This agreement forms part of the Terms. It governs the processing that ORIANA SYSTEMS (254 Rue Vendôme, 69003 Lyon, FR — the "Processor") carries out on behalf of the customer (the "Controller") when the customer uses the SignCloud Services, pursuant to Article 28 GDPR.
Processing consists of hosting, sealing, transmitting, verifying and retaining documents, signature evidence, identity-verification data and e-mail evidence, strictly to provide the Services, for the duration of the contract plus the retention periods chosen by the Controller.
Data subjects: the Controller's staff, its signers, recipients and verified persons.
The Processor: processes only on documented instructions (the use of the Services constituting such instructions); ensures persons authorised are bound by confidentiality; implements the technical and organisational measures described on the Security page (TLS, encryption at rest for vault content, hashed passwords, chained audit logs, per-organisation isolation, 2FA); assists the Controller with data-subject requests and Articles 32-36; notifies the Controller without undue delay and at the latest within 48 hours of becoming aware of a personal-data breach affecting its data; makes available the information necessary to demonstrate compliance and allows audits (once per year, at the Controller's cost, with 30 days' notice, without access to other customers' data).
The Controller gives general authorisation for the sub-processors listed in the privacy policy (hosting O2switch — France; Encrypted off-site backups: Hetzner (European Union); sensitive-data storage: OVHcloud, Paris — SecNumCloud-qualified hosting; Stripe for payment processing only; OpenAI (API) when AI drafting, analysis or transcription is used; RFC 3161 timestamp authority receiving only fingerprints). The Processor informs the Controller at least 30 days before adding or replacing a sub-processor; the Controller may object on legitimate grounds, in which case it may terminate the affected Service.
Primary service data is hosted in France, sensitive data is stored in an OVHcloud environment in Paris with SecNumCloud-qualified hosting, and encrypted off-site backups remain in the European Union. Use of AI drafting, analysis or transcription can involve processing outside the EU. Where a sub-processor involves a transfer outside the EU (for example Stripe or OpenAI), it is governed by an applicable transfer mechanism, such as an adequacy decision or the European Commission's Standard Contractual Clauses.
Upon termination, the Processor places the account in read-only mode, makes the data available in a standard format for 60 days, then deletes it. Data subject to a statutory retention duty or legal hold, and historical vault contracts, remain isolated only for the applicable duration.
Data-protection contact: contact@signcloud.fr. A countersigned copy of this DPA is available on request for the Controller's records.
The Controller documents its lawful instructions, provides the required information to data subjects, ensures that its collection and use of personal data are lawful, and does not instruct the Processor to act in breach of applicable law. If an instruction appears unlawful, the Processor informs the Controller and may suspend that instruction pending clarification.
Version 1.4 — 17 September 2026. Processor: ORIANA SYSTEMS · Company number: 10959159400014 · EU VAT number: FR58108748526.