Your data when you sign

The short version

• The person who sent you the document is responsible for the data. Asamla AB runs the service for the sender.
• When you open the page, sign or decline, data about you is stored as evidence of what happened: your name, e-mail address, the time, your IP address and your browser and device. You cannot sign without it being stored.
• A case that everyone has signed is kept for 10 years, unless the sender chose a shorter time.
• You can ask to see, correct or erase the data, and you can complain to the Swedish Authority for Privacy Protection (IMY).

Who is responsible

The sender is the controller. The sender is the company, organisation or person who sent you the document. The name is at the top of the signing page and in the e-mail you received.

Asamla AB, reg. no. 559564-0920, Industrigatan 7, 646 35 Gnesta, Sweden, runs Asamla Sign and processes the data on the sender's behalf. Asamla is then the processor.

If a private individual sends the document for purely private purposes, data protection rules do not apply to that person. Asamla AB is then responsible for the data that Asamla Sign stores about you.

What the document says, and why the sender wants your signature, is up to the sender. Ask the sender about that.

What is stored about you

This is stored, depending on what you do in the case:

• Your name and e-mail address, as the sender entered them when the document was sent. If you came here from a form on the sender's website, what you filled in is stored too.
• That you opened the page, and when. The first time, the time is stored together with your IP address and details of your browser and device (user agent).
• Each time you ask for a one-time code, we store that it was sent, when, to which e-mail address, and your IP address and browser. The code itself is not stored, only a fingerprint of it, and the fingerprint is removed when you have signed.
• Your signature: the name you typed and, if you drew it, the image of the drawing. Also the time to the second, the method (typed or drawn signature), the exact text you accepted, the fingerprint of the document your page showed, a verification ID, and the IP address and browser you signed from.
• What you write yourself: the comment if you approve as a reviewer, and the reason if you decline.
• The history of the case: each event, such as being invited, receiving a reminder, opening, signing or declining, is stored with its time. Each event carries a fingerprint of the one before it, so a later change is detected.
• What happened to the e-mails we sent you: delivered, bounced, marked as spam or failed. Where the sender's e-mail domain has open tracking on, that you opened the e-mail is stored too.
• The document and, when everyone has signed, the signed and sealed document. It has a signing certificate with each signer's name, e-mail address, time, method and IP address, and with drawn signatures.

No personal identity number is stored, and signing with BankID does not exist today.

Why, and on what basis

The data is stored for three purposes:

• So that the sender can send you the document and you can review, sign or decline it. This includes the e-mails with the link, the one-time code, reminders and the signed document.
• So that a signature can later be shown to be genuine: who signed, when, what, and that the file has not changed since.
• So that no one else signs in your name. The one-time code sent to your e-mail, and the limit on how many times a code can be tried, belong here.

The sender's legal basis is contract (GDPR article 6(1)(b)), where the signature concerns a contract you are entering into, and legitimate interest (6(1)(f)), in being able to prove a signature. Where Asamla AB is the controller, the basis is legitimate interest in being able to show that a signature is genuine.

You do not have to sign. But you cannot sign with Asamla Sign without the data being stored, because the evidence is the point. If you do not want that, you can decline, or ask the sender for another way to sign.

How long the data is kept

• If everyone has signed, the case is kept, with the document, the signed document and the evidence, for 10 years from the day everyone had signed. The sender may instead have chosen 2, 5, or 7 years.
• A case that nobody has signed, for example because it was declined, withdrawn or expired, can be deleted by the sender at any time. If anyone has signed, the sender cannot delete it.
• This applies even if the sender stops using Asamla: signed cases are still kept for the retention time.
• When the time has passed, the case is not deleted by itself today. Ask the sender or us to delete it then.
• What is deleted remains in our backups for about 35 days at most.
• E-mails and signed documents that have already been sent to you and the others in the case remain with their recipients. We cannot delete those.

Who receives the data

• The sender, and those in the sender's organisation who may see the case, see your name, your e-mail address, what you did and when, your comment or your reason for declining, the documents and the history. The sender can retrieve an evidence file that also has the IP address and browser. If the sender uses the Asamla Sign API or an integration, the sender's own systems can retrieve the case with the participants' names and e-mail addresses.
• The others in the case see your data. The signing page shows the participants' names, roles and status, but not e-mail addresses. When everyone has signed, everyone in the case receives the signed document with the signing certificate by e-mail, and it states each signer's name, e-mail address, time and IP address.
• Anyone who has the address printed on a signed document can open its verification page. It shows the sender's name, the case title, the signers' names, method and times, and the document's fingerprint, but no e-mail addresses, no IP addresses and not the content of the document.

We disclose data to an authority or a court if we are required to by law.

Transfers outside the EU

The database and the documents are in Sweden. Resend, which sends the e-mails, is in the USA, and Vercel is an American company even though the data is stored in Stockholm. Name, e-mail address and the content of the e-mails, with the signed document attached when everyone has signed, go to Resend when an e-mail is sent. The transfer relies on the EU–US Data Privacy Framework (DPF), as we state in our list of sub-processors.

Supabase's support can, when troubleshooting, see operating logs and metadata from the USA and Singapore, but not the content of the database without our explicit permission.

Your rights

You have the right to:

• find out whether we hold data about you and get a copy of it
• have incorrect data corrected
• ask for erasure. The sender may refuse it for as long as the data is needed as evidence, for example during the retention time
• ask for the processing to be restricted
• object to processing that is based on legitimate interest
• receive the data you yourself provided in a common format, where the legal basis is contract

Write to the sender or to us at hej@asamla.se. Say which document it concerns and which e-mail address the e-mail came to, so that we find the right case. If you write to us, we pass your request on to the sender and help to find the data. Where Asamla AB is itself responsible, we answer. An answer is due within one month, and we may need to ask you to show that the data concerns you.

Because you have no account, you cannot download or erase the data yourself in the service.

Contact and complaints

Questions about how your data is processed: hej@asamla.se, or Asamla AB, reg. no. 559564-0920, Industrigatan 7, 646 35 Gnesta, Sweden.

You have the right to complain to the Swedish Authority for Privacy Protection (IMY), imy.se, if you consider that your data is processed in breach of the data protection rules.

Cookies and tracking

The signing page, the verification page and this page show no cookie banner and have neither analytics nor ad tracking.

Further reading

• Privacy policy
• Sub-processors
• Terms of use
• Security and legal in Asamla Sign