Qodoonect Trust
Draft — pending legal review. These documents are drafts provided for transparency while an internal legal review is completed.

Data Processing Agreement (DPA)

This DPA forms part of the contract between MB Qodoonect, legal entity code 308013013 ("Qodoonect", the "Processor"), and the customer (the "Controller") for the use of the Qodoonect Trust Platform. It implements Art. 28 of Regulation (EU) 2016/679 (GDPR).

1. Scope & subject-matter

The Processor processes Personal Data on behalf of the Controller for the purpose of providing electronic signature services for documents the Controller uploads, as described in the Terms of Service. Identity and entity verification under Section 1 of the Terms is carried out by Qodoonect as an independent controller and is not covered by this DPA.

2. Duration

For the duration of the Service contract and any post-termination retention period required by applicable law or agreed with the Controller.

3. Nature, purpose & categories

  • Nature: hosting, signature workflow execution, identity verification, audit-trail generation, ledger anchoring.
  • Purpose: performance of the Service contract.
  • Data subjects:Controller's employees, customers, signers, and authorised representatives.
  • Data categories: identification data, contact data, professional context, document content uploaded for signing, authentication factors, audit metadata.

4. Processor obligations

  • Process Personal Data only on documented Controller instructions.
  • Ensure persons authorised to process are bound by confidentiality.
  • Implement technical and organisational measures aligned with Art. 32 GDPR (see Annex A — pending).
  • Assist the Controller in fulfilling data subject requests.
  • Notify the Controller of personal data breaches without undue delay (target: 24 hours).
  • Make available all information necessary to demonstrate compliance and allow audits or third-party audits.

5. Sub-processors

The Controller authorises engagement of the sub-processors listed at qodoonect.com/sub-processors. Additions or replacements are notified at least 30 days in advance; the Controller may object on legitimate grounds, in which case the parties will negotiate in good faith.

6. International transfers

Where transfers occur outside the EEA, the parties rely on the EU Standard Contractual Clauses (Decision 2021/914) with supplementary technical measures (encryption-at-rest, encryption-in-transit, access controls). The clauses are deemed incorporated by reference.

7. Return or deletion

Upon termination, the Processor will, at the Controller's choice, return or delete all Personal Data within 90 days, except where retention is required by Union or Member-State law or agreed with the Controller.

8. Liability

Liability between the parties is governed by the Terms of Service, without prejudice to GDPR Art. 82 rights of data subjects.

9. Annexes (pending)

  • Annex A: Technical and organisational measures.
  • Annex B: List of sub-processors.
  • Annex C: Standard Contractual Clauses (where applicable).

Last updated: 2026-10-19. Document version: draft-0.2. Final DPA will be available for signature via the Service once the legal review is complete.