Privacy Policy

Signum | Effective Date: March 11, 2026

1. Data Controller

Armlab, Brussels, Belgium — [email protected]

2. Data We Collect

  • Account information: name, email, company, billing address
  • Documents you upload and signature images
  • Signatory names and email addresses
  • Audit logs: timestamps, IP addresses, signing status
  • Usage data: pages visited, browser, device type

3. Legal Basis (GDPR)

  • Contract performance: account management, document processing, billing
  • Legitimate interest: security, fraud prevention, eIDAS compliance
  • Legal obligation: tax and regulatory requirements
  • Consent: marketing communications (opt-in)

4. Data Retention

  • Account data: retained during account lifetime + 30 days after deletion
  • Billing records: 7 years (Belgian tax law)
  • Audit logs: 5 years (eIDAS)
  • Documents: 90 days after cancellation, then deleted
  • Usage/server logs: 12 months

5. Third-Party Processors

  • Stripe (payments) — USA with GDPR safeguards
  • Brevo (transactional email) — EU
  • Hetzner (hosting) — Germany, EU

We do not sell your data.

6. Your GDPR Rights

You have the right to: access your data, correct inaccuracies, request deletion, restrict processing, data portability, and object to processing. Contact us at [email protected]. We respond within 30 days.

7. Cookies

We use only essential session cookies (login sessions, preferences). No third-party analytics cookies. No consent banner required for core functionality.

8. Security

We use TLS encryption in transit, encryption at rest, access controls, and regular security audits.

9. Data Breach Notification

In case of a breach posing risk to your rights, we notify you and relevant authorities within 72 hours.

10. Supervisory Authority

You may lodge a complaint with Belgium's Autoriteit Persoonsgegevens (gegevensbescherming.be).

11. Contact

Armlab — Brussels, Belgium — [email protected]