Data processing agreement

1. Preamble

This Data Processing Agreement (the DPA) applies to the relationship between the customer subscribing to the services (the Customer) and Actual Reports OÜ, a company incorporated under the laws of the Republic of Estonia with registration number 12318670 (the Supplier). It governs the processing of personal data that the Customer, its users, respondents or signers upload or otherwise provide to the Supplier in connection with the Documentas services. It forms part of the Terms of Service.

2. Definitions

• Customer Personal Data: personal data that the Customer, its users, respondents or signers provide to the Supplier through Documentas.
• Data Protection Requirements: the General Data Protection Regulation (EU) 2016/679 and the local laws and regulations implementing it.
• Personal Data Breach: any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data.
• Process: any operation performed on personal data, such as collection, recording, storage, retrieval, use, disclosure, erasure or destruction.
• Subprocessor: any entity that provides processing services to the Supplier in furtherance of its processing on behalf of the Customer.
• Supervisory Authority: the Estonian Data Protection Inspectorate.

3. Nature of the processing

The Supplier is a processor that processes Customer Personal Data on behalf of the Customer, who is the controller. The Supplier processes Customer Personal Data only for the purposes set out in this DPA. The data subjects, purposes, categories of data and retention are described in Annex 1.

4. Compliance with laws

The parties will each comply with their obligations under the Data Protection Requirements.

5. Customer obligations

• Give instructions to the Supplier and decide the purposes and general means of processing Customer Personal Data, in line with this DPA.
• Comply with its obligations as a controller: keep a procedure for the rights of data subjects, process only data that was lawfully collected and is relevant and proportionate, and ensure its personnel and anyone acting on its behalf comply with this DPA.
• Obtain any consent from data subjects that is needed, for example from respondents and signers it invites.

6. Supplier obligations

6.1 Processing requirements

• Process Customer Personal Data only to provide, support and improve Documentas, using appropriate technical and organisational security measures, and in line with the Customer’s instructions.
• Inform the Customer promptly if, in its opinion, an instruction violates the Data Protection Requirements.
• Ensure that its employees, agents and Subprocessors respect the confidentiality of Customer Personal Data, also after their engagement ends.
• Engage new Subprocessors only as Section 8 describes, remain liable for their acts and omissions, and bind them to the same level of data protection.
• Provide a summary of its privacy and security policies on request.

6.2 Notice to the Customer

The Supplier will inform the Customer of any non-compliance with this DPA, of any legally binding request for disclosure of Customer Personal Data by an authority (unless the law forbids it), of any inquiry by a Supervisory Authority, and of any request received directly from the Customer’s data subjects. The Supplier will not answer such a request without the Customer’s authorisation.

6.3 Assistance to the Customer

The Supplier will reasonably assist the Customer with data subject requests (access, rectification, erasure, restriction, portability), with the investigation and notification of Personal Data Breaches, and, where appropriate, with data protection impact assessments and consultations with a Supervisory Authority.

6.4 Required processing

If the law requires the Supplier to process Customer Personal Data for another reason, it will inform the Customer in advance, unless the law forbids it.

6.5 Security

The Supplier maintains appropriate organisational and technical security measures, including for personnel, facilities, hardware and software, storage and networks, access control, monitoring and logging, vulnerability and breach detection, incident response, and encryption of Customer Personal Data in transit and at rest. Actual Reports OÜ is certified to ISO/IEC 27001:2022.

The Supplier will notify the Customer of any Personal Data Breach by the Supplier or its Subprocessors without undue delay, and in any event within 48 hours of becoming aware of it.

7. Liability and audit

The Supplier is liable for damage caused by processing only where it has not complied with obligations the Data Protection Requirements address to processors, or has acted outside or against the Customer’s lawful instructions. The Customer will reimburse the Supplier for costs, claims and damages arising from the Customer’s own breach of this DPA. These obligations survive the end of this DPA.

If a Supervisory Authority requires an audit of the facilities from which the Supplier processes Customer Personal Data, the Supplier will cooperate. The Customer bears the costs of such an audit.

8. Transfers and Subprocessors

The Supplier will not transfer Customer Personal Data to a third party or engage a Subprocessor without the Customer’s written consent, except for the Subprocessors listed in Annex 1, which the Customer approves by accepting this DPA. Any approved transfer is subject to the same data protection obligations as this DPA.

If the Customer reasonably objects to a new Subprocessor, the Supplier will continue to provide the Service under the agreed terms until the parties agree how to continue, or agree to end the processing and return or delete the data, within no more than three months.

Customer Personal Data is hosted in the region agreed with the Customer: the United States, the European Union or Australia. Transfers outside the EU and EEA take place only under the EU-US Data Privacy Framework, an adequacy decision or the European Commission’s standard contractual clauses.

9. Return and deletion

When the processing ends, or at the Customer’s reasonable request, the Supplier will, at the Customer’s choice, return or securely destroy Customer Personal Data and copies, and cause its Subprocessors to do the same, unless the law requires it to keep some of it. Data that must be kept stays confidential and is processed only to comply with the law.

10. Term

This DPA stays in effect as long as the Supplier processes Customer Personal Data on behalf of the Customer, or until the Terms of Service end and all Customer Personal Data has been returned or deleted.

11. Governing law

Disputes arising from this DPA will be resolved through negotiation and, failing that, in Harju County Court under the laws of the Republic of Estonia.

Annex 1: Description of the processing

Data subjects

• The Customer’s users of Documentas.
• Respondents who fill in the Customer’s forms.
• Signers of the Customer’s documents, including the Customer’s own company counterparts.
• People named in the documents the Customer generates or uploads.

Purposes of the processing

• Collecting data with forms and showing it to the Customer.
• Generating documents from the Customer’s templates and the answers.
• Sending documents for electronic signature, sealing them on paid plans and recording the audit log.
• Validating the digital signatures of PDFs the Customer uploads.
• Storing signed documents and records until the Customer deletes them.

Categories of data

• Identification data: names, ID codes and other details the Customer’s forms ask for.
• Contact data: email addresses, phone numbers and addresses.
• Signatures: typed, drawn or uploaded signature images.
• Audit data: the times and IP addresses of opening, reviewing, accepting, submitting and signing.
• Any other data the Customer chooses to collect with its forms or include in its documents.

Retention

Customer Personal Data is kept until the Customer deletes it in Documentas or the agreement ends. Signed PDFs are stored with no expiry date until deleted; after a signed PDF is deleted, a minimal record of who signed and when stays. Files uploaded to signature validation are deleted from the check service after the check.

Approved Subprocessors

PDF Generator API is provided by the Supplier itself and is not a Subprocessor.

Data Processing Agreement version date: 16 October 2026.