Data Processing Agreement

Last Updated: November 7, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Firma and the customer that uses the Services (the "Customer"). It applies automatically when the Customer accepts the Terms and Firma processes Customer Personal Data on the Customer's behalf. No signature is required.

1. Parties and Roles

Processor: Cristian Cabrera, sole proprietor trading as "Firma", Chile (tryfirma.com), contact privacy@tryfirma.com.

Controller: the Customer, as identified in its Firma account.

The Customer is the controller (or, where it acts for its own clients, a processor) of Customer Personal Data, and Firma is its processor (or sub-processor). Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given in Regulation (EU) 2016/679 ("GDPR"). "Customer Personal Data" means personal data Firma processes on the Customer's behalf to provide the Services.

2. Processing on Instructions

Firma processes Customer Personal Data only on the Customer's documented instructions, which are this DPA, the Terms, and the Customer's configuration and use of the Services, unless EU or Member State law requires otherwise. In that case Firma informs the Customer first, unless the law prohibits it. Firma tells the Customer promptly if it believes an instruction infringes data protection law. Firma does not sell Customer Personal Data or use it for advertising or to train AI models.

3. Confidentiality

Firma ensures that all persons authorized to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4. Security

Firma implements the technical and organizational measures in Annex II, appropriate to the risk, as required by Article 32 GDPR. Firma may update these measures as long as the overall level of protection is not reduced.

5. Sub-processors

The Customer gives Firma general authorization to engage the sub-processors listed on the Sub-processors page (Annex III). Firma updates that page at least 30 days before adding or replacing a sub-processor, and emails Customers who ask to be notified. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected Services and receive a refund of prepaid fees for the unused period.

Firma imposes data protection obligations on each sub-processor that are no less protective than this DPA, and remains responsible to the Customer for their performance.

6. Assistance

Taking into account the nature of the processing, Firma assists the Customer in responding to data subject requests (access, rectification, erasure, restriction, portability, objection), and with security, breach notification, data protection impact assessments and prior consultations under Articles 32 to 36 GDPR. If Firma receives a request directly from a Customer's data subject, it forwards it to the Customer and does not respond without the Customer's authorization.

7. Personal Data Breaches

Firma notifies the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice includes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, likely consequences, and the measures taken or proposed. Firma takes reasonable steps to contain and remediate the breach.

8. Return and Deletion

On the Customer's request, including when the Customer stops using the Services, Firma deletes Customer Personal Data within 30 days, and returns a copy in a common format first if the Customer asks within that period. Backup copies are overwritten on the normal backup cycle within 30 days. Firma may keep data only where EU or Member State law requires it, and keeps it confidential.

9. Information and Audits

Firma makes available the information reasonably needed to demonstrate compliance with Article 28 GDPR, including answers to security questionnaires. If that is not enough, the Customer (or an independent auditor bound by confidentiality) may audit Firma once per year with at least 30 days' written notice, at the Customer's cost, during business hours and without unreasonably disrupting Firma's operations.

10. International Transfers

Firma is located in Chile and stores data in the United States. Neither country has a general EU adequacy decision covering this processing, so transfers of Customer Personal Data from the EEA are governed by the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (the "SCCs"), which are incorporated into this DPA by reference, as follows:

  • Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) where the Customer is a processor.
  • The Customer is the data exporter and Firma is the data importer.
  • Clause 7 (docking clause) applies.
  • Clause 9: Option 2 (general written authorization) applies, with the 30-day notice period in section 5.
  • Clause 11: the optional language does not apply.
  • Clause 13: the competent supervisory authority is the one determined by Clause 13 based on the Customer's establishment or EU representative.
  • Clauses 17 and 18: the SCCs are governed by the law of Ireland, and disputes are resolved by the courts of Ireland.
  • Annexes I, II and III of the SCCs are completed by Annexes I, II and III of this DPA.

For transfers from the United Kingdom, the UK International Data Transfer Addendum to the SCCs applies, and for Switzerland the SCCs apply with the references adapted to the Swiss Federal Act on Data Protection. If the SCCs conflict with this DPA, the SCCs prevail.

11. Term, Liability and Precedence

This DPA lasts as long as Firma processes Customer Personal Data. Each party's liability under this DPA is subject to the limitations in the Terms, except where the SCCs or applicable law do not allow such limits. If this DPA conflicts with the Terms on data protection, this DPA prevails.

Annex I: Details of Processing

  • Subject matter and purpose: providing the Firma email signature management service: importing directory data, creating and personalizing email signatures, deploying them to Google Workspace (Gmail) and Microsoft 365 (Outlook add-in), customer support and troubleshooting.
  • Nature of processing: collection, storage, structuring, retrieval, use for signature generation, transmission to the Customer's email platform, deletion.
  • Duration: while the Customer uses the Services, until deletion is requested, plus up to 30 days for deletion.
  • Frequency: continuous.
  • Data subjects: the Customer's employees, contractors and other users whose signatures are managed in Firma, and the Customer's admins.
  • Categories of personal data: name, email address and aliases, job title, department, organizational unit, phone numbers, profile photo, office address, social and meeting links, and other fields the Customer adds to signatures; account and usage data.
  • Special categories: none. Firma does not access email content.
  • Retention: as set out in section 8.

Annex II: Technical and Organizational Measures

  • Encryption of all data in transit (TLS/HTTPS, HSTS) and at rest (provider-managed encryption).
  • Least-privilege access to Google Workspace and Microsoft 365: signature settings and read access to directory data only, with no permission to read email content.
  • Row-level security in the database, so each organization can only access its own data.
  • Access to production systems limited to authorized personnel, through accounts protected by strong authentication.
  • Secrets and API keys stored in the hosting providers' encrypted environment configuration, not in source code.
  • Automated, provider-managed backups and infrastructure redundancy.
  • Logging and monitoring of errors and access through the hosting providers.
  • Data minimization: only directory fields needed for signatures are imported, and only the data needed for a task is shared with AI tools, which are used under no-training terms.
  • Sub-processors selected for their security practices and bound by data protection terms.
  • Admins can revoke Firma's access at any time from their Google Workspace or Microsoft 365 admin console.

Annex III: Sub-processors

The list of authorized sub-processors, their locations and transfer safeguards is on the Sub-processors page, which forms part of this DPA.