Data Processing Agreement

1. Definitions

"Applicable Data Protection Law"

Israel's Protection of Privacy Law, 5741-1981, and the regulations under it, including the Privacy Protection (Data Security) Regulations, 5777-2017 (תקנות הגנת הפרטיות (אבטחת מידע), התשע"ז-2017) and the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001; the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), and other privacy or data-protection laws applicable to Seald's processing on behalf of the Customer.

"Personal Data"

Personal information processed by Seald on behalf of the Customer in connection with the Service, as described in Annex I.

"Sub-processor"

Any processor engaged by Seald to process Personal Data on behalf of the Customer.

2. Roles and scope

For Personal Data processed in connection with the Service, the Customer is the controller (or processor on behalf of its own customer), and Seald is the processor (or sub-processor). This DPA implements the service-provider obligations of CCPA § 1798.140(ag) and § 1798.105(c). Seald is a "service provider" within the meaning of CCPA § 1798.140(ag) and not a "third party" or "contractor".

3. Processor obligations

1. Documented instructions. Seald processes Personal Data only on the documented instructions of the Customer, as set out in the Agreement, this DPA, and any further written instructions the Customer gives within the scope of the Service. Seald will inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law.
2. Confidentiality. Personnel authorized to process Personal Data are subject to a duty of confidentiality, whether by contract or by statute.
3. Security. Seald implements appropriate technical and organizational measures to protect Personal Data, as described in Annex II, and, as the Customer's processor ("holder"), complies with the obligations that the Privacy Protection (Data Security) Regulations, 5777-2017 place on it, including notifying the Customer of a security incident.
4. Sub-processors. See Section 4 below. Seald flows down obligations equivalent to those in this DPA.
5. Data-subject requests. Seald assists the Customer (taking into account the nature of the processing) in responding to requests from data subjects, including by providing in-product export and deletion functionality and by forwarding requests received directly by Seald.
6. Breach assistance. Seald notifies the Customer without undue delay (and in any event within seventy-two (72) hours) after becoming aware of a Personal Data Breach affecting Customer Personal Data, and provides reasonable assistance with the Customer's security and personal-data-breach obligations.
7. Return or deletion. Before termination, the Customer can export its data from the Service. When the Customer deletes its account, Seald deletes the Customer's contacts, templates and drafts, and keeps sent and completed envelopes and their audit records without a link to the Customer's account. Seald doesn't currently delete those records on a schedule.
8. Audit. Seald makes available to the Customer the information necessary to demonstrate compliance with this DPA. The Customer may, on reasonable prior written notice (not more than once per calendar year unless triggered by an incident), exercise an audit right limited to information requests, and where strictly necessary an on-site audit conducted by an independent auditor under reasonable confidentiality and security constraints, at the Customer's expense.

4. Sub-processors

The Customer authorizes Seald to engage Sub-processors to process Personal Data, subject to the following conditions:

• Seald maintains a current list of Sub-processors at /legal/sub-processors, including each Sub-processor's name, processing role, location, and transfer basis. Transfers of Personal Data outside Israel are made in accordance with the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001.
• Before adding or replacing a Sub-processor, Seald gives at least thirty (30) days' advance notice by updating the public list and by emailing subscribers to privacy@seald.nromomentum.com.
• The Customer may object on reasonable data-protection grounds within the thirty-day window. If the parties cannot agree on a resolution, the Customer may terminate the affected portion of the Service for the disputed Sub-processor as its sole and exclusive remedy.
• Seald imposes on each Sub-processor data-protection obligations equivalent in substance to those in this DPA and remains liable for the acts and omissions of its Sub-processors.

5. Liability

Each party's liability under this DPA is subject to the limitations and exclusions set out in the Agreement. Nothing in this DPA limits any liability that cannot be limited under Applicable Data Protection Law (for example, statutory data-subject claims).

6. Precedence and changes

If there is a conflict between this DPA and the Agreement, this DPA prevails on data-protection matters. Seald may amend this DPA from time to time to reflect changes in Applicable Data Protection Law; material amendments are notified at least thirty (30) days in advance.

Annex I — Description of processing

I.A Parties

Data exporter: the Customer (controller). Data importer / processor: Eliran Azulay, an individual trading as "Seald", Chlenov 24, Tel Aviv-Yafo 6604806, Israel, contact privacy@seald.nromomentum.com.

I.B Description

• Categories of data subjects: Customer's authorized users, Customer's signers and recipients, third parties named in Customer documents.
• Categories of Personal Data: name, email, optional phone, IP address, user agent, drawn or typed signature image, document content provided by the Customer, audit-event metadata.
• Sensitive data: none collected by Seald; any Sensitive Personal Information present in Customer-uploaded documents is incidental and processed only as part of the document content.
• Frequency: continuous for the duration of the Agreement.
• Nature of processing: hosting, transmission, signing, sealing (PAdES seal when applied), audit-trail capture, retention, deletion.
• Purpose: providing the Service.
• Retention: as set out in our Privacy Policy. We don't currently delete completed records on a schedule, and we don't promise to keep them for any particular period.

Annex II — Technical and organizational measures

• Encryption. TLS in transit between users and the Service, and between Seald's servers and its database, file-storage and email Sub-processors. Traffic between software components on the same server (the reverse proxy, the API and the document-conversion service) isn't separately encrypted. Data stored by Seald's database and file-storage Sub-processor is encrypted at rest by that Sub-processor.
• Cryptographic key management. Where Seald uses AWS Key Management Service (KMS) for document-sealing or Google Drive token-wrapping keys, the key material is non-exportable from KMS.
• Document integrity. Completed files include a PAdES seal when applied and an RFC 3161 timestamp when available.
• Audit chain. Each audit event includes a SHA-256 hash of the prior event, surfacing tampering.
• Access control. Access to customer data in production is limited to operators of the Service.
• Logging and monitoring. Envelope audit events are kept with the envelope. We don't currently promise a separate retention period for authentication or access logs.
• Backup and recovery. Seald doesn't currently keep separate backups of Customer Personal Data. Data lost from the primary database or file storage may not be recoverable.
• Vendor management. Sub-processors are bound to data-protection obligations equivalent to those in this DPA.
• Personnel. Confidentiality obligations.

Seald has not obtained SOC 2 Type II, ISO 27001, or any qualified-trust-service-provider recognition. The measures above are described as verifiable controls only.