1. Scope
This Data Processing Addendum (“DPA”) supplements the Terms of Service or other agreement between the customer (“Controller”) and Guiding Dawn Holdings, operator of SignoffDock (“Processor”), when Processor processes personal information on Controller’s behalf.
2. Instructions and purpose
Processor will process personal information only to provide, secure, support, and improve the contracted SignoffDock services; to follow documented Controller instructions; or as required by law. If law requires processing contrary to Controller instructions, Processor will provide notice where legally permitted.
3. Processing details
| Subject matter | Hosting and operating approval workflow, proof/revision, notification, and audit-record services. |
|---|---|
| Duration | For the term of the service and any limited retention period required for backup, security, legal, or contractual purposes. |
| Data subjects | Customer employees/users, the Customer’s customers and contacts, approval recipients, and other individuals whose information the Customer submits. |
| Data types | Names, business contact information, account identifiers, files/content, project details, comments, approval activity, timestamps, and technical/security metadata. |
| Sensitive data | Not intentionally required. Controller should avoid submitting sensitive data unless necessary and authorized. |
4. Confidentiality and security
Processor will ensure personnel authorized to process personal information are subject to appropriate confidentiality obligations and will maintain reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, alteration, or disclosure.
5. Subprocessors
Controller authorizes the subprocessors listed on our Subprocessors page. Processor remains responsible for requiring subprocessors to protect personal information through appropriate contractual terms. Where required by applicable law or customer contract, Processor will provide notice of material new subprocessors and a reasonable opportunity to raise data-protection objections.
6. Individual rights
Taking into account the nature of processing, Processor will provide reasonable assistance to Controller in responding to verified requests to exercise privacy rights. If Processor receives a request relating solely to data processed for Controller, Processor may direct the requester to Controller.
7. Security incidents
Processor will notify Controller without undue delay after becoming aware of a confirmed security incident involving Controller personal information when notification is required by applicable law or contract. Processor will provide reasonably available information needed for Controller to meet applicable notification obligations.
8. Deletion and return
At termination or upon valid Controller instruction, Processor will delete or return personal information as reasonably supported by the service, except where retention is required by law or necessary for limited backup, fraud-prevention, security, dispute, or legal purposes.
9. Compliance assistance
Processor will make reasonably available information about its processing and safeguards to support Controller’s compliance obligations and reasonable diligence requests, subject to confidentiality and security restrictions.
10. International transfers
Where cross-border transfer rules apply, the parties will use a legally recognized transfer mechanism as required, which may include applicable standard contractual clauses or another lawful mechanism.
11. Priority
If this DPA conflicts with the Terms regarding processing of personal information, this DPA controls to the extent of that conflict.