Data Processing Agreement

1. Who is who

You (the customer) are the controller of the personal data you put into Propovo about other people: your clients, signers, contacts and team members. Xirosys Pvt Ltd (16, Kh No. -23/2, 1st F, Street No 10, Sanjay Colony, Narela, North West Delhi, India, 110040), which operates Propovo, is your processor for that data. In this agreement, "Customer Personal Data" means that data, and "Data Protection Law" means the laws that apply to it, including the GDPR, the UK GDPR, the Swiss FADP, India's Digital Personal Data Protection Act 2023 and US state privacy laws.

For your own account details and billing, Propovo is a controller under its Privacy Policy.

2. What we process

3. Your instructions

We process Customer Personal Data only on your documented instructions. These Terms, your settings and the actions you take in Propovo are your instructions. If we think an instruction breaks Data Protection Law, we will tell you. If the law requires us to process data in another way, we will tell you first unless the law forbids it.

4. Confidentiality

Only people who need access to run, support or secure Propovo can reach Customer Personal Data, and they are bound to keep it confidential.

5. Security

We keep the technical and organisational measures in Annex 2 in place and improve them over time. We will not reduce the overall protection they give.

6. Sub-processors

You authorise the providers on our sub-processor page. We hold each one to data protection terms at least as protective as this agreement and remain responsible for them.

We add a new provider to that page at least 14 days before it starts processing Customer Personal Data. If you object on reasonable data protection grounds, email support@propovo.com before then. We will try to find a solution; if we cannot, you may end the affected service and we will refund any prepaid fees for the unused period.

7. Helping you

Propovo lets you find, export, correct and delete the data it holds about a person. If you need more help answering a data subject request, a data protection impact assessment or a regulator, we will help where we reasonably can. If a person contacts us directly about data you control, we will pass the request to you.

8. Personal data breaches

If we become aware of a breach of security that affects Customer Personal Data, we will tell you without undue delay. We will describe what happened, the data and people likely affected, the likely consequences, what we have done and what we recommend, and update you as we learn more. Telling you is not an admission of fault.

9. Deletion

When you delete documents, contacts or your account, we delete the Customer Personal Data in them. Two kinds of record are kept:

• Signed copies. Every person who signs a document receives their own copy. That signed PDF and its copy link are kept until seven years after signing, even if you delete the document or your account, so each signer can keep and reproduce their record. You instruct this by collecting signatures through Propovo.
• Legal records. Data we must keep by law, such as billing records.

You can export your data at any time from Settings before you delete it.

10. Information and audits

We will give you the information you reasonably need to show that this agreement is being met. If that is not enough, you may audit us once a year with 30 days' notice, during business hours, at your cost, under a confidentiality agreement, and without access to other customers' data.

11. International transfers

Propovo is operated from India. Our application servers and database are in Canada. Uploaded files and encrypted database backups are stored with Cloudflare R2 in the Asia-Pacific region, and some sub-processors are in the United States and other countries.

• Transfers to Canada rely on the European Commission's adequacy decision for Canada, and the UK and Swiss equivalents.
• Other transfers from the EEA rely on the European Commission's Standard Contractual Clauses (Decision 2021/914): Module 2 between you and us, and Module 3 between us and our sub-processors. They are part of this agreement. Clause 7 (docking) does not apply, Clause 9 option 2 (general authorisation, with the notice in section 6) applies, the optional wording in Clause 11 is not used, Clauses 17 and 18 choose the law and courts of Ireland, and Annexes I and II are sections 2 and 5 and Annex 2 of this agreement.
• For the UK, the UK International Data Transfer Addendum to those clauses applies. For Switzerland, the clauses apply with references to the GDPR read as references to the FADP and the FDPIC as the competent authority.
• Where a US provider is certified under the EU-US Data Privacy Framework, we may rely on that instead.

12. General

Each party's liability under this agreement follows the limits in the Terms of Service, unless Data Protection Law does not allow it. If this agreement and the Terms disagree about personal data, this agreement wins; the Standard Contractual Clauses win over both. For a countersigned copy, email support@propovo.com.

Annex 2: Security measures

• All traffic to Propovo uses HTTPS (TLS).
• Passwords are hashed with bcrypt, and passwords known from public data breaches are refused. Accounts can turn on two-factor authentication with an authenticator app.
• Email and integration access tokens are encrypted with AES-256. Database backups are encrypted with AES-256-GCM before they leave the server.
• Every request is checked against the workspace and role it belongs to; documents, rooms and signer links use unguessable tokens.
• Signed documents are sealed: the PDF is stored with its SHA-256 hash, an audit trail and a record fingerprint, and is checked before every download.
• Public endpoints are rate-limited.
• Error monitoring removes personal details from reports before they leave our servers.
• Production access is limited to the people who run Propovo.
• We keep a written incident response plan and a breach log.

Annex 3: Sub-processors

See the sub-processor page.