Data processing addendum
This Data Processing Addendum ("DPA") supplements the Terms of Service and applies where SignWorkspace processes personal information on behalf of Customer as an operator (POPIA) or processor (comparable foreign frameworks).
Last updated: 10 July 2026
1. Roles of the parties
For personal information contained in Envelopes, templates, recipient contacts and related Content that Customer submits to the Service, Customer is the responsible party under POPIA (and "controller" under comparable frameworks such as the EU/UK GDPR, where applicable to Customer's signers), and SignWorkspace is the operator (or "processor"). This DPA does not apply to processing where SignWorkspace is itself the responsible party, which is described in the Privacy Notice.
2. Instructions
SignWorkspace will process personal information within Content only: (a) to provide, secure and support the Service in accordance with the Terms of Service; (b) on Customer's documented instructions, which include the configuration choices Customer makes within the Service (for example, verification method, retention period and recipient details); and (c) as required by applicable law, in which case SignWorkspace will inform Customer before processing unless the law prohibits doing so.
3. Confidentiality of personnel
SignWorkspace ensures that personnel authorised to process personal information are subject to confidentiality obligations, whether contractual or statutory.
4. Security measures
SignWorkspace implements appropriate technical and organisational measures against unauthorised or unlawful processing, accidental loss, destruction or damage, consistent with POPIA section 19, including: encryption of Content in transit and at rest; role-based access control and tenant-scoped data isolation; hashing of documents and one-time verification codes; audit logging of key envelope and account events; and a documented security-incident response process.
5. Sub-operators
Customer authorises SignWorkspace to engage sub-operators to help provide the Service (see categories in Section 7 and the Privacy Notice), provided SignWorkspace imposes data-protection obligations on each sub-operator that are no less protective than this DPA. SignWorkspace remains liable for a sub-operator's acts and omissions to the same extent SignWorkspace would be liable if performing the sub-operator's services directly. Where SignWorkspace intends to appoint a new sub-operator with access to Content, it will provide reasonable advance notice through the Service or by email so Customer may object on reasonable data-protection grounds.
6. Assistance with data subject requests
Taking into account the nature of the processing, SignWorkspace will provide Customer with reasonable tools and assistance (through the Service or on request) to help Customer respond to requests from data subjects to exercise their rights under POPIA or comparable law, including access, correction, deletion and objection requests, consistent with the retention model configurable within the Service.
7. Categories of data subjects and personal information
| Category | Details |
|---|---|
| Data subjects | Customer's Authorised Users; Signers and other Envelope recipients; individuals in Customer's saved recipient contacts |
| Categories of personal information | Name, contact details (email, phone), organisation and role, signature image, form field responses entered on a document, verification/authentication outcomes, IP address and device metadata associated with signing activity |
| Special personal information | Only if Customer chooses to include it within document content or form fields; Customer is responsible for the lawful basis for doing so |
| Nature and purpose of processing | Hosting, transmission, display, verification and audit-trail generation to enable Customer to send, sign and track agreements |
| Duration | For the term of the Subscription and any configured post-termination retention or legal-hold period, as described in Section 9 |
8. International transfers
Where a sub-operator processes personal information outside South Africa, SignWorkspace will ensure the transfer is subject to appropriate safeguards under POPIA section 72 (such as contractual clauses providing an adequate level of protection) before the transfer occurs.
9. Return and deletion on termination
On termination of the Subscription, Customer may export Content for a reasonable period as described in the Service or the Terms of Service. After that period, or immediately on request, SignWorkspace will delete or de-identify personal information within Content, except where retention is required by law, by a legal hold applied within the Service, or for legitimate audit/evidentiary purposes (for example, retaining a completed envelope's audit trail as proof of execution) consistent with our data retention documentation.
10. Security compromise notification
SignWorkspace will notify Customer without undue delay after becoming aware of a security compromise involving personal information processed under this DPA, and will provide reasonably available information to help Customer meet its own notification obligations under POPIA section 22 or comparable law. SignWorkspace will not itself notify a Customer's data subjects or a regulator on Customer's behalf unless specifically agreed in writing.
11. Audits
On reasonable written request, no more than once per year (except following a security compromise or as required by a regulator), SignWorkspace will provide Customer with available information — such as security documentation, summaries of independent assessments where they exist, or responses to a reasonable security questionnaire — to demonstrate compliance with this DPA.
12. Sub-operator categories
Current categories of sub-operator, consistent with the Privacy Notice, are: cloud application hosting and document storage; transactional email delivery; SMS and WhatsApp messaging delivery (used only where a Customer enables those verification methods); and payment processing (for Subscription billing, which does not involve Envelope recipient personal information). A named subprocessor register, including provider, purpose, data categories and region, is maintained internally and will be made available to customers once finalised and contractually confirmed.
13. Relationship to the Terms of Service
This DPA forms part of, and is subject to, the limitation of liability and indemnification provisions of the Terms of Service. In the event of a conflict between this DPA and the Terms of Service regarding the processing of personal information, this DPA prevails.
14. Contact
Questions about this DPA can be sent to sales@signworkspace.com.
About this document
SignWorkspace provides privacy and security controls designed to support customers' POPIA obligations as responsible party; this DPA describes SignWorkspace's role and commitments as operator. This document is a comprehensive draft and has not been certified by a South African admitted attorney. Obtain legal sign-off, and confirm the final sub-operator register, before relying on it as final.