Version 1.0 (01 February 2026)
between
Customer of Covosign
– hereinafter “Controller” –
and
SMITH & FRIDAY PTE. LTD, 160 Robinson Road, #14-04, Singapore Business Federation Center, Singapore 068914
– hereinafter “Processor” –
Controller and Processor together referred to as the “Parties”.
1.1 The Processor provides a web-based software solution that enables the preparation, transmission, signing, and management of documents by electronic means (“Service”) under a separate agreement (“Terms of Service”).
1.2 In the course of providing the Service, the Processor processes personal data exclusively on behalf of the Controller within the meaning of Article 4 No. 8 GDPR.
1.3 This Data Processing Agreement (“DPA”) governs the processing of personal data pursuant to Article 28 GDPR and forms an integral part of the Terms of Service.
Processing shall take place for the duration of the Terms of Service and, where applicable, for limited retention periods necessary for backup, system integrity or statutory retention obligations, after which the data shall be deleted or returned in accordance with the Controller’s instructions.
3.1 The Processor shall process personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country or an international organization.
3.2 Instructions are issued primarily through the configuration and use of the Service or in text form (e.g. email).
3.3 If the Processor considers an instruction to be in violation of applicable data protection law, it shall inform the Controller without undue delay and suspend execution of the instruction pending clarification.
4.1 The Processor shall ensure that persons authorized to process personal data are subject to appropriate confidentiality obligations pursuant to Article 28(3)(b) GDPR.
4.2 Access to personal data is limited to those persons who require such access for the performance of the Service.
5.1 The Processor shall implement appropriate technical and organizational measures pursuant to Article 32 GDPR to ensure a level of security appropriate to the risk.
5.2 The technical and organizational measures are set out in Annex 1 to this DPA.
5.3 The Processor may adapt the measures provided that the overall level of protection is not reduced.
6.1 The Controller grants general authorization for the engagement of sub-processors pursuant to Article 28(2) GDPR.
6.2 The Processor shall inform the Controller of any intended changes concerning the addition or replacement of sub-processors at least 14 days in advance. The Controller may object on reasonable data protection grounds within this period.
6.3 Sub-processors shall be contractually bound by data protection obligations equivalent to those set out in this DPA.
Personal data is processed primarily within the European Union or European Economic Area. Where personal data is transferred outside the EU/EEA, such transfers shall be safeguarded in accordance with Articles 44–49 GDPR, including, where applicable, adequacy decisions of the European Commission and/or the Standard Contractual Clauses (SCCs), together with supplementary technical and organizational measures where required. Infrastructure hosting for the Service is configured in EU regions. Administrative access is restricted to authorized personnel in accordance with internal access control policies.
The Processor shall assist the Controller, taking into account the nature of the processing, in fulfilling obligations relating to data subject rights, data protection impact assessments and prior consultations pursuant to Articles 12–36 GDPR.
9.1 The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach.
9.2 The notification shall contain all information required under Article 33(3) GDPR to the extent available.
10.1 The Processor shall make available to the Controller all information necessary to demonstrate compliance with this DPA.
10.2 Audits may be conducted at reasonable intervals, taking into account certifications, audit reports or comparable evidence, and shall not unreasonably disrupt the Processor’s operations.
Upon termination of the Terms of Service, the Processor shall, at the choice of the Controller, return or delete all personal data processed on behalf of the Controller unless statutory retention obligations apply.
Liability between the Parties shall be governed by Article 82 GDPR and the liability provisions of the Terms of Service.
13.1 This DPA shall prevail over conflicting provisions of the Terms of Service with regard to data protection.
13.2 Amendments to this DPA shall be made in text form.
13.3 The governing law shall be the law agreed in the Terms of Service.
The Processor implements the following technical and organizational measures:
– Operation of processing systems in secured data centers
– Restricted access for authorized personnel only
– Visitor management and logging procedures
– Role-based access control
– Principle of least privilege
– Strong authentication mechanisms
– Secure password policies
– Automatic session timeouts
– Logging of access attempts
– Logical tenant separation in multi-tenant environments
– Separation of administrative and operational access
– Encryption of personal data at rest
– Encryption of data in transit using state-of-the-art cryptographic protocols
– Secure and authenticated communication channels
– Logging and audit trails for relevant processing activities
– Time-stamped system logs
– Protection of logs against unauthorized modification
– Regular backups
– Backup storage in separated environments
– Disaster recovery and business continuity procedures
– Monitoring of system availability
– Integrity checks for stored and transmitted data
– Integrity controls ensuring that subsequent modifications of signed documents are detectable via audit logs and system records
– Logical separation of data of different controllers
– Separation of test and production environments
– Data minimization
– Default restrictive access settings
– Configurable retention and deletion mechanisms
– Confidentiality obligations for personnel
– Regular data protection and security training
– Defined incident management procedures
Provision of a web-based electronic signature and document workflow service.
Hosting, transmission, signing, identity verification, storage of documents and generation of audit trails.
– Enabling electronic signing of documents
– Verification and documentation of signature processes
– Ensuring integrity and authenticity of signed documents
– Operation and security of the Service
– Employees of the Controller
– Customers and business partners of the Controller
– Contractual counterparties
– Other individuals designated by the Controller
– Identification data (e.g. name, email address)
– Contact data
– Signature-related metadata (e.g. timestamps, IP addresses)
– Audit and log data
– Document content uploaded by the Controller
Special categories of personal data are processed only if and to the extent such data is included in documents uploaded by the Controller. No targeted processing pursuant to Article 9 GDPR takes place.
For the duration of the Terms of Service and applicable retention periods.
European Union / European Economic Area; third-country transfers only with appropriate safeguards.
Use of sub-processors in accordance with Article 28 GDPR and this DPA.
The following entities act as sub-processors when the Processor processes personal data on behalf of the Controller. Where service providers act as independent controllers (e.g. payment service providers), they are identified separately below.
The Controller authorizes the use of the following sub-processors for the provision of the Service:
Data hosting and application infrastructure (EU hosting).
S3: document storage
SES: transactional email delivery
Processing based on EU Standard Contractual Clauses where applicable.
Mobile messaging and SMS delivery.
Payment processing and billing.
Stripe processes personal data as an independent controller for payment services.
The Processor shall inform the Controller of any intended changes to this list in accordance with Clause 6 of this DPA.