Data Processing Addendum

This DPA applies when Papereg processes personal data on behalf of the Customer ("Data Controller") as part of providing the Papereg platform services. It supplements any existing service agreement between the parties.

Papereg acts as a Data Processor with respect to workspace form submissions, file uploads, and any personal data contained therein. Papereg acts as a Data Controller for user account data necessary to operate the service.

Papereg processes personal data only in accordance with the Customer's documented instructions, which include:

• Collecting and storing form submissions as configured by the Customer
• Processing uploaded documents through AI extraction when initiated by authorized workspace users
• Syncing submission data to connected third-party apps as configured by the Customer
• Sending email notifications and webhook events as configured by the Customer
• Generating reports from submission data as requested by authorized workspace users

Data Subjects

• Customer's employees and workspace members
• Individuals who submit forms (public or workspace)
• Individuals whose data appears in uploaded documents

Categories of Personal Data

The specific categories depend on how the Customer configures their forms. Common examples include:

• Contact information (name, email, phone, address)
• Employment information (job title, department, employee ID)
• Health and safety information (when used in healthcare or incident forms)
• Financial information (when used in expense or billing forms)
• File attachments (which may contain any type of personal data)

Papereg implements the following technical and organizational measures to protect personal data:

For a complete description of security controls, see our Security page.

Papereg uses the following subprocessors for the delivery of its services:

Papereg will notify the Customer before adding or replacing a subprocessor, providing the Customer an opportunity to object.

Papereg will assist the Customer in fulfilling data subject requests (access, rectification, erasure, portability) to the extent technically feasible. The Customer can:

• Export submission data via CSV, Excel, or API
• Delete individual submissions through the registry interface or API
• Delete entire workspaces, which removes all associated data

For requests that cannot be fulfilled through the platform, contact us at privacy@papereg.com.

In the event of a personal data breach, Papereg will notify the Customer without undue delay after becoming aware of the breach. The notification will include:

• Description of the nature of the breach
• Categories and approximate number of data subjects affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach

Upon termination of the service agreement, at the Customer's choice:

• Export: Customer can export all data via CSV, Excel, or the API before termination
• Deletion: Deleting a workspace removes the entire tenant schema and all associated data from the database
• File attachments stored in S3 are deleted when the workspace is removed

Papereg will make available to the Customer the information necessary to demonstrate compliance with data processing obligations. This includes:

• This DPA and the Security page as current documentation of measures in place
• The Security Questionnaire as a summary of our security posture
• Audit logs accessible through the platform and compliance reports

On-site audits are not available at this time. For additional information requests, contact us at privacy@papereg.com.