Privacy notice

Who is responsible for your information

SendSignatures is the responsible party for the personal information described in this notice. Our business and Information Officer contact details appear on this page.

Information we collect

We collect information you give us, information created through your use of the service, and limited technical information needed to operate and secure it.

• Account details such as your name, email address, password hash and verification status.
• Signature, company, brand and employee details that you or an authorised company administrator enters, including uploaded logos and photographs.
• Purchase records such as plan, amount, currency, Paystack reference and payment status. SendSignatures does not receive or store full card or bank credentials.
• Security and operational records such as session data, rate-limit identifiers, timestamps, audit events and sanitised error logs.
• Messages and information you send when asking for support or exercising a privacy right.

Why we process it

We process personal information to provide and administer accounts, generate and store signatures, deliver transactional email, process purchases, prevent abuse, answer support requests, maintain records, comply with law and improve service reliability. We rely on performance of our agreement, legal obligations, legitimate operational and security interests, and consent where consent is legally required.

Employee and team information

A company administrator may add information about employees or team members. That customer is responsible for having authority and a lawful reason to provide the information, keeping it accurate, and informing affected people. SendSignatures processes it to provide the requested company features.

When an administrator distributes a signature, we email the employee a private, expiring installation link. We record delivery attempts and the first time the link is opened or its copy control is used so the administrator can support rollout. These operational records do not reveal the employee’s email contents or activity in their email client. Links can be rotated or revoked and expired distribution records are removed on the documented retention schedule.

Company administrators may add centrally managed campaign banners to employee signatures. We do not record banner image requests. When a recipient follows a campaign link, we increase an aggregate click total for that campaign without storing an employee-level click record.

Service providers and disclosures

We disclose only what is reasonably necessary to providers that support hosting, email delivery, payments, security and professional advice. Paystack processes payment credentials on its hosted checkout. We may also disclose information where required by law, to protect rights or security, or in connection with a lawful business transfer. Providers must be selected and managed with appropriate privacy and security protections.

International processing

Some service providers may process information outside South Africa. Where that happens, we take reasonable steps to use recipients, contractual protections or other grounds that provide an adequate level of protection as required by applicable law.

Retention

We keep information only for as long as reasonably needed for the purposes above, including providing an active account, resolving disputes and meeting tax, payment, security and legal-record obligations. Expired temporary tokens and operational logs are removed on documented schedules. Account deletion removes the account and owned personal assets, subject to records that must lawfully be retained or preserved.

Security and incidents

We use access controls, password hashing, encrypted transport, server-side validation, restricted storage, signed payment verification and audit records. No online service can guarantee absolute security. If a qualifying security compromise occurs, we will investigate and notify the Information Regulator and affected data subjects as required by law.

Your choices and rights

Subject to applicable law, you may ask whether we hold your personal information, request access or correction, ask for deletion or restriction, object to certain processing, or withdraw consent where processing depends on consent. Account tools provide profile correction, data export and account deletion. You may also contact the Information Officer. We may need to verify your identity before acting.

Cookies and analytics

SendSignatures uses an essential session cookie for login, security and continuity. When analytics is configured, our consent panel offers a separate choice for optional Google Analytics or Google Tag Manager measurement. We use basic consent mode: no Google analytics tag loads and no pre-consent product events are sent to Google unless you accept. Your preference is stored in your browser so we can respect it on later visits. You can reopen Cookie settings at any time to accept or withdraw analytics consent. Withdrawing consent stops new analytics events and removes accessible Google Analytics cookies for this site. Blocking the essential session cookie will prevent account features from working.

Children

The service is intended for people who can lawfully enter into this agreement and is not directed at children. Do not submit a child’s personal information without the authority and protections required by law.

Questions and complaints

Contact the Information Officer first at hello@sendsignatures.co.za so we can investigate. You may also lodge a POPIA complaint with the Information Regulator (South Africa).

Information Regulator contact and complaints →