Signly: Sub-Processor Disclosure

Introduction This Sub-Processor Disclosure identifies the third-party service providers that process personal data on behalf of Signly ("Signly", "we", "us", "our"). Signly is operated by Kevin Joseph, a sole trader established in the United Kingdom and trading as "Signly". These service providers support essential infrastructure, hosting, storage, database operations, email delivery, and platform functionality required for the Signly electronic signature service. Each sub-processor processes personal data only as necessary to provide its specific service to Signly and is contractually required to maintain appropriate confidentiality, security, and compliance measures.

Use of Sub-Processors Signly engages sub-processors to support the technical and operational delivery of the platform. Sub-processors are permitted to process personal data solely to provide their services to Signly and may not use the data for any other purpose. Signly remains responsible for ensuring that sub-processors provide a level of protection consistent with applicable data protection laws.

International Transfers Where a sub-processor is located outside the United Kingdom or the European Economic Area, Signly ensures that appropriate safeguards are in place, including Standard Contractual Clauses, the UK Addendum, or equivalent lawful transfer mechanisms. This includes sub-processors operating in the United States.

Customer Rights and Objections Customers provide general authorisation for Signly to engage sub-processors. Customers may object to a new sub-processor only where they have reasonable and legitimate grounds relating to data protection. If an objection cannot be resolved, the customer may terminate use of the Service as their sole remedy.

Sub-Processor Categories The following categories of sub-processors are currently used by the Signly service: Cloud infrastructure and storage providers that host the Signly platform environment and store documents, audit logs, and operational data. Database service providers that store and manage user account data, document metadata, audit records, and platform activity. Email delivery service providers that send platform-generated communications, including signature requests, reminders, verification emails, and notifications. Orchestration and deployment service providers that handle platform hosting, deployment automation, environment management, and operational infrastructure.

Sub-Processor List The following service providers currently process personal data on behalf of Signly: Amazon Web Services (AWS), Region: London (eu-west-2), Purpose: Cloud infrastructure, hosting, compute, networking, and encrypted storage of documents and audit records, Notes: Infrastructure-only provider, no access to document content. MongoDB Atlas, Region: London (eu-west-2), Purpose: Managed database services for user accounts, document metadata, audit logs, and operational platform data, Notes: Stores metadata only, no access to document contents. Postmark (ActiveCampaign, LLC), Region: United States (protected by SCCs and UK Addendum), Purpose: Delivery of email communications including signature requests, reminders, verification emails, and notifications, Notes: Processes only recipient email addresses, message content necessary for delivery, and activity metadata. Emergent, Region: European Union, Purpose: Hosting, deployment orchestration, environment management, continuous integration and delivery, and secure operational infrastructure, Notes: Processes operational data required to run and maintain the platform, no access to document content.

Future Changes Sub-processors may change as the service evolves. Any material updates to this list will be reflected in later versions of this disclosure. Where required, Signly will notify customers of updates in advance to allow reasonable review and any permitted objections.