Privacy Policy

1. Who we are

The controller for the data described here is Alexander Duggleby, a sole proprietor trading as SimpleSoftware365, of Marxergasse 24/2, 1030 Vienna, Austria ("we", "us"). You can reach us at hello@simpletrustcenter.com.

2. What this policy covers

This policy covers the SimpleTrustCenter website, the web app, the trust centers it hosts and the API. The role we play depends on whose data it is:

• Company users. For the data of the people who sign up a company and work in its account, we are the controller. This policy mainly describes that.
• The company's customers and visitors. For the personal data of the people a company works with through its trust centers, such as its customers' legal administrators, signers and document subscribers, the company (the account holder) is the controller and we are its processor. The company decides whom to invite and why, and we handle that data only on its instructions to provide the service. A data processing agreement under Article 28 GDPR is available on request at hello@simpletrustcenter.com.

If you signed an agreement or subscribed to documents in a company's trust center, please contact that company first, since it is responsible for why your data is used. You are also welcome to contact us, and we will help you reach the right person or deal with your request ourselves.

3. Data we collect

Account data

A company account has an owner, who can invite administrators and assign them to trust centers. When you or the members of your account sign in, we receive each person's email address and the name they give us. We send a magic link to that address instead of using a password. We also record the company's name, home region, plan, invoice details and settings, and the API keys the owner issues, of which we store only a hash.

Documents

Members and API keys upload documents and DPA templates. We store each version, its converted web and PDF forms, and who submitted, approved and published it. Published documents are public. Documents may contain personal data, such as a contact name, if the company includes it.

Customer and signing data

A customer's legal administrators sign in with a magic link like company users. They create a customer organisation with its legal name and address, invite colleagues and choose signers. A signer verifies their email address and gives their name and the signing details the agreement asks for. For each signed agreement we keep the completed agreement, the values entered, the template version, the acceptance wording, the signer's verified identity and the times of each step, as evidence of the signature.

Subscriptions and notifications

Visitors can subscribe to documents or a whole trust center with their email address. We store the subscription and the person's notification preferences. For each email we send, we keep a delivery record with the recipient, the type of email, its subject and its delivery status.

Audit log

We keep an audit log of what happens in each account: who did what and when, such as sign-ins, uploads, approvals, publications, signing steps, and role and settings changes. The log is part of the evidence for published versions and signed agreements.

Usage and technical logs

Our servers keep technical logs, such as requests, errors and security events, which can include IP addresses and user agents.

Website

The website sets no cookies and uses no analytics. The web app and trust centers use only strictly necessary cookies to keep you signed in and secure your session.

4. How and why we use it

We only use personal data when we have a legal basis under Article 6 GDPR.

Where we rely on legitimate interests, we weigh them against your rights, and you can object as described in section 10.

5. Who we share data with

We do not sell personal data, and we do not use it for advertising. We share it only with:

• The company whose trust center you use, which can see the customer organisations, signers, signed agreements and subscriptions in its account.
• Service providers (subprocessors) who help us run the service, under contracts that require them to protect the data. They are listed below.
• Authorities and advisers, where the law requires it or where we need to protect our rights.

6. Where your data is stored

We run two separate regions: the EU (Microsoft Azure, West Europe) and the US (Microsoft Azure, Central US).

• The company chooses a region. Each company account lives in exactly one region, chosen at sign-up. It cannot be moved later.
• It stays in that region. All data we store for the account stays in its region, including documents, signed agreements, audit records, logs, backups and archives. The two regions share no customer data, and emails are sent by the provider for the account's region.

Signed PDFs are timestamped by a trusted timestamp service. It receives only a fingerprint (hash) of the document, not its content or any personal data.

7. International transfers

For accounts in the US region, data is stored in the US. For accounts in the EU region, it is stored in the EU. Some of the providers in section 5 may process data elsewhere. Where personal data is transferred outside the European Economic Area, we rely on an adequacy decision, such as the EU-US Data Privacy Framework for certified US providers, or on the European Commission's Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for details at hello@simpletrustcenter.com.

8. How long we keep data

• Documents, signed agreements and their evidence are kept for as long as the company's account exists, including previous versions and replaced agreements, so the history stays complete.
• The audit log is kept for as long as the company's account exists.
• Subscriptions are kept until the person unsubscribes or the account ends.
• Email delivery records are deleted 30 days after the email was created.
• Account deletion. When a trial or paid plan ends without renewal, trust centers go offline after a 7-day grace period, and the account's data is deleted on day 37. Archives of its signed agreements are kept in the account's region for one year after that, and are then deleted.
• Technical logs are kept for 30 days.

We may keep some data longer where the law requires it, for example accounting records, or where we need it to handle a legal claim.

9. Security

We use reasonable technical and organisational measures to protect personal data, including encrypted connections and limiting access to people who need it. No system is perfectly secure. If a breach affects your personal data in a way the law says we must report, we will tell you and the authorities as required.

10. Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent where we rely on it. To use any of these rights, email hello@simpletrustcenter.com. We will answer within one month.

You can also complain to the supervisory authority. For us that is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at. You may complain to the authority in your own country instead.

11. Children

The service is not for anyone under 16, and we do not knowingly collect personal data from children. If you think a child has given us data, please tell us and we will delete it.

12. Changes to this policy

We may update this policy. If a change is significant, we will tell you by email or in the app before it takes effect. The date at the top shows when it was last updated.

13. Contact

For questions or requests about your data, email hello@simpletrustcenter.com, or write to Alexander Duggleby, Marxergasse 24/2, 1030 Vienna, Austria.