Version 1, in force from 2026-10-29. Published at https://trustbeat.eu/legal/dpa and\nincorporated by section 5.8 of the Terms of Service. It applies automatically to every customer who uses\nSignature Preservation; a customer that needs a countersigned copy can sign it as is. Language: English; a\ntranslation, if any, is informative.
Between
\nthe customer who holds a TrustBeat account and uses Signature Preservation (the "Controller"), and
\nTrustbeat s.r.o., Company ID (IČO) 24888648, VAT ID CZ24888648, registered office Korunní 2569/108,\nVinohrady, 101 00 Praha 10, Czech Republic, entered in the Commercial Register kept by the Municipal Court in\nPrague (Městský soud v Praze), section C, file 444524 (the "Processor", "TrustBeat").
\n1.1 The Processor processes personal data on behalf of the Controller when providing Signature\nPreservation under the Terms of Service (the "Service"): preservation of the digital signatures the\nController submits, with their validation data, under the preservation profile\nhttps://trustbeat.eu/preservation/profile/pds-wst-v1.
1.2 This agreement applies for as long as the Processor holds personal data submitted by the Controller\nthrough the Service — that is, until the end of the preservation period of the Controller's last record\nplus 30 days (Terms §5.6), even after the Controller's account or subscription has ended.
\n1.3 Other TrustBeat services (Document Anchoring, Tamper-Evident Logs, AI Decision Anchoring, Audit Trail)\naccept hash values only; TrustBeat does not process personal data on the Controller's behalf in them, and\nthis agreement does not apply to them. Account, billing and usage data of the Controller are processed by\nTrustBeat as controller, under its Privacy Policy.
\n| \n | \n |
|---|---|
| Nature | \nReceiving, validating, storing, time-stamping, renewing the evidence of, and making available to the Controller, signatures taken out of the Controller's signed files by the Controller's own extractor. The signed files themselves are never received. | \n
| Purpose | \nPreserving proof of the existence and validation status of the signatures for the preservation period, so that the Controller can establish, exercise or defend legal claims and meet retention obligations. | \n
| Categories of data subjects | \nSigners of the documents the Controller preserves (natural persons signing or sealing on their own or an organisation's behalf); persons named in certificates of certification authorities or time-stamping units (rare). | \n
| Categories of personal data | \nData in the signers' certificates: name, and as the certificate holds them, personal identification number or other identifier, email address, organisation, role, country; certificate serial numbers and validity; certificate status information (OCSP responses, CRLs) concerning those certificates; signing time; names, sizes and digests of the signed files as the Controller's extractor reports them (file names may contain personal data — the Controller chooses them). Any personal data in the signature's signed attributes (for example a signer role or commitment). No special categories (Art. 9) are intended; the content of the signed documents is never received. | \n
| Retention | \n30 years from each submission (or as agreed in writing), then 30 days; earlier when the Controller deletes a record (§9). | \n
| Location | \nEuropean Union only (Germany: hosting; France: encrypted backups). | \n
3.1 The Processor processes the personal data only on documented instructions from the Controller,\nincluding with regard to transfers to third countries, unless required to do so by Union or Member State law;\nin that case it informs the Controller before processing unless that law prohibits it.
\n3.2 The Terms of Service, the preservation profile pds-wst-v1, the signature validation policy, the\npreservation evidence policy and the practice statement (published at trustbeat.eu/preservation), the\nController's submissions through the Service, and this agreement are the Controller's complete instructions.\nIn particular the Controller instructs the Processor to keep each record for its full preservation period\nunless the Controller deletes it earlier (§9).
3.3 The Processor informs the Controller immediately if, in its opinion, an instruction infringes the GDPR or\nother data protection law.
\nThe Processor ensures that persons authorised to process the personal data have committed themselves to\nconfidentiality or are under an appropriate statutory obligation of confidentiality. Access is limited to\nthe persons who operate and support the Service.
\nThe Processor implements the technical and organisational measures in Annex 2 and keeps them appropriate to\nthe risk. It may change them provided the overall level of security is not reduced.
\n6.1 The Controller gives general authorisation for the sub-processors listed in Annex 3.
\n6.2 The Processor informs the Controller by email at least 14 days before adding or replacing a\nsub-processor that processes personal data under this agreement. The Controller may object on reasonable\ndata-protection grounds within that period; if the parties cannot resolve the objection, the Controller may\nstop submitting new records. Records already submitted stay preserved under the sub-processors then in place.
\n6.3 The Processor imposes on each sub-processor, by contract, data protection obligations at least\nequivalent to those in this agreement, and remains liable to the Controller for its sub-processors.
\n6.4 Not sub-processors: the qualified time-stamping authorities (they receive only a digest, which is not\npersonal data), and the certification authorities whose OCSP responders and CRL distribution points the\nProcessor queries to validate a signature (each acts as an independent controller of its own status service;\nthe query reveals to it only which of its own certificates is checked).
\n7.1 The Processor forwards to the Controller, without undue delay, any request it receives from a data\nsubject concerning data processed under this agreement, and does not answer it itself except to refer the\ndata subject to the Controller.
\n7.2 The Processor assists the Controller with appropriate technical and organisational measures: the\nController can retrieve, at any time, every record and its full content (GET /v1/signature-preservation,\nGET /v1/signature-preservation/{id}/package) to answer requests for access or portability. Requests for\nerasure or restriction before the end of the preservation period are handled as in §9.
8.1 The Processor notifies the Controller without undue delay, and at the latest within 48 hours, after\nbecoming aware of a personal data breach affecting the Controller's data, with the information Art. 33(3)\nGDPR requires as far as available, and supplements it as it becomes available.
\n8.2 The Processor assists the Controller with data protection impact assessments and prior consultations,\ntaking into account the nature of the processing and the information available to it. Its own DPIA of the\nService is summarised for the Controller on request.
\n9.1 Deletion by the Controller. The Controller can delete any of its records at any time\n(DELETE /v1/signature-preservation/{id} or the portal). The Processor then deletes the Preservation\nEvidence Object, the stored signatures and the record without undue delay; only the SHA-256 of the\nPreservation Evidence Object remains, as a leaf of a hash tree shared with other customers' records, which\nis not personal data. Deletion is final. Where a data subject requests erasure, the Controller decides\nwhether an exception under Art. 17(3) GDPR applies (in particular point (e), legal claims, or point (b), a\nlegal obligation) and, if not, deletes the record.
9.2 At the end of the preservation period of a record, the Processor makes the record's export-import\npackage available to the Controller and deletes the record, its Preservation Evidence Object and the stored\nsignatures 30 days later (Terms §5.6). Encrypted backups made before the deletion are not trimmed on a\nschedule yet and may still contain it (Annex 2, backup retention).
\n9.3 If TrustBeat terminates the Service, the Controller receives the package of every record before\nthe stop date (practice statement §7); the records, Preservation Evidence Objects and stored signatures are\nthen deleted, including from backups. Any copy TrustBeat keeps to evidence its operation contains no\npersonal data processed under this agreement.
\n9.4 Ending the account or subscription does not end the preservation period and does not trigger deletion\n(Terms §5.6).
\n10.1 The Processor makes available to the Controller the information necessary to demonstrate compliance with\nArt. 28 GDPR, in particular this agreement, Annex 2, the published preservation documents, and on request a\nrecord of the actions performed on the Controller's records.
\n10.2 The Processor allows for and contributes to audits, including inspections, by the Controller or an\nauditor mandated by it, bound by confidentiality, with at least 30 days' notice, during business hours, at\nmost once a year unless a breach or a supervisory authority requires more. Each party bears its own costs;\naudits of the sub-processors are covered by their certifications and reports.
\nNo personal data processed under this agreement is transferred outside the European Economic Area.
\n12.1 Liability follows Art. 82 GDPR and, between the parties, the Terms of Service.
\n12.2 In a conflict between this agreement and the Terms of Service on the processing of personal data, this\nagreement prevails.
\n12.3 This agreement is governed by Czech law; the courts of the Czech Republic have jurisdiction, as in the\nTerms of Service.
\nSee §2.
\n| Area | \nMeasure | \n
|---|---|
| Data minimisation | \nThe signed files never reach TrustBeat (architecture: the extractor runs on the Controller's side and sends only signatures and digests; the server rejects any CMS that still carries signed content). No account identifier inside the Preservation Evidence Object. Signer data is not written to application logs. | \n
| Access control | \nRecords are released only to the authenticated account that submitted them (API key or portal session); the public endpoints serve only the evidence record over a digest. Administrative access to servers by SSH key only, limited to the operator. | \n
| Encryption in transit | \nTLS for every API and portal connection; TLS from the Processor to its sub-processors where offered. | \n
| Encryption at rest | \nBackups encrypted on the server before they leave it (restic, AES-256). | \n
| Integrity | \nPreservation Evidence Objects stored byte for byte; their SHA-256 time-stamped by an EU qualified TSA (RFC 4998 evidence record); a record is deleted only by its owner's request or at the end of its period, and every deletion is logged. | \n
| Availability and resilience | \nDaily backups to a second EU country (Scaleway, France) in versioned storage whose history production cannot erase; integrity checked weekly, full restore tested every three months; recovery point up to 24 hours. Backup retention: copies on the database server itself are kept 14 days; offsite backups have no fixed retention period yet and are kept until one is introduced, which will then be stated here. | \n
| Separation | \nEach record belongs to one account; every query is scoped to the authenticated account. | \n
| Logging | \nStructured logs of requests (request id, account id, record id), no signer data; kept 14 days in the central log service (Grafana Cloud). Caller IP addresses recorded with requests are deleted after 90 days. | \n
| Vulnerability management | \nDependencies pinned and audited in CI; operating system updates applied regularly. | \n
| Hosting | \nHetzner Online GmbH data centres in Germany, certified to ISO/IEC 27001:2022. | \n
| Organisation | \nConfidentiality commitments; written practice statement, security policy and termination plan, reviewed at least yearly. | \n
| Sub-processor | \nLocation | \nProcessing | \n
|---|---|---|
| Hetzner Online GmbH | \nGermany | \nHosting of the application and database servers | \n
| Scaleway SAS | \nFrance | \nStorage of encrypted database backups | \n