Privacy Notice

SignRequest Privacy Notice

Effective as of 21 April 2021, SignRequest, and its subsidiaries, (collectively, “SignRequest” or “we” or “us” or “our”) have updated our Sign Request Privacy Notice (“Privacy Notice).

 

SignRequest Privacy Notice

SignRequest B.V. ("SignRequest") is committed to protecting your privacy and personal information. SignRequest provides a secure electronic signature solution that enables customers to sign and send documents online. This Privacy Notice explains how information (including personal data as defined under GDPR) is collected, retained, used, disclosed, and transferred by SignRequest and the available choices you have with regard to your personal information. This Privacy Notice applies to information collected, used, or shared by SignRequest when you use or access our websites, products, or services (collectively, the “SignRequest Services).”  

‍

What Information Do We Collect and For What Purpose? 

SignRequest collects information in the following ways: 

1. Information You Provide

We collect the information you directly provide to SignRequest when register for and/or use the SignRequest Services. The types of information we may collect directly from you includes:

·     Full name

·     Contact information (address, phone, email)

·     Social media accounts

·     Personal life data (date of birth, marital status, gender, language)

·     Signature

·     Financial data

We also collect the information of third parties you provide to enable the functionalities and features of the SignRequest Service. For example, if you send a sign request to a third party, we will collect the name and email address of the third party you provide in order to provide the SignRequest Service.

2. Information We Collect Automatically

We collect information related to your usage of the SignRequest Services and the devices you use to access the SignRequest Services.

·     Device Information: When you use the SignRequest Service and website, your computer will automatically provide us with certain information about your computer hardware and software, such as IP addresses, operating system, browser type, location data provided by your browser, domain names, access times/timestamps and referring websites.

·     Usage Information: We monitor your activity in connection with the use of the SignRequest Services and collect information about the features you use and the SignRequest websites you visit.

·     Log Information: We log information about you when you access and use the SignRequest Services, including: your IP address, access times/timestamps, browser type, the SignRequest webpages that you visit, dates and signatures. All changes to the document initiated by you, such as text, dates and signatures, will be included in the signing log.

·     Information Collected by Cookies and Similar Tracking Technologies: We use cookies for a variety of purposes. In order to provide, maintain and improve the SignRequest Services, we and our third-party partners, vendors, or service providers may save cookies to your device. We may also utilize similar cookie technologies such as web beacons, tracking pixels, images, and scripts. For information on what cookies are, which ones we use, why we use them, and how you can manage their use, please see the “Use of Cookies” section below.  

Use of Information

SignRequest uses information collected for the purpose of providing the SignRequest Service. Your information may be used to perform a variety of purposes, such as:

·     Provide, operate, maintain, and improve the SignRequest Services;

·     Enable you to use and access the SignRequest Services;

·     Send you technical notices, updates, alerts, and support/administrative messages;

·     Respond to your comments, questions, and requests, and provide customer service and support; and

·     Communicate with registered SignRequest users about SignRequest features, newsletters, offers, promotions, and events, and provide other news or information about SignRequest and our select partners. 

Sharing and Disclosure of Information 

SignRequest may share information with (i) third party service providers working on our behalf; (ii) SignRequest users that have exchanged a signed document; and (iii) when necessary, to protect the security and safety of our users or when required bylaw or a legal process.

We may share information about you as follows:

·     Third Party Service Providers: We share information with third party service providers who are working on our behalf and require access to your information (e.g., to process billing or provide customer support). These service providers are authorized to use your information only as necessary to provide services to SignRequest and/or the SignRequest Services. For a list of approved SignRequest service providers, please see the “Our Subprocessors” section below. If you log into yourSignRequest account using Facebook, Google or other services, these services may share additional information about you in accordance with their privacy policy.

·     SignRequest Users Exchanging Signed Document: Use of SignRequest's Services implies that certain personal information is shared between users exchanging a signed document. After completing a signing process, SignRequest will send a signing log to both the user that initiated the signing process and to any users that have signed the document or are in another way related to the sign request. This signing log may contain names, email addresses, IP addresses and timestamps of all users involved, and may also contain certain additional information, such as location data or domain names. All changes to the document initiated by users, such as text, dates and signatures, will be included in the signing log. During the signing process, we may provide the users involved with information about the status of the signing process, such as whether a sign request has been delivered, viewed, downloaded and/or it has resulted in a signature. These events may also be included in the signing log.

·     Third Party Products: SignRequest provides you with opportunities to connect with third-party products or services. If you choose to use any third-party products or services, we may share certain information about you with such third parties. For more information on our integration partners, please refer our Integrations Page.

If you log into your SignRequest account using Facebook, Google or other services, these services may share additional information about you in accordance with their privacy policies.

This Privacy Notice does not apply to your use of such third-party applications and services, and SignRequest is not responsible for how these third parties collect, use, and disclose your personal information. We encourage you to review the privacy notices of this third parties before connecting to or using their applications or services to learn more about their information and privacy practices. 

·     Other Disclosure Obligations: We may disclose your information to a third party if:

o  We believe that disclosure is reasonably necessary to comply with any applicable law, regulation, legal process, or governmental request;

o  To enforce our agreements and policies with our customers;

o  To protect the security or integrity of the SignRequest Services;

o  To protect SignRequest, our customers, or the public from harm or illegal activities;

o  To respond to an emergency which we believe in good faith requires us to disclose information to assist in preventing death or serious bodily injury of any person; or

o  To any other third party with your prior consent.  

·     Business Transfers: We may share your information with our parent company, Box, Inc. (“Box”) and its respective affiliates in order to provide the SignRequest Service. To learn more about Box’s privacy policy, please view the Box Privacy Notice. For a full list of Box affiliates, please visit the Box Subprocessor Page.

SignRequest may transfer your information to jurisdictions with differing data protection laws. As a result, a copy of our standard Data Processing Addendum (DPA), incorporating Standard Contractual Clauses, is available here. 

Retention and Protection of Personal Information 

SignRequest is committed to securing your personal information. We take appropriate technical and organizational measures to help protect your personal data from loss, theft, misuse, and unauthorized access, disclosure, alteration, and destruction. SignRequest complies with applicable data protection, privacy, and security breach notification laws.

Some of the ways in which SignRequest protects your personal information includes:

·     Encrypting your personal information when it is stored at rest on our data centers.

·     Encryption of your personal information in-transit.

·     Limiting access to the servers on which personal information is stored. 

SignRequest will retain your personal information for the period necessary to fulfill the purposes outlined in this Privacy Notice and for as long as necessary for the fulfillment of the contract or as needed to provide you the SignRequest Services. We will also retain your information to comply with our legal obligations, resolve disputes, and enforce our agreements.
If you would like to learn more about the security measures we take to protect your personal information, please visit: SignRequest Security 

The Use of Cookies 

Cookies are small data files containing small amounts of information that are placed on your device when you visit a website.  

What Cookies Do We Use?

·     First-Party Cookies: We use first-party cookies when you access our site or utilize the SignRequest Service.

·     Strictly Necessary Cookies: Strictly necessary cookies are required for the SignRequest Service to operate.  

·     Functionality Cookies: Functionality cookies enhance the performance and functionality of the SignRequest Service.

·     Third-Party Cookies: We also use cookies created by third parties. Third-party cookies may be utilized for the purpose of digital analytics. For more information about how third party-party’s handle information collected by third-party cookies, please see their respective privacy policies.

The chart below describes the first-party and third-party cookies served through the SignRequest Service, including the third parties who serve them, their purpose, and how to manage your cookie preferences.

Cookie Type

Who Serves the  Cookie?

Cookie  Information and Management

Targeting

We use targeting cookies,  sometimes called “advertising cookies”, to provide our users and website  visitors with more relevant content. Please note, SignRequest does not use  targeting cookies in the SignRequest web Application. We utilize targeting  cookies solely on our marketing web pages.  

LinkedIn Ads

LinkedIn  Ads helps us track how users interact with the SignRequest website and  enables us to target ads on LinkedIn. 

More  information about LinkedIn Ads cookies can be found here. 

Facebook Pixel

Facebook  Pixel helps us track how users interact with the SignRequest website and  enables us to target ads on Facebook.  

More  information about Facebook Pixel can be found here. 

Twitter

Twitter  helps us track how users interact with the SignRequest website and enables us  to target ads on Twitter. 

More  information about Twitter cookies can be found here.

Youtube / Google

Youtube  / Google helps us track video player preferences when viewing an embedded  Youtube video on the SignRequest website.  

More  information about Google cookies, including how they are used and how you can  opt out, can be found here. You can directly opt out of Google Ad personalization at the  following link.

Functional

Functional cookies are used  to remember user preferences, settings, and other information that helps  SignRequest improve user experience. Please note, opting-out of these cookies  may impair your access to the SignRequest Service. 

SignRequest

SignRequest uses  cookies to remember preferences and settings, authenticate users, manage  sessions, maintain security, and determine if cookies are enabled.  Users cannot opt out of SignRequest functional cookies or they will be unable to access  or use the SignRequest Service. SignRequest utilizes the following Functional  cookies: 

·       session id

·       sr_device_id

·       sr_user_tags

·       _gat_UA-53751645-1

·       sr_uuid

Stripe

We use  Stripe to process credit card transactions. SignRequest utilizes the  following Stripe cookies:

·       _stripe_mid

·       _stripe_sid

More  information about Stripe cookies, including how they are used and how you can  opt out, can be found here.

Analytics

Analytics cookies,  sometimes referred to as “performance cookies”, collect information about how  people interact with SignRequest. SignRequest uses this information to  measure performance and improve the SignRequest Service.  

Google Analytics / Google Tag Manager

Google  Analytics / Google Tag Manager helps us track usage and performance of the  SignRequest Service. SignRequest utilizes the following Google Analytics  cookies: 

·       _ga

·       _gid

·       _gat

·       _gid

·       collect 

More  information about Google cookies, including how they are used and how you can  opt out, can be found here. You can directly opt out of Google Ad personalization at the  following link.

Your Personal Information Choices 

SignRequest understands the importance of your personal information. Under the GDPR, you have certain rights, such as the right to update, access, and delete your account information; and choose whether you wish to receive promotional and newsletter communications. You may exercise your data protection and privacy rights at any time by contacting SignRequest at support@signrequest.com.

·     Account Information: You may update, correct, or delete your personal data at any time by emailing us at support@signrequest.com. You may also submit an access request by emailing support@signreqest.com, and SignRequest will provide you with information about whether we hold, or process on behalf of a third-party, any of your personal data. We will respond to your access request within the legally permissible timeframe. 

·     Cookies: Web browsers may be set to accept cookies by default. You may choose to set your browser to remove or reject browser cookies or to prompt you before accepting such a cookie. You can also directly opt-out of certain third-party cookies. Please note that choosing to remove or reject certain third-party cookies may adversely impact your use of the SignRequest Service. For more information about our use of cookies, please see the “Use of Cookies” section above.

·     Advertising: You may opt-out of personalized ads anytime by deleting your browser’s cookies. In addition, you may opt-out of interest-based advertising from some third-party partners by visiting: http://optout.aboutads.info/; http://optout.networkadvertising.org/; or the third-party provider’s websites. Residents in the European Economic Area(EEA), please visit http://www.youronlinechoices.eu/.

·     Promotional and Newsletter Communications: You may opt-out of receiving promotional and newsletter emails from SignRequest by following the opt-out instructions provided in those emails or by emailing support@signrequest.com.If you opt-out, we will continue to send non-promotional communications, such as security alerts and notices related to your access to or use of theSignRequest Service, or those about your account or our ongoing business relations.

·     Links to Third-Party Websites: If you log into your SignRequest account using Facebook, Google or other services, these services may share additional information about you in accordance with their privacy policies. We encourage you to visit their websites and review their privacy and user policies. 

Contacting Us 

Please contact support@signrequest.comor SignRequest B.V., Singel 542,1017 AZ Amsterdam, The Netherlands, if you:

·      Have questions about this Privacy Notice;

·      Wish to make a complaint or have a concern about our handling of your personal data; or

·      Wish to report a possible breach of privacy laws.

SignRequest will respond to your inquiry within the legally permissible timeframe.

In addition, you have the right to file a complaint to SignRequest B.V. via the Autoriteit Persoonsgegevens (Dutch authority for protecting personal data) via www.autoriteitpersoonsgegevens.nl.

Changes to This Notice

SignRequest may alter or amend this Privacy Notice from time to time. If we do, we will make reasonable efforts to inform you of such changes through SignRequest's website. If you subsequently continue to use SignRequest Services, this will be understood to imply that you accept the altered or amended Notice. In the event that you do not wish to accept the alterations or amendments, please stop using the services and delete any accounts you may have created on our systems. 

Our Subprocessors 

To support SignRequest, B.V. ("SignRequest" or "we"), in delivering the SignRequest Services, we may engage third party service providers ("Subprocessors") to assist with its data processing activities. Subprocessors and SignRequest’s affiliates and subsidiaries (“SignRequest Group Companies”) may process, store or otherwise access certain customer information or personal data found in customer Content in order to support and/or improve the SignRequest Services. Unless otherwise specified, capitalized terms that are used on this page have the meaning set forth in the SignRequest Terms of Service or in a superseding written agreement between SignRequest and a particular SignRequest customer. This information is provided in compliance with SignRequest’s EU General Data Protection Regulation (GDPR) and UK Data Protection obligations.

Before engaging any Subprocessor, SignRequest performs due diligence of the Subprocessor’s privacy, information security, and data protection practices. We enter into written agreements with Subprocessors that enforce compliance with applicable data protection laws, security controls, confidentiality, and international data transfer requirements. We also restrict Subprocessor access to only what is necessary to maintain and provide the SignRequest Services to our customers.

The following table identifies the Subprocessors used by SignRequest, the type of services that may be provided, and the location where such subprocessing activities are performed.

Subprocessor
Category of Service
Location
Amazon Web Services, Inc.
Analytics, compute, database, networking, and storage
Ireland, Germany, USA*
Google, LLC
Analytics, compute, database, networking, and storage
USA
Zendesk
Customer and user support
USA
TaskUs, LLC.
Customer Support
USA, Philippines

‍

California

As required by the California Consumer Privacy Act of 2018 (“CCPA”), as amended, this California Notice at Collection (the “CA Notice”) describes how SignRequest  uses and shares the personal information (as defined by CCPA) of California residents (“consumers” or “you”) and how to exercise your rights under the CCPA. With regard to Content (as defined in the SignRequest Terms of Service), you understand that SignRequest is a service provider, as defined by CCPA.

Scope. When we say personal information in this CA Notice, we mean information that identifies, relates to, or could reasonably be linked to you or your household. This CA Notice also applies to Content, as the term is defined in the SignRequest Terms of Service.

The CCPA provides certain exemptions that may apply to SignRequest’s collection of your personal information. These exemptions include personal information that we’ve collected from or about you that is publicly available (as described in Cal. Civ. Code Section 1798.140). As such, this CA Notice and the privacy rights described herein may not apply to you or to all your personal information in such instances.

Notice at Collection. We may collect personal information about you for a variety of purposes. For example, we may collect the below categories of personal information.

  • Contact Information that we collect directly from you, which may include your name, email address and phone number.
  • Commercial Information such as the SignRequest products or services you’ve purchased, obtained or considered.
  • Internet and other related network activity such as your IP address, session logs and how you interact with our website and applications in accordance with the Cookies section of this Privacy Notice.
  • Geolocation Data which may include a subset of your internet and network activity such as your IP address.
  • Sensitive Personal Information that you provide to us when you register an account, specifically your account log-in information and payment card details.
  • Other Personal Information such as (1) information you provide when you engage with SignRequest’s support Forums (2) information you provide when you contact us directly through the SignRequest Support portal.

Sources of Personal Information. The sources from which we collect Personal Information are described in the "What Information We Collect and For What Purpose?” section of the Privacy Notice.

Use of Personal Information. We may use your personal information for the following business purposes:

  • provide, operate, maintain, and improve the SignRequest Service;
  • communicate with you about services, features, surveys, newsletters, offers, promotions, contests and events, and provide other news or information about SignRequest and our select partners;
  • personalize and improve the SignRequest Services, and provide Content, features, and/or advertisements that match your interests and preferences or otherwise customize your experiences on the SignRequest Service; or
  • as otherwise described in the “Use of Information” section of the SignRequest Privacy Notice.

SignRequest does not: 

  • retain, use, or disclose Content outside of the business relationship between you and SignRequest, except as permitted under CCPA.
  • combine personal information in Content with personal information received from or on behalf of another person, except as permitted under the SignRequest Terms of Service and CCPA.
  • use or disclose sensitive personal information for purposes other than those permitted purposes under the CCPA.

Taking into account the nature of the processing, SignRequest will provide reasonable assistance and cooperate with you in a manner consistent with the Service Provider obligations provided under CCPA. 

"Sale" or "Sharing" of Personal Information. We may use your digital activity collected by third-party cookies to enhance, customize, improve and notify you about our Services. We may also use this information and share it with third parties for the purposes of "targeted advertising". Sharing digital activity in this manner may be considered a "sale" or "sharing" of personal information under the CCPA. To learn more about our use of cookies please review the “Cookies” section of this Privacy Notice. To adjust your cookie preferences, please click here. Additionally, we may share limited contact details with third-parties for business development and, where legally permissible, sales and marketing purposes. SignRequest does not sell or share Content.

The SignRequest Service is not directed to individuals under the age of 18 and we do not knowingly collect, “sell”, or “share” personal information from anyone under 18.

Your California Privacy Rights. Subject to verification of your request, you may exercise your privacy rights listed below in relation to the personal information SignRequest has collected about you.

  • The right to know what personal information SignRequest has collected about you;
  • The right to delete your personal information;
  • The right to correct your personal information;
  • The right to limit the use and disclosure of sensitive personal information;
  • The right to opt-out of the "sale" or "sharing" of your personal information; and
  • The right to non-discrimination for exercising your rights.

How To Exercise Your Rights. To exercise your California privacy rights, please contact us at support@signrequest.com. We will promptly verify your request and respond within the applicable time frame of forty-five (45) days. Should we reasonably require additional time beyond the applicable time frame, we will notify you directly. You may also opt-out from the "sale" or "sharing" of your personal information by submitting this email template. To adjust your cookie settings, please click here.

If we are unable to verify your identity as required by CCPA, we reserve the right to not process your request. Upon this determination, we will notify you of our decision along with any rights you may have to appeal the decision. As set forth in CCPA, we are only required to respond to certain rights requests twice in any twelve (12) month period. You may use an authorized agent to submit a request on your behalf, but we may ask your agent to provide information to verify that they have the proper authority to act on your behalf or ask you to verify your identity with us directly. 

If you elect to exercise any of your rights, SignRequest will not deny services, provide a different price or rate for our services, or provide a different level of service to you because you exercised such rights.

Prior Collection, Use and Sharing of Information. In connection with providing you the SignRequest Service (the “business purpose”), we may share your personal information to third parties and other entities as described in this Privacy Notice. 

As required by the CCPA, we are obligated to disclose the categories of personal information we’ve collected, the business purpose for the collection and the categories of third parties to whom we’ve disclosed your personal information. The table below sets out our practices over the last twelve (12) months.

‍

Categories of Personal Information

Business Purpose for Collecting Personal Information

Categories of Third Parties to whom Personal Information is Disclosed

Contact Information that we collect directly from you, which may include your name, email address and phone number.
‍
‍Commercial Information such as the  SignRequest services you’ve purchased, obtained or considered.
‍
Internet and other related network activity such as your IP address, session logs and how you interact with our website and utilize the SignRequeset Service in accordance with the SignRequest Cookie Notice.
‍
‍Geolocation Data which may include a subset of your internet and network activity such as your IP address.
‍
‍Sensitive Personal Information that you provide to us when you register for an account, specifically your account log-in information and payment card details.
‍
‍Other Personal Information such as (1) the information you directly provide to SignRequest when using the SignRequest Services, (2) information you provide when you contact us directly to provide you with customer service and support.

Provide, operate, maintain, and improve the  SignRequest Services;

Communicate with you about services, features, surveys, newsletters, offers, promotions, contests and events, and provide other news or information about  SignRequest and our select partner;

Personalize and improve the  SignRequest Services, and provide Content, features, and/or advertisements that match your interests and preferences or otherwise customize your experiences on the  SignRequest Services; or

As otherwise described in the “Use of Information” section of the SignRequest  Privacy Notice.

Service Providers and Contractors

SignRequest   parent company, Box, Inc. And its respective affiliates, and subprocessors as listed in the Subprocessor section of the SignRequest Privacy Notice. 

Business partners to which the SignRequest services may be integrated with.

Retention of Personal Information. We retain your personal information as described in the "Sharing and Disclosure of Information" section of this Privacy Notice

Updates to this CA Notice. We may update this CA Notice from time to time. When we make changes to this CA Notice, we will update the “Last Updated” date at the top of the page.

Contact Us. Should you have additional questions about this CA Notice, please contact us at support@signrequest.com.

‍

Other U.S. states

Some U.S. state privacy laws require specific disclosures for state residents and provide certain rights for state residents. Specifically, these state laws include the Virginia Consumer Data Protection Act ("VCDPA"), the Colorado Privacy Act ("CPA"), the Connecticut Data Privacy Act ("CTDPA"), and the Utah Consumer Privacy Act ("UCPA")(collectively, “US State Privacy Laws”). This section describes how SignRequest . collects, uses, and shares the personal data of U.S. state residents and how to exercise your rights under these state privacy laws.

Please note that the rights described in this section will depend on the applicable laws in your state of residence. If applicable, the privacy laws in your state of residence may also provide certain exemptions that apply to SignRequest’s collection of your personal data, including personal data that we’ve collected from or about you that is publicly available. As such, the privacy rights described herein may not apply to you or to all your personal data. 

With regard to Content, you understand that SignRequest is a processor, as defined by applicable US State Privacy Laws.

Personal Data We Collect and How We Use It. SignRequest collects certain categories of personal data when you use the Services, including identifiers, commercial information, internet or other related network activity, geolocation data tied to your IP address, and other personal data.  A more detailed description of the personal data SignRequest collects and how we use it is provided in the "Collection of Information," and "Use of Information" sections of this Privacy Notice.

For purposes of U.S. state privacy laws, SignRequest does not engage in profiling/automated decision making that produces legal or similarly significant effects.  Taking into account the nature of the processing, SignRequest will provide reasonable assistance and cooperate with you in a manner consistent with the processor obligations provided under US State Privacy Laws.

Sharing of Personal Data. In connection with providing you the SignRequst Service, we may share your personal data to third parties and other entities as described in this Privacy Notice. SignRequest does not sell or share Content. 

Targeted Advertising. SignRequest may collect personal identifiers from you automatically. These identifiers include IP address, device identifiers, advertising ID and other information about your browser or device. We may collect this information via cookies and other tracking technologies and use it to enhance, customize, improve and notify you about our Services. We may also share it with third parties that operate in the advertising ecosystem for "targeted advertising". This is further described in this Privacy NoticeDepending on your state of residence and applicable law, sharing digital activity in this manner may also be considered a "sale" of personal data.

Privacy Rights. Depending on the applicable laws in your state of residence, for example if you are a Colorado resident, you may have the right to the following:

  • request to confirm whether we process your personal data and to access such personal data;
  • request to correct inaccuracies in your personal data;
  • request deletion of your personal data, subject to certain exceptions;
  • request to obtain a copy of your personal data;
  • request to opt-out of processing of personal data for purposes of targeted-advertising;
  • request to opt-out of the "sale" of personal data; and
  • opt-out of profiling in furtherance of decisions that produce legal or similarly significant effects.

You may exercise your right to opt-out of the "sale" of personal data and targeted advertising by submitting  this email template or by clicking here. To exercise the other rights listed above, submit a request or appeal denial of a request, please contact support@signrequest.com.

We may need to verify your identity to process your request. If we are unable to verify your identity, we reserve the right to not process your request. If we refuse to take action on a request, we will provide instructions on how you may appeal the decision. We will respond to requests consistent with applicable law.

You may use an authorized agent to submit a request on your behalf, but we may ask your agent to provide information to verify that they have the proper authority to act on your behalf or ask you to verify your identity with us directly. If you elect to exercise any of your rights, SignRequest will not deny services, provide a different price or rate for our services, or provide a different level of service to you because you exercised such rights.

‍

*Data may also be processed in other locations for such purposes as caching that enables enhanced performance.

Last updated: February 2023

‍