Data processing agreement

The customer is the company that created the MonaSign workspace and accepted the terms of use. It is the controller of the personal data it enters. Weedoo VOF, Belgium, operates MonaSign and is the processor of that data.

For the account details of the people who sign in to MonaSign, and for billing, Weedoo VOF is a controller in its own right; the privacy policy covers that processing.

• Subject matter and purpose: designing email signatures, filling them with each person's details, and delivering them through share links, email and the Outlook add-in.
• Data subjects: the people the customer adds to its workspace or syncs from its Microsoft 365 directory (usually its employees), the members who work in the workspace, and recipients of signature emails.
• Personal data: name, job title, department, email address, phone and mobile numbers, website, social profile links, postal address and photo; team or department membership; who a signature was emailed to and when; if link tracking is on, the time, link and browser type of clicks on signature links; campaign banner loads and clicks and feedback answers, each with the signature and the sender they came from and the mail program family (nothing about the recipient); for the Outlook add-in, a hashed form of the sender's network address kept for two days; if the nightly Microsoft 365 sync is on, the connecting administrator's email and an encrypted Microsoft refresh token; an activity log of sign-ins and changes with IP address and browser.
• Special categories: none are needed and the customer must not enter them.
• Duration: for as long as the workspace exists, followed by deletion as described under "End of the service".

Weedoo VOF processes the data only on the customer's documented instructions: these terms, and what administrators set up in the product. It will tell the customer if it believes an instruction breaks data protection law, and will not process the data for its own purposes. If law requires other processing, Weedoo VOF will tell the customer first unless the law forbids that.

Everyone at Weedoo VOF who can access customer data is bound to confidentiality and accesses it only when needed to run, support or secure the service.

• Data is stored in the EU (Frankfurt) and encrypted at rest by the hosting provider; all connections use HTTPS.
• Each workspace is isolated in the database: every table enforces that only members of a workspace can read or change its rows.
• Operations that need elevated rights run only on our servers behind a server-side secret.
• Sign-ins and changes are written to an activity log that cannot be altered from a browser.
• Access to production systems is limited to Weedoo VOF's operators and protected with multi-factor authentication.
• The database is backed up daily; backups are kept in the EU and overwritten within 30 days.
• Dependencies are checked for known vulnerabilities before every deployment.

The customer authorises Weedoo VOF to use the sub-processors listed on the sub-processors page. Each is bound by written terms that protect the data at least as well as this agreement, and Weedoo VOF remains responsible for them. Weedoo VOF announces a new or replaced sub-processor on that page and by email to every workspace owner at least 30 days in advance. If the customer objects on reasonable data protection grounds and the parties cannot resolve it, the customer may end its subscription and have its workspace deleted, with a refund of any prepaid period it can no longer use.

Stored data stays in the EU. Any transfer to a sub-processor outside the EU relies on the EU Standard Contractual Clauses or an adequacy decision, as described on the sub-processors page.

Administrators can view, correct, export (People, Export) and delete each person's data themselves. When a request reaches Weedoo VOF directly, we pass it to the customer and do not answer it ourselves unless the customer asks us to.

Weedoo VOF gives the information the customer reasonably needs for a data protection impact assessment or a consultation with a supervisory authority.

Weedoo VOF tells the workspace owner without undue delay, and at the latest within 48 hours of becoming aware of a breach affecting the customer's data, with what is known about its nature, the data and people concerned, the likely consequences and the measures taken. Further details follow as they become available.

Before leaving, the customer can export its people from the People page. Deleting the workspace in Settings removes its data and uploaded images immediately; backups are overwritten within 30 days. Entries in the activity log keep only what happened and when. If a subscription ends without the workspace being deleted, the workspace stays read-only, so the data can still be exported, until the customer deletes it or asks us to.

Weedoo VOF makes available the information needed to show it meets this agreement, including the security documentation of its sub-processors. The customer, or an auditor bound to confidentiality, may audit compliance once a year at its own cost with 30 days' written notice, in a way that does not disturb the service or other customers.

On data protection, this agreement takes precedence over the terms of use. Liability follows the terms of use. Belgian law applies. Questions go to hello@weedoo.work.