1.1 Purpose

This Data Processing Agreement (“DPA”) sets out the terms under which SUBNOTO SAS (“Subnoto” or the “Processor”) processes personal data on behalf of the professional customer (the “Customer” or the “Controller”) in connection with the electronic signature services described in the Terms of Use (subnoto.com/terms) and the General Terms and Conditions of Sale (subnoto.com/terms-of-sale).

1.2 GDPR Article 28

This DPA constitutes the written contract required by Article 28 of Regulation (EU) 2016/679 (GDPR) and by applicable French data protection law. It forms an integral part of the contract between the parties, together with the ToU and the GTCS.

1.3 Hierarchy

On personal-data processing in Subnoto’s capacity as processor, this DPA prevails over the ToU and the GTCS. On commercial, pricing, liability-cap and termination matters, the GTCS prevail. Subnoto’s processing as controller of Account-related data is described in the privacy policy at subnoto.com/privacy and is outside the scope of this DPA.

Terms defined in the ToU or the GTCS have the same meaning in this DPA. In addition:

3.1 Processor

In providing the services, Subnoto acts as processor for Document Personal Data. The Customer is the controller of that data. Subnoto processes Document Personal Data only to the extent strictly necessary to provide the services.

3.2 Controller processing by Subnoto

Subnoto acts as controller for Account-related data (subscription management, billing and support). That processing is not governed by this DPA.

3.3 No instruction to process as controller

Nothing in this DPA transfers controllership of Document Personal Data to Subnoto. Subnoto claims no intellectual property rights over Documents.

4.1 Subject-matter and nature

The processing consists of hosting, transmitting, displaying, timestamping and cryptographically processing Documents and related envelope data in order to collect electronic signatures and generate evidence folders. Document contents and certain associated metadata are processed exclusively inside Secure Enclaves and remain encrypted; they are not visible in plaintext to Subnoto, its hosting provider or third parties. Operational metadata required to operate the service (for example recipient contact details used to send notifications) may be processed outside the Enclave.

4.2 Purpose

The purpose is the performance of the electronic signature services subscribed by the Customer.

4.3 Duration

Processing lasts for the term of the contract and the retention periods set out in Article 11 of the GTCS and in Article 12 of this DPA. Cancellation is governed by Article 10 of the GTCS and Article 12.3 of this DPA.

4.4 Categories of data subjects and Personal Data

The Customer determines the content of Documents. Subnoto does not control that content and, by design of the Secure Enclaves, cannot view it in plaintext.

4.5 Special categories of data

The Customer shall not instruct Subnoto to process special categories of data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR) unless the Customer has a lawful basis and has informed Subnoto in writing. The Platform is a general-purpose signing tool and is not designed as a dedicated health, criminal or special-category filing system.

5.1 Documented instructions

Subnoto processes Document Personal Data only on documented instructions from the Customer, including with regard to transfers, unless required to do so by Union or Member State law. In that case Subnoto informs the Customer of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.

The documented instructions are: (i) this DPA; (ii) the ToU and the GTCS; (iii) the Customer’s configuration and use of the Platform (including recipients, Documents and retention resulting from the subscribed plan).

5.2 Purpose limitation

Subnoto does not process Document Personal Data for its own purposes and does not sell Document Personal Data or document contents. By design of the Secure Enclaves, Document contents and Enclave-protected metadata are never available in plaintext to Subnoto, its personnel, its hosting provider or third parties, including for support or troubleshooting.

5.3 Unlawful instructions

If Subnoto considers that an instruction infringes the GDPR or other Union or Member State data protection provisions, it shall immediately inform the Customer.

Subnoto ensures that persons authorised to process Document Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

This obligation is without prejudice to the confidentiality undertaking in Article 15 of the GTCS, which survives termination for five (5) years.

7.1 Appropriate measures

Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, Subnoto implements appropriate technical and organisational measures pursuant to Article 32 GDPR, including:

Further detail is provided in the Security Whitepaper at subnoto.com/security.

7.2 Inaccessibility of Enclave-protected data

Secure Enclaves prevent Subnoto, its hosting provider and third parties from accessing Document contents and Enclave-protected metadata in plaintext. This inaccessibility is architectural and applies at all times. It is not waived by a support request or by any other instruction that would require plaintext access.

7.3 No absolute security

No system is absolutely secure. Subnoto takes reasonable measures as described above and in the GTCS. Liability remains subject to Article 13 of the GTCS.

8.1 General authorisation

The Customer gives Subnoto a general authorisation to engage Sub-processors to the extent necessary to provide the services. Subnoto remains responsible for the performance of those Sub-processors. Sub-processors do not receive Document contents or Enclave-protected metadata in plaintext.

8.2 Current Sub-processors

The Sub-processors used at the date of this DPA, as also listed in the privacy policy, are:

Logs sent to Grafana Cloud do not contain customer data, Document contents or Enclave-protected metadata.

8.3 Changes

Subnoto will update the Sub-processor list when new Sub-processors are added. Any change of hosting provider resulting in a transfer outside the EU will be notified to the Customer with reasonable notice and will not take place without appropriate GDPR safeguards, in accordance with Article 8.2 of the GTCS.

The Customer may object on reasonable data-protection grounds within thirty (30) days of notice of a new Sub-processor. If the parties cannot resolve the objection, the Customer may cancel the subscription in accordance with the GTCS.

8.4 Flow-down

Subnoto imposes on Sub-processors data-protection obligations equivalent to those set out in this DPA, in particular providing sufficient guarantees to implement appropriate technical and organisational measures.

Document contents are hosted in France, in the European Union, in encrypted form. Subnoto does not transfer Document Personal Data to a third country or an international organisation except as required to operate listed Sub-processors (in particular security, performance, email or SMS delivery of operational metadata, or observability) and only where a valid transfer mechanism under Chapter V GDPR applies, including an adequacy decision or standard contractual clauses together with any required supplementary measures. Such transfers do not include Document contents or Enclave-protected metadata in plaintext.

On request, Subnoto provides the Customer with relevant information on the transfer mechanism applicable to a listed Sub-processor.

10.1 Data subject rights

Taking into account the nature of the processing, including that Enclave-protected data are not available to Subnoto in plaintext, Subnoto assists the Customer by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Customer’s obligation to respond to requests for exercising the data subject’s rights in Chapter III GDPR.

Where a data subject contacts Subnoto directly in relation to Document Personal Data, Subnoto forwards the request to the Customer without undue delay and does not respond on the Customer’s behalf unless instructed to do so.

10.2 DPIA and prior consultation

Subnoto assists the Customer, at the Customer’s request and taking into account the nature of processing and the information available to Subnoto, in meeting obligations under Articles 32 to 36 GDPR (security, personal-data breach, data protection impact assessment and prior consultation).

10.3 Channel

Requests under this article are sent to [email protected] or via the GDPR request form linked from subnoto.com/privacy.

Subnoto notifies the Customer without undue delay after becoming aware of a personal data breach affecting Document Personal Data, and in any event no later than forty-eight (48) hours after becoming aware, so that the Customer can meet its own notification duties under Articles 33 and 34 GDPR.

The notification includes, to the extent reasonably available: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address the breach.

Subnoto documents breaches and cooperates with the Customer’s reasonable investigation. Notification under this article is not an admission of liability.

12.1 Retention during the contract

While the subscription remains active, signed documents and associated evidence folders are retained for the periods set out in Article 11 of the GTCS:

For the Free plan, the period runs from account creation. For paid plans, the period runs from the date of the last signature event on the document concerned. No document is retained beyond ten (10) years under any plan. Upon expiry of the applicable period, documents are permanently and irreversibly deleted, subject to any legal retention obligation binding on Subnoto.

The periods in this Article 12.1 apply only while the subscription remains active. They do not survive cancellation. Cancellation ends these periods and triggers the shorter recovery window in Article 12.3.

12.2 Pre-deletion notice

Three (3) months before expiry of the applicable retention period, Subnoto notifies the Customer by email with recovery instructions, as set out in the GTCS.

12.3 End of services

Upon cancellation, the retention periods in Article 12.1 cease to apply. The Customer retains read-only access for six (6) months from the effective cancellation date to recover data, in accordance with Article 10 of the GTCS. Upon written request within that window, a full export in a standard, interoperable format can be provided. After that window, Document Personal Data is permanently deleted, unless Union or Member State law requires storage.

12.4 Return versus deletion

Unless the Customer requests return by export within the applicable window, deletion is the default at the end of the retention or recovery period.

Subnoto makes available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR and this DPA, and allows for and contributes to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer.

Audits are limited to once per twelve (12)-month period, unless a competent supervisory authority requires otherwise or the audit follows a personal data breach attributable to Subnoto. The Customer gives reasonable written notice of at least thirty (30) days, and audits are conducted during business hours, under confidentiality, without disrupting operations and without accessing the content of other customers’ documents.

Because of the Secure Enclaves, audits concern technical and organisational measures, attestations and documentation. They cannot require Subnoto, its hosting provider or third parties to produce Document contents or Enclave-protected metadata in plaintext.

The Customer bears its own audit costs. Subnoto may charge reasonable costs for dedicated support beyond standard documentation already published at subnoto.com/security and subnoto.com/privacy.

The Customer, as controller, is solely responsible for:

The Customer warrants that its instructions comply with applicable data protection law.

Each party’s liability under this DPA is subject to Article 13 of the GTCS, including the liability cap, the exclusion of indirect damages, and the exceptions for gross negligence, wilful misconduct and personal injury.

Nothing in this DPA limits a party’s liability to a data subject where such limitation is prohibited by the GDPR.

This DPA enters into force when the Customer accepts the ToU and the GTCS, or otherwise starts using the Platform, and continues for as long as Subnoto processes Document Personal Data on behalf of the Customer, including during applicable retention and recovery periods.

Subnoto may amend this DPA in accordance with Article 9 of the GTCS. Changes affecting data retention periods or other essential data-protection obligations are material amendments and are notified by email with thirty (30) calendar days’ notice. Continued use after the effective date constitutes acceptance. A Customer who does not accept may cancel without penalty before that date.

18.1 Governing law and jurisdiction

This DPA is governed by French law. Any dispute relating to its formation, interpretation or performance is subject to the exclusive jurisdiction of the Commercial Court of Paris (Tribunal de Commerce de Paris), following a good-faith attempt to resolve the matter amicably within thirty (30) days.

18.2 Language

The contractual language of this DPA is French. In the event of translation, the French text governs.

18.3 Severability

If any provision is held void or unenforceable, the remaining provisions remain in full force.

18.4 Notices

Notices relating to this DPA are made by email to the addresses provided at registration, and to [email protected] for Subnoto. The GDPR request form linked from subnoto.com/privacy may be used for data-subject and compliance requests.

18.5 Entire agreement on processing

This DPA, together with the ToU, the GTCS and the privacy policy for Subnoto’s controller activities, constitutes the entire agreement between the parties regarding the processing of Document Personal Data.