Signly: GDPR Privacy Notice

This notice provides additional information for individuals located in the European Economic Area and the United Kingdom regarding how personal information is processed when using the Signly service and should be read together with the Signly Privacy Policy.

Data controller Signly is operated by Kevin Joseph, a sole trader established in the United Kingdom and trading as "Signly". Kevin Joseph acts as the data controller for personal information processed in connection with account administration, service operation, billing, communications, and security. Data protection enquiries may be directed to support@signly.io.

Data protection officer Signly has not appointed a data protection officer, as it is not required to do so under applicable data protection law. All data protection enquiries may be directed to support@signly.io.

Controller and processor roles For account information, billing data, service usage, communications, and security monitoring, Signly acts as a data controller. For documents, signer information, and audit records processed through the service on behalf of customers, Signly acts as a data processor, with the customer acting as the data controller responsible for determining the purposes and lawful basis of processing.

Legal bases for processing Personal information is processed where necessary to perform a contract, comply with legal obligations, protect the security and integrity of the service, or pursue legitimate interests that are not overridden by the rights and interests of individuals. In limited cases, consent may be relied upon where optional information is provided voluntarily.

Right to withdraw consent Where processing is based on consent, individuals may withdraw their consent at any time by ceasing use of the relevant feature or by contacting the customer or Signly as appropriate. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Categories of personal information Personal information may include names, email addresses, contact details, technical identifiers, timestamps, internet protocol addresses, usage data, document metadata, signer identifiers, and information associated with document transactions, account administration, billing, fraud prevention, and security monitoring.

Mandatory and optional information Certain personal information is required to create an account, send or sign documents, and operate the service. Failure to provide such information may prevent use of the service. Other information may be provided voluntarily.

Sharing and international transfers Personal information may be shared with essential service providers acting under contractual obligations and confidentiality requirements. Signly primarily stores and processes personal information within the United Kingdom and the European Union. Where personal information is transferred outside the United Kingdom or European Economic Area, appropriate safeguards such as standard contractual clauses or equivalent lawful transfer mechanisms are applied.

Retention Personal information is retained only for as long as necessary to fulfil the purposes for which it was collected or to comply with legal and regulatory obligations. Draft documents and account data are deleted or anonymised following verified data subject requests, subject to cooling-off periods and legal hold requirements. Signed documents and associated audit records are retained for evidential, contractual, and compliance purposes for up to seven years, after which they are deleted unless further retention is required by law. Audit records retained after deletion requests are pseudonymised to remove direct personal identifiers.

Right to erasure and limitation Individuals may request deletion of personal information in accordance with applicable data protection law. Where erasure is requested, Signly deletes or anonymises personal information unless retention is required to comply with legal obligations, establish or defend legal claims, or preserve the integrity and evidentiary value of executed contracts. In such cases, data is restricted or pseudonymised rather than erased.

Automated decision making Signly does not carry out automated decision making or profiling that produces legal or similarly significant effects on individuals within the meaning of applicable data protection law.

Your rights Individuals have the right to request access to their personal information, request correction or deletion, object to or restrict processing, request data portability where applicable, and lodge a complaint with the UK Information Commissioner's Office or another competent supervisory authority in the European Economic Area.

Updates This notice may be updated from time to time to reflect changes in the service or applicable law.