Skip to content

Quick links

  • Product overview
  • Secure spaces
  • Campaigns
  • Portals
  • Security
  • Pricing

TipPut a phrase in quotes to search for it exactly.

↑↓navigateEnteropenEscclose

Request a demo

Data Processing Agreement (DPA)

Last updated:

This DPA is accepted by the Client upon acceptance of the Terms and Conditions on wearenestor.com. A formal signed version is available on request at contact@wearenestor.com

Version 1.1 - 19 October 2026

1. Parties

This Data Processing Agreement (hereinafter "DPA") is entered into between:

Paprwork SAS, a simplified joint-stock company registered under SIRET number 848 815 437 00027, with its registered office at 82 rue Winston Churchill, 59000 Lille, France (hereinafter "Paprwork" or the "Processor"),

AND

Any legal or natural person using the Nestor / Paprwork Services, as identified in the Terms and Conditions (hereinafter the "Client" or the "Controller").

2. Subject Matter and Duration

This DPA sets out the conditions under which Paprwork processes personal data on behalf of the Client in connection with the provision of Nestor services (secure document exchange platform, electronic signature, archiving).

This DPA enters into force upon acceptance of the Terms and Conditions and terminates upon expiration or termination of the service agreement.

3. Nature of Processing

In connection with the Services, Paprwork processes the following personal data on behalf of the Client:

  • Identification data of recipients: name, surname, email address
  • Connection data: access logs, timestamps, IP addresses
  • Documents transmitted by the Client and its recipients
  • Data collected through forms configured by the Client
  • Electronic signature data (if feature enabled): name, email, OTP, audit trail

The nature, purpose and categories of data subjects are defined in Paprwork's Record of Processing Activities, available upon request.

4. Obligations of Paprwork (Processor)

Paprwork undertakes to:

  • Process personal data only on documented instructions from the Client, unless required to do so by applicable law
  • Ensure the confidentiality of personal data and impose this obligation on any person authorised to access such data
  • Implement appropriate technical and organisational measures to ensure data security (TLS 256-bit encryption, hosting in France on fully sovereign European infrastructure, certified ISO 27001 and HDS by the hosting provider, individual access logging)
  • Not engage any sub-processor without prior notice to the Client, and impose the same data protection obligations on any sub-processor
  • Notify the Client without undue delay upon becoming aware of a personal data breach
  • Assist the Client in responding to data subject rights requests
  • Make available to the Client all information necessary to demonstrate compliance with this DPA
  • Delete or return all personal data upon termination of the service, at the Client's choice

5. Obligations of the Client (Controller)

The Client undertakes to:

  • Provide Paprwork with lawful and documented instructions regarding the processing of personal data
  • Ensure that data subjects have been informed of their rights, notably through Paprwork's Terms and Conditions
  • Obtain any necessary consents (in particular for data collected through forms)
  • Not transmit special categories of personal data (within the meaning of Article 9 GDPR) to Paprwork without prior written agreement

6. Sub-processors

The Client authorises Paprwork to engage the sub-processors listed below. Paprwork shall inform the Client of any intended changes and give the Client the opportunity to object.

Current sub-processors:

  • OVHcloud - Cloud hosting (France, ISO 27001 / HDS)
  • Tipimail - Email delivery (France)
  • Mailjet - Email delivery (EU, ISO 27001)
  • Scaleway - Email delivery (France, ISO 27001)
  • Yousign - Electronic signature (France, eIDAS) - if feature enabled

7. International Data Transfers

Personal data is hosted in France, on fully sovereign European infrastructure. Where data is transferred outside the European Union, Paprwork shall implement appropriate safeguards in accordance with the GDPR (Standard Contractual Clauses approved by the European Commission).

8. Security

Paprwork implements the following security measures:

  • Data encryption in transit (TLS 256-bit)
  • Hosting in France on fully sovereign European infrastructure, certified ISO 27001 and HDS by the hosting provider
  • Strictly limited and individual access to data, with access logging
  • Professional user authentication by password, magic link, one-time code received by email, or single sign-on (SSO, SAML 2.0 or OpenID Connect)
  • Recipient sign-in by magic link or code received by email, or with a Google or Microsoft account
  • Two-factor authentication with a passkey, which each user can turn on
  • Single-use magic links expiring after 30 minutes

9. Data Subject Rights

Paprwork shall assist the Client in responding to data subject rights requests (access, rectification, erasure, portability, objection, restriction). The Client remains responsible for handling such requests within the statutory deadlines (1 month, Article 12 GDPR).

Data subjects may contact Paprwork's data protection officer at: dpo@wearenestor.com

10. Personal Data Breaches

In the event of a personal data breach, Paprwork shall notify the Client without undue delay, and at the latest within 72 hours of becoming aware of it, in order to enable the Client to fulfil its notification obligations to the relevant supervisory authority.

11. Audit

Paprwork shall make available to the Client all information necessary to demonstrate compliance with this DPA. The Client may, at its own expense and upon reasonable notice, appoint an independent auditor to verify Paprwork's compliance, limited to once per year.

12. Term and Termination

Upon expiration or termination of the service agreement, Paprwork shall delete or return all personal data processed on behalf of the Client, in accordance with the Client's instructions, within 30 days.

13. Formal Signed Version

This DPA is accepted by the Client upon acceptance of the Terms and Conditions on wearenestor.com. Upon the Client's express request, a formally executed version may be prepared. For any such request: contact@wearenestor.com

14. Governing Law

This DPA is governed by French law. In the event of a dispute, the parties shall seek an amicable resolution. Failing that, the competent courts of Lille shall have jurisdiction.