Data Processing Addendum

For personal data contained in documents, form responses, and signatures, the customer is the controller (or processor acting for its own customer) and Signum is the processor. Signum processes that data only on the customer's documented instructions, which include use of the service's features and any written directions the customer gives support.

• Subject matter: hosting, form filling, signature collection, and records management for customer documents.
• Duration: the term of the customer's subscription, plus the retention windows described below.
• Categories of data subjects: customer personnel and the recipients who fill or sign documents.
• Categories of personal data: identity and contact details, whatever the customer places in form fields, signature images, and signing metadata such as timestamp, IP address, and user agent.
• Special categories: only if the customer chooses to place them in a document. The customer is responsible for determining whether that is appropriate.

Personnel with access to customer data are bound by confidentiality obligations and are granted access on a least-privilege basis limited to what their role requires.

• TLS encryption in transit and encryption at rest for stored documents and database records.
• Workspace-level isolation enforced by row-level access rules on every data table.
• Private file storage; document files are served only through short-lived signed URLs.
• Authentication with hashed credentials, optional single sign-on, and leaked-password screening.
• Immutable audit logging of document, field, signature, and administrative events.
• Managed infrastructure with automated backups and patching by the hosting platform.

Full detail is on the Security & trust page.

The customer authorizes the subprocessors listed in our Privacy Policy. Each subprocessor is engaged under a written contract imposing data protection obligations no less protective than these terms. We will give notice before adding a new subprocessor so the customer has an opportunity to object.

Signum will provide reasonable assistance with data subject requests, data protection impact assessments, and regulator inquiries, taking into account the nature of the processing and the information available to us. Where we receive a request directly from a data subject about customer content, we refer it to the customer.

Signum will notify affected customers without undue delay, and in any case within 72 hours of becoming aware of a personal data breach affecting their data. The notice will describe the nature of the incident, the data involved so far as known, the likely consequences, and the measures taken or proposed.

Customer data is hosted in United States. Where personal data is transferred out of the EEA, UK, or Switzerland, the transfer relies on the European Commission's Standard Contractual Clauses together with any supplementary measures appropriate to the transfer, incorporated into this addendum by reference.

On reasonable written request, and no more than once per year unless required by a regulator, Signum will make available the information necessary to demonstrate compliance with these terms, including responses to a reasonable security questionnaire.

On termination, the customer may export its data through the service. After the export window, Signum deletes customer content in line with the retention schedule in the Privacy Policy — documents purged 30 days after deletion, with audit records retained up to 7 years to preserve the integrity of completed documents — unless a longer period is required by law.

Email legal@admysterium.com with your legal entity name and the address for notices and we will return a countersigned addendum.