Data Processing Agreement

1. Parties and roles

For workforce personal data that the Customer uploads to or generates in the Service (names, work email addresses, department and station, documents assigned, notifications sent and acknowledgement records), the Customer is the controller and SkySign is the processor. Each party will comply with the data protection law that applies to it, including the UK GDPR and Data Protection Act 2018 and, where applicable, the EU GDPR (“Data Protection Law”).

For account-holder, billing and website-visitor data SkySign acts as an independent controller, as described in the Privacy Policy; that processing is outside this DPA.

2. Scope and details of processing

The subject matter, duration, nature and purpose of processing, the types of personal data and the categories of data subject are set out in the Annex.

3. Processing on instructions

• SkySign will process Customer personal data only on the Customer’s documented instructions, which are: to provide the Service as described in the agreement and as configured by the Customer’s administrators in the application; and any further written instructions agreed between the parties.
• SkySign will inform the Customer if, in its opinion, an instruction infringes Data Protection Law, unless prohibited from doing so.
• SkySign will not use Customer personal data for its own purposes, sell it, or use it for advertising or for training machine-learning models.

4. Confidentiality

SkySign will ensure that persons authorised to process Customer personal data are bound by confidentiality obligations, and that access is limited to those who need it to provide, support and secure the Service.

5. Security measures

SkySign will implement and maintain appropriate technical and organisational measures, which at the date of this DPA include those described on the Security & Trust page:

• encryption of data in transit (TLS) and at rest;
• per-organisation access control enforced in the database (Row Level Security) and in the application;
• private document storage with time-limited signed access links;
• role-based permissions, a minimum password length of 12 characters and database-level protection against role escalation;
• acknowledgement records that cannot be edited once made, and an audit log of key administrative actions;
• automated backups managed by the database provider.

SkySign may update these measures from time to time provided the overall level of protection is not reduced.

6. Subprocessors

• The Customer gives general authorisation for SkySign to engage the subprocessors listed at useskysign.com/subprocessors as at the date of this DPA.
• SkySign will give the Customer at least [notice period, e.g. 30 days — to be confirmed] notice before engaging a new subprocessor that will process Customer personal data, by updating that page and emailing the Customer’s administrators. The Customer may object on reasonable data-protection grounds within that period; if the objection cannot be resolved, the Customer may terminate the affected part of the Service without penalty.
• SkySign will impose data-protection obligations on each subprocessor that are no less protective than those in this DPA, and remains responsible for their performance.

7. International transfers

SkySign’s primary database and file storage are located in [Supabase project region — to be confirmed]. Where Customer personal data is transferred to a subprocessor outside the UK or EEA, SkySign will ensure an appropriate transfer mechanism is in place, such as the provider’s standard contractual clauses with the UK International Data Transfer Addendum where required. [Confirm the mechanism for each subprocessor — to be confirmed].

8. Data subject requests

Taking into account the nature of the processing, SkySign will assist the Customer with appropriate technical and organisational measures to respond to requests from data subjects exercising their rights. The application lets administrators view, export, correct and delete workforce data directly. If SkySign receives a request directly from a data subject it will, where lawful, refer the request to the Customer within [number of days — to be confirmed] and not respond further except on the Customer’s instructions.

9. Personal data breach notification

SkySign will notify the Customer without undue delay, and in any event within [hours, e.g. 48 — to be confirmed] hours of becoming aware, of a personal data breach affecting Customer personal data. The notification will describe, so far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. SkySign will provide further information as it becomes available and will cooperate with the Customer’s own notification obligations.

10. Assistance and records

• SkySign will assist the Customer, taking into account the nature of the processing and the information available to it, with data protection impact assessments and prior consultation with a supervisory authority where required.
• SkySign will maintain records of its processing activities as required by Data Protection Law and make them available to the Customer on reasonable request.

11. Return and deletion of data

• During the term, the Customer can export acknowledgement records as CSV at any time.
• On termination or expiry, the Customer may delete its organisation from the application, which removes documents, acknowledgement records and workforce accounts immediately. Otherwise SkySign will delete Customer personal data within [number of days — to be confirmed] of termination, unless retention is required by law.
• Residual copies in provider backups are overwritten in line with the provider’s backup retention cycle and are not restored except for disaster recovery.

12. Audit rights

SkySign will make available the information necessary to demonstrate compliance with this DPA, including the Security & Trust page, the subprocessor list and responses to reasonable security questionnaires. Where that information is insufficient, the Customer (or an independent auditor bound by confidentiality) may audit SkySign’s compliance no more than once per year on [notice period — to be confirmed] written notice, during business hours, in a manner that does not unreasonably disrupt SkySign’s operations or compromise other customers’ data. SkySign does not currently hold ISO 27001 or SOC 2 certification; subprocessor reports may be relied on for infrastructure controls.

13. Liability and term

This DPA applies for as long as SkySign processes Customer personal data. Each party’s liability under this DPA is subject to the limitations and exclusions in the main agreement, [confirm with counsel whether a separate cap applies to data-protection liability — to be confirmed]. This DPA is governed by the same law as the main agreement.

14. Annex: processing details