subprocessors at least 30 days in advance on that page and by email to account holders. You may object for good reason within this period. If we cannot find a solution, you may end the contract before the change.
- signround binds each subprocessor to the same data protection duties as in this DPA and stays responsible for them.
6. Transfers outside the EU
Transfers to third countries take place only under Art. 44 ff. GDPR, in particular under an adequacy decision (e.g. EU-US Data Privacy Framework) or EU Standard Contractual Clauses.
7. Support for you
signround helps you, as far as possible and taking the nature of processing into account:
- To answer requests from data subjects (Art. 12–22 GDPR). If a data subject contacts signround, signround forwards the request to you and does not answer it itself.
- With security, breach notifications, data protection impact assessments and prior consultation (Art. 32–36 GDPR).
8. Data breaches
signround informs you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting your data. It gives you the information it has, so that you can meet your own duties (Art. 33, 34 GDPR).
9. Deletion at the end
When the contract ends, signround deletes all your personal data after 30 days, unless the law requires storage. You can download your documents before then. Data in backups is overwritten in the normal backup cycle.
10. Proof and audits
signround gives you the information needed to show compliance with Art. 28 GDPR. You may check compliance, normally through written questions or documents. On-site audits are possible with 30 days' notice, during business hours and at your cost, and at most once a year unless there is a breach.
11. Your responsibilities
You are responsible for the lawfulness of the processing, including informing your signers (Art. 13, 14 GDPR) and your right to upload documents and invite signers.
12. Liability and precedence
Liability follows Art. 82 GDPR and the Terms. If this DPA conflicts with the Terms on data protection, this DPA prevails.
Annex 1 – Details of processing
| Purpose | Uploading documents, preparing fields, sending signing invitations and reminders, collecting electronic signatures, creating the completed PDF and audit trail, storing them |
| Kind of processing | Collecting, storing, organising, transmitting, combining, deleting |
| Data subjects | Customer's users; signers and other recipients invited by the Customer; persons named in uploaded documents |
| Types of data | Names, email addresses, signature images, field entries, document content, IP addresses, browser details, timestamps, hashes, email delivery status |
| Special categories | Not intended. If documents contain them, the Customer is responsible for this. signround stores signatures as images only, without biometric data |
| Storage period | Until the Customer deletes the document or the account; see section 9 |
Annex 2 – Technical and organisational measures (Art. 32 GDPR)
- Access control: login for all account features; access controls on every database table (row-level security); private file storage; short-lived download links.
- Signing links: random tokens, stored only as hashes, expire when the document is completed, declined, voided or expired.
- Encryption: TLS for all connections; encryption at rest at our hosting providers.
- Integrity: SHA-256 hash of the original and completed document; audit trail that can only be added to.
- Location and availability: storage in the EU (database and files in Frankfurt); server functions in the USA (Netlify on AWS, Ohio) without permanent storage; backups according to the database provider's plan, kept for at most 7 days.
- Data minimisation: no tracking, no analytics; no document content or signatures in logs; technical logs deleted after 30 days.
- Misuse protection: rate limits on public endpoints; secrets only on the server.
- Review: measures are checked when the service changes, at least once a year.
Annex 3 – Subprocessors
See Subprocessors.