Data processing agreement

This is a translation for information only; the Spanish version prevails. This agreement, in accordance with Article 28 of the GDPR, applies when you use MultiDocs to send documents to other people. It forms part of the Terms of use and contract and you accept it by using the service.

• Controller: you, the user who sends the documents (or the organisation on whose behalf you act).
• Processor: EXAMFY SOFTWARE, S.L., tax ID (NIF) B56684905, Carrer del General Palafox, 8, 08860 Castelldefels, Barcelona (Spain).

1. Purpose and duration

The processor processes, on behalf of the controller, the data needed to send documents for signature, collect the signatures and any requested details, and deliver the signed document. The agreement lasts for as long as you use the service.

2. Data and data subjects

• Data subjects: the people who receive documents to sign and the people named in them.
• Data: identification and contact details (name, email, ID number, address, phone), a photo of the identity document if the controller asks for it, whatever the document contains, the digitised handwritten signature and the technical signature data (date, time, IP, browser).
• If the document contains special categories of data (for example, health data), the controller guarantees that it has the necessary legal basis.

3. Processor's obligations

• Process the data only on the controller's instructions, which are those resulting from use of the service, and not use it for its own purposes.
• Ensure the confidentiality of the people authorised to process it.
• Apply appropriate security measures (Art. 32 GDPR): encrypted connections, private and encrypted storage, access via personal link and access control.
• Use only the sub-processors listed below, under contracts imposing the same obligations, and give notice of any change so that the controller can object.
• Help the controller respond to data subjects' rights and meet its obligations on security, impact assessments and consultations.
• Notify the controller without undue delay, and in any case within 48 hours, of any security breach affecting its data.
• Delete the data when the service ends: documents are deleted 30 days after signing or sending. The evidence log of each signature, without the document, is kept for 5 years so the signature can be proven, and is then deleted.
• Make available to the controller the information needed to demonstrate compliance and allow reasonable audits.

4. Controller's obligations

• Have a legal basis for the processing and have informed the data subjects.
• Provide only the data that is necessary. In particular, ask for a photo of the identity document only when it is genuinely needed for that document.
• Supervise the processing.

5. Authorised sub-processors

Documents and personal data are processed and stored in the European Union. Vercel and Resend are based in the USA: if their staff ever accessed the data from there (for example, to provide technical support), that access is covered by the EU-US Data Privacy Framework and by standard contractual clauses.

The data is processed in the European Union. Any access by a sub-processor from outside the European Economic Area is covered by the EU-US Data Privacy Framework or by the standard contractual clauses approved by the European Commission.

6. Contact

For any question about this agreement, write to info@multidocs.es.