Data processing

How SimpleSign365 processes personal data on behalf of your office, and how to get a data processing agreement under Article 28 GDPR.

Last updated 27 October 2026

When your office sends documents for signature, your office decides whose personal data is used and why. For that data we act as your processor. This page sums up how we handle it. The Privacy Policy has the full details.

Data processing agreement

We sign a data processing agreement (DPA) under Article 28 GDPR with any office that asks for one. Email [email protected] with your organisation's name and we will send it to you.

Roles

• Your office is the controller for the personal data of the people it sends documents to, such as clients and employees who sign, and for the content of its documents.
• We are the processor for that data. We handle it only on your office's instructions, to provide the service.
• For the data of the people who sign in and send documents, we are the controller, as the Privacy Policy describes.

What we process

Documents and signed PDFs, signer names and email addresses, the one-time codes that confirm a signer's address, and the signing history: name, confirmed email address, IP address, the time of each step and the wording the signer agreed to.

Where it is stored

Each organisation is stored in one place only, chosen once when it is created: the EU (Microsoft Azure, West Europe) or the US (Microsoft Azure, Central US). Its documents, signing history, logs and backups stay there and are never moved.

Subprocessors

The providers that help us run the service are listed on the subprocessors page. We update that list when it changes.

Security

Connections are encrypted, the key that seals finished PDFs is held in a hardware-backed key vault, and access to customer data is limited to people who need it. The security page has more.

Deletion

• On the Free plan nothing is stored: the signed PDF is emailed to everyone and the documents are deleted within 24 hours.
• On paid plans documents are kept until you delete them.
• When an Admin closes an organisation, its documents and data are deleted 30 days later. The signing record (who signed, when and from which email address, without the document content) is kept for 10 years as evidence of the signature.

Requests from signers

If a signer asks us about their data, we help your office answer, and we may refer them to your office as the controller.