Data Processing Addendum (DPA)

Effective date: November 15, 2026 (version 1.1)

This Data Processing Addendum (“DPA”) forms part of the agreement between Circularo (“Processor”) and the customer (“Controller”) and applies where Circularo processes Personal Data on behalf of the Controller in the provision of its services.

This DPA is concluded in accordance with Article 28 of Regulation (EU) 2016/679 (“GDPR”).

1. Definitions

1.1 Agreement
The binding agreement governing the provision of services by Circularo to the Controller, including the Terms of Service and any applicable order form or contract.

1.2 Controller
The customer that determines the purposes and means of the processing of Personal Data, as defined in Article 4(7) GDPR.

1.3 Processor
Circularo, acting on behalf of the Controller, as defined in Article 4(8) GDPR.

1.4 Data Protection Laws
All applicable laws and regulations relating to data protection and privacy, including Regulation (EU) 2016/679 (GDPR) and any national implementing legislation.

1.5 Personal Data
Any information relating to an identified or identifiable natural person processed by Circularo on behalf of the Controller in connection with the Services, as defined in Article 4(1) GDPR.

1.6 Processing
Any operation or set of operations performed on Personal Data, whether or not by automated means, as defined in Article 4(2) GDPR.

1.7 Data Subject
An identified or identifiable natural person to whom Personal Data relates.

1.8 Services
Circularo’s document management, workflow, electronic signing, notification, certificate handling, and related services provided under the Agreement.

1.9 Sub-processor
Any third party engaged by Circularo to process Personal Data on behalf of the Controller in connection with the Services.

1.10 Customer Configuration
The technical and functional settings selected by the Controller within the Services, including the use of customer-provided infrastructure (such as SMTP servers or certificates) or optional third-party services.

1.11 Cloud Infrastructure
The hosting, storage, security, and hardware security module (HSM) services provided to Circularo via Microsoft Azure data centers located in the European Union.

1.12 Digital Certificate
An electronic certificate used for signing or authentication purposes, whether provided by the Controller or issued through a certification authority upon the Controller’s request.

1.13 HSM (Hardware Security Module)
A secure cryptographic key management system used for the storage and protection of cryptographic keys and certificates.

1.14 Personal Data Breach
A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data, as defined in Article 4(12) GDPR.

1.15 Standard Contractual Clauses or SCCs
Standard data protection clauses adopted by the European Commission for the transfer of Personal Data to third countries pursuant to Article 46 GDPR.

1.16 Supervisory Authority
An independent public authority established pursuant to Article 51 GDPR.

2. Roles of the Parties

2.1 The Controller determines the purposes and means of the Processing of Personal Data.

2.2 The Processor processes Personal Data solely on documented instructions from the Controller, including instructions arising from the Agreement, this DPA, and the Controller’s Customer Configuration of the Services.

2.3 The Processor has designated a point of contact for all matters relating to the Processing of Personal Data under this DPA, including instructions, Data Subject requests, Personal Data Breaches, Sub-processor changes and audit or information requests. The point of contact can be reached at privacy@circularo.com. Security incidents may additionally be reported to security@circularo.com. The Processor shall notify the Controller of any change to the designated point of contact without undue delay. The Controller shall designate its own contact person for matters arising under this DPA and keep it up to date in the account settings or by written notice to the Processor.

3. Description of the Processing

3.1 Subject Matter

The Processing of Personal Data as necessary to provide the Services.

3.2 Duration

For the term of the Agreement and any additional period during which the Processor processes Personal Data on behalf of the Controller.

3.3 Nature and Purpose of the Processing

Processing operations include, as applicable:

Hosting, storing, securing, and managing documents and related metadata
Executing document workflows and electronic signing
Delivering email and SMS notifications, where enabled
Issuing, storing, and validating Digital Certificates, where requested
Ensuring availability, integrity, and security of the Services

3.4 Categories of Data Subjects

Employees, contractors, representatives, customers, or other individuals whose Personal Data is processed through the Services.

3.5 Categories of Personal Data

Depending on Customer Configuration:

Identification and contact data
Business-related data required for Digital Certificate issuance
Document content and metadata
Communication details for notification delivery

The Services are not designed to require the Processing of special categories of personal data unless explicitly configured by the Controller.

4. Processor Obligations

The Processor shall:

a) Process Personal Data only on documented instructions from the Controller
b) Ensure that persons authorized to process Personal Data are subject to confidentiality obligations
c) Implement appropriate technical and organizational measures pursuant to Article 32 GDPR
d) Assist the Controller with Data Subject rights requests, Personal Data Breaches, and data protection impact assessments
e) Notify the Controller of any Personal Data Breach affecting Personal Data processed on behalf of the Controller without undue delay, and in any event no later than 48 hours after becoming aware of it, in accordance with Section 4a
f) Not use Personal Data processed on behalf of the Controller for marketing, advertising or similar commercial purposes, unless expressly authorized in advance in writing by the Controller. Such authorization shall not be a condition for the provision of the Services, and the Processor shall ensure that its Sub-processors are bound by the same restriction.

4a. Personal Data Breach Notification

4a.1 The notification under Section 4(e) shall be sent to the Controller's designated contact and shall include, to the extent known at the time:

a) a description of the nature of the Personal Data Breach, including the time period and the systems affected
b) the categories and approximate number of Data Subjects and records concerned, and a description of the data affected
c) the likely consequences of the Personal Data Breach
d) the measures taken or proposed to address the Personal Data Breach and mitigate its effects, including any data restored
e) the name and contact details of the Processor's point of contact under Section 2.3.

4a.2 Where the information cannot be provided at the same time, it shall be provided in phases without undue further delay.

4a.3 The Processor shall cooperate with the Controller and provide reasonable assistance to enable the Controller to meet its obligations to notify supervisory authorities and Data Subjects.

4a.4 The obligations under this Section do not apply to Personal Data Breaches caused by the Controller, its users, or within system components for which the Controller is responsible.

4a.5 Notification of a Personal Data Breach shall not be construed as an acknowledgement of fault or liability by the Processor.

5. Sub-processing

5.1 General Authorization

5.1.1 The Controller grants the Processor general authorization to engage the Sub-processors listed in this Section 5. The Processor remains fully responsible for its Sub-processors' compliance with this DPA and shall impose on each Sub-processor data protection obligations no less protective than those set out in this DPA.

5.1.2 The Processor shall inform the Controller in advance of any intended addition or replacement of a Sub-processor, or any change in the country of processing, within a reasonable period before the change takes effect, so that the Controller has the opportunity to object to such change. Notice is given by e-mail to the Controller's designated contact and by updating this DPA.

5.1.3 The Controller may object to the change on reasonable data protection grounds before the change takes effect. The parties shall discuss the objection in good faith. If no solution is found, the Controller may terminate the affected Services without penalty before the change takes effect.

5.1.4 In an emergency, where a Sub-processor must be replaced without delay to ensure the security or continuity of the Services, the Processor may make the change immediately and shall inform the Controller without undue delay afterwards, with the same right to object.

5.1.5 Sub-processors listed in this Section for optional services are engaged only where the Controller enables the respective service through Customer Configuration. By enabling such a service, the Controller authorizes the engagement of the Sub-processor listed for it. Sections 5.1.2 and 5.1.3 apply to changes affecting services that the Controller has already enabled.

5.2 Cloud Infrastructure

The Processor utilizes Microsoft Azure and Oracle cloud services as Cloud Infrastructure for the provision of the Services.

Sub-processor: Microsoft Corporation or Oracle Corporation (KSA)
Processing activities: Cloud hosting, data storage, security services, and HSM
Locations:
- European Union - Microsoft data center located in the Netherlands
- United Arab Emirates - Microsoft data center located in the Emirate of Dubai
- State of Qatar - Microsoft data center located in the State of Qatar
- Kingdom of Saudi Arabia - Oracle data center in Jeddah, Saudi Arabia
Safeguards:
- Microsoft Products and Services Data Protection Addendum - learn more.
- Data Processing Agreement for Oracle Services - learn more.

Personal Data is stored and processed within the Cloud Infrastructure in data centers located in the European Union, the United Arab Emirates, State of Qatar or the Kingdom of Saudi Arabia, depending on the Controller’s Customer Configuration and the geographic region selected for the Services.

5.3 Email Notification Services

5.3.1 Customer-Provided SMTP

Where the Controller configures the Services to use its own SMTP servers, the Processor does not engage any third-party Sub-processor for email delivery.

5.3.2 Default Email Service (Optional)

Where the Controller does not configure their own SMTP servers, the Processor engages SendGrid (under Twilio):

Sub-processor: SendGrid
Location: Dublin, Ireland
Processing activities: Delivery of email notifications
Safeguards: Twilio Data Protection Addendum, including Standard Contractual Clauses - learn more.

Where enabled through Customer Configuration, the Processor engages Brevo (formerly Sendinblue):

Sub-processor: Brevo
Location: Paris, France (EU)
Processing activities: Delivery of email notifications
Safeguards: Brevo Terms of Use and Data Processing provisions - learn more.

5.4 Digital Certificates

5.4.1 Customer-Provided Digital Certificates

Where the Controller provides its own Digital Certificates, such certificates are stored and protected exclusively within the Processor’s HSM environment hosted in the relevant Cloud Infrastructure.

No Personal Data is disclosed to any certification authority in this scenario.

5.4.2 Processor-Issued Digital Certificates

Where requested by the Controller, the Processor may engage certification authorities as Sub-processors for the issuance of Digital Certificates.

5.4.2.1 European Union and Global

Sub-processor: První certifikační autorita, a.s. (1st Certification Authority)
Location: Prague, Czech Republic (EU)
Processing activities: Issuance of company Digital Certificates
Personal Data processed: Limited business-related identification data required for certificate issuance
Safeguards: Principles of Client’s Personal Data Processing - learn more.

Following issuance, Digital Certificates are stored exclusively within the Processor’s HSM hosted on Microsoft Azure. During certificate validation, no Personal Data beyond that embedded in the Digital Certificate is processed by the certification authority.

5.4.2.1 United Arab Emirates

Where applicable to the Controller’s jurisdiction or Customer Configuration, the Processor may engage:

Sub-processor: Dubai Electronic Security Center (DESC)
Location: Dubai, United Arab Emirates
Processing activities:
- Issuance of electronic certificates and electronic seals
- Support for electronic signing of documents in accordance with applicable UAE and Dubai laws
Personal Data processed:
Limited identification and business-related data strictly required for the issuance of electronic certificates or electronic seals
Legal and regulatory framework:
- UAE Federal Data Protection Law
- DESC Information Security Regulation (ISR)
- Law No. (15) of 2024 Concerning the Dubai Electronic Security Center

Following issuance, Digital Certificates are stored exclusively in the Processor’s HSM.
During validation, no Personal Data beyond that embedded in the Digital Certificate is processed by the certification authority.

Processing under this subsection applies only where the Controller operates in, or explicitly configures the Services for use in, the United Arab Emirates or the Emirate of Dubai.

5.5 SMS Notification Services (Optional)

Where enabled through Customer Configuration, the Processor engages:

Sub-processor: Twilio Inc.
Location: United States (San Francisco, California)
Processing activities: SMS message delivery
Safeguards: Twilio Data Protection Addendum, including Standard Contractual Clauses - learn more.

5.6 KYC Services (Optional)

Where enabled through Customer Configuration, the Processor engages:

Sub-processor: Identomat Inc.
Location: United States (Champaign, Illinois)
Processing activities (where applicable):
- Identity Document (ID) Verification
- Biometric Verification & Liveness Detection
- AML Screening
- Proof of Address (PoA) Verification
- Video KYC
- Multi-Factor Authentication (MFA)
Safeguards: Data Privacy Statement of Identomat Inc. - learn more.

6. International Data Transfers

Where Personal Data is transferred outside the jurisdiction in which it is processed, including cross-border transfers involving the European Union, the United Arab Emirates, State of Qatar or the Kingdom of Saudi Arabia, the Processor ensures that such transfers are subject to appropriate safeguards in accordance with applicable Data Protection Laws, including Standard Contractual Clauses, regulatory requirements, and technical and organizational measures designed to protect the confidentiality, integrity, and availability of Personal Data.

6a. Requests for Disclosure of Personal Data

6a.1 If the Processor receives a request from a public authority, court or other third party for disclosure of Personal Data processed on behalf of the Controller, the Processor shall:
a) verify whether the request is legally binding on the Processor, and reject any request that is not legally binding
b) notify the Controller of a legally binding request without undue delay, and no later than 3 business days after its receipt, before any disclosure is made, unless such notification is prohibited by applicable law
c) where legally permissible, consult the Controller before disclosure and give the Controller a reasonable opportunity to seek a protective order or other remedy
d) disclose only the minimum Personal Data strictly necessary to comply with the request.

6a.2 Where the Processor is legally prohibited from notifying the Controller, it shall use reasonable efforts to obtain a waiver of the prohibition and shall notify the Controller as soon as the prohibition ceases to apply.

6a.3 The Processor shall record every disclosure of Personal Data to third parties, including what data was disclosed, to whom, when, and on what legal basis.

6a.4 Disclosures authorized in advance by the Controller (e.g. to auditors or service providers designated by the Controller) are not subject to 6a.1 b) and c).

7. Technical and Organizational Measures

The Processor implements and maintains appropriate technical and organizational measures proportionate to the information security risks and the nature, scope and purposes of the Processing, including:

Encryption of Personal Data at rest and in transit
Role-based access controls
Secure cryptographic key and certificate management via HSM
Security monitoring and incident response procedures
Secure authentication options for Controller's users, including multi-factor authentication, SSO (OAuth 2.0 / SAML 2.0) and configurable password and session policies

7a. Backup and Restoration

7a.1 The Processor performs regular backups of Personal Data processed in the Services. Backups are created hourly; hourly backups are retained for 48 hours and daily backups for 21 days.

7a.2 Backups are stored encrypted in storage that is logically and geographically separated from the primary production environment, within the same Cloud Infrastructure region as the production data, and are accessible only to authorised personnel of the Processor.

7a.3 The Processor maintains documented recovery procedures with a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 1 hour, and tests the restoration of backups at least once a year. Each restoration test is recorded in accordance with Section 7a.4.

7a.4 At the Controller's request, the Processor may restore Personal Data from backups within the retention periods stated in 7a.1. Restoration of the Controller's data is performed only on documented request or consent of the Controller and is recorded.

7a.5 Personal Data deleted from the production environment, including upon termination under Section 9, is permanently removed from backups no later than 21 days after its deletion.

8. Assistance with Data Subject Rights

The Processor shall, taking into account the nature of the Processing, assist the Controller in fulfilling its obligations to respond to requests from Data Subjects under Articles 12–22 GDPR.

9. Return or Deletion of Personal Data

9.1 During the term of the Agreement the Controller may at any time export its Personal Data using the export functions of the Services, or request its deletion.

9.2 Upon expiry or termination of the Agreement, the Processor shall retain the Controller's Personal Data for a period of 30 days to allow the Controller to retrieve it, unless the Controller requests earlier deletion. During this period the Processor shall, at the Controller's request, return the Personal Data in a commonly used, machine-readable format or transfer it to another provider designated by the Controller.

9.3 After the period under 9.2, the Processor shall delete the Personal Data from the production environment. Personal Data is permanently removed from backups no later than 21 days after its deletion from production (Section 7a.5). No Personal Data therefore remains in the Processor's systems later than 51 days after termination.

9.4 The Processor shall ensure that Sub-processors delete Personal Data processed on behalf of the Controller within the same periods, in accordance with their data processing agreements.

9.5 Deletion is performed by logical deletion from the production environment, followed by expiry of backups and, for cryptographic keys, by destruction of the key material in the HSM.

9.6 Upon written request, the Processor shall confirm the deletion in writing.

9.7 The obligations under this Section do not apply to Personal Data that the Processor is required to retain under applicable law. This includes, for example, audit trails and records of trust services under eIDAS. Such data remains subject to this DPA, is protected against further processing, and is deleted once the retention obligation ends.

9.8 Deletion from backups follows Section 7a.5.

10. Audits and Information

10.1 The Processor shall make available information reasonably necessary to demonstrate compliance with this DPA and allow audits, subject to reasonable confidentiality and security requirements.

10.2 The Controller has access to audit records relating to the Processing of its Personal Data through the administration of the Services and via API, for the retention period stated in the Agreement. Audit records relating to other customers are never made available to the Controller. Upon request, the Processor shall provide additional log information relevant to the Controller's data, where necessary for the investigation of a Personal Data Breach or for compliance purposes.

11. Liability

Liability arising under this DPA shall be governed by the Agreement and applicable Data Protection Laws.

12. Governing Law

This DPA shall be governed by the governing law specified in the Agreement, unless otherwise required by Data Protection Laws.

13. Order of Precedence

In the event of a conflict, this DPA shall prevail with respect to data protection obligations.