Data processing agreement
When you send a document through Pixasign, the people who receive and sign it are your contacts, not ours. You are the controller of their data and we are your processor. These are the terms of that, as UK GDPR Article 28 requires. They form part of our terms of service and apply automatically. You do not need to sign anything separately, though we will sign a copy on request. Last updated 19 October 2026.
1. Roles
You are the controller. Pixacomms Ltd (company no. 15861826) is the processor. We process personal data only on your documented instructions, which are: run the Pixasign service as described, and produce the evidence trail that goes with it.
Those instructions cover transfers of personal data outside the UK too: we make them only to the sub-processors listed in section 3, in the places listed there.
If UK law requires us to process your data other than on your instructions, we will tell you about that legal requirement before we do, unless that law forbids telling you on important grounds of public interest.
We will tell you immediately if, in our opinion, an instruction you give us infringes the UK GDPR or other UK data protection law.
2. What we process for you
| Item | Detail |
|---|---|
| Subject matter | Sending documents for electronic signature and sealing them |
| Duration | For as long as your account is open, or until you ask us to delete the data |
| Data subjects | Your staff who use the account, and the recipients you send documents to |
| Categories of data | Name, email address, IP address, approximate location derived from it, browser user-agent, timestamps of viewing and signing, the signature image or typed name, and the contents of the documents you upload |
| Special category data | None is requested. If your documents contain any, you remain the controller of it and must have your own lawful basis. |
3. Sub-processors
We use these, and only these. We will give you 30 days' notice by email before adding one, and if you object on reasonable data-protection grounds you may terminate without penalty.
We impose on each sub-processor, by written contract, the same data protection obligations as those in this agreement, in particular sufficient guarantees to put appropriate technical and organisational measures in place so that the processing meets the requirements of the UK GDPR. If a sub-processor fails to meet those obligations, we remain fully liable to you for its performance of them.
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting and storage | Nuremberg, Germany |
| Stripe (Stripe Payments Europe Ltd, with processing by Stripe, Inc.) | Payments and subscriptions (billing data only) | Ireland and United States |
| Brevo (Sendinblue SAS) | Sending signing invitations, account email, and the completed document with its evidence certificate attached | France |
| 1984 ehf | Off-site backup storage. Backups are encrypted on our server before they are sent, and the key that decrypts them is never held by the backup host, so it cannot read what it stores. | Reykjavík, Iceland |
| Cloudflare, Inc. | Receiving email sent to hello@pixasign.co.uk, including requests you send us about your recipients' data, and passing it to our mailbox | United States |
| Microsoft (Microsoft 365, Microsoft Ireland Operations Ltd) | Our mailbox: email sent to hello@pixasign.co.uk, and our service alerts, some of which name a recipient's email address | Ireland, and Microsoft may process data outside the UK and the EEA |
Location lookup for the evidence trail runs on our own server against a local database. No IP address is sent to any third party for it.
To time-stamp the seal, a fingerprint (hash) of the finished PDF is sent to DigiCert. It contains no personal data and nothing of what the document says.
4. Where the data is
Documents and their evidence trail are held in Germany. Encrypted backups are held in Iceland. Both are within the EEA, which the UK recognises as adequate, so no additional transfer mechanism is required for them. Card payments are handled by Stripe, which receives billing data only, as listed above.
Email you send to hello@pixasign.co.uk passes through Cloudflare in the United States and is kept in our Microsoft 365 mailbox, which also receives our service alerts, as listed above.
Where Stripe, Cloudflare or Microsoft handle personal data in the United States, the transfer is covered by the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), under which each of them is certified. Stripe also uses the UK International Data Transfer Addendum where a contract is needed.
5. Security
The measures we take are set out in full on our security page. In summary: HTTPS everywhere with HSTS, passwords stored only as hashes, two-factor authentication required on every account from its first sign-in, documents held on encrypted storage, tenant separation enforced in the data layer, signing links that sign only once and stop working if they are not used in time (once signed, a link still lets that signer download the signed copy and its evidence certificate), and hash-chained audit events: the chain's final value is printed on the evidence certificate every party is sent, so a later change to the record would not match their copy.
6. Confidentiality
Everyone with access to your data is bound by confidentiality obligations, and access is limited to those who need it to run or support the service.
7. If there is a breach
We will tell you without undue delay and within 48 hours of becoming aware of a personal data breach affecting your data, with what we know, what we are doing, and what we suggest you do. Reporting to the Information Commission (the ICO) is your call as controller, and we will give you what you need for it.
8. Helping you meet your obligations
If a data subject asks you for access, correction or deletion, we will help you answer. Export and deletion are done on request: email hello@pixasign.co.uk and we will do it.
Taking into account the nature of the processing and the information available to us, we will also help you meet your obligations on the security of processing, on notifying and communicating personal data breaches, on data protection impact assessments, and on any prior consultation with the Information Commission, still known as the ICO (UK GDPR Articles 32 to 36).
9. Audit
On reasonable notice, and no more than once a year unless a regulator requires otherwise, we will answer a written security questionnaire and provide the information you reasonably need to satisfy yourself we are meeting these terms.
We will also make available to you all the information necessary to demonstrate that we meet the obligations in Article 28 of the UK GDPR, and we will allow for and contribute to audits, including inspections, carried out by you or by another auditor you mandate, on reasonable notice. We may ask you to start with the questionnaire above, but where it does not give you what you reasonably need, you may audit or inspect.
10. Deletion at the end
When your account closes, email hello@pixasign.co.uk and we will delete your data. If you want it returned to you first, say so in the same email and we will send you your documents and their evidence certificates before we delete them. Copies in backups are removed as the backups roll over, which completes within 90 days. We keep only the SHA-256 fingerprint of each sealed file and the serial number and issuer of its DigiCert timestamp, none of which reveals what a document says. Sealed documents you have already downloaded keep their DigiCert seal, and pixasign.co.uk/check still recognises them after your account is deleted.
11. Sign a copy
These terms apply without signature. If your procurement process needs a countersigned copy, email hello@pixasign.co.uk and we will send one back, signed through Pixasign.