Privacy Policy

Who we are

Signum is operated by Cloud Logics Limited, a company registered in England and Wales (company number 12713109). For the personal data described in this policy we are the data controller, except where the next section says otherwise. You can reach us about anything here at hello@getsignum.uk.

Documents you are asked to sign

When an organisation sends you a document through Signum, that organisation decides what it contains, who receives it and how long it is kept. It is the data controller for the document and for your details in it; we handle them on its instructions, as its processor. If you have a question about a document you were sent, or want something in it corrected or removed, the organisation that sent it is the right place to start — if you write to us instead, we will pass your request on.

What we collect

If you ask for access: your name, email address, company name and whatever you tell us about how you would use Signum.

If you have an account: your email address, a securely hashed password, the businesses you belong to, the record that you accepted our Terms of Service (which version, when, and from which IP address and browser), your support conversations with us and any files you attach to them, and your subscription and invoice history. Card details are entered on our payment provider’s pages and never reach us.

If you send documents: the documents you upload, and the names and email addresses of the people you ask to sign or copy in.

If you sign a document: your name and email address, your signature and anything else you enter, any files the sender asks you to upload (proof of identity, for example), and technical signing evidence — IP address, timestamps and device information — captured to make the signature legally defensible.

Why we use it, and our lawful basis

To answer a request for access and set up your account: steps taken at your request before entering into a contract. To provide the service to account holders, bill for it and give support: performance of our contract. To keep invoices and tax records: a legal obligation. To record signing evidence and the audit trail that keeps a signature verifiable, to check that a recipient’s address can receive mail, to handle bounced email, and to keep the platform secure and free from abuse: our legitimate interests, and those of everyone relying on the signed document. To tell UK companies about Signum: our legitimate interests, as described under Business marketing below.

We do not rely on consent as the basis for using personal data, which is why our forms do not ask you to tick a consent box. If we ever need your consent for something, we will ask for it separately and you will be able to withdraw it. (The agreement a signer gives before signing is an agreement to sign electronically, not a consent to data processing.)

Where it lives

Documents and the database are stored in the United Kingdom (London). Documents are encrypted at rest and access is segregated per organisation. Email that you send to us is received in a data centre in the European Union.

Who we share it with

We do not sell personal data. Signing invitations and completed documents are delivered only to the recipients the sender names. We use a small number of providers to run the service, each bound by data-processing terms: Amazon Web Services (hosting, document storage and sending email), Supabase (database and sign-in), Stripe (payments and invoices), Zoho (the mailbox that receives email sent to us), MillionVerifier (checks that a recipient’s email address can receive mail before a document is sent — it is given the address and nothing else) and Google Workspace (the mailbox used for the business marketing described below).

Some of these providers may process data outside the United Kingdom. Where they do, the transfer is covered by UK adequacy regulations or by the contractual safeguards UK law requires.

Retention

Completed envelopes and their audit trails are retained as legal records, including after an organisation becomes inactive, so that signatures remain verifiable. Documents uploaded by signers at a sender’s request are retained only while that organisation is active, and for 30 days afterwards. Drafts and unsent data can be deleted on request, subject to legal-record obligations.

A request for access that we decline, or that is never taken up, is deleted 12 months after it was made; one that becomes an account is kept with that account. Account details, support conversations and the record of your acceptance of our terms are kept for as long as the account exists, and afterwards for as long as we need them to deal with any question or dispute about it — you can ask us to delete them sooner. Invoices and tax records are kept for at least six years, as UK law requires.

Your rights

You have the right to ask for a copy of your personal data, to have it corrected or deleted, to have our use of it restricted, to object to our use of it, and to receive it in a portable format. Email hello@getsignum.uk and we will reply within one month. For a document you were asked to sign, the organisation that sent it is the controller: contact it first, or write to us and we will pass your request on. Completed documents and their audit trails are legal records relied on by everyone who signed them, so we may not be able to delete those at one person’s request.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint — though we would appreciate the chance to put things right first.

Signing evidence

To make signatures defensible, we record when a document was viewed, consented to, and signed, along with the signer’s IP address and device information. This is stored with the document and shown on its certificate of completion.

Cookies and browser storage

We set no advertising or analytics cookies, and use no third-party tracking on this website or in the app. When you sign in, the app keeps your session, and the business you last worked in, in your browser’s local storage. That is strictly necessary for the app to work, so there is no cookie banner to dismiss. Signing out clears the session.

Website visits

We count visits to the public pages of this website so we can see how many people find us and from where. We do it without cookies and without storing anything on your device. For each visit we record the page, the time, the country (worked out by our hosting provider as the request arrives), the site or link you came from, and a rough device type such as “Mobile · Chrome”. We never store your IP address. To count distinct visitors we briefly turn the IP address and browser type into an anonymous code using a random key that is replaced every day, so the code cannot be turned back into an address or linked to your visits on another day. We rely on our legitimate interest in understanding how the website is used. Visit records are deleted after 12 months. Visits made while signed in are not counted.

Business marketing

From time to time we send a single email about Signum to UK limited companies we have not dealt with before, relying on our legitimate interest in telling businesses about the service. We send no follow-ups. Every such email carries an unsubscribe link that takes effect immediately, and you can object at any time by contacting us. If you ask, we will tell you where we obtained your details. We record whether the email was delivered, opened or replied to. We keep a record of the addresses we have written to, or plan to write to, so that nobody is written to twice, and of who asked not to be contacted, for as long as needed to honour it.