Data processing agreement
Last updated 29 October 2026
This agreement is between the company that runs a Pledge workspace, the controller, and Ur Solutions AS (org. no. 822 634 192), the processor. It applies whenever we process personal data in the workspace for you, and it is part of our terms of service. If it conflicts with the terms, this agreement wins for personal data.
1. What we process
| Purpose | Running Pledge for you: storing, showing, sending and signing contracts, tracking time and plans, handling leads, AI features you use, support |
| Data subjects | Your users, your clients and their contacts, signers, people in your team, leads |
| Kinds of data | Names, email addresses, phone numbers, job titles, company details, contract content, signatures with time, IP address and browser, hours and bookings, time off, comments, files, AI chat messages |
| Special categories | None expected. Do not put health, union or other special category data in Pledge unless you have a lawful basis and need to |
| Duration | As long as the workspace uses Pledge, plus the deletion period in section 8 |
2. Your instructions
We process the data only on your documented instructions. These terms, the settings you choose in Pledge, and what your users do in it are your instructions. If we think an instruction breaks data protection law, we tell you. If the law makes us process the data in another way, we tell you first unless the law forbids it.
3. Confidentiality
Everyone at Ur Solutions who can reach your data is bound to keep it confidential, and only those who need it to run or support Pledge have access.
4. Security
We keep appropriate technical and organisational measures in line with article 32, including:
- encryption in transit (TLS) and at rest;
- strict separation of workspaces in the application and the database;
- passkey and email sign-in, and roles for owners, admins and members;
- sealed signatures and audit trails so changes to signed contracts can be detected;
- backups with point-in-time recovery;
- access to production limited to named people, and a log of security events.
We may improve these measures, but never so they protect your data less.
5. Sub-processors
You give us general authorisation to use the sub-processors on our sub-processors page. We will tell workspace owners by email at least 30 days before we add or replace one. You can object on reasonable data protection grounds. If we cannot meet the objection, you may end the agreement before the change takes effect.
We bind each sub-processor to data protection terms that are at least as protective as these, and we remain responsible to you for their work.
6. Transfers out of the EEA
Some sub-processors are in the United States. We only transfer data under the EU–US Data Privacy Framework, the EU’s standard contractual clauses, or another valid basis under GDPR chapter V.
7. Helping you
We help you, as far as we reasonably can, to answer requests from data subjects, to keep data secure, to assess data protection impact and to consult Datatilsynet. Much of this you can do yourself in Pledge: export, correct and delete data. Help that takes significant work may be charged at our normal rates.
We tell you without undue delay, and within 48 hours where possible, after we become aware of a personal data breach affecting your workspace. We give you what you need to report it.
8. Deletion and return
You can export your contracts and data at any time. If you delete the workspace yourself, the data is deleted at once and is gone from backups when they roll over, which takes up to 7 days. If the agreement ends another way, you have 30 days to export, and we then delete the data the same way. We keep data longer only if the law requires it.
9. Audits
We make available the information you need to show that we meet article 28. You may audit us, or have an independent auditor bound to confidentiality do it, once a year with 30 days’ notice, at your cost. We first try to answer through written questions and documentation.
10. Liability
The limits of liability in the terms apply to this agreement, as far as GDPR article 82 allows.