Privacy Policy

1. Data Controller

The operator named at the end of this policy is the administrator of account, contractual, billing, security and product data. When a business customer uploads documents or provides data for their employees, customers and signatories, they can be the administrator and SignFida can process the data on their behalf to provide the service.

2. Categories of data

We process account and organisation details, roles, settings, plan and access dates; documents, recipients, signing data and evidence needed for the selected functions. For a personal offer we retain contact name, account email, optional company/phone, selected plan, users, requested storage, message and request status. The request is stored in the administration and emailed to the operator to respond to the enquiry, not for marketing consent.

3. Purposes and Legal Basis

• Contract performance: registration, access, storage, signing, sharing, billing and maintenance.
• Legal obligation: accounting, tax, regulatory and valid requests from authorities.
• Legitimate interest: protection against fraud and abuse, security, diagnostics, protection of legal claims and improvement of reliability, after weighing the interests.
• Consent: optional analytics and other cases where we explicitly request it; consent may be withdrawn at a later date.

4. Sources and Mandatory

Data comes from users, workspace owners, recipients and their devices. Required fields are needed for the selected account or service function. In this mode, enquiry data is not sent to a card payment processor.

5. Recipients and suppliers

Service providers process data as needed for hosting, storage, email delivery and the signing method used. Offer requests are delivered to the operator's mailbox. Optional analytics and anti-abuse services apply only when enabled. Local signing tools are not evidence of a partnership with their vendors.

Optional AI signature-location analysis: when enabled for Business or Enterprise and authorised at upload, images of a limited number of pages and context near candidate areas are sent to OpenAI. The analysis suggests positions and visible marks; it does not verify signature validity. Without permission the document is processed locally. We do not use the Files API and requests set store=false; this does not exclude provider retention for security and abuse monitoring. OpenAI contract terms, international transfers and retention settings must be reviewed before processing customer documents. OpenAI data and retention

6. International transfers

Some service providers may process data outside the EEA. Applicable locations, contractual safeguards and lawful transfer mechanisms must be assessed for the actual providers used.

7. Storage periods

Account and contract data are kept while the account is active and afterwards for periods required for claims and obligations. When deletion is requested, the account is scheduled for permanent removal after 30 days; during this period the request can be cancelled after email confirmation. On permanent deletion, documents, workspaces, signatures, and associated operational history are removed unless a legal obligation or valid dispute requires limited retention. Invoices and accounting records are kept for the applicable statutory period. Data in backups is removed through the regular rotation cycle and is not restored for operational use. A valid dispute, investigation, or legal obligation may extend a retention period.

8. Rights

Subject to GDPR, contact the legal operator for access, correction, erasure, restriction, objection, portability or withdrawal of consent. We respond without undue delay and within one month. Complex or numerous requests may require up to two additional months; we explain the reasons within the first month. Reasonable identity verification may be required. Requests concerning an organisation's documents may need to go to that controller. This is separate from the account-deletion cancellation window.

9. Complaint and automated checks

You may lodge a complaint with the Bulgarian Commission for Personal Data Protection or your competent supervisory authority. This mode does not run card-payment fraud or card authentication checks. cpdp.bg.

10. Security and Violations

We implement access control, HTTPS, CSRF protection, limited privileges, private file storage, an audit trail, and AES-256-GCM encryption of private documents before storage. Encryption keys and sensitive private keys are managed separately from the files. If a breach occurs, we assess the risk and notify the competent authority and affected individuals when required by law.

Signing evidence

For each new signature we retain the accepted statement and its version, signer details, account or signing-link access basis, server time, IP address, browser information, document hashes and a separate signed PDF copy. The owner can export the evidence; co-signers can export evidence for the versions they signed. Account or link access alone is not independent identity verification, and server time is not a qualified timestamp. Removing a document with a signature hides it only from that user's listing, without destroying the other parties' signed copies or evidence. Permanent deletion and account erasure involving signed records require a separate retention review; this button does not implement an automatic retention period. Email codes have limited attempts and lifetime, and only their hashes are stored in the database. If external timestamping is explicitly configured, only a manifest hash is sent to the provider. A separately configured locked archive retains documents and evidence for an agreed period even after local deletion; provider contracts, lawful basis, location, transfers and retention must be settled before activation. These services are not enabled automatically.

Declarations, contract evidence and backups

Withdrawal records contain name, email, contract reference, declaration and submission time to fulfil legal obligations. Paid-order evidence includes the accepted offer and version, time and any express request for early performance. These records are not automatically erased with the account where needed for legal obligations or claims; retention must follow the applicable basis, not be indefinite. Encrypted backups use a 30-day operational rotation; the latest recoverable copy is retained if later backups fail. Valid erasure requests must be reapplied after restoration. Backup access is restricted to administrators.

Operator

The SignFida service is provided byЛИХТ ЕООД. Company registration number: 120562752. Address: ул. Петър Берон 14, 4700 Смолян, България.