1Parties & roles
This Data Processing Agreement ("DPA") is entered into between:
- Mostly Tiny Ltd, a company registered in England & Wales, operator of the MostlySign service — acting as the processor; and
- the customer — the Business-plan account holder — acting as the controller of the personal data processed through MostlySign.
The controller determines the purposes and means of processing the personal data contained in the documents it sends for signature. Mostly Tiny Ltd processes that data only on the controller's behalf, to provide the MostlySign service. Where terms are defined in the UK GDPR / EU GDPR (such as "personal data", "processing", "data subject", "sub-processor"), they carry those meanings here.
2Subject-matter & duration
The subject-matter of the processing is the provision of the MostlySign electronic-signature service to the controller. Processing lasts for the term of the controller's subscription and for the limited retention period afterwards described in section 12. This DPA remains in force for as long as Mostly Tiny Ltd processes personal data on the controller's behalf.
3Nature & purpose of processing
The purpose is electronic-signature document processing: receiving documents and recipient details from the controller, delivering signing requests, capturing the audit trail, applying the platform PAdES seal and trusted timestamp, and storing the completed documents so the controller and its signers can retrieve them. Mostly Tiny Ltd does not use the personal data for any purpose of its own, and does not sell it or use it to train AI models.
4Types of personal data & categories of data subjects
Types of personal data
- Signer and recipient names and email addresses;
- IP addresses and access timestamps captured in the audit trail;
- signature images (drawn or typed) and typed signature text;
- the contents of the documents the controller uploads for signature, which may themselves contain personal data chosen by the controller;
- account-holder contact and billing details for the controller's own users.
Categories of data subjects
- the controller's signers and recipients (the people invited to view or sign documents);
- the controller's own users and administrators of the account;
- any individuals whose personal data the controller includes within a document's contents.
5Controller instructions
Mostly Tiny Ltd processes personal data only on the controller's documented instructions. The controller's instructions are given through its configuration and use of the service, through this DPA, and through the applicable terms of service. Mostly Tiny Ltd will inform the controller if, in its opinion, an instruction infringes the UK GDPR / EU GDPR or other data-protection law — though it is not obliged to provide legal advice. If Mostly Tiny Ltd is required by law to process personal data beyond the controller's instructions, it will inform the controller of that legal requirement before processing, unless the law prohibits it from doing so.
6Confidentiality
Mostly Tiny Ltd ensures that the people authorised to process the personal data are bound by an appropriate duty of confidentiality — whether a contractual obligation or a statutory one. Access to controller personal data is limited to the personnel who need it to operate, support, and secure the service.
7Security measures
Mostly Tiny Ltd implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access (Article 32). These include:
- Encryption in transit — all connections to the service use TLS.
- Encryption at rest — documents and database records are stored encrypted at rest by the underlying Google Cloud / Firebase infrastructure.
- Access controls — least-privilege access for personnel, authenticated access for account users, and per-document access scoping so signers see only what they are invited to.
- The PAdES seal & audit trail — every completed document is sealed with a standards-based PAdES digital signature and an RFC 3161 timestamp, and carries a tamper-evident audit trail. Any later change to the bytes breaks the seal, so integrity is verifiable independently of Mostly Tiny Ltd.
- Segregation & regional hosting — compute and storage run in the Google Cloud europe-west2 (London) region (see section 9).
8Sub-processors
The controller authorises Mostly Tiny Ltd to engage the sub-processors below to provide the service. Each is bound by data-protection terms no less protective than this DPA. Mostly Tiny Ltd remains responsible to the controller for its sub-processors' performance.
| Sub-processor | Purpose | Location |
|---|---|---|
| Google Cloud / Firebase | Application hosting, database, and document storage | EU — europe-west2 (London) |
| Stripe | Subscription payments & billing (account-holder data only) | EU / US (SCCs) |
| Resend | Transactional email delivery (signing invitations & notifications) | US (SCCs) |
Mostly Tiny Ltd will give the controller reasonable prior notice of any intended addition or replacement of a sub-processor, giving the controller the opportunity to object on reasonable data-protection grounds.
9International transfers
Personal data is hosted in the EU (europe-west2, London) by default. Where a sub-processor processes personal data outside the UK / EEA — for example transactional email or payments — such transfers are made under an appropriate safeguard, in the ordinary case the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, together with any supplementary measures required. Mostly Tiny Ltd does not otherwise transfer controller personal data outside the UK / EEA.
10Assisting with data-subject rights
Taking into account the nature of the processing, Mostly Tiny Ltd assists the controller — by appropriate technical and organisational measures, and so far as reasonably possible — in fulfilling its obligation to respond to requests from data subjects exercising their rights (access, rectification, erasure, restriction, portability, and objection). Much of this the controller can do directly from within the service; for anything it cannot, Mostly Tiny Ltd will help on request. If a data subject contacts Mostly Tiny Ltd directly about controller data, Mostly Tiny Ltd will refer them to the controller.
11Breach notification
Mostly Tiny Ltd will notify the controller without undue delay after becoming aware of a personal-data breach affecting the controller's data, and will provide the information reasonably available to help the controller meet its own notification obligations to supervisory authorities and data subjects. Mostly Tiny Ltd also assists the controller, where appropriate, with data-protection impact assessments and prior consultation (Articles 35–36).
12Deletion or return on termination
On termination of the service, and at the controller's choice, Mostly Tiny Ltd will delete or return the controller's personal data and delete existing copies, unless retention is required by law. Completed, sealed documents remain available for export until the end of the retention window; after that they are deleted from active systems. Routine backups are cycled out on their normal schedule.
13Audit rights
Mostly Tiny Ltd makes available to the controller the information reasonably necessary to demonstrate compliance with Article 28, and allows for and contributes to audits, including inspections, conducted by the controller or an auditor it mandates. In the first instance this is satisfied by the documentation and information Mostly Tiny Ltd provides on request; on-site audits, where genuinely necessary, are arranged on reasonable notice, during business hours, and without unreasonable disruption to the service or other customers.
14Liability
Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the agreement between the parties (the MostlySign terms of service). Nothing in this DPA limits either party's liability where it cannot lawfully be limited, and each party remains responsible for its own compliance obligations under applicable data-protection law.
15General
Where there is a conflict between this DPA and the MostlySign terms of service on the subject of personal-data processing, this DPA prevails. If any provision is found unenforceable, the rest remains in effect. This DPA is governed by the law of England & Wales, consistent with the underlying agreement.