Data Processing Agreement

This DPA forms part of the Closepact Terms of Service. It governs the processing of personal data by Closepact (Processor) on behalf of the Customer (Controller).

Scope

The personal data processed includes account contacts; recipients and signers of documents, with the IP address, user agent and timestamps recorded as signing evidence; the Customer's own customers and their contacts and service addresses; employees whose working time is reported and whose position is recorded at the moment they clock in or out; and the content the Customer puts into the Service. Purposes are limited to providing the Service.

Sub-processors

Current sub-processors:

• Hetzner Online GmbH — hosting, database and storage, in Germany
• Cloudflare — edge CDN and DDoS mitigation
• Closepact's own mail server at Hetzner — transactional email
• OpenStreetMap Foundation (Nominatim) — coordinates for a service address, when asked for in the panel; the address only, no name
• Stripe — payment and subscription processing, once payment through Stripe is switched on
• OpenAI — AI generation, only where a provider is configured
• Twilio or 46elks — SMS, only where SMS is configured, through whichever is

The current list, with purpose and region for each, is maintained at /legal/subprocessors. We notify the Controller in writing at least 30 days before a new sub-processor begins processing.

Other services (independent controllers)

Google is used only for sign-in, when the user chooses to sign in with Google.

Security measures

• Transport over HTTPS; storage with the sub-processors listed above, under their own agreements
• Role- and permission-based access control, with an audit log of actions; signing events chained with SHA-256
• Isolation per organisation on every query, which closes to no rows rather than opening when no organisation is in context
• IP allowlist, idle session timeout and a two-factor requirement, each controlled by the Controller and enforced on every request

Retention and deletion

Cancelling a module deletes nothing: the paid period runs out, the module stays readable for 90 days, and is then archived. Deletion of a user account is requested in the Service, scheduled 14 days ahead, and withdrawable within those 14 days. Audit records are kept for the retention period the Controller sets in Settings → Security — 365 days by default, 30 at the least, 3 650 at the most — and are removed after it, including for organisations that have already left. Deletion or return of personal data beyond this, on termination, is carried out on written request to the address below.

Breach notification

Within 72 hours of a confirmed breach affecting Customer data.

To execute a counter-signed DPA, contact legal@closepact.com.