Data Processing Agreement

Operator: Nezuna Technologies Inc., an Ontario corporation (Ontario Corporation No. 1001604486, incorporated May 11, 2026), registered office 29 Hemlock Drive, Markham, Ontario L3P 4M5, Canada. Contact: hello@docnez.com

Effective date: November 5, 2026

This Data Processing Agreement ("DPA") forms part of the Docnez Terms of Service between Nezuna Technologies Inc. ("Processor", "we") and the account holder ("Customer"). It applies when we process personal data in Customer's documents and signer information ("Customer Personal Data") on Customer's behalf. It is designed to meet GDPR/UK GDPR Article 28, PIPEDA, Québec Law 25, CCPA "service provider" requirements, and comparable laws.

1. Roles and instructions

Customer is the controller (or business); we are the processor (or service provider). We process Customer Personal Data only on Customer's documented instructions, which are the Terms, this DPA and Customer's use of the Service, unless law requires otherwise (in which case we will tell Customer if legally permitted). We will tell Customer if we believe an instruction breaks data protection law.

2. Confidentiality

Everyone we authorize to process Customer Personal Data is bound by confidentiality.

3. Security

We implement the measures in Annex 2 and keep them appropriate to the risk.

4. Subprocessors

Customer gives general authorization to the subprocessors in Annex 3. We will give at least 15 days' notice (on docnez.com/subprocessors and by email to account owners) before adding or replacing one. Customer may object on reasonable data-protection grounds; if we cannot address the objection, Customer may stop using the Service and delete its account. We bind each subprocessor to data-protection terms at least as protective as this DPA and remain responsible for them.

5. Assistance

Taking into account the nature of processing, we help Customer respond to data subject requests (mainly through in-app export and deletion), and with security, breach notification, impact assessments and regulator consultations. We forward requests we receive from Customer's signers to Customer.

6. Personal data breaches

We notify Customer without undue delay, and in any case within 72 hours after becoming aware of a breach affecting Customer Personal Data, with the information reasonably available, and update it as we learn more.

7. International transfers

Customer Personal Data is hosted in Canada. Transfers to subprocessors outside Canada (Resend, United States) are protected as follows. Where GDPR applies and a transfer is not covered by an adequacy decision or the EU–US Data Privacy Framework, the EU Standard Contractual Clauses (Commission Decision 2021/914) are incorporated by reference, Module 2 (controller to processor) or Module 3 (processor to processor) as applicable, with: Clause 7 docking clause included; Clause 9 option 2 (general authorization, 15 days' notice); Clause 11 optional language omitted; Clauses 17 and 18 the law and courts of Ireland; Annex I and II as Annexes 1 and 2 of this DPA. For UK transfers, the UK International Data Transfer Addendum (version B1.0) applies with the same details. For Swiss data, the SCCs apply with the FDPIC as competent authority.

8. Deletion and return

Customer may export its documents at any time. On deletion of documents or the account, we delete Customer Personal Data as set out in the Retention and Deletion Policy, except the proof-of-signature record (no document content) we keep for up to 7 years to verify signatures and establish or defend legal claims, and data the law requires us to keep. These are kept confidential and processed only for those purposes.

9. Audits

We make available information needed to show compliance with this DPA, including written answers to reasonable security questionnaires. We hold no third-party certifications. Where law requires, Customer may conduct an audit once per year on 30 days' notice, during business hours, at its own cost and under confidentiality, without access to other customers' data.

10. CCPA

We will not sell or share Customer Personal Data, retain, use or disclose it outside the direct business relationship or for any purpose other than providing the Service, or combine it with other data except as the CCPA permits. We will notify Customer if we can no longer meet our CCPA obligations.

11. Liability and precedence

Liability under this DPA is subject to the limitation of liability in the Terms, except where law forbids. If this DPA conflicts with the Terms, this DPA prevails for data protection; the SCCs prevail over both.

12. EU/UK representative

[PLACEHOLDER — not appointed]. If we begin targeting EU or UK users, we will appoint a representative where required.

Annex 1 — Processing details

• Data subjects: Customer's users, signers and people named in documents.
• Categories: names, email addresses, signatures and initials, IP addresses, timestamps, browser user agent, approximate location from IP, access-code verification events, and any personal data in documents (Customer must not upload special-category data unless lawful and necessary).
• Purpose and nature: hosting, transmitting, signing, sealing, storing and verifying documents; sending signing emails; security and fraud prevention.
• Duration: for the term of the Terms, then as in Section 8.
• Frequency: continuous.

Annex 2 — Technical and organizational measures

HTTPS/TLS in transit; AES-256-GCM encryption of documents at rest; passwords stored as salted hashes; optional two-factor authentication; optional per-signer access codes; single-use signing links; role-based access within workspaces; restricted administrator access; SHA-256 hash-chained audit trail with Ed25519-signed chain head; tamper-evident PDF seal (PAdES-B-B); public verification page; logging and monitoring; on-server backups and off-server backups encrypted before upload to Backblaze B2 (Canada); hosting in Canada with OVHcloud; incident response with 72-hour customer notice.

Annex 3 — Subprocessors