Data Processing Agreement under Art. 28 GDPR
Version of 22 October 2026
between
Company: ______________________________
Address: ______________________________
represented by: ______________________________
(the "Controller")
and
Devin Lemcke Capital UG (haftungsbeschränkt), Bahrenfelder Kirchenweg 36, 22761 Hamburg, Germany, represented by its managing director Devin Lemcke, operator of CanUSign (canusign.com)
(the "Processor")
§ 1 Subject matter and duration
(1) The Processor operates the CanUSign platform for signing documents electronically. This agreement governs the processing of personal data that the Processor carries out in doing so on behalf of the Controller. The service is provided under the agreement on the use of the Controller's account under the CanUSign Terms and Conditions (the "Main Agreement").
(2) This agreement applies for as long as the Processor processes personal data on behalf of the Controller. It ends together with the Main Agreement without separate notice; § 9 continues to apply beyond that.
§ 2 Nature, purpose and scope of the processing
(1) Purpose: Provision of the platform, namely uploading and creating documents, placing signature fields, sending invitations to sign, capturing the signatures, creating the signed PDF with audit trail and storing the documents in the account. On request, this includes automatic detection of signature fields and a summary of the document for the signers.
(2) Types of data:
- Contents of the uploaded documents, insofar as they contain personal data
- Names and email addresses of the signers
- Signature images and texts entered by signers
- Audit trail: times, IP address and browser identifier when opening and signing
- Account data of the Controller's users (name, email address, sign-in data)
(3) Categories of data subjects: Employees of the Controller, its customers and their contact persons, and other persons whom the Controller invites to sign.
(4) The Processor processes special categories of personal data under Art. 9 GDPR only insofar as the Controller includes them in documents. The Controller assesses whether this is permissible.
(5) The processing takes place in the European Union. Data is transferred to a third country only in accordance with § 6 and Annex 1.
(6) The Processor processes the Controller's payment and billing data as a controller in its own right; such data is not subject to this agreement.
§ 3 Instructions
(1) The Processor processes the data only on documented instructions from the Controller, including with regard to transfers to a third country, unless required to do so by Union or Member State law. In such a case, the Processor informs the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
(2) Instructions are the Main Agreement, this agreement and the settings and actions of the Controller in its account. The Controller gives further instructions in text form (Textform) to contact@canusign.com.
(3) If the Processor considers an instruction to be unlawful, it informs the Controller without undue delay. It may suspend its execution until the Controller confirms or changes it.
§ 4 Obligations of the Processor
(1) The Processor ensures that all persons who have access to the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality.
(2) It takes the technical and organisational measures under Art. 32 GDPR described in Annex 2. It may develop them further as long as the level of protection does not decrease.
(3) Taking into account the nature of the processing, it assists the Controller as far as possible in responding to requests from data subjects under Chapter III GDPR. If a data subject contacts the Processor directly, it forwards the request to the Controller without undue delay.
(4) Taking into account the nature of the processing and the information available to it, it assists the Controller with the obligations under Art. 32 to 36 GDPR, in particular with notifications of personal data breaches and with a data protection impact assessment.
(5) It notifies the Controller of a personal data breach without undue delay after becoming aware of it, with the information under Art. 33(3) GDPR insofar as it is available to it.
(6) The contact person for data protection is the managing director, Devin Lemcke, contact@canusign.com.
§ 5 Sub-processors
(1) The Controller grants general authorisation to engage sub-processors. Those engaged at the conclusion of this agreement are listed in Annex 1; they are deemed authorised.
(2) The Processor informs the Controller in text form at least 30 days before any intended addition or replacement. Within this period, the Controller may object for an important reason relating to data protection. If the parties do not reach agreement, the Controller may terminate the Main Agreement with effect from the date of the change.
(3) The Processor imposes on each sub-processor by contract the same data protection obligations as set out in this agreement. Where a sub-processor fails to fulfil its obligations, the Processor remains liable to the Controller for their performance.
(4) Services that the Controller or a signer chooses itself and that act under their own responsibility, such as signing in with a Google account, are not sub-processors.
§ 6 Transfers to third countries
Data is transferred to a country outside the European Economic Area only if the conditions of Art. 44 et seq. GDPR are met, in particular on the basis of the adequacy decision on the EU-US Data Privacy Framework or the standard contractual clauses of the European Commission. Annex 1 states the basis for each sub-processor.
§ 7 Evidence and audits
(1) The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations under this agreement.
(2) It allows for and contributes to audits, including inspections, by the Controller or by an auditor mandated by it and bound to confidentiality. The Controller announces on-site audits with reasonable notice, as a rule 14 days; they take place during normal business hours and must not disrupt operations disproportionately. The Processor may also provide evidence by means of current audit reports or certificates of its sub-processors.
§ 8 Obligations of the Controller
The Controller is responsible for the lawfulness of the processing, in particular for informing the signers under Art. 13 and 14 GDPR. If it detects errors or irregularities in the processing, it informs the Processor without undue delay.
§ 9 Deletion and return
(1) The Controller can download its documents in the account at any time and delete them individually.
(2) After the end of the Main Agreement, the Processor deletes all personal data or returns it and deletes existing copies, at the choice of the Controller, unless there is a legal obligation to store it. If the Controller deletes its account, this counts as choosing deletion.
(3) Fully signed documents in which persons other than the Controller are involved are kept by the Processor separately from the account after the account has been deleted, so that the other signers can continue to retrieve and verify their copy through their link. They are deleted at the end of the tenth calendar year after the last signature. The Controller gives this instruction with this agreement. It may instead demand in text form that these documents are also deleted immediately; the Processor then deletes them within 30 days.
(4) Backups at the sub-processors are overwritten according to their periods: the database after 24 hours, backups of the hosting infrastructure after 30 days.
§ 10 Final provisions
(1) Liability is governed by Art. 82 GDPR and otherwise by the Main Agreement.
(2) In the event of conflicts, this agreement takes precedence over the Main Agreement insofar as the protection of personal data is concerned.
(3) Amendments require text form. The agreement may be concluded in electronic form (Art. 28(9) GDPR).
(4) If any provision is invalid, the remainder of the agreement remains valid.
(5) German law applies. The place of jurisdiction is Hamburg, insofar as permitted by law.
Annexes: 1 Sub-processors, 2 Technical and organisational measures
| For the Controller | For the Processor |
|---|---|
| Concluded electronically on ______________________________ by ______________________________, through the account ______________________________ | Concluded electronically on ______________________________ by Devin Lemcke, managing director |
Annex 1: Sub-processors
As of: 22 October 2026
| Provider | Service | Place of processing | Basis where a third country is involved |
|---|---|---|---|
| Devin Lemcke (sole proprietorship), Bahrenfelder Kirchenweg 36, 22761 Hamburg, Germany | Provision of hosting, database, cloud services and email delivery through its contracts with the following providers; access only by Devin Lemcke | Hamburg, Germany | no transfer, agreement under Art. 28(4) GDPR |
| Vercel Inc., USA | Hosting of the application, server functions, file storage for documents and signature images | Frankfurt am Main (region fra1) | EU-US Data Privacy Framework; standard contractual clauses in the Data Processing Addendum |
| Databricks, Inc. (Neon), USA | Database | Frankfurt am Main (AWS eu-central-1) | EU-US Data Privacy Framework; alternatively standard contractual clauses (Module 3) |
| Google Cloud | Generation of the PDF files; AI features field detection and summary (Gemini model), contents are not used for training | Frankfurt am Main (region europe-west3) | EU-US Data Privacy Framework; standard contractual clauses |
| Plus Five Five, Inc. (Resend), San Francisco, USA | Delivery of emails (invitations, reminders, completion notices) | Delivery via Ireland (region eu-west-1) | EU-US Data Privacy Framework; standard contractual clauses |
The four providers are engaged by the sole proprietorship of Devin Lemcke, which provides the infrastructure for CanUSign; it is bound by the same obligations as the Processor. The data is stored in Frankfurt am Main. The providers have their registered offices in the USA, so access from the USA cannot be ruled out; the basis stated applies to it.
Annex 2: Technical and organisational measures
As of: 22 October 2026
1. Confidentiality
Physical access control: The Processor does not operate its own servers. The data centres belong to the sub-processors in Annex 1 and are secured according to their procedures. Vercel is certified under ISO 27001:2022 and has a SOC 2 Type 2 audit; Databricks (Neon) is certified under ISO 27001 and ISO 27701 and has a SOC 2 report.
System access control:
- Users sign in with a passkey, with a one-time link sent to their email address or with a Google account. CanUSign does not use passwords.
- Signers receive a random link that cannot be guessed, per document and role.
- API keys are stored only as a SHA-256 hash, requests are limited to 60 per minute.
- Only the managing director has access to hosting, database, cloud and email delivery, with a passkey or two-factor sign-in.
Data access control:
- Each user sees only the documents of their account, each signer only the document they have been invited to.
- Administrative rights in the application are checked against the database on every request.
- Documents and signature images are kept in non-public storage and are delivered only through verified requests.
Separation control: Every record is assigned to an account. Development and tests run on separate databases without production data.
Data minimisation: The log of API requests contains no contents, only method, path, status, duration and key prefix. Unpaid drafts are deleted 90 days after the last change.
2. Integrity
Transfer control: All connections are encrypted with TLS. Stored data is encrypted at all sub-processors, at Vercel and Google Cloud with AES-256.
Input control: Every document has an audit trail with the time, IP address and browser identifier of each opening and each signature. The final PDF is generated once, provided with an electronic seal (PAdES) and its SHA-256 hash is stored. Any later change can be detected through the public verification page.
3. Availability and resilience
- Operation on the infrastructure of the sub-processors in Frankfurt am Main with several availability zones.
- The database can be restored to any point in time within the last 24 hours.
- Errors in critical processes (payments, account deletion, qualified signature) are reported automatically to the managing director by email.
4. Regular review
- Automated tests for sign-in, signing and PDF generation; before the first release of a day, the sign-in test must have passed.
- Regular updates of the software libraries used.
- Deletion periods run automatically every day.
- Sub-processors only with an agreement under Art. 28(4) GDPR (Annex 1).