Data Processing Agreement

1. Roles of the parties

The Customer is the data controller and Coventract is the data processor. Coventract processes personal data only on the Customer's documented instructions and to provide the service.

2. Subject-matter & duration

Processing lasts for the term of the customer agreement and covers the creation, signing, storage and management of contracts and related records.

3. Types of data & data subjects

Names, email addresses, IP addresses, device information, signatures and the contents of documents the Customer chooses to process. Data subjects include the Customer’s users and their counterparties.

4. Security measures

Encryption in transit (TLS) and at rest, role-based access controls, a SHA-256 tamper-evidence seal on signed documents, and an append-only audit trail. See the Trust Center for details.

5. Our access to Customer data

Coventract administrators can view a monitoring list of contracts across the service showing each contract's title, the account that created it, its status, its value and when it was last updated. Where necessary to provide the service — support, billing disputes, suspected abuse, or a legal obligation — an administrator can also open the contents of an individual contract. Such access to a contract belonging to another account is recorded in an internal security log with the identity of the administrator and the time of access. We do not access contract contents for any other purpose and do not use them to train AI models.

6. Sub-processors

The Customer authorises the sub-processors listed below. We will give reasonable notice before adding a new sub-processor so the Customer can object.

7. Personal data breaches

We will notify the Customer without undue delay after becoming aware of a personal data breach affecting their data, with the information needed to meet their obligations.

8. International transfers

Customer records, contracts, signatures and audit data are stored in me-central1 (Doha, Qatar). Uploaded files are stored in the same Qatar region. Application servers run in asia-east1 (Taiwan), so data is transmitted there to serve requests but is not stored there. Where personal data leaves Qatar, appropriate safeguards (such as Standard Contractual Clauses) apply.

9. Return & deletion

On termination, and at the Customer’s choice, we will return or delete the personal data, subject to any retention required by law.

10. Audit

We will make available information necessary to demonstrate compliance and allow for reasonable audits on request, subject to confidentiality.

11. Provider commitment

By publishing and accepting this Agreement, Coventract agrees to and is bound by its terms. When you sign electronically below, a binding agreement is formed between both parties — no separate signature from Coventract is required. A countersigned PDF copy is available on request.