Data Processing Addendum

Last updated: October 9, 2026

This Data Processing Addendum ("DPA") forms part of the SimplySigned Terms of Service between SimplySigned, LLC, a Massachusetts limited liability company ("SimplySigned", "we", "us", or "our") and the business that has created an account ("Customer"). It applies whenever we process personal data on Customer's behalf in providing the Services. If there is a conflict between this DPA and the Terms, this DPA controls for matters concerning personal data.

1. Roles

For personal data that Customer enters, imports, or generates in the App about its leads, clients, recipients, and signers ("Customer Personal Data"), Customer is the controller (or "business" under U.S. state privacy laws) and SimplySigned is the processor (or "service provider") acting on Customer's documented instructions. For Customer account, billing, and usage data, SimplySigned is the controller as described in our Privacy Policy.

2. Processing details

  • Subject matter: provision of the Services described in the Terms.
  • Duration: the term of Customer's account plus the deletion period in Section 8.
  • Nature and purpose: lead capture, agreement creation, signing-link delivery by SMS and email, electronic signature collection, PDF generation, conversion event reporting, and CRM synchronization, each as configured by Customer.
  • Categories of data subjects: Customer's leads, clients, recipients, and signers.
  • Categories of personal data: names, email addresses, phone numbers, lead source and ad click identifiers, agreement contents, electronic signatures, IP addresses and timestamps in audit trails, and any sensitive information a Customer includes in an agreement, such as government identification numbers or financial details.

3. Our obligations

We will:

  • Process Customer Personal Data only on Customer's documented instructions, which include the Terms, this DPA, and Customer's use of the App's features, unless required by law.
  • Not sell Customer Personal Data, share it for cross-context behavioral advertising, retain, use, or disclose it outside our direct business relationship with Customer, or combine it with personal data from other sources, except as permitted for service providers under applicable law.
  • Use Customer Personal Data only to provide, maintain, secure, and improve the Services.
  • Comply with the U.S. state privacy laws that apply to us as a service provider or processor, and tell Customer if we determine we can no longer meet those obligations.
  • Ensure personnel with access are bound by confidentiality obligations.
  • Maintain the security measures described in Section 5.
  • Assist Customer in responding to data subject requests and in meeting its security, breach notification, and impact assessment obligations, taking into account the nature of the processing.
  • Delete or return Customer Personal Data as described in Section 8.
  • Make available information reasonably necessary to demonstrate compliance with this DPA.

Customer may, on notice to us, take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data.

4. Customer's obligations

Customer is responsible for the lawfulness of the Customer Personal Data it provides, including having a lawful basis to collect it, providing any required privacy notices to data subjects, and obtaining any consents required to contact recipients by SMS or email, to collect electronic signatures, and to send conversion events to advertising platforms.

5. Security

We implement appropriate technical and organizational measures to protect Customer Personal Data, including: encryption in transit (TLS) and at rest; role-based access controls with organization-level isolation enforced at the database layer; authentication through a dedicated identity provider; least-privilege access for our personnel; platform-level access logging; and use of subprocessors that maintain independent security certifications.

6. Subprocessors

Customer authorizes us to engage the subprocessors listed at simplysigned.co/subprocessors. We will give at least 14 days' notice before adding a new infrastructure subprocessor by updating that page and, for Customers who have requested it, by email. If we must replace a subprocessor urgently to maintain security or availability, we will give notice as soon as reasonably possible. Customer may object on reasonable data protection grounds within that period; if we cannot resolve the objection, Customer may terminate the affected Services. We remain responsible for our subprocessors' performance of this DPA.

7. Data subject requests

If we receive a request from a data subject relating to Customer Personal Data, we will promptly forward it to Customer and will not respond directly except to confirm the request relates to Customer, unless required by law. We will provide reasonable assistance, including tools in the App to locate, export, correct, and delete records.

8. Deletion and return

During the term, Customer can export leads and agreements as CSV, download signed agreements as PDF, and delete records and organizations from within the App. For 30 days after termination Customer may request an export by email. After that period we delete Customer Personal Data from active systems within 30 days, and from backups on their rolling overwrite schedule, except where retention is required by law or to preserve a signed agreement as a legal record for the other party.

9. Breach notification

We will notify Customer without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data, and will provide information reasonably available to help Customer meet its own notification obligations.

10. Audits

On written request no more than once per year, we will provide a written description of our security measures and relevant subprocessor certifications. Where a regulator or applicable law requires an on-site audit, the parties will agree on scope, timing, and confidentiality in advance, and Customer will bear its own costs.

11. Location of processing

Customer Personal Data is processed in the United States. The Services are intended for Customers in the United States and are not designed for personal data subject to the GDPR or UK GDPR. A Customer that needs to process such data should contact us before doing so.

12. Liability

Each party's liability under this DPA is subject to the limitations of liability in the Terms.

13. Contact

Data protection requests and questions about this DPA: email info@simplysigned.co.