PRIVACY POLICY

Last updated on 30 January 2026

1. Data controller

SIGNFREE SRL, a company incorporated and existing under the laws of Belgium, with registered office at Avenue Louise 209A/7, 1050 Brussels, Belgium, and registered with the Crossroads Bank of Enterprises under number 0799.494.487 (hereafter "SIGNFREE" or "we"), acts as a controller when it processes personal data of users who use its Site and e-signature platform ("data subjects" or "you"), for those cases where the General Data Protection Regulation n°2016/679 (hereafter "GDPR") applies.

2. Categories of personal data

We process the following categories of personal data: personal identification data (name, surname, e-mail address, phone number), electronic identification data (cookies, IP addresses, device and browser identifiers where necessary for the operation or security of the service), financial data (payment-related data processed by our payment provider, account identifiers).

For users who sign documents without a registered account (Free Plan), we may process only the data strictly necessary to provide the service (e.g. e-mail address for sending signing links, IP and technical data for audit trail and security).

3. Purpose of the processing

We will process these personal data for the following purposes:

User account management: registration, management and modification of your registered account; provision of Solo Plan, Team Plan and other paid plans; trial and subscription management.
Legal basis: the performance of the contract that binds us (cf. Terms and Conditions).
Storage period: for the duration of the subscription plan and two (2) years after closure of the subscription plan.
Management of the website and services: tracking of traffic to and the number of visitors to the websites, correspondence with customers ("help desk"), security and fraud prevention, audit trails for e-signatures.
Legal basis: our legitimate interests (organisation of our commercial activity, security, compliance); your consent where required.
Storage period: two (2) years after closure of your session or as required for audit and legal compliance.
Marketing: sending out newsletters, showing ads on social media.
Legal basis: your consent.
Storage period: as long as you have not unsubscribed.

4. Recipients

The personal data may be transferred to processors (such as IT service providers, hosting providers, payment processors, identity and authentication providers) who process data on our behalf and in accordance with our instructions. We ensure that such processors are bound by appropriate contractual obligations. We are not liable for the processing carried out by such processors beyond our obligations under applicable data protection law.

5. Data transfers

Your personal data are primarily processed within the European Economic Area. Where we or our processors transfer data to countries outside the EEA, we ensure appropriate safeguards are in place (such as adequacy decisions, standard contractual clauses or equivalent mechanisms) in accordance with applicable law.

6. Data subjects' rights

Under certain conditions, provided for in the General Data Protection Regulation n°2016/679, as a data subject you enjoy the following rights: the right to access, to rectify your personal data, to erase your personal data ("right to be forgotten"), to restrict and to object to the processing of your personal data, to data portability and the right not to be subjected to a decision based solely on automated processing, including profiling.

To exercise your rights, you can send an email to info@signfree.io with a reasoned request and proof of your identity.

As a data subject, you are entitled to lodge a complaint with a supervisory authority.

Should you have any question regarding the processing of your personal data by us, do not hesitate to send us an email to info@signfree.io.

7. Updates

We regularly review our processing of personal data of data subjects and strive to continuously improve our Privacy Policy. We may therefore amend or update our Privacy Policy from time to time as necessary. The revised Privacy Policy will take effect as soon as it is posted on our Site. We encourage you to review this page periodically. Your continued use of the Site after the posting of changes constitutes acceptance of those changes.