Data Protection Information for the Remote Signature System: signFLOW

1. General Information

In today's fast-paced and increasingly digital world, personal data is an important resource. Your data is valuable and must therefore be handled with the care required by various laws and regulations (GDPR, TDDDG, ...).

As a provider of local solutions (OnPremise), the manufacturer of signFLOW, Digital Data GmbH, places a clear focus on data protection and data security. For you, this means that only the necessary data is collected and stored (data minimization). Furthermore, current and secure technologies are used in processing.

Contact details of the manufacturer:

Contact the Data Protection Officer: privacy-flow@digitaldata.works

2. Responsible Entity for Data Processing

Your data is processed with confidence by:

Contact our Data Protection Officer: privacy-flow@digitaldata.works

3. Data Collection

3.1 The following categories of personal data are processed

• Names: Username, first and last names as well as your digital signature
• Contact details: Phone number, mobile phone number, and email address
• Technical data: IP address, time of access, or access attempts

3.2 Source of the personal data

You have previously provided the data mentioned under 3.1 to your business partner (the responsible entity). This transmission may have occurred verbally over the phone, in personal contact, via email, or via a contact form.

You transmit your digital signature independently when signing a document.

3.3 Retention periods / Storage duration

• Automatic email correspondence is stored for 6 years.
• Signed contracts are retained for the duration of their term + 10 years.
• The technical process is stored in the signFLOW software solution indefinitely, depending on the document or contract type.

Your personal data will generally be anonymized when:

• The contract has expired, and the statutory retention period is over.
• The contract was rejected by you or never signed.

The legal basis for these retention periods includes:

• Commercial Code (HGB)
• Tax Code (AO)
• Principles for the Proper Keeping and Retention of Books, Records, and Documents in Electronic Form and for Data Access (GoBD)

Depending on the specific type of document, the retention period may vary. Additionally, the periods may be extended in case of irregularities, such as a pending or ongoing legal dispute.

3.4 Purpose of processing

The personal data defined under 3.1 is processed to:

• Support or provide the technically necessary process.
• Enable you, as the end user, to sign a document digitally. This requires the identification of the applicant, application verification and processing, billing, and compliance with documentation requirements.

In individual cases, data is processed separately by the IT department, particularly in response to support requests, or possibly forwarded to the manufacturer for further processing.

Data processing also occurs to ensure information security, especially for the identification and prevention of attacks, and for conducting internal and external audits, export controls, and sanctions list checks. Information may also be transmitted to the relevant authorities in accordance with Section 8 (2) VDG.

3.5 Legality of processing

Your data is collected based on an impending or already existing business relationship.

The legal basis for the transmission to competent authorities is Section 8 (2) VDG. Requests from data subjects are processed in accordance with Articles 12 to 23 of the GDPR and Sections 32 to 37 of the Federal Data Protection Act (BDSG).

3.6 Legitimate interests

A legitimate interest of the responsible entity in accordance with Article 6 (1) (f) GDPR exists in the following cases:

Measures are taken for information security, which include both preventive technical and organizational measures as well as incident handling. The aim is to assess and avoid potential harm to the company, the individuals affected by data processing, and the users of trust services.

3.7 Necessity of data

The collected data represents the minimum necessary for the digital signature. Without the data mentioned under 3.1, the service cannot be operated.

It is particularly important to provide a mobile number or a German landline number, as this is used for authentication and signature triggering as a second factor. Without this security mechanism, the service cannot be provided.

3.8 Data transfer

Systematic data transmission does not take place.

Data is only forwarded to the manufacturer for support services in exceptional cases. A valid data processing agreement (DPA) exists with the manufacturer, which ensures the security and integrity of the handling of your data.

4. Use of Cookies

When visiting certain pages, temporary cookies are used, which are necessary for the technical provision of the services. These so-called session cookies do not contain any personal data and are automatically deleted after the session ends. Methods such as Java applets or Active-X controls that could track user behavior are not used.

5. Rights of Affected Persons

If you have questions about your data or wish to request correction, deletion, or restriction of processing, please send your request by mail or email to the address provided above. This also applies if you wish to object to the processing in accordance with Article 21 GDPR or request data portability.

If you have questions or complaints about a procedure, you can also contact us using the contact details provided. If you have further grounds for complaint, you can contact our supervisory authority. You can find out which supervisory authority is responsible for you here: Laender-node.html