ForgeSign

Data Processing Addendum (DPA)

Effective 2026-11-02

This DPA forms part of the Terms of Service between JVANET PTY LTD (ABN 26 696 484 107) ("Processor") and you, the customer ("Controller"). It governs Processor's processing of personal data on Controller's behalf when you use ForgeSign for B2B signing workflows where you are the data controller for the signers' personal data.

1. Definitions

"Personal Data", "Data Subject", "Processing", "Controller", and "Processor" have the meanings given in the EU General Data Protection Regulation (GDPR), the UK GDPR, or the California Consumer Privacy Act (CCPA), as applicable.

2. Subject matter and scope

Processor will process Personal Data only on documented instructions from Controller, which include the use of the Service per its product documentation. Processing types include storage, transmission, AI-assisted analysis, and signed-document retention.

3. Processor obligations

  • Maintain technical and organisational measures appropriate to the risk (see Trust page)
  • Ensure personnel processing data are bound by confidentiality
  • Assist Controller in responding to Data Subject requests within 30 days
  • Notify Controller of any personal data breach within 72 hours of becoming aware
  • Delete or return Personal Data on termination per Controller's instructions, subject to retention obligations under applicable law (notably ESIGN/UETA 10-year retention)
  • Make available all information necessary to demonstrate compliance with GDPR Art. 28

4. Subprocessors

Controller authorises Processor to use the subprocessors listed at /legal/subprocessors. Processor will give 30 days notice of changes to the subprocessor list. Controller may object; if no commercially reasonable alternative exists, Controller may terminate.

5. International transfers

Where Personal Data is transferred from the EU/UK to a third country, Processor and subprocessors rely on the EU-US Data Privacy Framework (where certified) or Standard Contractual Clauses (SCCs).

6. Audits

Processor will, at Controller's reasonable request and at Controller's expense, provide a SOC 2 Type 2 report (when available) and respond to a written security questionnaire. On-site audits are not permitted; the documentation provided is intended to satisfy Controller's audit obligations.

7. Liability

Liability under this DPA is subject to the limitations in the Terms of Service.

8. Acceptance

This DPA is automatically accepted on creation of any paid account. For an executed copy with your company's details, contact hello@jvanet.com.