Data Processing Agreement (DPA) & GDPR Art. 28 | KvikSign

Read KvikSign Data Processing Agreement (DPA) under GDPR Article 28, covering security measures, EU data residency, and approved sub-processors.

1. Parties & Role Allocation (GDPR Article 28)

This Data Processing Agreement governs KvikSign’s processing of personal data on behalf of the Customer (the Data Controller) when using the KvikSign platform for digital signatures, confidential file sharing, forms, and eID verification.

2. Security Measures & EU Data Residency

All data is encrypted in transit (TLS 1.3) and at rest (AES-256) within European data centers. Sensitive personal identifiers are automatically anonymized after 12 months, and document files are permanently deleted 40 days after completion.

3. Approved Sub-processors

KvikSign utilizes audited sub-processors with European data residency, including Google Cloud Platform (Frankfurt/Eemshaven), IDURA A/S (Denmark/EU), Brevo (France/Germany), and Stripe Payments Europe (Ireland).