Last updated 4 September 2026
Data Processing Agreement
This agreement (“DPA”) applies whenever a customer (“Customer”, the controller) uses TapSign to process personal data that is subject to the GDPR, the UK GDPR or a similar law. Sawang Tech (“TapSign”, the processor) enters into it as part of the Terms of Service; no signature is needed. Customers who require a countersigned copy can request one by email.
1. Details of the processing
| Subject matter | Provision of the TapSign electronic-signature service. |
| Duration | For as long as the Customer has an account, plus the deletion period in section 8. |
| Nature and purpose | Storing documents, rendering pages, collecting form values and signatures, producing signed PDFs, sending emails to signers, keeping an audit trail. |
| Categories of data subjects | The Customer’s staff who use the account; the people the Customer asks to sign or view documents; any person named in those documents. |
| Categories of personal data | Name, email, phone number; content of documents and form fields; handwritten or typed signature; IP address, user-agent and timestamps; plan and billing references for the Customer. |
| Special categories | Not intended. The Customer must not include health, biometric or other special-category data unless it has a lawful basis to do so and informs TapSign. |
2. TapSign’s obligations
- Process personal data only on the Customer’s documented instructions – which are: using the service as configured by the Customer – unless required by law, in which case TapSign informs the Customer before processing where legally permitted.
- Ensure the people who operate the service are bound by confidentiality.
- Implement the technical and organisational measures in section 6.
- Assist the Customer in responding to data-subject requests (section 5) and in meeting its obligations on security, breach notification and impact assessments, taking into account the nature of the processing.
- Delete or return personal data at the end of the service (section 8).
- Make available the information needed to demonstrate compliance and allow audits (section 9).
- Inform the Customer immediately if an instruction, in TapSign’s opinion, infringes data-protection law.
3. Sub-processors
The Customer gives general authorisation for the following sub-processors:
| Sub-processor | Service | Location |
|---|---|---|
| Hostinger International Ltd. | Server hosting (API, database, file storage) | Malaysia |
| Vercel Inc. | Web-application hosting | United States |
| Resend Inc. | Transactional email | United States |
| CHIP IN Asia Sdn Bhd / Billplz Sdn Bhd | Payment processing (Customer billing data only) | Malaysia |
TapSign will give at least 14 days’ notice by email before adding or replacing a sub-processor. The Customer may object on reasonable data-protection grounds; if the parties cannot resolve the objection the Customer may terminate the service and receive a pro-rata refund of prepaid fees. TapSign remains responsible for its sub-processors’ performance.
4. International transfers
TapSign’s servers are in Malaysia. For personal data subject to the GDPR, the parties agree that the transfer is governed by the EU Standard Contractual Clauses (Commission Decision 2021/914), Module Two (controller to processor), which are incorporated by reference with the following choices: Clause 7 (docking) included; Clause 9 option 2 (general authorisation, 14 days); Clause 11 optional language not included; Clause 13 and 17: the law of Ireland; Clause 18: the courts of Ireland; Annex I is completed by section 1 of this DPA and the Customer’s account details; Annex II by section 6; Annex III by section 3. For UK GDPR data the UK International Data Transfer Addendum (version B1.0) applies with the same information. TapSign will inform the Customer if it can no longer comply with these clauses.
5. Data-subject requests
TapSign provides self-service tools for access, portability and erasure of the Customer’s own data (Account → Privacy & data). Where a signer contacts TapSign directly, TapSign will forward the request to the Customer within 5 business days and will not respond on the Customer’s behalf unless instructed, except to confirm receipt.
6. Technical and organisational measures
- Transport encryption (TLS 1.2+) on every connection.
- Signature images and signer-entered values encrypted at rest (AES-256-CBC with HMAC, application-managed key).
- Passwords hashed with bcrypt; API tokens expire after 30 days and are revoked on password change.
- Per-workspace access control: a user can only reach data in their own workspace.
- Signing links use 40-character random tokens; document page images require an expiring HMAC signature.
- Completed PDFs are digitally sealed (PDF /Sig with a TapSign certificate) and fingerprinted with SHA-256.
- Rate limiting on authentication and signing endpoints.
- Automatic retention: IP/user-agent removed after 90 days, raw signature images after 30 days, unfinished requests after 180 days, orphaned uploads after 30 days.
- Audit log of every document event kept with the document.
- Production access limited to named operators; secrets kept outside the codebase.
7. Personal-data breach
TapSign will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal-data breach affecting the Customer’s data, with the information the Customer needs for its own notification under Art. 33 GDPR, and will cooperate in the investigation and remediation.
8. Deletion and return
The Customer can export all workspace data as JSON and download every signed PDF at any time. When the Customer deletes its account, all personal data in the workspace is deleted immediately; copies in backups expire within 30 days. TapSign may keep billing records as required by tax law.
9. Audits
Once a year, or after a breach, the Customer may request written evidence of TapSign’s compliance with this DPA (for example a completed security questionnaire, this DPA’s measures list, and the retention configuration). If that is insufficient, the Customer or an independent auditor bound by confidentiality may audit TapSign’s relevant systems on 30 days’ notice, during business hours, at the Customer’s cost.
10. General
This DPA prevails over the Terms of Service in case of conflict about personal data. The liability provisions of the Terms apply, except that nothing limits either party’s liability towards data subjects under the SCCs. This DPA is governed by the law that governs the Terms, except where section 4 requires otherwise.