Privacy Policy

This Privacy Policy applies to sign.online OÜ (“Website”). This Privacy Policy describes how we collect, use, share and secure the information provided by our customers. It also describes our customers’ choices regarding use, access, correction, and deletion of their data. We value all of our customers and respect their right to privacy and data protection.

Who We Are

The data controller responsible for the Processing of Personal Data described in this Privacy Policy is:

sign.online OÜ
Estonian business registry code: 16518242
Registered address: Lõõtsa tn 2a, 11415 Tallinn, Harjumaa, Estonia
E-mail: hello@sign.online

We have not appointed a Data Protection Officer, as our Processing activities do not meet the thresholds set out in Article 37 GDPR. All data protection enquiries can be addressed to the e-mail above.

The following terms, when used in the Privacy Policy, the Agreement, and any communication between the Parties, have the meanings given below:

Definitions

“Agreement” is a Service Agreement or other agreement between sign.online OÜ and the Customer.
“Cookies” are small data files that are placed on visitors’ devices by a website containing details of your browsing history on that particular website.
“Customer” is any individual or legal person who uses or has expressed a wish to use the Services of sign.online OÜ.
“Customer Account” is the personal data account of the Data Subject, which in particular gives access to his / her data and services and through which the Client identifies himself / herself. The Customer Account belongs to the Data Subject and is valid during the validity of the Agreement.
“Data Subject” is an individual person for whom sign.online OÜ has information or information that can be used to identify an individual person. Data Subject includes, but is not limited to, customers, visitors, partners, and employees for whom sign.online OÜ have personal data.
“Legitimate Interest” means sign.online OÜ’s interest in managing its own business to provide the best possible Services on the market.
“Personal Data” is any information about an identified or identifiable individual person.
“Processing of Personal Data” or “Processing” is any act performed by the Data Subject with Personal Data like collecting, recording, organizing, storing, modifying and disclosing Personal Data, providing access, performing queries and retrieving, using, transmitting, cross-linking, merging, closing, deleting or destroying, or several of the previously mentioned operations, regardless of the manner in which the operations are performed and the means used.
“Sales Channels” are the means of communication with the Data Subject, used by sign.online OÜ, a tool for the sales of goods and the provision of services. Sales Channels may include but is not limited to email, phone, public and social media, various chat lines, individualized and interactive ads, and other similar tools.
“Services” are all services and products offered by sign.online OÜ.
“Service Portfolio” is a range of sign.online OÜ products and Services, which are available on the Website or on a received offer.
“Visitor” is the person who uses the website of sign.online OÜ.

General Provisions

By utilizing our Services, the Customer agrees to this Privacy Policy.
The Privacy Policy applies to the Data Subjects, and the rights and obligations specified in the Privacy Policy are the responsibility of all employees and partners of sign.online OÜ who have contact with Personal Data held by sign.online OÜ.
This Privacy Policy may be supplemented by privacy notices published on the Website.

General Principles

When processing Personal Data,sign.online OÜ always follows the interests, rights and freedoms of Data Subjects.
All sign.online OÜ processes, guides, operations and activities related to the Processing of Personal Data are based on the following principles:

Legal. There is a legal basis for processing Personal Data, such as an Agreement;
Justice. Processing of Personal Data is fair, in particular by requiring the Data Subject to have sufficient information and information about how Personal Data is processed.
Transparent. Processing of Personal Data is transparent to the Data Subject, including through the Client Account created specifically for this purpose, which explains in simple language why, how, and when Personal Data is processed.
Purpose. Personal Data shall be collected for specified, explicit, and legitimate purposes and not further processed in a way incompatible with those purposes. It is possible for the Data Subject to check the specific purpose of the Data Processing.
Minimized. Personal Data is relevant, important, and limited to what is necessary for the purpose for which they are processed. When processing Personal Data, sign.online OÜ shall follow the Minimum Processing Principle, and if Personal Data is not necessary or is no longer necessary for the purpose for which it was collected, the Personal Data shall be deleted.
Correct. Personal Data are correct and up-to-date, and all reasonable steps have been taken to ensure that inappropriate Personal Data will be corrected or deleted.
Restriction on storage. Personal Data shall be kept in a form which permits identification of the Data Subject only for as long as it is necessary for the purpose for which the Personal Data are processed. This means that if sign.online OÜ wants to keep Personal Data longer than is necessary for the purpose of the collection, sign.online OÜ will anonymize the data such that the Data Subject is no longer identifiable. In the case of data that sign.online OÜ has obtained through a customer or similar relationship, sign.online OÜ will, in accordance with best practice and Data Subject to consent, retain generally until the withdrawal of consent. Deadlines for storage are set by the internal rules of sign.online OÜ.
Reliability and confidentiality. Processing of Personal Data shall be carried out in a manner that ensures appropriate security of the Personal Data, including protection from unauthorized or illegal Processing and accidental loss, destruction or damage through reasonable technical or organizational measures. sign.online OÜ has internal rules, internal instructions or regulations for employees, as well as separate contracts with each authorized processor that provides best practices, continuous risk assessment and appropriate technical and organizational measures for the processing of Personal Data.
Default and integrated data protection. sign.online OÜ ensures that all systems used meet the required technical criteria. Appropriate data protection measures are prepared for updates or design of each information and data system (eg, information systems and business processes are built around pseudonymization and encryption assumptions).

Personal Data

Personal Data may be processed by sign.online OÜ:

identifying the purposes and means of processing as a controller;
as processor in accordance with the instructions of the controller;
as a recipient to the extent that Personal Data is transmitted.

sign.online OÜ processes and collects, in particular, the following types of Personal Data:

Personal Data published by the Data Subject to sign.online OÜ;
Personal Data resulting from the normal communication between the Data Subject and sign.online OÜ;
Personal Data obviously disclosed by the Data Subject (e.g., social media posts);
Personal Data generated when using the Services;
Personal Data resulting from visitation and use of the Website (e.g., time spent on the Website);
Personal Data created and combined by sign.online OÜ (e-mail correspondence or contract flow and history list).
Personal Data generated from the customer relationship between the Data Subject and sign.online OÜ.

Personal Data Processing Objectives And Principles

sign.online OÜ processes Personal Data exclusively on the basis of consent or law. The principles for processing Personal Data arising from law include, but are not limited to, a Legitimate Interest or Agreement between the Data Subject and sign.online OÜ.
On the basis of consent, Personal Data is processed within the limits, to the extent and for the purposes specified by the Data Subject. The principle of sign.online OÜ is that each consent must be clearly distinguishable from other issues, and in an understandable and easily accessible form, in clear and simple language. Consent may be given in writing or by electronic means or as a verbal statement. The Data Subject gives consent voluntarily, specifically, knowingly and unequivocally, for example, by marking the cell on the Website.
While signing and fulfilling the Contract, Processing of Personal Data may be specified in an Agreement, but sign.online OÜ may also process Personal Data for the following purposes:

Taking pre-contractual measures at the request of the Data Subject;
Taking pre-contractual measures to prevent money laundering and terrorist financing;
Identifying Customers to the extent required by due diligence;
Fulfilling the Customer’s expectations regarding provision of Services;
Communicating with the Customer;
Securing the Customer’s payment obligation;
Realizing and protecting claims.

On the basis of the law, sign.online OÜ processes Personal Data only after careful evaluation and confirmation that sign.online OÜ has a Legitimate Interest, on the basis of which the Processing of Personal Data is necessary and in accordance with the data subject’s interests and rights. In particular, the Processing of Personal Data may be based on Legitimate Interest for the following purposes:

Securing a trusted customer relationship, such as Processing Personal Data, strictly necessary to identify actual beneficiaries or to prevent fraud and money laundering and terrorist financing;
Managing and analyzing the customer base to improve the availability, choice, quality of the Services and Products, and to make the best and most personalized offers to the Customer upon consent;
Using collected data for web analysis or service analysis in order to ensure reliable workflow, to improve processes, to produce statistics and to analyze the visitor’s behavior and usage experience, and to provide a better and more personalized Service;
Conducting campaigns, including arranging personalized and targeted campaigns, conducting customer and visitor satisfaction surveys and measuring the effectiveness of marketing activities performed;
Analyzing Customer and Visitor Behavior in various sales channels, websites;
Storing notices and orders given on its own premises as well as by means of communication (e-mail, telephone, etc.), as well as information and other actions that sign.online OÜ has made and, if necessary, using them for verifying orders or other operations;
Fighting piracy, securing the Website, making and storing backups and other actions for network, information, and cyber security as sign.online OÜ sees fit;
Managing finances and Processing Personal Data of Clients or employees;
Preparing, submitting, or defending against legal claims.

For the purpose of fulfilling an obligation by the Law, the Personal Data shall be processed by sign.online OÜ for the performance of the obligations provided by law or for the implementation of permitted uses permitted by law.
If the Processing of Personal Data is for a purpose other than the one for which the Personal Data was originally collected or is not based on the consent of the Data Subject, sign.online OÜ shall carefully evaluate the permissibility of such new Processing. sign.online OÜ will determine whether the New Purpose is consistent with the purpose for which Personal Data was originally collected, including:

The link between the purposes for which the Personal Data was collected and the intended further Processing intensions;
The context of the collection of personal data, in particular the relationship between the Data Subject and sign.online OÜ;
The nature of the Personal Data, in particular whether Personal Data relating to specific categories or Personal Data relating to convictions and offenses in criminal matters;
The possible consequences of the proposed further processing for Data Subjects;
The existence of appropriate protection measures, such as encryption and pseudonymisation.

Disclosure And / Or Transmission Of Customer Data To Third Parties

sign.online OÜ cooperates with entities to which sign.online OÜ may provide Data Subject data, including Personal Data, within the framework of and for the purpose of cooperation.
The main categories of processors and recipients we currently use are:

Cloud infrastructure and hosting: Amazon Web Services EMEA SARL (AWS), primarily the Frankfurt (eu-central-1) region in Germany, where the Website backend and the webinar subscription service are hosted;
Transactional and marketing e-mail delivery: Postmark, operated by ActiveCampaign LLC (United States), used to send webinar invitations, double opt-in confirmations and other transactional e-mails;
Payment processing: Stripe Payments Europe Ltd. (Ireland), with onward processing by its group entities as described in Stripe’s Privacy Policy;
Signature method providers: qualified and advanced electronic signature providers in the user’s country, used only when the Data Subject actively chooses a specific signing method;
Professional advisors: accounting, legal and audit partners, strictly on a need-to-know basis;
Public authorities: when required by applicable law, court order or binding request from a competent authority.

In every case, sharing takes place only if:
The purpose and Processing are legitimate;
Processing of Personal Data is carried out in accordance with the instructions of sign.online OÜ and under a written Data Processing Agreement where the recipient acts as a processor;
The identity and role of such processors have been disclosed to Data Subjects through this Privacy Policy.

International transfers. Personal Data is primarily processed within the European Union. Where transfers of Personal Data to recipients outside the European Economic Area are necessary (today, principally transfers to the United States for e-mail delivery via Postmark), sign.online OÜ relies on the following safeguards under Chapter V GDPR:

The EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module 2 (Controller-to-Processor) or Module 3 (Processor-to-Processor), as applicable;
Supplementary technical and organisational measures (e.g., encryption in transit and at rest, access controls, and vendor security certifications);
Where the European Commission has adopted an adequacy decision for the destination country, we rely on that adequacy decision instead.

A copy of the applicable transfer safeguards for a specific recipient can be requested at hello@sign.online.

In the limited additional cases allowed under Article 49 GDPR — including where the transfer is necessary for the performance of a contract with the Data Subject, for the exercise or defence of legal claims, or to protect the vital interests of a Data Subject — sign.online OÜ may transfer Personal Data outside the EEA on those bases.

Security Of Processing Personal Data

Retention periods are set per Processing activity and are determined by the purpose of the Processing and applicable legal obligations. The main retention periods are:

Document and signing data processed through the sign.online signing service: deleted from our operational servers after 7 days;
Payment information: retained for 10 years, as required by Estonian accounting law, by our payment service provider Stripe (see Stripe’s Privacy Policy);
Webinar subscription data: retained until withdrawal of consent (see the Webinar Subscriptions section below);
Applicant data: retained for 2 years from submission (see the Applicant and Employment Privacy section below);
Request, security and audit logs: retained for up to 90 days for anti-abuse, security monitoring and incident investigation purposes under Legitimate Interest.

Personal Data for which the retention period has expired will be destroyed using best practices and in accordance with the procedures established by sign.online OÜ for this purpose.

sign.online OÜ has established guidelines and rules of procedure on how to ensure the security of Personal Data through both organizational and technical measures.
In case of any incident with respect to Personal Data, sign.online OÜ will take all necessary measures to relieve the consequences and reduce future risks. Personal Data breaches are notified to the Estonian Data Protection Inspectorate without undue delay and, where feasible, no later than 72 hours after sign.online OÜ becomes aware of the breach, in accordance with Article 33 GDPR. Affected Data Subjects are notified directly without undue delay where the breach is likely to result in a high risk to their rights and freedoms, as required by Article 34 GDPR.

Analytics And Tracking

sign.online OÜ does not use third-party web analytics, advertising networks, or cross-site tracking technologies on the Website. We do not deploy Google Analytics, Meta Pixel, or similar services. The limited first-party cookies and local storage we rely on for strictly necessary functionality are described in our Cookie Policy.

Processing Of Personal Data Of Children

sign.online OÜ Services are not directed at persons under the age of 16, and we do not knowingly collect Personal Data from such persons. Where applicable national law sets a lower age of consent for information-society services, that lower threshold applies in the relevant jurisdiction.
If sign.online OÜ becomes aware that it has collected Personal Data from a person below the applicable age threshold without appropriate parental consent, sign.online OÜ will delete such Personal Data without undue delay.

Webinar Subscriptions

sign.online OÜ offers an opt-in subscription that allows interested individuals to receive e-mail invitations to our free, English-language webinars on digital signing, eIDAS compliance, and paperless contract workflows. This section describes how Personal Data provided through the webinar subscription form is processed.

Legal basis. Processing of your name and e-mail address for the purpose of sending webinar invitations is based on your explicit consent under Article 6(1)(a) GDPR. You give this consent by ticking the consent checkbox on the webinar subscription form on our Website.
Data we collect through the form:

Your name (optional);
Your e-mail address (required);
A record that you gave consent, together with the timestamp of submission;
Your browser-reported time zone, used solely to schedule invitations at a reasonable local time;
Your IP address and the submission timestamp, logged by our infrastructure for anti-abuse, audit, and security purposes under Legitimate Interest.

Double opt-in. After you submit the form you will receive a confirmation e-mail. Your e-mail address is added to the active webinar invitation list only after you click the confirmation link. If you do not confirm within 14 days, the pending signup record is deleted.
Retention. Your name and e-mail address remain on the webinar invitation list until you unsubscribe. On unsubscribe we retain a suppression record (hashed e-mail address) for 2 years to make sure you are not accidentally re-added by a later submission. All other Personal Data collected through the form is deleted.
Third-party processors. The subscription form is served by Amazon Web Services EMEA SARL (AWS), with the backend hosted in the Frankfurt (eu-central-1) region. Webinar invitation e-mails, and the double opt-in confirmation e-mail, are delivered through Postmark, a transactional e-mail service operated by ActiveCampaign LLC (United States). Postmark acts as a processor on sign.online OÜ’s documented instructions under a Data Processing Agreement. Transfers of Personal Data to the United States for this purpose take place under the EU Standard Contractual Clauses (Module 2, Controller-to-Processor) together with supplementary technical measures.
No profiling, no sharing with advertisers. We do not profile subscribers, we do not perform automated decision-making on subscription data, and we do not share your e-mail address with third-party advertisers, data brokers, or marketing networks.
Withdrawing your consent. You can withdraw your consent at any time by:

clicking the unsubscribe link included in every webinar invitation e-mail; or
e-mailing us at hello@sign.online.

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

Anti-spam measure. The subscription form includes a hidden anti-bot field. Submissions that fill this field are discarded and no Personal Data from them is retained beyond the short-lived request log described above.

Rights Of The Data Subject

Authorization rights:

The Data Subject has the right at any time to notify sign.online OÜ of its wish to withdraw the Processing of Personal Data.
Data Subject can view, modify and withdraw the approval given to sign.online OÜ in the Customer Account or by contacting sign.online OÜ. Contacts can be found in the Contact Information section below.

The Data Subject also has the following rights when processing Personal Data:

Right to receive information, the Data Subject has the right to receive information about the Personal Data collected about him / her.
Right to Access Data. Including the right for the copy of Processed Personal Data. The Client has the opportunity to get info about the Personal Data collected by sign.online OÜ on the Client Account.
Right to demand correction of inaccurate Personal Data. The Data Subject may also correct incorrect data in his / her Client Account.
Right to erase data. In some cases, the Data Subject has the right to request that the Personal Data be deleted, for example, if the Processing is performed only on the basis of agreement.
Right to restrict the Processing of Personal Data. This right arises if the Processing of Personal Data is not permitted by law or if the Data Subject contests the accuracy of the Personal Data. The Data Subject has the right to request that the Processing of Personal Data be restricted for a period of time that enables the Controller to verify the correctness of Personal Data or if Processing of Personal Data is illegal, if the Data Subject does not request the deletion of personal data.
Right to transfer data (data portability). Data Subject is entitled to receive Personal Data in a structured, commonly used, machine-readable format and to have it transmitted to another controller, where Processing is based on consent or on a contract and is carried out by automated means.
Right to object (Article 21 GDPR). The Data Subject has the right to object, at any time and on grounds relating to their particular situation, to Processing of Personal Data based on Legitimate Interest. Where Personal Data is processed for direct marketing purposes — including sending webinar invitations — the Data Subject has an absolute right to object at any time, and we will stop such Processing without further justification.
Rights related to automated decision-making. sign.online OÜ does not take decisions based solely on automated Processing — including profiling — that produce legal effects concerning the Data Subject or similarly significantly affect them. If this ever changes, we will notify the Data Subject in advance and provide the safeguards required under Article 22 GDPR.
Right to lodge a complaint with a supervisory authority. The Data Subject has the right to lodge a complaint with the Estonian Data Protection Inspectorate (AKI, https://www.aki.ee/en) as our lead supervisory authority. Residents of other EU/EEA Member States may additionally lodge a complaint with the supervisory authority of their habitual residence, place of work, or place of the alleged infringement, in accordance with Article 77 GDPR.
Right to compensation for material or non-material damage caused by Processing in breach of the GDPR, in accordance with Article 82 GDPR.

Applicant And Employment Privacy

In order to enter into a contract of employment on the basis of a contract and a Legitimate Interest, sign.online OÜ will apply the Personal Data Processing as follows:

Processing of the data submitted by the candidate to sign.online OÜ for the purpose of concluding an employment contract;
the Processing of Personal Data received from the person who was marked as a reference by the candidate;
Processing of Personal Data collected from national databases and registers and from public (social) media.
If the candidate for employment is not elected, sign.online OÜ will keep the Personal Data collected for the employment contract only for two years in order to make a job offer to the candidate upon release of a suitable job position. Two years after submission of the application for employment Personal Data will be deleted.

Claiming The Rights And Submission Of Complaints

Claiming the rights:

The Data Subject has the right to contact sign.online OÜ using the contact details provided in the Contact Information section below in case of any question, application or complaint related to the Processing of Personal Data.
sign.online OÜ encourages Data Subjects to use their rights to claim info about their personal data issues.

Submitting complaints:

The Data Subject has the right to appeal to the sign.online OÜ and the Data Protection Inspection or the court if the Data Subject finds that his / her rights have been violated in the Processing of Personal Data.
Contact details of the Data Protection Board (AKI) can be found on the AKI website: https://www.aki.ee/en

Supplemental Documents, Instructions, And Procedures

The following documents, procedures and instructions apply when implementing the sign.online OÜ Privacy Policy:

The internal rules set out all the purposes, ways of processing the Personal Data, the types and categories of Personal Data processed and the Processing Principles, as well as the different measures that sign.online OÜ implements to keep personal data always confidential and secure.
Cookie Policy. You can read more about how we use cookies here.
On Customer Account, through which the Data Subject can access his / her own Personal Data, Data Subject can correct, modify, and enforce any other rights granted under this Agreement and these Terms and Conditions;
All About Cookies: Descriptions of cookies and other web technologies used by sign.online OÜ;
Your Online Choices; About Ads; Network Advertising: A platform for checking and monitoring cookies and other web technologies that allows the Data Subject to change and control how Personal Data is used and collected.

Contact Information

If you have questions or concerns, sign.online OÜ can be contacted by e-mail: hello[at]sign.online

Changes To This Privacy Policy

sign.online OÜ may update this Privacy Policy from time to time to reflect changes to our Services, our Processing activities, or applicable law. The current version is always available on the Website; the “Last updated” date at the top of this page indicates when the latest revision took effect. Where changes materially affect your rights or the way we process your Personal Data, we will notify you by e-mail or by a prominent notice on the Website before the change takes effect.