Signal Email — Data Processing Agreement (DPA)

Last edited on 5 June 2026

1. Parties and scope

1.1 This Data Processing Agreement (DPA) forms part of the Agreement between Signal (Signal Ocean Ltd and/or the contracting Signal entity identified in your Order, the "Processor") and the customer organisation that uses the Email Service (You / the "Controller").

1.2 This DPA applies where and to the extent Signal processes Controller Personal Data on the Controller's behalf in providing the Email Service. Where Signal determines the purposes and means of processing (for example, account, usage, log, security, and billing data), Signal acts as an independent controller and that processing is governed by the Privacy Policy, not this DPA.

1.3 In the event of conflict on data-protection matters, the order of precedence is: (a) this DPA; (b) the Privacy Policy; (c) the Terms of Use / Order.

2. Definitions

• "Data Protection Law" means all laws applicable to the processing of personal data under the Agreement, including the UK GDPR, the EU GDPR (Regulation 2016/679), the UK Data Protection Act 2018, and any implementing or successor legislation.
• "Controller Personal Data" means personal data within Email Data (and chat content) that Signal processes on the Controller's behalf in providing the Email Service, as further described in Annex 1.
• "Sub-processor" means any third party engaged by Signal to process Controller Personal Data.
• "Data Subject", "processing", "controller", "processor", "personal data breach", and "supervisory authority" have the meanings given in Data Protection Law.
• "SCCs" means the European Commission's Standard Contractual Clauses (Decision 2021/914); "UK IDTA" means the UK International Data Transfer Agreement / Addendum issued by the ICO.

3. Roles and processing details

3.1 The parties acknowledge that, for Controller Personal Data, You are the controller (or a processor acting on behalf of a third-party controller) and Signal is the processor.

3.2 The subject matter, duration, nature and purpose of the processing, the types of personal data, and the categories of data subjects are set out in Annex 1.

4. Processor obligations

Signal shall:

4.1 Documented instructions. Process Controller Personal Data only on the Controller's documented instructions (including as set out in the Agreement and as given through the Service's features), including with regard to international transfers, unless required to do otherwise by law — in which case Signal will, where legally permitted, inform the Controller first. Signal will inform the Controller if, in its opinion, an instruction infringes Data Protection Law.

4.2 Confidentiality. Ensure that persons authorised to process Controller Personal Data are bound by appropriate confidentiality obligations.

4.3 Security. Implement and maintain the technical and organisational measures set out in Annex 2 to ensure a level of security appropriate to the risk, taking account of Article 32 of the GDPR.

4.4 Sub-processors. Engage Sub-processors only in accordance with clause 5.

4.5 Assistance with data-subject rights. Taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures, insofar as possible, to respond to requests by data subjects exercising their rights. Where Signal receives such a request directly, it will (unless legally prohibited) promptly forward it to the Controller and not respond except on the Controller's instruction.

4.6 Assistance with compliance. Taking into account the nature of processing and the information available to Signal, assist the Controller in ensuring compliance with its obligations relating to security (Art. 32), personal data breach notification (Arts. 33–34), data protection impact assessments (Art. 35), and prior consultation (Art. 36).

4.7 Breach notification. Notify the Controller without undue delay after becoming aware of a personal data breach affecting Controller Personal Data, and provide information reasonably available to assist the Controller in meeting its breach-notification obligations. Security incidents may be reported to security@thesignalgroup.com.

4.8 Deletion or return. At the Controller's choice, delete or return all Controller Personal Data at the end of the provision of the Service, and delete existing copies, unless retention is required by law. Deletion timelines align with the Privacy Policy (Email Data deleted or de-identified within 30 days of account disconnection/deletion; residual backup copies expire on their normal cycle).

4.9 Records and audits. Make available to the Controller information reasonably necessary to demonstrate compliance with Article 28, and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor it mandates, subject to reasonable notice, confidentiality, frequency limits, and not compromising other customers' security. Signal may satisfy audit requests by providing its current certifications and third-party audit reports (e.g. ISO/IEC 27001) where these reasonably address the request.

5. Sub-processors

5.1 The Controller provides general written authorisation for Signal to engage Sub-processors to process Controller Personal Data. The Sub-processors engaged as at the date of this DPA are listed in Annex 3.

5.2 Signal will impose data-protection obligations on each Sub-processor that are no less protective than those in this DPA (flow-down), and remains liable to the Controller for the performance of each Sub-processor's obligations.

5.3 Signal will give the Controller reasonable prior notice of the addition or replacement of a Sub-processor (via the mechanism in Annex 3), giving the Controller the opportunity to object on reasonable data-protection grounds. If the parties cannot resolve a reasonable objection, the Controller may terminate the affected part of the Service as its sole remedy.

6. International transfers

6.1 Signal will not transfer Controller Personal Data outside the UK or EEA except where an appropriate safeguard under Data Protection Law is in place — such as an adequacy decision, the SCCs, or the UK IDTA, together with any supplementary measures required.

6.2 Where Signal or a Sub-processor processes Controller Personal Data outside the UK/EEA (see Annex 3 and Annex 4), the relevant transfer mechanism in Annex 4 applies, and the parties agree to enter into the SCCs / UK IDTA as necessary, which are incorporated by reference.

7. Liability, term, and general

7.1 Term. This DPA takes effect on the date the Agreement takes effect and continues for as long as Signal processes Controller Personal Data, after which clause 4.8 applies.

7.2 Liability. Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Use, to the extent permitted by law.

7.3 Governing law. This DPA is governed by the law and subject to the jurisdiction set out in the Terms of Use, except where Data Protection Law requires otherwise.

7.4 Changes. Signal may update this DPA to reflect changes in Data Protection Law, regulatory guidance, sub-processors, or the Service, provided such changes do not materially reduce the protections for Controller Personal Data.

Annex 1 — Details of processing

Annex 2 — Technical and organisational measures (security)

Signal applies measures appropriate to the risk, including (carry over and keep consistent with Privacy Policy §8):

• Encryption of data in transit (TLS) and at rest;
• Encryption and access control of OAuth tokens and credentials;
• Role-based access control, least-privilege access, and audit logging;
• Strict org-level data isolation across storage, database, real-time channels, and search indices;
• Network controls, monitoring, and vulnerability management;
• Secure software-development practices and change management;
• Regular penetration testing of the production environment;
• An information security management system certified to ISO/IEC 27001;
• Business continuity and backup measures, with backups expiring on their normal cycle.

Annex 3 — Authorised Sub-processors

Change-notice mechanism. Signal maintains a current list of Sub-processors and will notify the Controller of any intended addition or replacement of a Sub-processor by email to the Controller's designated administrator contact (and/or by updating the published Sub-processor list with an option to subscribe to change notifications), at least 30 days before the new Sub-processor begins processing Controller Personal Data. The Controller may object on reasonable data-protection grounds within that 30-day period in accordance with clause 5.3.

Annex 4 — International transfer mechanisms

Signal will complete the relevant SCC modules and the parties' details on execution where a customer requires a signed DPA.