MultiSigner
SparkRelay Tech Services ("Company," "we," "us," or "our"), with registered address at 2000 Hogback Rd, Suite 6, Ann Arbor, MI 48105-9735, USA, operates the MultiSigner electronic document signing service (the "Service"). This notice explains how we comply with European data protection law when processing personal data of individuals located in the EEA, UK, or Switzerland, and how you can exercise your rights.
"Personal data," "processing," "controller," "processor," "data subject," "supervisory authority," and "personal data breach" have the meanings given in the GDPR / UK GDPR. Where we refer to the GDPR in this notice, it also includes the UK GDPR and, where applicable, the Swiss FADP.
Where we determine the purposes and means of processing your personal data (for example, when you register for and use the Service as a direct customer), we act as a controller. Where we process personal data on behalf of a customer (for example, when a customer uploads documents that contain personal data of third parties), we act as a processor under our Data Processing Agreement and process that data only on the customer's instructions.
We process personal data in accordance with the following principles:
We rely on the following legal bases under Article 6 of the GDPR:
| Legal basis | Examples of processing |
|---|---|
| Performance of a contract (Art. 6(1)(b)) | Creating and managing your account, processing signing jobs, managing credits, and delivering signed documents. |
| Consent (Art. 6(1)(a)) | Your authorization to store and use your data for the purposes of the Service, and any processing for which we specifically request consent. |
| Legitimate interests (Art. 6(1)(f)) | Securing and improving the Service, preventing fraud, and providing support, balanced against your rights and interests. |
| Legal obligation (Art. 6(1)(c)) | Complying with accounting, tax, and legal record-keeping requirements. |
We process the following categories of personal data, for the purposes described in our Privacy Policy:
We do not intentionally process special categories of personal data (Art. 9 GDPR), with one exception that depends on how you use the Service: where a signature flow records an acceptance video containing a signer's face and voice, that recording may constitute, or may reveal, biometric or other special-category data. The account holder who creates the flow is the one who requires that evidence and is the controller for it; we act solely as the technical tool that provides the method of collecting and temporarily holding the evidence on the account holder's instructions. The account holder is responsible for identifying a valid Article 9 condition, which will usually require the signer's explicit consent, and for safely storing and protecting the evidence it downloads for as long as it needs it for its own legal, evidentiary, or compliance purposes. The documents and the evidence are deleted after a reasonable, limited retention period (currently 30 days) set to allow them to be downloaded, and retention is never indefinite. While they are retained, access is confined to the flow's creator: no other customer and no user of any other account can see, list, or download them. Only the invited signer (limited to the documents they must read and sign, through their single-use link, which is invalidated once they sign) and the Company's designated system administrators (for strictly limited operational purposes such as administration, requested support, security, or a legal obligation) may otherwise access them. We do not sell your personal data.
You have the following rights under the GDPR:
To exercise any of these rights, contact us using the details in Section 13. We may need to verify your identity before responding, and we will respond within the timeframes required by law (generally within one month).
Your personal data is processed and stored on our automatically load-balanced infrastructure across servers located in the United States and Canada. Where personal data is transferred from the EEA, UK, or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards, including the Standard Contractual Clauses (or, where available, an adequacy decision), as incorporated into our Data Processing Agreement. A copy of the relevant safeguards is available on request.
We retain personal data only for as long as necessary for the purposes for which it was collected, as described in our Privacy Policy. Key retention periods include:
We implement appropriate technical and organizational measures in accordance with Article 32 GDPR, as described in our Encryption and Access Control document, including encryption in transit and at rest, hashing of credentials, role-based access control, least-privilege access, and automatic deletion of sensitive transient data.
In the event of a personal data breach, we will act in accordance with our Incident Notification Procedures. Where required, we (or the relevant controller) will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours, and will notify affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
You may direct any privacy-related enquiries to our privacy contact at info@multisigner.vip. Where we are required to appoint a Data Protection Officer or an EU/UK representative, details will be provided upon request and updated in this notice.
SparkRelay Tech Services
2000 Hogback Rd, Suite 6, Ann Arbor, MI 48105-9735, USA
Email: info@multisigner.vip
Website: https://multisigner.vip
If you believe our processing infringes applicable data protection law, you have the right to lodge a complaint with the supervisory authority in your country of residence, place of work, or the place of the alleged infringement.
We may update this notice from time to time. Material changes will be communicated by reasonable notice (such as posting the updated notice). Your continued use of the Service after the effective date constitutes acceptance of the revised notice.