Version: dpa-2026-11 · Part of the Terms of Service for any customer that uses the Service for a business purpose.
1. Definitions. "Customer Personal Data" means personal data in Customer Content that Inkpacket processes for Customer. "Data Protection Laws" means U.S. federal and state privacy laws that apply to that processing, including the CCPA/CPRA and comparable state laws. Terms such as "controller," "processor," "business," "service provider," and "personal data" have the meanings those laws give them. 2. Roles. Customer is the controller/business. Inkpacket is the processor/service provider. 3. Instructions. Inkpacket processes Customer Personal Data only to provide, secure, and support the Service according to Customer's documented instructions (the Terms, this DPA, and Customer's configuration of the Service), unless the law requires otherwise, in which case Inkpacket will tell Customer if the law permits. 4. Details. *Subject matter and duration:* provision of the Service for the term of the Terms plus the retention period. *Nature and purpose:* storing, transmitting, and displaying documents; collecting e-signatures; generating audit trails and certificates. *Data subjects:* Customer's users, signers, and individuals named in documents. *Categories:* identifiers, contact details, signatures, document content, IP and device data, and audit events. *Special categories:* prohibited (including PHI; see Terms §4) unless agreed in writing. 5. CCPA service-provider terms. Inkpacket will not: (a) sell or share Customer Personal Data; (b) keep, use, or disclose it for any purpose (including any commercial purpose) other than the business purposes in this DPA, or outside the direct business relationship with Customer; (c) combine it with personal information from other sources except as the CCPA permits; or (d) use it for cross-context behavioral advertising. Inkpacket will comply with the CCPA and give the same level of privacy protection the CCPA requires. It will tell Customer if it can no longer meet its obligations, and lets Customer take reasonable steps to stop and fix unauthorized use. Inkpacket certifies that it understands and will comply with these restrictions. 6. Confidentiality. Personnel with access are bound by confidentiality obligations. 7. Security. Inkpacket maintains reasonable technical and organizational measures appropriate to the risk, including those described in Annex A. 8. Subprocessors. Customer authorizes the subprocessors listed at /subprocessors. Inkpacket will impose data-protection terms on each that are no less protective than this DPA, and stays responsible for them. Inkpacket will give at least 30 days' notice of a new subprocessor by updating /subprocessors and emailing workspace owners who subscribe. Customer may object on reasonable data-protection grounds within that period. If the parties can't resolve the objection, Customer may terminate the affected Service and receive a refund of prepaid unused fees. 9. Assistance. Inkpacket will provide reasonable help, taking into account the nature of the processing, with data-subject requests, data protection assessments, and consultations with regulators. Requests received directly will be passed to Customer. 10. Security incidents. Inkpacket will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a breach of security leading to unauthorized access to, or acquisition, disclosure, loss, or alteration of, Customer Personal Data. The notice will include the information then available, and updates will follow. Inkpacket will take reasonable steps to contain and fix the breach. Notifying is not an admission of fault. 11. Deletion and return. During the term, Customer can download documents, Certificates of Completion, and audit trails, and can export the workspace. Customer may ask in writing to delete a document sooner. Inkpacket deletes that document's stored files and field values and keeps the audit trail and document fingerprints for 7 years. When the Terms end or the workspace is closed, Inkpacket keeps completed documents for 7 years after closure and then deletes them, and keeps the audit trail and document fingerprints for those same 7 years, except where the law requires earlier deletion or longer retention. During that period the data stays protected under this DPA and is used only to store it, provide copies to Customer and its signers, and meet legal obligations. Backups are overwritten within 7 days of deletion. 12. Audits. Once a year (or after a security incident or a regulator's request), on 30 days' written notice, Inkpacket will answer a reasonable written security questionnaire and provide relevant documentation. If that doesn't reasonably meet Customer's legal obligations, Customer may conduct an audit (or use an independent auditor bound by confidentiality) at Customer's expense, during business hours, in a way that doesn't disrupt operations or compromise other customers' data. 13. Data location. United States. 14. Liability; precedence. Subject to the limits in the Terms. If this DPA conflicts with the Terms on data protection, this DPA controls.
Annex A — Security measures (as currently implemented): TLS/HTTPS in transit; hashed passwords; isolation of workspace data by organization; role-based access (owner, admin, member); optional signer access codes; rate limiting on authentication, signing, Web Forms, and the API; an append-only audit log enforced by a database trigger; SHA-256 fingerprints of completed documents with public verification; error monitoring; provider-managed infrastructure with access limited to authorized personnel. **
---