Data Processing Agreement

1. Background and Relationship to the Terms

This Data Processing Agreement (this "DPA") forms part of, and is incorporated by reference into, the K Sign Terms of Service or other written agreement between K Sign Pty Ltd ("K Sign", "we", "our", or "us") and the customer (the "Customer", "you", or "your") governing the Customer's use of the Services (together, the "Agreement").

This DPA applies where, and to the extent that, K Sign processes Personal Data on behalf of the Customer in the course of providing the Services. It records the parties' obligations in respect of that processing under the Privacy Act 1988 (Cth) (the "Privacy Act"), the Australian Privacy Principles (the "APPs"), and, where applicable to the Customer or to individuals whose Personal Data is processed, other Data Protection Laws.

Capitalised terms used but not defined in this DPA have the meaning given to them in the Agreement. In the event of a conflict between this DPA and the rest of the Agreement regarding the processing of Personal Data, this DPA prevails to the extent of the inconsistency. In the event of a conflict between this DPA and the Privacy Policy regarding such processing, this DPA prevails.

2. Definitions

In this DPA, unless the context requires otherwise:

Controller

The entity that determines the purposes and means of the processing of Personal Data; in respect of Customer Personal Data, this is the Customer.

Data Protection Laws

All laws and regulations applicable to the processing of Personal Data under the Agreement, including the Privacy Act and the APPs and, where applicable, other privacy or data protection laws.

Data Subject

An individual to whom Personal Data relates.

Eligible Data Breach

Has the meaning given under the Notifiable Data Breaches scheme in the Privacy Act, and includes an equivalent personal data breach under other applicable Data Protection Laws.

Personal Data

Personal information (as defined in the Privacy Act) contained in Customer Content that K Sign processes on behalf of the Customer under the Agreement.

Processor

The entity that processes Personal Data on behalf of the Controller; in respect of Customer Personal Data, this is K Sign.

Processing

Any operation performed on Personal Data, whether or not by automated means, including collection, recording, storage, use, disclosure, and deletion.

Sensitive Information

Has the meaning given in the Privacy Act.

Subprocessor

A third party engaged by K Sign to process Personal Data on behalf of the Customer.

3. Roles of the Parties

This section defines how each party operates with respect to Customer Personal Data.

Customer as Controller

As between the parties, the Customer is the Controller of Customer Personal Data and K Sign is the Processor. Where the Customer is itself a processor acting on behalf of a third-party controller, the Customer warrants that it has the authority and instructions necessary to engage K Sign as a subprocessor on the terms of this DPA.

K Sign as Processor

K Sign processes Customer Personal Data only as a Processor on behalf of the Customer for the purpose of providing the Services and as otherwise set out in this DPA.

K Sign as Controller for Limited Purposes

K Sign acts as a controller, and the Privacy Policy rather than this DPA governs, in respect of personal information it handles for its own purposes, including account administration, billing, security, and improving the Services, and including any aggregated or de-identified data it creates in accordance with the Agreement.

4. Customer Obligations and Warranties

The Customer warrants and undertakes that:

Consents and Authorisations

It has provided all notices and obtained all consents and authorisations necessary for K Sign to process Customer Personal Data as contemplated by the Agreement and this DPA.

Lawful Basis

It has a lawful basis for the collection and processing of Customer Personal Data through the Services.

Compliance of Instructions

Its instructions for the processing of Personal Data comply with Data Protection Laws.

Compliance of Customer Content

The Customer Content, and the Customer's use of the Services, do not breach the Agreement, including the provisions relating to prohibited content, sensitive and restricted data, and acceptable use.

Accuracy and Legality of Data

It is solely responsible for the accuracy, quality, and legality of Customer Personal Data and the means by which it acquired that data.

5. K Sign Processing Obligations

K Sign's core obligations as a data processor under this DPA.

Processing on Documented Instructions

K Sign will process Customer Personal Data only on the documented instructions of the Customer, including as set out in the Agreement, this DPA, the configuration and use of the Services by the Customer, and any further written instructions agreed by the parties, except where required to process by a law to which K Sign is subject, in which case K Sign will, where lawful, inform the Customer of that requirement before processing.

Scope of Instructions

The Customer's instructions are described in Annex A. The Customer may give additional reasonable instructions consistent with the Agreement. If K Sign becomes aware that an instruction infringes Data Protection Laws, it will promptly inform the Customer, and may suspend the relevant processing until the instruction is confirmed, amended, or withdrawn. K Sign is not obliged to carry out an instruction that it reasonably considers would cause it to breach Data Protection Laws.

Confidentiality of Personnel

K Sign will ensure that personnel authorised to process Customer Personal Data are bound by appropriate obligations of confidentiality and are made aware of the confidential nature of the data.

Purpose Limitation

K Sign will not sell Customer Personal Data, and will not use or disclose it for any purpose other than providing the Services and as permitted by this DPA, except that K Sign may create and use aggregated and de-identified data as permitted by the Agreement.

6. Security Measures

K Sign will implement and maintain appropriate technical and organisational measures designed to protect Customer Personal Data against unauthorised or unlawful processing and against accidental loss, destruction, damage, alteration, or disclosure, taking into account the nature of the processing and the state of the art. A description of these measures is set out in Annex B.

K Sign may update its security measures from time to time, provided that the updates do not materially reduce the overall level of protection afforded to Customer Personal Data during the term of the Agreement.

The Customer is responsible for its own use and configuration of the Services, including access controls, user management, and the security of its credentials, systems, and integrations, as further described in the Agreement.

7. Subprocessing

K Sign's obligations and the Customer's rights in relation to the engagement of Subprocessors.

General Authorisation

The Customer provides a general authorisation for K Sign to engage Subprocessors to process Customer Personal Data in connection with the Services. K Sign maintains a Subprocessor List identifying its current Subprocessors and makes it available to the Customer.

Subprocessor Obligations

K Sign will impose on each Subprocessor data protection obligations that are no less protective than those in this DPA to the extent applicable to the services provided by that Subprocessor, and will remain liable to the Customer for the performance of each Subprocessor's obligations.

Changes to Subprocessors

K Sign will notify the Customer of any intended addition or replacement of a Subprocessor at least thirty (30) days before that Subprocessor begins processing Customer Personal Data, by a mechanism that may include email or a notification within the Services or via the Subprocessor List. The Customer may object on reasonable data protection grounds within that period. The parties will discuss the objection in good faith and K Sign will use reasonable efforts to make available a change in the configuration or use of the Services to avoid processing by the objected-to Subprocessor. If the parties cannot resolve the objection within a reasonable period, the Customer may terminate the affected Services without penalty by written notice, and K Sign will refund any prepaid Fees for those Services covering the period after termination.

8. Assistance to the Customer

K Sign's obligations to assist the Customer in meeting its own compliance obligations.

Data Subject Requests

Taking into account the nature of the processing, K Sign will provide reasonable assistance to the Customer, by appropriate technical and organisational measures and so far as practicable, to enable the Customer to respond to requests from Data Subjects seeking to exercise their rights under Data Protection Laws. Where K Sign receives such a request directly, it will, unless legally prohibited, refer the request to the Customer and will not respond except on the Customer's instructions.

Compliance Assistance

Taking into account the nature of the processing and the information available to it, K Sign will provide reasonable assistance to the Customer with privacy impact assessments and with consultations with regulators, to the extent these relate to K Sign's processing of Customer Personal Data.

Costs

K Sign will provide the assistance described in this Section in respect of its own processing at no additional charge to the extent it is supported by the functionality made available within the Services. K Sign may charge a reasonable, cost-based fee, notified in advance, only for assistance that requires significant manual effort beyond that functionality, and will not unreasonably withhold or delay assistance pending agreement on fees.

9. Data Breach Notification

K Sign will notify the Customer without undue delay, and in any event within forty-eight (48) hours, after becoming aware of an Eligible Data Breach affecting Customer Personal Data. K Sign is treated as becoming aware when its security or incident response function has confirmed, with reasonable certainty, that an Eligible Data Breach has occurred. The notification will include, to the extent then known and as it becomes available, a description of the nature of the breach, the categories and approximate volume of data and Data Subjects affected, the likely consequences, and the measures taken or proposed to address it. K Sign will provide further information in stages, without undue delay, as it becomes available, so as to enable the Customer to meet its own notification obligations within the time required by Data Protection Laws.

K Sign will take reasonable steps to mitigate and remediate the breach and will cooperate with the Customer in responding to it. As between the parties, the Customer is responsible for determining whether the breach requires notification to a regulator or affected individuals and for making any such notification, except where K Sign is independently required by law to notify.

K Sign's notification of, or response to, a breach is not an acknowledgement of fault or liability.

10. Cross-Border Transfers

Customer Personal Data is primarily stored in Australia. Where K Sign or its Subprocessors access or process Customer Personal Data from outside Australia, K Sign will take reasonable steps in the circumstances to ensure that the recipient handles the data in a manner consistent with the APPs and applicable Data Protection Laws.

Where a transfer of Personal Data is subject to the requirements of a Data Protection Law that mandates a specific transfer mechanism, the parties will, before the transfer, put in place the safeguards required by that law. Where standard contractual clauses (or an equivalent approved mechanism) are required, the Customer acts as data exporter and K Sign (or the relevant importing entity) acts as data importer, the parties will enter into the applicable clauses, and those clauses prevail over this DPA to the extent of any conflict in respect of the transfer. K Sign will provide reasonable information to assist the Customer in carrying out any transfer impact assessment required by Data Protection Laws.

11. Audits and Records

K Sign's obligations regarding information, access, and audit rights.

Information First

K Sign will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA. This will, where available, take the form of summaries of K Sign's policies and controls, current certifications (such as SOC 2 or ISO/IEC 27001), and independent third-party audit or assessment reports. The Customer will accept such materials as the primary means of verifying compliance where they are sufficient to do so.

Audit Where Information is Insufficient

Where the materials described above are not reasonably sufficient to demonstrate compliance, the Customer may request an audit. An audit may be conducted no more than once in any twelve month period, except where required by a regulator or following an Eligible Data Breach affecting the Customer's Personal Data. The Customer must give at least thirty (30) days' prior written notice. The audit must be carried out by an independent, suitably qualified third-party auditor that is not a competitor of K Sign, is bound by obligations of confidentiality, and is reasonably acceptable to K Sign.

Costs

Each audit is at the Customer's cost. K Sign will bear its own costs of cooperating and will reimburse the Customer's reasonable, documented audit costs only where the audit identifies a material breach by K Sign of its obligations under this DPA that K Sign does not reasonably dispute or that is upheld through the dispute resolution process under the Agreement. Any reimbursement under this Section is limited to the lesser of the Customer's actual reasonable audit costs and ten thousand Australian Dollars (AUD 10,000).

Regulator Rights Preserved

Nothing in this Section limits or excludes any right of a regulator, or of the Customer where required by Data Protection Laws or by the Customer's regulator, to access, audit, or obtain information about K Sign's processing. K Sign will reasonably cooperate with the exercise of any such right, which is not subject to the frequency, notice, scope, or cost provisions of this Section.

12. Return and Deletion of Personal Data

On termination or expiry of the Agreement, K Sign will, at the Customer's election and where the Services provide the relevant functionality, make Customer Personal Data available for export for the retrieval period specified in the Agreement.

Following that period, K Sign will delete or de-identify Customer Personal Data in accordance with the Agreement, subject to residual copies retained in routine backups for a limited period and to any retention required by law. K Sign will protect any retained data in accordance with this DPA for so long as it is retained.

13. Liability and General

Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Agreement, and any reference in those provisions to the Agreement includes this DPA.

Where the parties agree an enhanced liability cap for data protection claims in an order form or other written agreement (a Data Protection Liability Cap), that cap applies in place of the general cap in the Agreement to claims arising from a breach by a party of this DPA. In the absence of an agreed Data Protection Liability Cap, the general cap in the Agreement applies. To the extent permitted by Applicable Laws, neither party excludes or limits liability that cannot lawfully be excluded or limited, including, where applicable, liability for civil penalties that a regulator imposes directly on a party for that party's own conduct, which each party bears itself.

This DPA takes effect on the effective date of the Agreement and continues for as long as K Sign processes Customer Personal Data, after which the provisions that by their nature should survive will survive. K Sign may make changes to this DPA that are required to comply with Data Protection Laws, or that are administrative or do not materially reduce the protections afforded to Customer Personal Data, on reasonable notice; any other change requires the agreement of the parties. This DPA is governed by the law that governs the Agreement.

14. Annex A — Details of Processing

Particulars of the processing activities covered by this DPA.

Subject Matter

The provision of the Services by K Sign to the Customer under the Agreement, including electronic signature, forms and data collection, workflow, and related features.

Duration

For the term of the Agreement and any subsequent retention or deletion period described in the Agreement and this DPA.

Nature and Purpose

Processing necessary to host, operate, secure, and support the Services and to perform the functions selected and configured by the Customer, including storing documents and form submissions, routing them to participants, generating audit records, and enabling the Customer's connected integrations.

Categories of Data Subjects

Determined by the Customer, and may include the Customer's personnel and authorised users, signatories, form respondents, payers, customers, and other individuals whose Personal Data the Customer chooses to process through the Services.

Categories of Personal Data

Determined by the Customer, and may include identification and contact details, professional details, document and form content, signature and authentication data, audit and event data, and any other Personal Data the Customer includes in Customer Content. The Customer is responsible for any Sensitive Information it chooses to process and for meeting the additional requirements that apply to it.

15. Annex B — Technical and Organisational Security Measures

K Sign maintains a security program that includes measures of the following kinds, as applicable to the Services and updated from time to time:

Encryption

Encryption of Personal Data in transit and, where appropriate, at rest.

Access Controls

Logical access controls, including authentication, role-based access, and the principle of least privilege.

Network Security

Network security controls designed to protect against unauthorised access.

Logging and Monitoring

Logging and monitoring of access to and activity within the Services.

Availability and Resilience

Measures to support the availability, integrity, and resilience of the Services, including backups and redundancy.

Secure Development

Secure development and change-management practices.

Personnel Vetting

Vetting and confidentiality obligations for personnel with access to Personal Data.

Incident Response

Incident detection and response processes, including procedures for assessing and notifying breaches. Further detail may be set out in K Sign's Security and Compliance Overview, as made available from time to time.

16. Annex C — Subprocessors

K Sign engages Subprocessors to provide infrastructure and supporting services, which may include cloud hosting and storage, communications and email delivery, analytics and monitoring, customer support tooling, and security services.

The current list of Subprocessors, including their names, the nature of the services they provide, and the locations of processing, is set out in the Subprocessor List made available by K Sign and updated in accordance with the subprocessing provisions of this DPA.