Privacy Policy

1. Data we process

Account data: name, email address, organisation, hashed password and authentication settings.

Document and signing data: documents you upload, named-party information you supply, signer email addresses, one-time-code verification events, consent records, and the IP address and user agent captured as evidence of a signing event.

Technical data: log data, correlation identifiers and security events needed to operate and protect the Service.

2. Purposes and legal bases

To provide the Service and perform our contract with you (Art. 6(1)(b) GDPR).

To secure the Service, prevent abuse and keep tamper-evident audit and signing evidence, based on our legitimate interests and legal obligations (Art. 6(1)(f) and (c) GDPR).

One-time codes are sent to a signer's email to confirm control of that address; this is necessary to perform the signing service requested.

3. Evidence, immutability and retention

To keep signatures and seals trustworthy, the audit log and signing events are append-only and tamper-evident, and issued/sealed artefacts are retained as evidence. This means certain records cannot be altered or deleted on request where doing so would destroy the integrity of evidence or breach a legal obligation. We retain personal data for as long as needed for the purposes above and for applicable limitation periods, then delete or anonymise it.

4. Sharing and processors

We share personal data with service providers acting on our instructions (for example hosting and email delivery) under appropriate contracts, and with authorities where legally required. We do not sell personal data.

Where personal data is transferred outside your region, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

5. Your rights

Subject to applicable law, you may request access, rectification, erasure, restriction, portability, and object to certain processing, and you may lodge a complaint with your data-protection authority. Some rights are limited where we must preserve the integrity of evidence or comply with a legal obligation (see section 3).

To exercise your rights, contact privacy@veridock.eu.

6. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit, hashing of secrets, access controls and tamper-evident logging. No method of transmission or storage is completely secure.

7. Children

The Service is not directed to children and is intended for business use by adults.

8. Contact

Controller: DOC CLEAN CREW LIMITED, Suite 204, Coral House, Providence Industrial Estate, Mahé, Seychelles (company no. B8420816). Data-protection contact: privacy@veridock.eu.