Siglane
Data Processing Addendum
This Data Processing Addendum ("DPA") governs IV-Lead's processing of Customer Personal Data on behalf of a connected organisation.
Last updated: 31 October 2026
Siglane was previously named IV-LEAD Email Signatures. An acceptance recorded before this version refers to the Service by that name and to the document version in force at that time, not to this version.
1. Scope and incorporation
This DPA forms part of the Siglane Terms of Service. It applies where Chen Yehoshua, trading as IV-Lead ("IV-Lead"), processes Customer Personal Data on behalf of the organisation that connected the HubSpot app ("Customer").
This DPA does not apply to processing for which IV-Lead acts as an independent controller: IV-Lead's own service administration, terms-acceptance evidence, its security audit log and security-incident records, erasure records, infrastructure security, support correspondence and legal compliance, each as described in the Privacy Notice. Records that IV-Lead keeps to operate a Customer's team signature designs and personal copies, including the copy and click records described in the Privacy Notice, are Customer Personal Data even though they also help secure the Service.
2. Definitions
"Customer Personal Data" means personal data processed by IV-Lead on Customer's behalf to provide the connected app, including personal data read from Customer's HubSpot user records, rollout records, saved signatures, shared team designs and their versions, recipient assignments and dismissals, and the related team copy and click records described in section 4. It does not include processing for which IV-Lead acts as an independent controller, as described in section 1 and the Privacy Notice. "Data Protection Law" means the privacy and data-protection law applicable to the relevant processing, including the GDPR or UK GDPR where applicable. "Controller", "processor", "personal data", "processing", and "personal data breach" have the meanings given by applicable Data Protection Law.
3. Roles and documented instructions
Customer is controller and IV-Lead is processor for Customer Personal Data. Customer instructs IV-Lead to process Customer Personal Data only as necessary to provide, secure, support, and terminate the connected app in accordance with the Terms, this DPA, Customer's authorised use of the Service, and any additional lawful written instruction accepted by IV-Lead.
Customer is responsible for informing its users, in the manner and within the time required by the law that applies to Customer, that a team signature design has been shared with them and about the related processing described in the Privacy Notice, before or promptly after instructing IV-Lead to store the sharing, and in any case within one month where Customer is established in the EEA. Customer gives that notice on its own behalf and, where applicable, on IV-Lead's behalf as the transferring entity. The line the Service shows a user on first opening a shared design is supplementary and does not replace Customer's notice.
IV-Lead will inform Customer if, in IV-Lead's reasonable opinion, an instruction infringes applicable Data Protection Law, unless law prohibits that notice. IV-Lead may suspend the affected processing while the parties resolve the issue.
Customer is responsible for the lawfulness of its instructions, its HubSpot data, its notices to workers, and its legal basis for the processing.
4. Processing details
| Subject matter | Providing a company-standard email-signature generator, a rollout view, and shared team signature designs connected to Customer's HubSpot account. |
|---|---|
| Duration | For the connection period and the limited deletion and security-retention periods stated in the Privacy Notice. |
| Nature and purpose | Retrieve the permitted HubSpot user roster; distinguish active from deactivated users so that rollout totals count only active users; prefill a user's own name, work email address, job title, and - where the optional scope is granted - that user's own personal meeting link, as editable defaults; verify account membership and super-admin status; apply Customer's brand kit; retrieve publicly available brand details from a web address a user supplies, transiently, to propose editable defaults; store per-user rollout status under HubSpot user ID; store signatures a user has chosen to save, encrypted at rest, so they can be reopened, edited, and regenerated when the brand kit changes; show authorised rollout information; store team signature designs shared by Customer's super admin and the HubSpot user IDs of the users they are shared with; show each recipient a private preview of the design with that user's own details; store a personal copy only when that user chooses to add it, together with an encrypted comparison baseline used to review later updates, keep the user's edits and check that an update applies to the copy the user reviewed; keep records of adds, updates and dismissals so that the five-signature limit, updates and deletions behave as described in the Privacy Notice; secure, troubleshoot, and terminate the connected service. |
| Data subjects | Customer's HubSpot users, typically employees and contractors. |
| Data categories | HubSpot user ID; work name, work email address, activation status, job title where set, and personal meeting link where the optional scope is granted, processed transiently for prefill; language, template, renderer version, email-client choice, generated or confirmed state, confirmation time, and self-test status; where a user saves a signature, the signature fields that user entered - name, job title, company, work email address, telephone number, website, postal address, meeting link and label, additional call-to-action links and their labels, image URLs, credential badges, and social links - stored encrypted under that user's HubSpot account and user ID; team signature designs (design name and title, layout settings including an optional font, the meeting-link style and label, and additional link labels and addresses, the free-text fields among them able to identify people, a frozen copy of the brand kit, renderer version, sharing admin's HubSpot user ID, confirmation text version, timestamps); design assignments (recipient HubSpot user IDs, version, dismissal records); for personal copies made from a team design, the design reference, an encrypted comparison baseline containing the team values and the personal fields used for that copy, identifiers, revision numbers, digests and timestamps, and click records (identifier, action, version, digests, outcome, time); account and team information needed to verify access. |
| Special-category or highly sensitive data | Not required or intended. Customer must not instruct IV-Lead to process such data through the Service. |
5. Confidentiality and personnel
IV-Lead will ensure that any person authorised to process Customer Personal Data is bound by an appropriate duty of confidentiality and receives access only as needed for the Service, security, support, or legal obligations.
6. Security
Taking account of the nature, scope, context, and purposes of the processing, IV-Lead will maintain reasonable technical and organisational measures designed to protect Customer Personal Data. The current measures include:
- HTTPS for data in transit;
- authenticated encryption of HubSpot OAuth tokens at rest;
- hashed, short-lived OAuth state and builder launch tokens, with single-use launch tokens;
- least-privilege HubSpot access using two required read-only scopes and one optional read-only scope;
- server-side verification of account membership and super-admin status, re-confirmed with HubSpot on a bounded schedule rather than only when a session begins, so that removal or deactivation ends access within hours rather than persisting for the life of a signed session; session revocation that applies to every device a person is signed in on;
- tenant isolation based on the verified session rather than browser-supplied account input;
- sandboxed signature previews;
- security audit logging that is designed not to contain raw OAuth tokens or signature content; and
- automated testing of tenant isolation, including cross-tenant replay attempts.
The organisational measures include: a single named individual accountable for security decisions; a written non-disclosure agreement in place before any contracted specialist is given access to Customer systems or data; access granted per engagement, scoped to what the specific task requires, time-limited, and withdrawn when the engagement ends; a documented offboarding step that removes access and confirms return or deletion of Customer material; and change control under which production changes are version-controlled, reviewed, and pass an automated test suite before deployment. IV-Lead may update security measures where the overall level of protection is not materially reduced.
7. Subprocessors
Customer gives general authorisation for IV-Lead to use the subprocessors listed below for Customer Personal Data:
| Subprocessor | Service | Processing location |
|---|---|---|
| Cloudflare, Inc. | Application hosting, database, request handling, security observability, and database recovery | Cloudflare infrastructure, including global network routing; the application database is located in Cloudflare's Eastern Europe region. Cloudflare is certified under the EU-U.S. Data Privacy Framework (with the UK extension) and its data processing addendum incorporates the EU Standard Contractual Clauses where they apply. |
HubSpot is Customer's selected platform and the source from which Customer directs the app to retrieve roster data. Google Workspace is used for support correspondence for which IV-Lead acts as controller; neither is listed above as a subprocessor of the core Customer Personal Data processing.
IV-Lead will require a subprocessor to protect Customer Personal Data under written terms that provide materially equivalent data-protection obligations. IV-Lead remains responsible for the subprocessor's performance of those obligations to the extent required by applicable law.
IV-Lead will provide at least 14 days' notice before appointing a new subprocessor that will process Customer Personal Data, through an in-app notice to connected accounts and an update to this page. Customer may object on reasonable data-protection grounds during that period. If the parties cannot resolve the objection, Customer may terminate the affected processing by disconnecting the app.
8. Assistance with data-subject requests and compliance
Taking account of the nature of the processing and information available to IV-Lead, IV-Lead will reasonably assist Customer with:
- responding to requests to exercise data-subject rights;
- security obligations, breach assessment and notification;
- data-protection impact assessments and prior consultation where legally required; and
- demonstrating compliance with applicable processor obligations.
If IV-Lead receives a request concerning Customer Personal Data, IV-Lead will direct the requester to Customer unless law requires IV-Lead to respond directly, and will notify Customer where permitted.
9. Personal data breaches
IV-Lead will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will provide further information in stages as it becomes available. Where reasonably practicable, the initial notice will be provided within 48 hours; that aim does not qualify the obligation to notify without undue delay. The notice will include available information reasonably required for Customer to assess and meet its legal obligations. IV-Lead's notice is not an admission of fault or liability.
10. Deletion and return
On disconnect, IV-Lead destroys usable HubSpot OAuth credentials and blocks further HubSpot access. IV-Lead will delete Customer Personal Data from the live application database within the periods stated in the Privacy Notice, unless Customer requests earlier verified deletion or applicable law requires retention.
Cloudflare point-in-time recovery may contain earlier copies for up to 7 additional days after live deletion. Such copies are isolated for disaster recovery and age out automatically.
On Customer's verified written request made before disconnect or within the deletion window stated in the Privacy Notice, IV-Lead will provide Customer with a copy of the stored Customer Personal Data held for Customer's account in the following categories, in a structured, machine-readable file, within 30 days of verification: team signature designs and their versions, recipient assignments and dismissals, personal copies made from team designs with their records, and each user's saved signatures. Brand-kit values can be read in the app's own settings at any time. IV-Lead does not provide a return of transient roster names or work email addresses because those fields are not persisted; Customer retains the source data in HubSpot. Before disconnecting, each of Customer's users can also open their own saved signatures in the app and copy them.
11. Audit information
On reasonable written request, IV-Lead will provide information reasonably necessary to demonstrate compliance with this DPA. Customer must first use available documentation and remote evidence. Any additional audit must:
- be limited to once in any 12-month period unless a confirmed breach or regulator requires otherwise;
- give at least 30 days' notice where practicable;
- occur during reasonable hours without disrupting the Service or exposing another customer's data or confidential information;
- be performed by an independent qualified auditor bound by confidentiality; and
- be paid for by Customer unless the audit identifies material non-compliance by IV-Lead.
12. International transfers
IV-Lead is established in Israel, which the European Commission recognises as providing an adequate level of data protection. Where Customer Personal Data is transferred onward to a country that requires an additional transfer mechanism, IV-Lead will rely on an applicable lawful safeguard, including relevant provider contractual safeguards and the European Commission's Standard Contractual Clauses where applicable.
Israel is recognised as providing adequate protection under the GDPR (European Commission decision 2011/61/EU, maintained on review in January 2024) and under the UK GDPR. Where a Customer established in the EEA or the UK connects the app, this DPA is intended to satisfy Article 28(3) of the GDPR or the UK GDPR as between Customer and IV-Lead.
13. Liability and order of precedence
The Terms' limitations and exclusions of liability apply to this DPA to the fullest extent permitted by law. Nothing in this DPA limits rights that cannot lawfully be limited.
If this DPA conflicts with the Terms on Customer Personal Data, this DPA controls. Mandatory Data Protection Law always controls.
14. Contact
Data-processing questions and instructions: support@iv-lead.com.