Data processing agreement
Draft — for legal review. Not an executed agreement.
Updated: 2026-10-27
This public draft is a starting point for an agreement under GDPR Article 28, not confirmation that all terms or supplier arrangements are finalized.
1. Roles and scope
The business customer determines the purposes and lawful basis for personal data in submitted documents and signing instructions. Bullseye Labs AS (registered as Kefas AS, org. no. 928 769 879, Norway) acts as processor for that instructed processing, and as an independent controller for account administration, security and billing. Final roles must be confirmed for each processing activity.
2. Processing instructions
Processing covers receiving documents, requesting and recording signatures, delivery, troubleshooting and deletion or return as agreed. Data may include document contents, names, email addresses, mobile numbers, signature images and signing evidence (IP address, device information and timestamps). Data subjects are the customer’s personnel, signers and people named in documents. Do not submit special-category data without a separately agreed scope and safeguards.
3. Confidentiality and security
The final agreement should require confidentiality for authorized personnel, access limited to necessary processing, secure transport, protected signature storage and appropriate organizational safeguards. Shared views mask contact details; the signer and account owner can see their own authorized information. Security measures must be documented and assessed against the customer’s risks.
4. Subprocessors and international transfers
The service uses Lovable Cloud, Mailgun EU, Twilio and an external signing service; Stripe processes payments. Provider roles, contracting entities, locations and any further subprocessors must be confirmed in the final annex. The agreement should require notice of changes, a reasonable opportunity to object, equivalent processor obligations and a valid transfer mechanism where data leaves the EEA. Do not assume every supplier is a processor or that every transfer is covered.
5. Assistance, incidents and audits
The final agreement should provide assistance with data-subject requests, security assessments and regulatory obligations, notification of personal-data breaches without undue delay, and information and proportionate audit rights needed to demonstrate compliance with GDPR Article 28. Incident contacts and procedures must be agreed before execution.
6. Duration, return and deletion
Processing continues for the agreed service period. On termination, the final agreement must specify return or deletion, statutory retention exceptions, backup handling and the external signing service’s actual retention rules. No verified PDF retention period is promised in this draft. Customers should save their delivered signed copy. Fiken copies follow the customer’s Fiken arrangements.
Contact: support@smoothsign.cc · Privacy policy