Data Processing Agreement (DPA)
This Data Processing Agreement ("DPA") forms part of the agreement between DokDesk ("Processor", "we", "us") and the customer that uses the DokDesk service ("Controller", "you"). It governs how DokDesk processes personal data on your behalf when you use the DokDesk secure contract workflow to create contracts from templates, negotiate a single live version, send no-account secure links for electronic signing at the eIDAS SES, AES or QES level, and retain a court-ready evidence base for each signature. This DPA is intended to support compliance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and, where relevant to electronic signing, the eIDAS Regulation (Regulation (EU) No 910/2014). DokDesk is currently in early access / pre-launch; this is a generic template document and the specific commercial, contact and operational details below are intentionally left as placeholders to be completed and reviewed before any production use. Where this DPA conflicts with the main agreement on the subject of data protection, this DPA prevails. DokDesk is not a law firm and does not provide legal advice.
Pre-launch draft - to be reviewed by qualified counsel before launch. This is not legal advice.
1. Pre-launch status — review by qualified counsel required (not legal advice)
This document is a pre-launch DRAFT template provided for information and planning purposes only. DokDesk is in early access; the service, its hosting arrangements, its sub-processors and its security measures may change before and during launch. Nothing in this DPA is legal advice, and DokDesk is not a law firm.
Before this DPA is relied upon for any real processing of personal data, it MUST be reviewed, completed and adapted by qualified legal counsel for the specific facts of your organisation, your jurisdiction(s) within the EU and the Baltics, and the categories of data you process. Placeholders in this template — including party identity and registration details, postal address, the list of named sub-processors, hosting locations, retention periods and effective dates — must be completed with accurate, current information before signature.
No part of this template should be treated as a representation that any particular certification, audit, integration or signing level (including QES) is already live in production. Where the template describes capabilities that are architecture-ready rather than generally available, those must be confirmed in writing before being relied upon.
2. Definitions and roles of the parties
Terms such as "personal data", "processing", "controller", "processor", "sub-processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given to them in the GDPR.
For personal data that you upload to, generate within, or process through DokDesk in the course of your contract workflow, you act as the Controller (you determine the purposes and means of processing) and DokDesk acts as the Processor, processing that personal data only on your behalf and on your documented instructions. Where a contract is signed between you and a counterparty, each party may be a separate controller for its own purposes; this DPA governs only DokDesk's role as your processor.
DokDesk may itself act as an independent controller for limited operational data — for example account administration, billing where applicable, security logging and product-improvement metrics that do not form part of your contract content. Such independent-controller processing is governed by the DokDesk privacy notice rather than by this DPA.
3. Subject-matter, duration, nature and purpose of processing
Subject-matter and nature: DokDesk processes personal data so that you can build contracts from reusable templates and dynamic data fields, manage a contract through its versions and status history, negotiate a single live version, send signers a no-account secure link, capture electronic signatures at the SES, AES or QES level via supported EU national eID rails such as Smart-ID and Mobile-ID, and retain an evidence base for each signature. DokDesk is a contract-workflow and electronic-signing service. It is NOT invoicing, payments, accounting or a CRM, and personal data is not processed for any of those purposes.
Purpose: processing is carried out for the sole purpose of providing, securing and supporting the DokDesk service in accordance with your instructions and the main agreement.
Duration: processing continues for the term during which you use the service, plus any limited period required to return or delete personal data as described in this DPA or required by applicable law (for example, retention of signature evidence necessary to preserve the integrity and legal value of a signed document).
4. Categories of data subjects and types of personal data
Categories of data subjects typically include: your authorised users (such as owner, admin, manager, legal and viewer roles); your clients, counterparties and their representatives; and the individuals invited to sign or to participate in negotiating a contract.
Types of personal data typically include: identity and contact details of parties and signers (such as name, organisation, role, email address and the party details you place into a contract); contract content that you choose to include, which may itself contain personal data; signing and identity-assurance data associated with the chosen eIDAS level; and technical evidence captured at signing time, such as IP and device metadata, timestamps, signature status, the audit trail of actions, and the final signed document container.
You are responsible for the personal data you choose to place into templates and contracts. You should not include special-category data (Article 9 GDPR) or other particularly sensitive data unless you have a lawful basis to do so and have configured your use of the service appropriately. DokDesk does not require such data to provide the service.
5. Obligations of DokDesk as Processor
DokDesk will process personal data only on your documented instructions, including the instructions embodied in the main agreement and in your configuration and use of the service, unless required to act otherwise by EU or member-state law to which DokDesk is subject; in that case DokDesk will inform you of that legal requirement before processing, unless the law prohibits such notice on important grounds of public interest.
DokDesk will ensure that persons authorised to process personal data are bound by appropriate confidentiality obligations. DokDesk will assist you, taking into account the nature of processing and the information available to it, in responding to data-subject requests and in meeting your obligations regarding security, breach notification, data-protection impact assessments and prior consultation under Articles 32 to 36 GDPR.
DokDesk will make available to you the information reasonably necessary to demonstrate compliance with the processor obligations under Article 28 GDPR, and will inform you without undue delay if, in its opinion, an instruction infringes the GDPR or other EU or member-state data-protection provisions.
6. Security of processing
Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risks to data subjects, DokDesk implements appropriate technical and organisational measures designed to ensure a level of security appropriate to the risk, in line with Article 32 GDPR.
These measures are intended to include, as applicable: encryption of personal data in transit and at rest; access controls and role-based permissions reflecting the workflow roles; logging and audit trails (including the evidence base captured for each signature); secure handling of secure-link and signing flows; measures to preserve the integrity and authenticity of signed documents; and procedures for restoring availability and access to personal data after an incident.
Because DokDesk is in early access, the specific, current list of security measures must be set out in a security schedule or equivalent document and confirmed before production use. This template does not assert any specific certification or audit status.
7. Sub-processors and international transfers
You authorise DokDesk to engage sub-processors (such as cloud-hosting, infrastructure, identity/eID and supporting service providers) to assist in providing the service. DokDesk will impose data-protection obligations on each sub-processor that are no less protective than those in this DPA, and DokDesk remains responsible to you for a sub-processor's performance. This template does not name specific sub-processors; an accurate, current list must be maintained and made available, and you should be given a reasonable opportunity to object to material changes.
DokDesk's intention is that personal data remains hosted and processed within the EU, consistent with DokDesk's positioning that data stays in the EU under GDPR. Where any transfer of personal data outside the EU/EEA were to occur, it would only take place on the basis of a valid transfer mechanism under Chapter V GDPR (such as an adequacy decision or appropriate safeguards), and the relevant details would be documented before any such transfer.
eID and trust-service rails used for electronic signing (for example Smart-ID, Mobile-ID, national eIDs and qualified trust providers) operate under their own terms and, for qualified services, under eIDAS. QES capability is architecture-ready: where you require qualified signing, the applicable provider and its arrangements must be confirmed before relying on QES in production.
8. Data-subject rights, breach notification, return and deletion
DokDesk will, taking into account the nature of the processing, assist you by appropriate technical and organisational measures, insofar as this is possible, in fulfilling your obligation to respond to requests by data subjects exercising their rights under Chapter III GDPR (including access, rectification, erasure, restriction, portability and objection). Where DokDesk receives such a request directly, it will, unless legally required to act, refer the request to you.
DokDesk will notify you without undue delay after becoming aware of a personal data breach affecting personal data processed on your behalf, and will provide information reasonably available to it to assist you in meeting your own notification obligations under Articles 33 and 34 GDPR.
On termination of the service, and at your choice, DokDesk will delete or return the personal data processed on your behalf and delete existing copies, unless EU or member-state law requires continued storage — for example, where retention is necessary to preserve the integrity and legal value of signed contracts and their associated signature evidence. Applicable retention periods must be specified before production use.
9. Audits, liability, governing law and final provisions
DokDesk will, on reasonable prior written request and subject to appropriate confidentiality, make available information necessary to demonstrate compliance with Article 28 GDPR and allow for and contribute to audits, including inspections, conducted by you or an auditor mandated by you, in a manner that does not compromise the security or confidentiality of other customers' data.
Liability, indemnities and limitations are as set out in the main agreement between the parties; this template does not itself fix liability caps or amounts. The governing law and competent courts are those agreed in the main agreement and consistent with the GDPR; the specific jurisdiction must be completed before signature.
This DPA is a generic, pre-launch template. Party identities and registration details, postal address, effective date, the list of sub-processors, hosting locations and retention periods are intentionally left as placeholders. Complete these details accurately and have the document reviewed by qualified counsel before any production use. This document is not legal advice, and DokDesk is not a law firm.