Data Processing Agreement
Effective date: 2026-08-09 00:00
Last updated: 2026-08-09 00:00
This Data Processing Agreement (DPA) forms part of the Documira Terms of Service between the professional customer identified by the account or order (Customer) and Documira (Processor).
It applies where Processor processes personal data on behalf of Customer in Customer Content. Terms such as personal data, processing, controller, processor and supervisory authority have the meanings in Regulation (EU) 2016/679 (GDPR).
1. Roles and scope
Customer is controller, or a processor authorized by another controller, for personal data it places in the Service. Documira is Processor for that data. Each party remains independently responsible for personal data it processes for its own purposes, including account administration, contracting, security and billing as described in the Privacy Notice.
The subject matter, nature, purpose, duration, data types and data-subject categories are described in Annex 1. Processing continues for the Service term and the deletion period in this DPA.
If Customer acts as a processor, it confirms that its controller has authorized the instructions, subprocessors and international transfers in this DPA. References to Customer instructions include relevant controller instructions passed lawfully to Customer.
2. Customer instructions
Processor will process personal data only:
- to provide, secure, maintain and support the Service under the Terms and Customer’s use of its functions;
- on other documented instructions from Customer; or
- where Union or Member State law requires processing, in which case Processor will inform Customer before processing unless the law prohibits notice.
The Terms, this DPA, Customer’s configuration and use of the Service, and documented support requests constitute instructions. Customer is responsible for the lawfulness, accuracy and proportionality of its instructions and for providing notices and legal bases to data subjects.
Processor will promptly inform Customer if, in its opinion, an instruction infringes GDPR or other applicable EU or Member State data-protection law. Processor may suspend the affected instruction while the parties resolve the issue.
3. Prohibited data
The Service is not designed for personal identification numbers such as CNP, identity documents, full payment-card details, passwords, GDPR Article 9 special-category data or Article 10 criminal-offence data. Customer must not submit such data unless Processor has first agreed in a separate written instrument describing the required safeguards.
4. Confidentiality and personnel
Processor will ensure that persons authorized to process Customer personal data are bound by confidentiality and access it only as needed for their duties. At MVP launch, infrastructure and administrative access is limited to the individual Provider. Access will be reviewed and removed when no longer needed.
5. Security
Taking account of the state of the art, implementation costs, processing context and risk, Processor will maintain measures intended to provide security appropriate to the risk. Current measures are summarized in Annex 2.
Customer acknowledges that no service can guarantee absolute security. Customer is responsible for account credentials, lawful content, endpoint security, its own backups of exported documents and selecting data appropriate for the Service’s documented controls.
Processor may update measures as technology and risk change, without materially reducing overall protection during a paid subscription.
6. Subprocessors
Customer gives general written authorization for the subprocessors in Annex 3. Processor will require each subprocessor to protect personal data through obligations materially equivalent to those required by GDPR Article 28 for the service it performs. Processor remains responsible to Customer for its subprocessor’s performance to the extent required by GDPR.
Processor may add or replace a subprocessor. It will give affected Customers individual advance notice by email or an in-Service message at least 15 days before the new subprocessor begins processing Customer personal data. Customer may object during that period on reasonable data-protection grounds. The parties will seek a practical alternative; if none is reasonably available, either party may terminate the affected Service without penalty for the unused prepaid period.
Services used only for Documira’s controller activities, and independent controllers such as a Merchant of Record or optional identity provider, are identified separately in the Privacy Notice and are not automatically subprocessors under this DPA.
7. International transfers
Processor will not transfer Customer personal data outside the EEA except on Customer’s instructions or through an authorized subprocessor using a lawful GDPR Chapter V mechanism.
Where an adequacy decision does not apply, the parties authorize use of the relevant European Commission Standard Contractual Clauses, including the 2021 controller-to-processor or processor-to-processor module as appropriate, together with supplementary measures identified through the relevant vendor arrangement. Processor will provide information reasonably available about the transfer mechanism on request.
8. Data-subject requests
Taking account of the nature of processing, Processor will assist Customer through appropriate technical and organizational measures, insofar as possible, to respond to requests under GDPR Chapter III.
If Processor receives a request relating solely to Customer Content, it will not respond substantively except on Customer’s instruction or as legally required. It will direct the requester to Customer or notify Customer where reasonably identifiable. Customer remains responsible for deciding and communicating the response.
9. Security incidents and personal-data breaches
Processor will notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer personal data. Notice will include information reasonably available concerning the nature of the breach, affected data and persons, likely consequences, measures taken or proposed, and a contact point. Information may be supplied in phases.
Processor will take reasonable steps to contain, investigate and mitigate the breach and will assist Customer with notifications under GDPR Articles 33 and 34. Notification is not an admission of fault. Customer is responsible for notification decisions and statutory deadlines applicable to it.
10. Compliance assistance
Taking account of the nature of processing and information available, Processor will reasonably assist Customer with security obligations, data-protection impact assessments and prior consultation under GDPR Articles 32-36. Assistance beyond standard Service information may be charged at a reasonable rate agreed in advance, unless needed because of Processor’s breach.
11. Return and deletion
During the Service term, Customer may retrieve data using available viewing, PDF and ZIP export functions. During the 30-day restricted period after expiry or closure, the workspace is viewable; export assistance may be requested through the contact form, without attaching or pasting Customer Content, because inactive-workspace PDF/ZIP export and one comprehensive structured account export are not currently self-service functions.
On termination, Customer may choose return of available Customer personal data, deletion, or both by contacting Processor before the restricted period ends. If Customer gives no choice, deletion is the default. After the 30-day restricted period, Processor will manually delete Customer Content from production systems unless Union or Member State law requires retention. Encrypted backups are made approximately every seven days and retained for up to 30 days, after which deleted content ages out. Backup data is isolated from ordinary use and will not be restored except for disaster recovery or legal necessity; if restored, applicable deletion instructions will be reapplied.
Controller-side account, security, transaction and legal records are retained under the Privacy Notice and are outside Customer’s deletion instructions to the extent Processor acts as an independent controller.
12. Information and audits
Processor will make available information reasonably necessary to demonstrate compliance with this DPA, including this document, relevant policies, subprocessor information and summaries of controls.
Processor will allow for and contribute to audits, including inspections, by Customer or an independent auditor mandated by Customer. Routine audits may ordinarily be handled remotely and limited to once per 12-month period. Those limits do not apply where an inspection or additional audit is required by law, a supervisory authority or a substantiated security or compliance concern. Audits must give reasonable notice, avoid unnecessary disruption and protect other customers and confidential security information. Customer bears its audit costs unless the audit identifies a material Processor breach.
Nothing requires disclosure of another customer’s data, credentials, vulnerability details that would increase risk, or legally privileged information. Processor will cooperate with a competent supervisory authority as required by law.
13. Liability and order of precedence
Liability arising from this DPA is subject to the Terms to the extent permitted by GDPR and mandatory law. Nothing limits data-subject rights or regulatory powers.
If documents conflict concerning processing of Customer personal data, this DPA prevails over the Terms, and executed Standard Contractual Clauses prevail over this DPA for the relevant transfer.
14. Duration and changes
This DPA starts when Customer first submits personal data to the Service and ends when Processor has deleted it as described above. Processor may update the DPA to reflect legal or Service changes. Material reductions in Customer rights will be notified reasonably in advance.
The governing-law and dispute provisions in the Terms apply to this DPA, without restricting a supervisory authority’s or data subject’s rights.
Annex 1 - Processing details
Subject matter and purpose
Hosting and operating a professional document-template automation service: storing templates and project information, substituting variables, generating and editing documents, handling uploads, exporting PDF/ZIP files, providing support, security and related technical operations.
Duration and frequency
Continuous or Customer-initiated processing during the Service term, followed by the restricted and deletion periods in section 11.
Data subjects
- Customer users, staff, contractors and professional contacts;
- Customer clients, suppliers, beneficiaries, representatives and institutional contacts; and
- other persons whose ordinary professional data the Customer lawfully includes in documents.
Personal-data categories
- names, professional roles, organizations and ordinary business contact details;
- project, contract, property/site and document-reference information;
- template text, variable values, record fields, images and generated documents;
- file and document metadata; and
- user/account identifiers where needed to attribute Customer actions.
The prohibited categories in section 3 are outside the agreed scope.
Customer rights and obligations
Customer determines the purpose and essential means, provides lawful instructions, handles data-subject relationships, limits data to what is necessary, controls its users and exports needed data before deletion.
Annex 2 - Technical and organizational measures
- Organization-scoped application access controls and tenant-aware queries for Customer workspaces.
- Individual authentication, password hashing, session controls and CSRF protection.
- Limited administrative and infrastructure access; only the individual Provider currently has such access.
- Input validation, HTML sanitization, restrictions on scripts and unsafe URLs, and file type/size/signature validation for uploads.
- Private-media delivery controls and non-public storage paths.
- Signed verification of billing webhooks and environment-based secret configuration.
- HTTPS delivery for public endpoints through Cloudflare and the application proxy.
- Database and private media on servers in Germany.
- Approximately weekly manual backups of database and media, encrypted and copied to a separate local device, with 30-day retention.
- Procedures for manual production deletion after the restricted period and deletion propagation through backup expiry.
- Transactional-email and support providers used only for their documented functions.
- No representation of application-level encryption at rest, high availability, offsite cloud redundancy, guaranteed recovery or a contractual uptime SLA.
Annex 3 - Subprocessors and other providers
| Provider | Processing | Location/transfer information |
|---|---|---|
| Hosting provider | Servers, Database, media and operational hosting | Germany/EEA |
| Cloudflare | Proxy, CDN, DNS and security processing for public traffic | Global network; applicable DPA and Chapter V safeguards |
Formspree, Brevo and marketing analytics process controller-side website, account, contact or transactional-message data rather than Customer Content. Google and Meta process optional login data under their respective roles. Dodo Payments acts as an independent controller for its checkout, tax, invoice, payment and Merchant-of-Record functions under its own documents. See the Privacy Notice for the complete recipient description.
Contact
DPA and data-protection communications may be sent to documira.contact [at] gmail.com. Ordinary support should use the website contact form.