1. Roles
For customer content, you are the controller and VXSign is the processor, processing personal data only on your documented instructions.
2. Scope & subject matter
Processing is limited to providing the Service: preparing, sending, signing, and sealing documents, and producing audit records.
3. Categories of data & data subjects
Identification and contact data of signers and account users, and the contents of the documents you choose to process.
4. Processor obligations
We process only on instructions, ensure personnel confidentiality, and implement appropriate technical and organizational measures.
5. Subprocessors
You authorize the subprocessors listed in the Annex (payment processing, email delivery, cloud hosting); we remain responsible for their performance and will give notice of changes.
6. International transfers
Cross-border transfers rely on Standard Contractual Clauses or another lawful mechanism.
7. Security measures
Encryption in transit and at rest, access controls scoped by API keys, logging, and monitoring, described in the Annex.
8. Data subject requests
We will assist you in responding to data subject requests to the extent reasonably possible.
9. Breach notification
We will notify you of a confirmed personal-data breach without undue delay.
10. Audits
We will make available information necessary to demonstrate compliance and allow for audits within reasonable limits.
11. Deletion & return
On termination, we will delete or return personal data as you elect, subject to legal retention requirements.
12. Annexes
Annex I: list of subprocessors. Annex II: technical and organizational security measures.