Stackable E-sign Privacy Notice

1. Who is responsible for your information?

In Short: The company that sent you the document.

The Sender named in your document is responsible for your personal information. Please send questions and requests to the Sender's contact email below. We have not appointed a data protection officer, as none is required; the contact below handles privacy questions.

2. What information do we collect?

In Short: The details needed to show who signed a document and when.

• When you are added to a document: your name and email address, provided by the Sender, and any message the Sender adds for you, shown with the signing request.
• When you request a sign-in code: your email address, IP address and the time.
• When you open, sign or decline a document: how your identity was checked (an emailed code, typed or confirmed by a link in that email, and an access code where the sender requires one) and when, your IP address, browser and device, time zone, and the time of each step.
• What you enter: your signature and initials (drawn, typed, or uploaded as an image), any details you fill into the document, the version of the electronic signing consent you accept, your confirmation that you are the person the document was sent to, any note you send the Sender if you tell us you aren't the right person, and your reason if you decline. If you upload an image, it is processed on your device and only the cropped signature is sent to us; the rest of the image is not.

You are not required to provide this information, but we need it for you to sign electronically. If you prefer not to, please ask the Sender for a paper process instead.

3. How do we use your information?

In Short: To get the document signed and to be able to prove it was signed.

We use your information to show who signed a document and when. We rely on the following legal bases under the EU and UK General Data Protection Regulation ("GDPR"):

• Performing the agreement (GDPR Art. 6(1)(b)): getting the document signed and giving every signer a copy.
• Our legitimate interest in proving the document was signed (GDPR Art. 6(1)(f)): if the agreement is ever questioned, we need to show who signed it, when, and that it has not changed since.

We do not use your information for marketing, we do not sell it, and we do not make automated decisions about you.

4. Will your information be shared with anyone?

In Short: Only with the other signers, the people and providers who help us run the E-sign Service, and where needed for a legal claim or required by law.

• The other signers of the same document. Everyone who signs receives a certificate of completion showing each signer's name, email address, how their identity was checked, and the time of each step. It shows your IP address shortened, and only your browser type and operating system.
• The Sender's team, to manage the document.
• Our service providers: our hosting providers, and the affiliated company that operates the E-sign Service for us. They use your information only to provide the service to us.
• Advisers, courts and authorities, where needed to establish, exercise or defend a legal claim, or where the law requires it.

To date-stamp the signed document, we send a timestamp service a fingerprint of the document. The fingerprint contains no personal information.

5. Where is your information stored?

In Short: In the United States.

Our hosting providers store your information for us in the United States. If you are signing from outside the United States, your information will be processed in the United States.

6. How long do we keep your information?

In Short: Signed documents and their records for 10 years from completion; everything else for much less.

We keep signed documents, their certificates of completion and audit trails for 10 years after completion, or longer where needed for a legal claim, even if you ask us to delete your personal information. We need them to establish, exercise or defend legal claims and to meet our legal obligations.

7. How do we keep your information safe?

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate technical and organizational security measures designed to protect the security of any personal information we process, including encrypting documents in transit and at rest, keeping completed documents in write-once storage, and recording each step in an add-only audit log. However, please also remember that we cannot guarantee that the internet itself is 100% secure. You should only access the E-sign Service within a secure environment.

8. Do we collect information from minors?

In Short: We do not knowingly collect data from children under 18 years of age.

The E-sign Service is for signing business agreements. We do not knowingly collect personal information from children under 18 years of age. If you become aware that we have, please contact the Sender using the details in Section 1.

9. What are your privacy rights?

In Short: Depending on where you live, you may ask for a copy of your information, ask us to correct or delete it, or object to how we use it.

In some regions (like the European Economic Area ("EEA"), the United Kingdom ("UK") and Switzerland), you have certain rights under applicable data protection laws. These may include the right to ask us to:

• give you a copy of your personal information, or send it to you in a portable format;
• correct it;
• delete it, or restrict how we use it; and
• stop using it where we rely on our legitimate interest. We will stop unless we have compelling grounds or need it for a legal claim.

We keep signed documents, their certificates of completion and audit trails even if you ask us to delete your information, because we may need them to establish, exercise or defend a legal claim (Section 6). We delete everything else we no longer need.

To make a request, please email the Sender's contact address in Section 1. We will respond within one month. For complex or numerous requests we may extend this by up to two further months, and we will tell you if we do.

Complaints. If you are unhappy with how we handle your personal information, please contact us first. You also have the right to complain to a data protection supervisory authority: in the EEA, the authority where you live or work (list of EEA authorities); in the UK, the Information Commissioner's Office (ico.org.uk); in Switzerland, the Federal Data Protection and Information Commissioner (edoeb.admin.ch).

10. Do we make updates to this notice?

In Short: Yes, we will update this Notice as necessary to stay compliant with relevant laws.

We may update this Notice from time to time. The updated version will be indicated by an updated "Last Updated" date and will be effective as soon as it is posted here. If we make material changes to this Notice, we may notify you by prominently posting a notice of the change on the E-sign Service or by sending you a notification directly.

11. How can you contact us about this notice?

If you have questions or comments about this Notice, or wish to make a request about your personal information, please email the Sender named in your document at its contact address in Section 1, or write to it at the address shown there.