What we do with the personal data in your documents

This addendum forms part of the agreement between you and AgreeVia Solutions Ltd, registered in Scotland (company number SC898504), whose registered office is 53 High Street, Bonnyrigg, Midlothian, EH19 2DB, Scotland. Our Terms of Service are the rest of it. Our Privacy Policy explains how we handle the personal data we control.

It takes effect when you create an account and lasts as long as we process personal data on your behalf.

Where this addendum and the Terms of Service disagree on data protection, this addendum wins. On anything else, the Terms win.

In this addendum "UK GDPR", "controller", "processor", "personal data", "processing", "data subject" and "personal data breach" have the meanings given in the UK GDPR and the Data Protection Act 2018. "Customer Personal Data" means personal data we process on your behalf, as described in Annex 1.

You are the controller of the personal data in documents you create, upload or send for signature, and of the personal data of the people you invite to sign. You decide what goes into a document and who receives it.

We are the processor of that data. We act only on your instructions.

We are a separate controller — not your processor — of your account data, your subscription, your support messages, the audit and integrity records the service generates, and, once a document has been completed, the copy of it we keep so that it stays verifiable for every party (section 10). Section 2 of our Privacy Policy covers that data; this addendum does not apply to it.

We process Customer Personal Data only:

• on your documented instructions — this addendum, the Terms of Service, and the operations you carry out in the app;
• to provide and secure the service; and
• where UK or EU law requires something else of us, in which case we'll tell you first unless the law forbids it.

We won't process Customer Personal Data for our own purposes. We won't sell it, and we won't use it to train any AI model.

If we think an instruction from you breaches data protection law, we'll tell you, and we may pause the processing concerned while we resolve it.

The Article 28(3) particulars — subject matter, duration, nature, purpose, categories of data and of data subject — are in Annex 1.

Everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality, by contract or by statute, and that duty survives the end of their engagement. Access is limited to people who need it to run the service.

We implement appropriate technical and organisational measures under Article 32, taking into account the state of the art, the cost of implementation, and the risk to data subjects. Our current measures are in Annex 2.

We may change these measures as the service develops, but not in a way that materially reduces the protection of Customer Personal Data.

You give us general authorisation to engage sub-processors. The current list is Annex 3, kept up to date on this page and in section 7 of the Privacy Policy.

Before adding or replacing a sub-processor we'll give you at least 30 days' notice by email or in the app. If you have a reasonable data-protection objection, tell us within those 30 days and we'll work to resolve it. If we can't, you may terminate the affected part of the service and we'll refund any unused prepaid period.

Every sub-processor is engaged under a written contract imposing obligations no less protective than these. We remain fully liable to you for their performance.

If a data subject contacts us directly about personal data in one of your documents, we'll tell them to contact you and let you know it happened. We won't respond substantively ourselves unless you ask us to or the law requires it.

Taking into account the nature of the processing, we'll help you meet your obligations to data subjects — access, rectification, erasure, restriction, portability and objection. In practice: you can export any document and its evidence package from within the app, and for anything the app doesn't cover, email [email protected] and we will act on your instruction.

Note the limit in section 10: once a document has been signed, erasure is not available to either of us. Where that's the answer, we say so plainly rather than leave a data subject chasing you for something you cannot deliver.

We may charge for assistance that goes materially beyond this, having told you the cost first.

We'll tell you about a personal data breach affecting Customer Personal Data without undue delay, and in any event within 24 hours of becoming aware of it — so you can meet your own 72-hour deadline to the ICO.

Our notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where we can't give all of that at once, we'll give what we have and follow up.

We won't notify the ICO or data subjects on your behalf unless you ask us to.

Taking into account the nature of the processing and the information available to us, we'll give you reasonable assistance with data protection impact assessments and any prior consultation with the ICO arising from your use of AgreeVia.

You can export your documents and their evidence packages at any time from within the app.

Documents cannot be deleted from within AgreeVia. This is deliberate: a signature is only worth something if the record behind it cannot be quietly removed. Deletion therefore happens on instruction, not by button.

Before a document is signed, email [email protected] and we will delete it, together with its event history, and confirm when it's done — normally well within one month. This is your Article 28(3)(g) deletion right, and we treat a request from you as a documented instruction.

Once anyone has signed, the document is fixed. At the end of the agreement you have 30 days to export, after which we delete Customer Personal Data — subject to two exceptions:

• Completed documents and their audit trail, kept for 7 years after the document was completed and then deleted together, unless a legal claim about it has been made or is expected, in which case until that is resolved. A signature is only worth something if the record behind it cannot be made to disappear while someone may still rely on it. We keep this copy as controller under section 2, for that purpose only, so it falls outside your deletion instruction. When your account closes we remove your name from the ownership record, but the document survives for the rest of that period. Section 10 of the Privacy Policy explains why it can't be scrubbed party by party.
• Keep your own copies. AgreeVia is not a backup or archive service, so please download and keep your own copy of every document that matters. Our hosting provider may keep copies of our database for a short period for its own disaster recovery, and deleted data can remain in them until they age out. It stays protected by this addendum until it's gone, and we never restore a copy to recover data that has been deleted on request.

Where UK or EU law requires us to keep something longer, we will, and we'll tell you what and why.

We'll make available the information reasonably needed to demonstrate compliance with Article 28, including our security documentation and the data protection terms of our sub-processor contracts, redacted for commercial confidentiality.

You may audit us, or appoint an independent auditor to, no more than once in any 12-month period unless a personal data breach or a regulator requires otherwise. Give us 30 days' notice, keep the audit to what's reasonably necessary, don't disrupt the service, and bear your own costs. We may charge for our time on any audit beyond the annual one.

Customer Personal Data is stored in the United Kingdom — our database, file storage and authentication run on AWS London (eu-west-2).

Some sub-processors in Annex 3 are outside the UK. Where personal data is transferred out, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on UK adequacy regulations where they apply, in each case with a transfer risk assessment. Ask us at [email protected] which safeguard applies to a particular transfer.

By using the service you instruct us to make those transfers and confirm you're satisfied with the safeguards.

Each party's liability under this addendum is subject to the limits and exclusions in clause 14 of the Terms of Service. Nothing here limits liability that the law does not allow to be limited, or affects a data subject's rights against either of us under Article 82 UK GDPR.

This addendum is governed by the law of Scotland, and clause 19 of the Terms of Service applies to any dispute about it.

Subject matter. Provision of the AgreeVia electronic signature service.

Duration. For as long as your account is open, plus the retention periods in section 10 (up to 7 years after a document is completed).

Nature and purpose. Storing, hosting, transmitting, rendering and generating PDF documents; sending signing invitations and completion notices; capturing signatures; producing evidence packages; and, where you use the AI drafting feature, transmitting the brief you write so a contract can be drafted from it.

Types of personal data. Whatever you put in a document, plus: names, email addresses, signature images, the name signed under, IP addresses, device and browser type, and event timestamps.

Categories of data subject. People you invite to sign, and anyone else whose personal data appears in a document you upload or generate.

Special category data. Not requested and not supported. Some details typed into a document can still reveal it (the name of a religious ceremony, for example). If you put it in a document, you're responsible for your own Article 9 condition.

These are the measures referred to in clause 14.4 of the Terms of Service.

• TLS in transit; encryption at rest on provider infrastructure.
• Row-level authorisation enforced in the database, so one account cannot read another's records.
• Every document event written to an append-only log and chained with SHA-256, making alteration detectable.
• Documents are not deletable from any client session. Deletion of an unsigned document happens only through a restricted internal function that refuses completed documents, frozen audit chains and requests from anyone other than the document's creator.
• Signing links single-purpose, time-limited and revocable; a creator can cancel a pending invitation.
• Storage buckets restricted by MIME type and file size, with user-scoped upload paths.
• Production access limited to what's needed to run the service.
• Secrets held in managed secret storage, never in client code.
• Breach reported to the ICO within 72 hours where the risk threshold is met, and to affected people without undue delay where the risk is high.

Apple and Google take payment for store subscriptions as independent controllers, not as our sub-processors. Stripe takes payment for web subscriptions for us. It handles only the subscriber's payment details, never the documents or other Customer Personal Data covered by this DPA, so it is not a sub-processor under it. We never receive card details.