Data Processing Agreement
Last updated: [DATE]
This Data Processing Agreement ("DPA") forms part of the SigMonster Terms of Service (the "Terms") between SigMonster Pty. Ltd. (ABN 49 639 500 299, ACN 639 500 299) ("SigMonster", "Processor") and the customer organisation that has accepted the Terms ("Customer", "Controller"). It applies where SigMonster processes personal data on the Customer's behalf that is subject to the EU GDPR or UK GDPR ("Data Protection Law").
1. Definitions
Terms such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given in Data Protection Law. "Customer Personal Data" means personal data the Customer, its administrators or its Members provide to the Service and that SigMonster processes on the Customer's behalf.
2. Roles
2.1 The Customer is the controller, and SigMonster is the processor, of Customer Personal Data.
2.2 SigMonster is an independent controller of personal data it processes for its own business purposes (such as account administration, billing, security, analytics and its own marketing), as described in its Privacy Policy. This DPA does not apply to that data.
3. Details of processing
- Subject matter: providing the SigMonster email signature service.
- Duration: the term of the Customer's use of the Service, plus the deletion periods in clause 11.
- Nature and purpose: storing, rendering, hosting and deploying email signatures, including generating signature images and applying signatures to Members' mailboxes; providing support.
- Data subjects: the Customer's Members (employees, contractors and others the Customer adds), and its administrators.
- Categories of data: name, job title, department, email address, phone numbers, postal or office address, photograph, social media links, account identifiers from sign-in providers, and any other content the Customer or Members choose to include in signatures.
Special category data: not intended. The Customer must not include special category data in signatures unless it has a lawful basis and accepts that signature content is publicly visible to email recipients.
4. Customer instructions
4.1 SigMonster processes Customer Personal Data only on the Customer's documented instructions, including as set out in the Terms, this DPA and the Customer's configuration of the Service, unless required otherwise by law. In that case, SigMonster will tell the Customer before processing, unless the law prohibits it.
4.2 SigMonster will tell the Customer if it believes an instruction breaches Data Protection Law.
4.3 The Customer is responsible for having a lawful basis, and any notices or consents required, for providing Customer Personal Data to SigMonster and for applying signatures to Members' mailboxes.
5. Confidentiality
SigMonster ensures that anyone authorised to process Customer Personal Data is bound by confidentiality obligations.
6. Security
6.1 SigMonster implements appropriate technical and organisational measures, including:
- encryption of data in transit and at rest;
- strictly limited, need-to-know access controls;
- storage of credentials and secrets in secure key vaults;
- self-hosting of identity and authentication services;
- web server logs deleted within 7 days at most;
- backups kept for no more than 30 days.
6.2 The Customer acknowledges that signature images are, by design, publicly accessible to anyone with the image link, including email recipients.
7. Sub-processors
7.1 The Customer gives general authorisation for SigMonster to use sub-processors. Current sub-processors are:
| Sub-processor | Purpose | Location |
|---|---|---|
| Linode (Akamai) | Application hosting and databases | United States |
| Cloudflare | Content delivery and signature image hosting | Global |
| Email (support correspondence) | Global | |
| Microsoft, Google, Facebook, Apple | Sign-in (only the provider the user chooses) | Global |
7.2 SigMonster will give the Customer at least 30 days' notice [CHECK period] before adding or replacing a sub-processor that processes Customer Personal Data. The Customer may object on reasonable data protection grounds. If the parties can't resolve the objection, the Customer may stop using the affected part of the Service, or terminate, as its sole remedy.
7.3 SigMonster imposes data protection obligations on each sub-processor that are substantially equivalent to this DPA, and remains liable to the Customer for its sub-processors' performance.
8. International transfers
Customer Personal Data is stored in the United States and may be processed in other countries where sub-processors operate. For transfers from the EU, the parties incorporate the EU Standard Contractual Clauses (Module 2, controller to processor, or Module 3 where applicable) [CHECK module and annex completion]. For transfers from the UK, the parties incorporate the UK International Data Transfer Addendum. Where an adequacy decision or other valid mechanism (such as the EU–US Data Privacy Framework for a certified recipient) applies, SigMonster may rely on it instead.
9. Data subject requests
9.1 Taking into account the nature of the processing, SigMonster will help the Customer respond to data subject requests, mainly through the Service's own features.
9.2 If SigMonster receives a request directly from a Member about Customer Personal Data, it will refer the request to the Customer, or, where appropriate, handle it with the Customer's authorisation.
10. Personal data breaches
10.1 SigMonster will notify the Customer without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.
10.2 The notice will include, as far as known: the nature of the breach, categories and approximate numbers of data subjects and records affected, likely consequences, and measures taken or proposed. SigMonster may provide information in stages.
10.3 SigMonster will reasonably help the Customer meet its own breach notification obligations.
11. Return and deletion
11.1 On termination, or on the Customer's request, SigMonster will delete Customer Personal Data through its offboarding process. Confirmed deletion requests are actioned within 24 hours.
11.2 Deleted data is fully removed from backups within 30 days.
11.3 Before termination, the Customer may ask for an export of its data, which SigMonster will provide in a machine-readable format within one month.
11.4 SigMonster may keep data where the law requires it.
12. Assistance and audits
12.1 SigMonster will give the Customer reasonable help with data protection impact assessments and prior consultations with supervisory authorities, where they relate to the Service.
12.2 SigMonster will make available information reasonably necessary to show compliance with this DPA. Audits may be conducted by the Customer or an independent auditor it appoints, no more than once a year, on at least 30 days' written notice, during business hours, at the Customer's cost, and subject to confidentiality. SigMonster may first respond with written answers and documentation, which the Customer will consider in good faith before requesting an on-site audit. [CHECK]
13. Liability
Each party's liability under this DPA is subject to the limitations and exclusions in the Terms, except where Data Protection Law doesn't allow it.
14. Order of precedence
If there is a conflict about the processing of Customer Personal Data, the Standard Contractual Clauses prevail, then this DPA, then the Privacy Policy, then the Terms.
15. Governing law
This DPA is governed by the same law as the Terms (Queensland, Australia), except where Data Protection Law or the Standard Contractual Clauses require otherwise.