Data Processing Agreement (GDPR Article 28) — template, version 1

Version 1, in force from 2026-10-29. Published at https://trustbeat.eu/legal/dpa and incorporated by section 5.8 of the Terms of Service. It applies automatically to every customer who uses Signature Preservation; a customer that needs a countersigned copy can sign it as is. Language: English; a translation, if any, is informative.

Between

the customer who holds a TrustBeat account and uses Signature Preservation (the "Controller"), and

Trustbeat s.r.o., Company ID (IČO) 24888648, VAT ID CZ24888648, registered office Korunní 2569/108, Vinohrady, 101 00 Praha 10, Czech Republic, entered in the Commercial Register kept by the Municipal Court in Prague (Městský soud v Praze), section C, file 444524 (the "Processor", "TrustBeat").

1. Subject matter and duration

1.1 The Processor processes personal data on behalf of the Controller when providing Signature Preservation under the Terms of Service (the "Service"): preservation of the digital signatures the Controller submits, with their validation data, under the preservation profile https://trustbeat.eu/preservation/profile/pds-wst-v1.

1.2 This agreement applies for as long as the Processor holds personal data submitted by the Controller through the Service — that is, until the end of the preservation period of the Controller's last record plus 30 days (Terms §5.6), even after the Controller's account or subscription has ended.

1.3 Other TrustBeat services (Document Anchoring, Tamper-Evident Logs, AI Decision Anchoring, Audit Trail) accept hash values only; TrustBeat does not process personal data on the Controller's behalf in them, and this agreement does not apply to them. Account, billing and usage data of the Controller are processed by TrustBeat as controller, under its Privacy Policy.

2. Nature, purpose and scope of the processing (Annex 1)

3. Instructions

3.1 The Processor processes the personal data only on documented instructions from the Controller, including with regard to transfers to third countries, unless required to do so by Union or Member State law; in that case it informs the Controller before processing unless that law prohibits it.

3.2 The Terms of Service, the preservation profile pds-wst-v1, the signature validation policy, the preservation evidence policy and the practice statement (published at trustbeat.eu/preservation), the Controller's submissions through the Service, and this agreement are the Controller's complete instructions. In particular the Controller instructs the Processor to keep each record for its full preservation period unless the Controller deletes it earlier (§9).

3.3 The Processor informs the Controller immediately if, in its opinion, an instruction infringes the GDPR or other data protection law.

4. Confidentiality

The Processor ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Access is limited to the persons who operate and support the Service.

5. Security of processing (Art. 32; Annex 2)

The Processor implements the technical and organisational measures in Annex 2 and keeps them appropriate to the risk. It may change them provided the overall level of security is not reduced.

6. Sub-processors

6.1 The Controller gives general authorisation for the sub-processors listed in Annex 3.

6.2 The Processor informs the Controller by email at least 14 days before adding or replacing a sub-processor that processes personal data under this agreement. The Controller may object on reasonable data-protection grounds within that period; if the parties cannot resolve the objection, the Controller may stop submitting new records. Records already submitted stay preserved under the sub-processors then in place.

6.3 The Processor imposes on each sub-processor, by contract, data protection obligations at least equivalent to those in this agreement, and remains liable to the Controller for its sub-processors.

6.4 Not sub-processors: the qualified time-stamping authorities (they receive only a digest, which is not personal data), and the certification authorities whose OCSP responders and CRL distribution points the Processor queries to validate a signature (each acts as an independent controller of its own status service; the query reveals to it only which of its own certificates is checked).

7. Assistance with data subject rights

7.1 The Processor forwards to the Controller, without undue delay, any request it receives from a data subject concerning data processed under this agreement, and does not answer it itself except to refer the data subject to the Controller.

7.2 The Processor assists the Controller with appropriate technical and organisational measures: the Controller can retrieve, at any time, every record and its full content (GET /v1/signature-preservation, GET /v1/signature-preservation/{id}/package) to answer requests for access or portability. Requests for erasure or restriction before the end of the preservation period are handled as in §9.

8. Assistance with security, breaches, DPIA and consultation (Art. 32–36)

8.1 The Processor notifies the Controller without undue delay, and at the latest within 48 hours, after becoming aware of a personal data breach affecting the Controller's data, with the information Art. 33(3) GDPR requires as far as available, and supplements it as it becomes available.

8.2 The Processor assists the Controller with data protection impact assessments and prior consultations, taking into account the nature of the processing and the information available to it. Its own DPIA of the Service is summarised for the Controller on request.

9. End of the processing; deletion

9.1 Deletion by the Controller. The Controller can delete any of its records at any time (DELETE /v1/signature-preservation/{id} or the portal). The Processor then deletes the Preservation Evidence Object, the stored signatures and the record without undue delay; only the SHA-256 of the Preservation Evidence Object remains, as a leaf of a hash tree shared with other customers' records, which is not personal data. Deletion is final. Where a data subject requests erasure, the Controller decides whether an exception under Art. 17(3) GDPR applies (in particular point (e), legal claims, or point (b), a legal obligation) and, if not, deletes the record.

9.2 At the end of the preservation period of a record, the Processor makes the record's export-import package available to the Controller and deletes the record, its Preservation Evidence Object and the stored signatures 30 days later (Terms §5.6). Encrypted backups made before the deletion are not trimmed on a schedule yet and may still contain it (Annex 2, backup retention).

9.3 If TrustBeat terminates the Service, the Controller receives the package of every record before the stop date (practice statement §7); the records, Preservation Evidence Objects and stored signatures are then deleted, including from backups. Any copy TrustBeat keeps to evidence its operation contains no personal data processed under this agreement.

9.4 Ending the account or subscription does not end the preservation period and does not trigger deletion (Terms §5.6).

10. Information and audits

10.1 The Processor makes available to the Controller the information necessary to demonstrate compliance with Art. 28 GDPR, in particular this agreement, Annex 2, the published preservation documents, and on request a record of the actions performed on the Controller's records.

10.2 The Processor allows for and contributes to audits, including inspections, by the Controller or an auditor mandated by it, bound by confidentiality, with at least 30 days' notice, during business hours, at most once a year unless a breach or a supervisory authority requires more. Each party bears its own costs; audits of the sub-processors are covered by their certifications and reports.

11. International transfers

No personal data processed under this agreement is transferred outside the European Economic Area.

12. Liability, precedence, law

12.1 Liability follows Art. 82 GDPR and, between the parties, the Terms of Service.

12.2 In a conflict between this agreement and the Terms of Service on the processing of personal data, this agreement prevails.

12.3 This agreement is governed by Czech law; the courts of the Czech Republic have jurisdiction, as in the Terms of Service.

Annex 1 — Details of the processing

See §2.

Annex 2 — Technical and organisational measures

Annex 3 — Authorised sub-processors