Version: September 2019

This Data Protection Attachment for Scribo (“DPA”) is incorporated into and made part of the Scribo Site Use and Services Terms and Conditions, and governs the Processing of Personal Data by Scribo as a Processor on behalf of Customer or Customer Affiliates, as applicable. Unless otherwise defined in this DPA, capitalized terms will have the meaning given to them in the Agreement.

SECTION 1: Definitions

General. The terms “Personal Data,” “Process/Processing,” “Controller,” “Processor,” “Subprocessor,” and “Data Subject” have the meanings ascribed to them under the General Data Protection Regulation; provided that the term “Personal Data” as used herein only applies to Personal Data for which Scribo is a Processor. “EEA” means the European Economic Area.

“General Data Protection Regulation” or “GDPR” means Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

“Processor Privacy Code” or “Processor Code” means Scribo’s processor binding corporate rules for the Processing of Personal Data, the most current version of which is available on Scribo’s website, available at link.

SECTION 2: Data Processing and Protection of Personal Data

  • 2.1 Scope of Data Processing. Subject to Scribo’s corporate policies regarding the retention of User data and applicable law, the maximum duration of the Processing of Personal Data will be the same as the duration of the Agreement, except as otherwise agreed to in writing by the parties. The subject matter of the Processing of Personal Data is set out in the Agreement and this DPA. The nature and purpose of the Processing of Personal Data involve the provision of Scribo Services service to the Customer, as set out in the Agreement and this DPA.
  • 2.2 Data Processing Limitations. With respect to Personal Data Processed by Scribo or a Scribo Affiliate as a Processor on behalf of Customer or Customer Affiliate or as a Subprocessor where Customer Processes such Personal Data on behalf of its customers (or both), Scribo will: (a) Process Personal Data only as necessary to provide the Services in accordance with the terms of the Agreement or as instructed by Customer in writing, including in electronic form, and consistent with the terms of the Agreement; and (b) Not disclose Personal Data to third parties except: (i) To employees, service providers, or advisers who have a need to know the Personal Data and are under confidentiality obligations at least as restrictive as those described under this DPA; or (ii) As required to comply with valid legal process in accordance with the terms of the Agreement. If Scribo has reason to believe Customer’s instructions infringe the GDPR or other EEA data protection provisions, then Scribo will immediately notify the Customer.
  • 2.3 Assistance to Customer and Regulatory Investigation. Upon written request, Scribo will provide reasonable assistance and information to Customer in fulfilling any legal obligations that Customer may have under the GDPR regarding data protection impact assessments, data and systems inventory, records of Processing, and related consultations of data protection authorities, or in the event of an investigation by any governmental authorities, if and to the extent that such investigation relates to Personal Data Processed by Scribo in accordance with the Agreement. Such assistance will be at Customer’s sole expense, except where such an investigation was required due to Scribo’s failure to act in accordance with the Agreement.
  • 2.4 Transfers of Personal Data from EEA. In providing the Scribo Services, Scribo may transfer and access Personal Data to and from other countries where Scribo has operations or Subprocessors, or as otherwise required by applicable law. Scribo’s Processor Privacy Code and the additional terms in this Section 2.4 will apply to Scribo’s Processing of Personal Data on Customer’s behalf as a data processor in providing the Scribo Signature service, where such Personal Data is: (a) Subject to any restriction under the GDPR or other applicable EEA data protection laws regarding outbound transfers of Personal Data; and (b) Processed by Scribo in a country outside of the EEA. The most current version of the Processor Code is available on Scribo’s website, currently located at link, and the terms of the Processor Code are incorporated by reference into this DPA. Capitalized terms used but not defined in this Section 2.4 have the meanings set forth in the Processor Code and/or Scribo’s Site Use and Services Agreement. Scribo will make commercially reasonable efforts to maintain the EU authorization of its Processor Code for the duration of the Agreement and will promptly notify Customer of any subsequent material changes in the EU authorization of its Processor Code. Scribo will at all times remain solely liable to Customer or Customer Affiliate for Scribo’s obligations (and those of its Affiliates, if any) under this DPA, and in no event will any other Scribo Affiliate owe liability to Customer or Customer Affiliate under this DPA, except where and to the extent required by applicable law.

SECTION 3: Customer Responsibilities

The Customer acknowledges and accepts responsibility for properly implementing access and use controls and configuring certain features and functionalities of Scribo Services that Customer may elect to use and that it will do so in such manner that the Customer deems adequate to maintain appropriate security, protection, deletion, and backup of Personal Data. Scribo will be entitled to rely solely on the Customer or the Customer Affiliate’s instructions relating to any Personal Data Processed by Scribo. The Customer is responsible for coordinating all communication with Scribo under this DPA, including, without limitation, any communication in relation to this DPA on behalf of its Affiliates.

SECTION 4: Information Security

Scribo will safeguard Personal Data with appropriate technical, physical, and organizational measures as described more fully in the Processor Code and the Agreement for the provision of the Scribo Signature service. The parties agree that the audit reports and audit rights provided under the Processor Code and Agreement will be used to satisfy any audit or inspection requests by or on behalf of Customer and to demonstrate compliance with applicable obligations of Scribo under this DPA.

SECTION 5: Personal Data Breach

Scribo will notify the Customer without undue delay if Scribo becomes aware of a Personal Data Breach affecting the Personal Data. Taking into account the nature of Processing and the information available to Scribo, Scribo will assist the Customer at the Customer’s request and expense in complying with the Customer’s notification obligations regarding Personal Data Breaches as required by the GDPR.

SECTION 6: Data Privacy Contact

Scribo’s data privacy officer can be reached at the following address:

  • Scribo, LLC
  • Attn: Chief Privacy Officer
  • 15 Main Street, Suite 168
  • Watertown MA

SECTION 7: Data Subjection Rights; Access, Correction, Restriction and Deletion

Taking into account the nature of the Processing, Scribo Signature provides functionality to assist Customer by appropriate technical and organizational measures, insofar as this is possible, to access, correct, amend, restrict, or delete Personal Data contained in Scribo Signature to address requests by a Data Subject under the GDPR. To the extent Customer, in its use of Scribo Signature, is not familiar with Scribo Signature functionality that may be used for these purposes, Scribo will provide Customer with additional Documentation or customer support assistance to educate the Customer on how to take such actions in a manner consistent with the functionality of Scribo Signature and in accordance with the terms of the Agreement. If Scribo receives any request from any Data Subject to access, correct, restrict, or delete Personal Data, Scribo will advise such Data Subject to submit its request to Customer and Customer will be responsible for responding to any such request using the functionality of Scribo Signature.

SECTION 8: Subprocessors

Scribo may engage Subprocessors to provide parts of Scribo Signature, subject to the restrictions of the Agreement and this DPA. Scribo will ensure that Subprocessors Process Personal Data only in accordance with the terms of this DPA and that Subprocessors are bound by written agreements that require them to provide at least the level of data protection required by this DPA. Before appointing any new Subprocessors, Scribo will inform Customer of the appointment (including the name and location of such Subprocessor and the activities it will perform) either by electronic mail, via Scribo Signature, or by publication to a Scribo website provided to Customer prior to any appointment. Customer may object to Scribo’s appointment by giving written notice to Scribo within thirty (30) days of being informed by Scribo of such appointment, and if, within thirty (30) days of Scribo’s receipt of Customer’s objection, Scribo fails to provide a commercially reasonable alternative to avoid the Processing of Personal Data by the appointed Subprocessor, Customer may, as its sole and exclusive remedy, terminate any Scribo Signature services to which this DPA applies.

SECTION 9: Return or Disposal

Prior to termination or expiration of the Agreement for any reason, Customer may retrieve Personal Data processed by Scribo Signature in accordance with the terms of the Agreement, and at Customer’s request provided in writing to Scribo, Scribo will promptly return or delete Personal Data from Scribo Signature, unless applicable law requires storage of the Personal Data.