Draft for review — not yet in force

Data processing agreement

Last updated: 12 October 2026

This agreement applies when Sipru handles personal data on behalf of a professional who uses it. It is meant to meet Article 28 of the UK GDPR, and it forms part of the terms of service. It has not been reviewed by a solicitor yet.

1. Roles

Sipru is operated by Stepan Zarichnyi, a sole trader in the United Kingdom. Contact: [email protected]. How we handle the data we control is in the privacy notice.

2. Subject matter and duration

We process personal data so that you can use Sipru to run your business. This lasts as long as your workspace exists, and afterwards only as long as the retention schedule in Annex 2 says.

3. Nature and purpose of the processing

Storing, organising and showing the information you enter; sending your clients links to documents and showing them those documents; recording signatures, answers and messages made through those links; drawing PDFs; exporting data to you; and deleting it. We process it for these purposes and no other.

4. Whose data, and what kind

People: your clients and their contacts, people who enquire, people named on a project (for example event contacts), the people you invite into the workspace, and anyone who opens a link you send.

Data: names, e-mail addresses, phone numbers and notes; project details such as dates, venues and times; quotes, contracts and invoices; answers to questionnaires; messages; signature records (typed name, time, IP address, browser details, the consent text shown and a document fingerprint); records of when a delivery link was opened and from which IP address and browser; and, in the queue of e-mail notifications waiting to be sent, the recipient's e-mail address and the details of the event it is about.

Sipru is not built for special-category data (for example health information). Please do not enter it.

5. What we do as your processor

• Instructions. We process the data only on your documented instructions. Using the features of Sipru is an instruction; so is a written request to [email protected]. If we think an instruction breaks the law, we will say so.
• Confidentiality. Everyone who can reach the data is bound to keep it confidential.
• Security. We use the measures in section 7.
• Sub-processors. You agree in general to the sub-processors in Annex 1. We will update the list and tell you in the app before we add or replace one. If you object, you can delete your account. We use written terms with each of them that protect the data in the same way as this agreement.
• Helping you. We help you answer requests from the people whose data it is, and with security, breach notification and impact assessments, as far as that is possible from what we hold. We will tell you without undue delay after we become aware of a personal data breach affecting your workspace.
• Deletion and return. You can take a machine-readable copy at any time (More → Account → Export my data). When you delete your account, your workspace data is erased, except the records a business has to keep, which are kept for the period in Annex 2. See delete account.
• Audit information. We will give you the information needed to show we meet this agreement and will allow reasonable checks, with notice, during normal working hours.

6. International transfers

Your workspace data (the database, files and accounts) is stored in the United Kingdom, in the AWS London region, and we do not move it to another region. Some of our sub-processors handle limited operational data, such as IP addresses and request logs, on infrastructure that may be outside the United Kingdom; Annex 1 says what each one receives.

7. Security measures

• Each workspace is separated in the database itself by row-level security, not only in the app. People outside a workspace cannot read its records, and people who open a link can reach only what that link points to.
• Links and invitations are long random values stored only as a one-way hash. One-time codes are stored hashed on the link and expire after ten minutes. While e-mail delivery is not configured, an encrypted copy of each code that is issued also sits in the outbox until the workspace is erased.
• Generated PDFs are kept in private storage and handed out through links that work for one hour.
• The key that can bypass the database rules never leaves the server.
• Connections are encrypted in transit.
• Significant actions (changes to accounts and workspaces, signing, document access) are written to an append-only audit record.

8. Your responsibilities

You decide why and how the personal data in your workspace is used. You are responsible for having a lawful basis for holding it, for telling the people it is about, and for what you enter.

9. Liability and law

Liability under this agreement is subject to section 11 of the terms of service. The law of England and Wales governs it.

Annex 1. Sub-processors

Annex 2. Retention

The scheduled job that erases the six-year records once the six years are over is not built yet. Until it is, they are not removed automatically.