Data Processing Agreement

This Data Processing Agreement (DPA) is between the customer organisation identified in the Scriboflow account or applicable order (Customer) and Scriboflow ApS, Denmark, contactable at privacy@scriboflow.com (Scriboflow).

For Customer Personal Data processed to provide the Service, the Customer is the controller and Scriboflow is the processor. Where the Customer acts as a processor for another controller, Scriboflow is its subprocessor and the Customer confirms that it may appoint Scriboflow on these terms.

Capitalised terms not defined here have the meaning given in the Terms. GDPR means Regulation (EU) 2016/679, and Data Protection Law means the GDPR and other data-protection law applicable to the processing.

This DPA is incorporated automatically into the Scriboflow Terms of Service at /terms-of-service and applies whenever Scriboflow processes Customer Personal Data on the Customer's behalf. It is effective for the Customer when the organisation accepts the Terms or otherwise starts using processing covered by this DPA.

If there is a conflict about processing of Customer Personal Data, this DPA prevails over the Terms. The main body prevails over an annex unless the annex expressly states otherwise. Mandatory Data Protection Law always prevails.

Scriboflow processes Customer Personal Data to host and operate the contract-management and electronic-signing Service, provide support requested by the Customer, maintain security and reliability, and carry out the processing described in Annex II.

Processing continues for the term of the Customer's subscription and any limited period afterwards in which data remains available for export, deletion, legal compliance, dispute handling, or secure removal in accordance with the Terms and this DPA.

Scriboflow will process Customer Personal Data only on documented instructions from the Customer, including the Terms, this DPA, the Customer's configuration and use of the Service, support requests, and other written instructions agreed by the parties, unless EU or Member State law requires processing.

If law requires processing beyond the Customer's instructions, Scriboflow will inform the Customer before processing unless the law prohibits that notice for important public-interest reasons. Scriboflow will promptly inform the Customer if, in its opinion, an instruction infringes Data Protection Law and may suspend the affected processing until the instruction is clarified or changed.

Scriboflow will ensure that persons authorised to process Customer Personal Data are bound by confidentiality obligations or an appropriate statutory duty of confidentiality, receive access only where needed for their work, and receive relevant data-protection and security guidance.

The Customer is responsible for managing its users, roles, sharing, recipients, signing participants, and instructions, and for ensuring that its personnel and invitees use the Service lawfully.

Taking into account the state of the art, implementation costs, and the nature, scope, context, and purposes of processing as well as risks to individuals, Scriboflow will maintain appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to it.

The current verified measures are described in Annex III. Scriboflow may update them as technology and risks change, provided the overall protection is not materially reduced. The Customer must use available security controls, protect credentials, configure permissions appropriately, and notify Scriboflow of suspected compromise.

The Service is not designed for and does not broadly authorise routine processing of special categories of personal data under GDPR Article 9, personal data relating to criminal convictions and offences under Article 10, national identification numbers except where specifically required for an enabled identity service, health records, biometric templates, or similarly high-risk or regulated datasets.

The Customer must not submit such data unless the parties have expressly agreed the relevant use in writing and the Customer has established a lawful basis, safeguards, access restrictions, and any required impact assessment. Incidental appearance of information in a contract does not expand Scriboflow's authorised purposes; the Customer remains responsible for minimising and protecting it.

Taking into account the nature of the processing, Scriboflow will provide reasonable technical and organisational assistance for the Customer to respond to requests to exercise data-subject rights. Available product functions may be used to access, correct, export, restrict, or delete relevant data.

If Scriboflow receives a request relating to Customer Personal Data, it will, where legally permitted, direct the requester to the Customer and will not respond on the Customer's behalf without authorisation. The Customer is responsible for verifying requests and deciding how to respond.

Taking into account the nature of processing and information available to Scriboflow, Scriboflow will provide reasonable assistance with the Customer's obligations concerning security, personal-data breaches, data-protection impact assessments, and prior consultation with supervisory authorities.

Scriboflow may charge reasonable fees for unusually extensive assistance that is not caused by Scriboflow's breach of this DPA, after giving the Customer advance information about the expected work and cost.

Scriboflow will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notice will include available information about the nature of the breach, likely consequences, affected data and individuals, measures taken or proposed, and a contact point. Information may be supplied in phases as it becomes available.

Scriboflow will take reasonable steps to contain, investigate, mitigate, and remediate the breach and will reasonably cooperate with the Customer. A notice is not an admission of fault. The Customer is responsible for notifications to supervisory authorities and individuals unless law assigns that duty to Scriboflow.

On reasonable request, Scriboflow will provide information available to it that the Customer reasonably needs to conduct a data-protection impact assessment for its use of the Service or consult a supervisory authority. The Customer remains responsible for determining whether an assessment or consultation is required and for the content of its submission.

During an active subscription, the Customer may use available export and deletion functions. On termination or a written request made in connection with termination, Scriboflow will, at the Customer's choice and subject to available functionality, return or delete Customer Personal Data and delete remaining copies after applicable operational retention periods, unless law requires continued storage.

Data retained by law will be isolated from further processing except for that legal purpose. Deletion from distributed systems and provider media may take additional time. Customer account deletion does not by itself guarantee deletion of organisation-owned data; an authorised organisation administrator must request or perform organisation-level deletion or return.

Scriboflow will make available information reasonably necessary to demonstrate compliance with GDPR Article 28 and this DPA. The Customer should first use current documentation, questionnaires, summaries, and independent reports that Scriboflow makes available.

Where that information is insufficient, the Customer may request an audit no more than once in any 12-month period, unless a breach, regulator, or credible material concern justifies another audit. Audits must be proportionate, during normal business hours, on reasonable notice, subject to confidentiality and security restrictions, and avoid access to other customers' data. The Customer bears reasonable audit costs unless the audit identifies a material breach by Scriboflow.

The Customer gives general written authorisation for Scriboflow to use the subprocessors in Annex IV and the current public register at /trust/subprocessors. Scriboflow will impose data-protection obligations that provide substantially equivalent protection for Customer Personal Data and remains responsible for its subprocessors' performance to the extent required by Data Protection Law.

Scriboflow will give at least 30 calendar days' notice before a new customer-data subprocessor begins processing, normally by updating the register and using the Customer's registered administrative contact or an in-product notice. The Customer may object during that period on reasonable data-protection grounds.

The parties will work in good faith on a commercially reasonable solution. If none is available, Scriboflow may avoid the disputed processing or the Customer may terminate the materially affected Service before the new subprocessor begins processing. Termination is the Customer's remedy for an unresolved reasonable objection, without limiting mandatory rights.

Scriboflow and its subprocessors may process Customer Personal Data outside the Customer's country and outside the EEA. Scriboflow will not make a restricted transfer unless a lawful transfer mechanism applies, such as an adequacy decision, the EU Standard Contractual Clauses, or another mechanism permitted by Data Protection Law.

Where the EU Standard Contractual Clauses are required for a transfer from the Customer to Scriboflow, Module Two applies when the Customer is a controller and Module Three applies when it is a processor. The optional docking clause applies; the supervisory authority and governing law are determined by the Customer's EEA establishment where legally possible, otherwise Denmark and Danish law; and the annexes to this DPA complete the relevant SCC annexes. If the SCCs conflict with this DPA, the SCCs prevail for that transfer.

This DPA does not apply where Scriboflow independently determines purposes and essential means of processing. As described in the Privacy Policy, these limited activities may include account and business relationship administration, billing and regulated payment coordination, fraud and abuse prevention, service security, legal compliance, establishment or defence of claims, and privacy-request records.

Scriboflow will process that data under the Privacy Policy and applicable law. Scriboflow will not treat contract content as its own marketing data or sell Customer Personal Data.

Each party is responsible for its compliance with Data Protection Law and for damage caused by processing where the law assigns responsibility to it. Between the parties, liability arising from this DPA is subject to the exclusions, limitations, and allocation of liability in the Terms, except to the extent those terms cannot lawfully limit a data subject's rights or mandatory regulatory liability.

This DPA remains in force while Scriboflow processes Customer Personal Data on the Customer's behalf. Provisions that protect retained data or by their nature should survive will continue after termination.

Scriboflow may make editorial or non-material clarifications without renewed acceptance. Material changes are identified through a new legal acceptance revision and require organisation-level acceptance before continued use. No change reduces mandatory rights under Data Protection Law.

This DPA is governed by Danish law, without regard to conflict-of-law rules, and disputes are handled under the forum provision in the Terms. This does not restrict a data subject's or supervisory authority's rights under applicable Data Protection Law, and it does not alter the governing-law or forum selections required by any applicable Standard Contractual Clauses.