Data-processing terms

Roles

The customer ordinarily determines the purpose and means of the signing workflow and remains responsible for the documents, recipients, lawful basis, instructions and retention decision. LulaSign processes customer content to provide and secure the service, subject to the service terms and documented instructions.

Customer instructions

Document upload, recipient configuration, sending, retention settings, evidence requests and authorised support actions form part of the customer’s instructions. LulaSign may refuse an instruction that is unlawful, insecure or outside the service.

Confidentiality and access

Access is limited according to role and operational need. Customer workspace roles remain separate from internal LulaSign administration. Restricted evidence access should be purpose-bound and recorded.

Security controls

LulaSign uses access controls, protected authentication, operational logging, backups, monitoring and incident-response processes. The exact controls available to a customer can depend on the deployed environment and agreed configuration. Contact LulaSign before relying on a specific security, hosting or compliance requirement.

Subprocessors

LulaSign may use approved providers for hosting, databases, object storage, communications, payments and monitoring. See subprocessor information.

Incidents

LulaSign maintains an incident-response and escalation process. Where an incident affects customer personal information, notification and cooperation will follow the applicable contract and law.

Return and deletion

Customer content is returned through the product’s download and delivery functions and deleted according to the selected retention policy, legal holds and operational backup controls. See retention.

Audit and assistance

LulaSign will provide reasonable information about the service controls and assist with relevant data-subject or regulator requests according to the customer agreement, security requirements and proportionality of the request.