Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Dan Zilberman ("Hereby", "Processor") and the customer that owns a Hereby workspace ("Customer", "Controller"). It applies when Hereby processes personal data on the Customer's behalf and that processing is subject to the EU GDPR, the UK GDPR, the Swiss FADP, or similar data protection laws ("Data Protection Law"). It takes effect when the Customer accepts the Terms; no signature is needed. Customers who need a signed copy can request one at [email protected].

1. Scope and roles

The Customer is the controller of the personal data in its workspaces ("Customer Personal Data"), and Hereby is its processor. Details of the processing are in Annex 1.

2. Hereby's obligations

Hereby will:

1. Process Customer Personal Data only on the Customer's documented instructions, which are the Terms, this DPA and the Customer's use and configuration of the Service, unless the law requires otherwise (in which case Hereby will tell the Customer first, unless the law forbids it). Hereby will tell the Customer if it believes an instruction breaks Data Protection Law.
2. Ensure that everyone authorised to process Customer Personal Data is bound by confidentiality.
3. Implement the technical and organisational measures in Annex 2.
4. Help the Customer, taking into account the nature of the processing, to respond to data subject requests, mainly through the Service's export, deletion and retention features.
5. Help the Customer with security, breach notification, data protection impact assessments and prior consultation, as far as they concern Hereby's processing.
6. Notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information the Customer reasonably needs to meet its own obligations.
7. At the end of the Service, delete Customer Personal Data (after the Customer has had the chance to export it) within the retention window described in the Privacy Policy, unless the law requires it to be kept. Signing evidence that the Customer chose to keep in completed envelopes is deleted with the workspace.
8. Make available the information needed to show compliance with this DPA and allow audits as set out in section 5.

3. Sub-processors

The Customer gives general authorisation for Hereby to use sub-processors. The current list is at usehereby.com/legal/subprocessors. Hereby will update that list at least 30 days before a new sub-processor starts processing Customer Personal Data, and notify Customers who have subscribed to updates. The Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Customer may terminate the affected Service and receive a refund of prepaid fees for the remaining term. Hereby imposes data protection obligations on each sub-processor that are at least as protective as this DPA and remains responsible for their performance.

4. International transfers

Where Customer Personal Data is transferred from the EEA, the UK or Switzerland to a country without an adequacy decision, the parties agree that the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module 2 (controller to processor), are incorporated by reference, with Clause 7 included, option 2 in Clause 9 (general authorisation, 30 days), the optional language in Clause 11 omitted, and Clauses 17 and 18 governed by the law and courts of Ireland. For UK transfers, the UK International Data Transfer Addendum applies; for Swiss transfers, references to the GDPR are read as references to the FADP. Annexes 1 and 2 of this DPA complete the appendix to the Clauses. Hereby will put equivalent safeguards in place with its sub-processors.

5. Audits

Hereby will answer the Customer's reasonable written security questionnaires once a year, and share summaries of relevant third-party audits or certifications when available. If that is not enough to show compliance, or a supervisory authority requires it, the Customer may conduct an audit at its own cost, on 30 days' notice, during business hours, no more than once a year, under confidentiality, in a way that does not disrupt the Service or other customers' data.

6. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Terms, to the extent Data Protection Law allows. If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data; if the Standard Contractual Clauses conflict with this DPA, the Clauses prevail.

Annex 1: Details of processing

Subject matter and duration. Providing the Service under the Terms, for as long as the Customer uses it and until deletion as described above.

Nature and purpose. Hosting, storing, sharing and displaying documents; running data rooms with access control and activity analytics; preparing, routing, collecting and sealing electronic signatures; optional AI-assisted document preparation; sending service emails; producing audit logs; support.

Categories of data subjects. The Customer's members; people the Customer invites to view data rooms or sign documents; people named in documents the Customer uploads.

Categories of personal data. Names, email addresses, job titles and organisations; signature images and typed names; form field values; IP addresses, browser user agents, timestamps and activity records (views, pages, downloads, signing events); any personal data contained in documents the Customer uploads.

Special categories. Not intended. The Customer may not upload special category data unless it has a lawful basis and has assessed the safeguards in Annex 2 as appropriate.

Frequency. Continuous.

Annex 2: Technical and organisational measures

• Encryption in transit: TLS for all connections; HSTS.
• Encryption at rest: encrypted disks and encrypted off-site database backups; optional application-level encryption of files with per-workspace keys.
• Access control: passwordless sign-in with one-time codes; session tokens, codes and API tokens stored only as hashes; role-based access per workspace and per drive; per-group access policies for data rooms; staff access to production limited to named administrators.
• Tenant isolation: every database query is scoped to the workspace, enforced in code and checked in automated tests; inaccessible resources answer "not found".
• Integrity: append-only, hash-chained audit log verified nightly; completed documents sealed with a PAdES signature and SHA-256 hashes recorded on the certificate of completion.
• Availability and resilience: continuous database replication to off-site storage; tested restore procedure; protection against denial-of-service by our network provider.
• Application security: strict Content Security Policy, frame restrictions, rate limits on sign-in, upload type checks, dependency auditing in continuous integration.
• Data minimisation and deletion: configurable retention per workspace; trash purge after the retention window; account deletion anonymises the user in audit records; per-user data export.
• Incident response: monitoring and alerting, a documented incident process and breach notification as set out in section 2.