Data Processing Agreement
This DPA forms part of the Touch2Sign customer agreement when you process personal data of EU/UK data subjects through the platform. Touch2Sign acts as processor; you (the customer) act as controller for signer and document data you submit.
1. Scope
Applies to personal data processed by Touch2Sign on your behalf to provide eSignature, audit trails, notifications, and related platform services.
2. Processor obligations
- Process data only on documented instructions from you.
- Ensure confidentiality of persons authorised to process the data.
- Implement appropriate technical and organisational security measures.
- Engage sub-processors only under written terms with equivalent protections (see Privacy Policy).
- Assist with data-subject requests, DPIAs, and breach notification as required by GDPR.
- Delete or return personal data at the end of the service, subject to legal retention (signed audit trails typically 7 years).
3. International transfers
Primary processing is in the EU (AWS eu-west-1, Ireland). Transfers outside the UK/EEA use Standard Contractual Clauses or equivalent safeguards where required.
4. Governing documents
The authoritative text, schedules, and PDF are published at app.touch2sign.com/legal/dpa. See also the Privacy Policy and Terms.