Data Processing Agreement

Terms not defined here have the meaning given in the Agreement or in the GDPR. "Applicable Data Protection Law" means the laws that apply to the processing, including the EU GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, US state privacy laws and the Bangladesh Personal Data Protection Act, 2026.

The Customer is the controller of personal data it submits or that a Signer submits at the Customer's request. KTL is the processor. KTL is an independent controller for the account, billing and website data described in its Privacy Policy.

KTL processes personal data only on the Customer's documented instructions, including those given by configuring and using the Service, and as required by law. KTL will tell the Customer if it believes an instruction infringes Applicable Data Protection Law. KTL does not sell personal data, does not use it for advertising, does not use it to train artificial intelligence models and does not send it to any AI provider.

KTL ensures that personnel authorized to process personal data are bound by confidentiality obligations.

KTL implements the measures in Annex II. KTL may update them provided the overall level of security is not materially reduced.

The Customer authorizes KTL to engage the subprocessors listed at signingus.com/subprocessors. KTL will publish any new subprocessor there at least 30 days before it processes personal data. The Customer may object on reasonable data protection grounds during that period by writing to privacy@signingus.com; if the objection cannot be resolved, the Customer may terminate the affected subscription and receive a refund of prepaid fees for the unused period. KTL imposes data protection obligations on each subprocessor and remains liable for them.

KTL will assist the Customer, by appropriate measures, to respond to requests from data subjects, including Signers. If a data subject contacts KTL directly, KTL will refer the request to the Customer without undue delay.

KTL hosts the Service with Amazon Web Services in the United States and stores documents with Cloudflare. KTL personnel in Bangladesh access personal data to develop, operate and support the Service. For transfers from the EEA, the UK or Switzerland, the European Commission's standard contractual clauses, Module Two (controller to processor), are incorporated by reference, with Clause 7 applying, Clause 9 option 2 with the notice period in section 6, Clause 17 governed by Irish law and Clause 18 naming the courts of Ireland. For the UK, the International Data Transfer Addendum applies; for Switzerland, references to the GDPR are read as references to the Swiss Federal Act on Data Protection. Annex I and Annex II to this DPA are the annexes to the clauses. KTL does not rely on the EU-US Data Privacy Framework.

KTL will notify the Customer without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach affecting the Customer's personal data, and will provide the information the Customer reasonably needs to meet its own obligations.

The Customer may remove individual documents from its account at any time and request their permanent deletion. On termination, the Customer may download its documents for at least 30 days. KTL will delete the Customer's personal data within 30 days of a verified written request to privacy@signingus.com, except where the law requires retention. Copies in backups are removed as backups expire.

KTL will make available the information reasonably necessary to demonstrate compliance with this DPA. The Customer may carry out an audit no more than once in any twelve months, or following a personal data breach, on 30 days written notice, during business hours, subject to confidentiality and at its own cost.

KTL will provide reasonable assistance with data protection impact assessments and prior consultations relating to the Service.

Where US state privacy laws apply, KTL acts as a service provider or processor, will not sell or share personal data, will not use it for any purpose other than providing the Service, and will not combine it with other data except as those laws permit.

Liability under this DPA is subject to the limitations in the Agreement, except where the law prohibits such limitation. Where the standard contractual clauses apply and conflict with this DPA, the clauses prevail.

This DPA takes effect when the Customer accepts the Agreement and continues while KTL processes the Customer's personal data. A countersigned copy is available on request at legal@signingus.com. KTL may update this DPA for a change in law or in the Service, without materially reducing its protections, on 30 days notice.

Contact: privacy@signingus.com · Khulna Technologies LLC, 4520 East-West Highway #780, Bethesda, MD 20814, United States