Data Processing Agreement
Last updated: 24 September 2026 · version 2026-09-24
These terms govern our processing of personal data on your organisation's behalf. They form part of the Terms of Use and take effect when an administrator accepts them in the Sigil portal, or when we agree them with you in writing.
This is an agreement between your organisation and Tophhie Cloud Ltd, a company registered in England and Wales under number 17393069, whose registered office is at 21 Manor Way, Hoyland, Barnsley, England, S74 9QX ("we", "us").
1. Roles and scope
Your organisation is the controller of the personal data Sigil processes from your Microsoft 365 directory. Tophhie Cloud Ltd is the processor, acting only on your instructions. Where an MSP partner manages Sigil for you, that partner acts as your processor and we act as a sub-processor to them; the protections below still apply to your data.
In this agreement "data protection law" means the UK GDPR and Data Protection Act 2018, and the EU GDPR where it applies to your processing.
2. Subject matter, duration, nature and purpose
| Subject matter | Rendering, managing and reporting on email signatures for your organisation. |
|---|---|
| Duration | For as long as your organisation remains connected to the service, plus the deletion period in section 9. Cancelling a subscription does not by itself end the processing: your data is retained so that re-joining restores it (section 9). |
| Nature | Reading directory attributes, storing templates and images, rendering signature HTML, and recording metadata-only activity telemetry. |
| Purpose | To provide the Sigil service to you, and nothing else. We do not use your data to train models, to build profiles, or for advertising. |
Categories of data subject
- your personnel who have a Microsoft 365 mailbox in your tenant;
- your personnel who administer or edit within the Sigil portal.
Types of personal data
- Directory attributes, read from Microsoft Graph: name, job title, department, company, email address, telephone numbers, office and address, manager, photo, and any on-premises extension attributes your organisation populates.
- Content you supply: signature templates, compliance footers, campaign banners and uploaded images, which may contain personal data you choose to place in them.
- Activity metadata: which mailbox requested a signature, the template version served, the compose type, and whether the add-in applied it.
- Tracked-link clicks: the link clicked and when, plus a device class, browser family and referring host name derived at click time. No IP address, no recipient identity, and no raw user-agent or referring URL is retained. Per-click records are deleted after 90 days; daily totals are kept.
- Portal access records: the email address and role of each person you grant portal access, and a log of the changes they make.
What is out of scope
Sigil does not process the content of your users' email, the identities of their recipients, or rendered signature HTML in telemetry. It reads your directory and never writes to it. No special category data under Article 9 is requested by the service; if you place such data in a template or an extension attribute, you do so as controller and remain responsible for the lawfulness of doing so.
3. Our obligations as processor
- Documented instructions. We process personal data only on your documented instructions, which comprise this agreement, the Terms of Use, and the configuration you make in the portal. If we believe an instruction infringes data protection law we will tell you.
- Legal compulsion. If law requires us to process beyond your instructions, we will inform you before doing so unless that law forbids it.
- Confidentiality. Personnel authorised to process your data are bound by a duty of confidentiality that survives their engagement.
- Minimum access. Access to your data is limited to those who need it to operate or support the service.
4. Security
We implement appropriate technical and organisational measures under Article 32, including:
- encryption in transit (TLS) and encryption at rest for stored data;
- tenant isolation: every stored record is keyed to your tenant, and every request is authorised against it;
- authentication through Microsoft Entra ID, with role-based access within the portal that you control;
- read-only, least-privilege Microsoft Graph permissions granted by your own administrator, revocable by you at any time;
- an append-only change log of administrative actions, visible to you in the portal;
- segregation of duties between customer-facing portal access and platform operator access, with operator actions logged.
5. Sub-processors
You give general authorisation for the sub-processors below. We remain liable for their performance and impose data protection obligations on them no less protective than these.
| Sub-processor | Purpose | Location |
|---|---|---|
| Microsoft | Identity (Entra ID) and directory data (Microsoft Graph) | Your own tenant's region |
| Cloudflare | Application hosting, storage and caching | Stored data in the EU; cached copies on its global network |
| Stripe | Subscription billing and payment card processing | UK/EU and US |
We will give you at least 30 days' notice before adding or replacing a sub-processor. If you reasonably object on data protection grounds within that period, you may terminate the affected part of the service without penalty and receive a pro-rata refund of prepaid fees.
6. International transfers
Your directory data and content are stored in the United Kingdom or European Economic Area. To serve signatures quickly wherever your users are, Cloudflare also holds cached copies of rendered signatures, and of the directory details they are built from, on its global network. Those copies expire on their own and can sit outside the UK and EEA. That caching, and any transfer of personal data outside the UK or EEA by a sub-processor, is covered by an adequacy decision or by the UK Addendum to the EU Standard Contractual Clauses, which are incorporated into this agreement by reference where required.
7. Assisting you
- Data subject rights. Sigil gives your administrators direct access to the personal data it holds about a user, including an export of an individual's record, so most access and erasure requests can be answered without involving us. Where you need more, we will assist you, taking into account the nature of the processing.
- Requests sent to us. If a data subject contacts us directly about your data, we will not respond substantively; we will refer them to you and tell you promptly.
- DPIAs and consultation. We will provide reasonable assistance with data protection impact assessments and prior consultation under Articles 35 and 36.
8. Personal data breaches
We will notify you without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting your data. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where we cannot provide all of that at once, we will provide it in phases without further undue delay.
9. Return and deletion
You may export your templates, images and activity data at any time from the portal. Cancelling your subscription does not initiate deletion: your organisation's data (templates, images, cached signatures, activity telemetry and the tenant record) is retained so that, should you re-join, your signatures are restored exactly as you left them rather than rebuilt from scratch. Deletion is initiated on your request — from the portal, by asking an administrator in the platform console, or in writing to privacy@usesigil.app — and we will then delete that data within 30 days, except where law requires us to retain it. Backups are overwritten on their normal cycle, within 90 days, and remain protected by this agreement until then.
10. Audit
We will make available the information reasonably necessary to demonstrate compliance with Article 28, and will respond to a reasonable security questionnaire once in any twelve-month period. Where that is insufficient to satisfy a supervisory authority, you may audit us on 30 days' notice, no more than once a year unless a breach or a regulator requires otherwise, during business hours, subject to confidentiality, and without access to other customers' data.
11. Liability and precedence
Liability under this agreement is subject to the limits in the Terms of Use. Where this agreement conflicts with the Terms of Use on the processing of personal data, this agreement prevails. Where it conflicts with a separate signed data processing agreement between us, that signed agreement prevails.
12. Changes
We may update these terms. When the substance changes we will publish a new version and ask your administrator to accept it in the portal, so that the version you accepted is always on record. Changes that materially reduce your protections will be notified at least 30 days ahead.
Contact
Data protection enquiries: privacy@usesigil.app.