Consent to Electronic Signature

Draft – pending legal review. The German version is authoritative; this English version is a non-binding translation.

This short text is shown to you as the signing person (hereinafter “Signer”; if you do not have an account, “Guest Signer”) at the time of signing. It explains what you consent to when you electronically sign a Document via evidona. Responsible for the Document you sign is the organisation that invited you to sign (hereinafter “Customer / Organisation”).

By completing the signing process, you consent to signing the presented Document electronically instead of by hand, and you confirm that your electronic signature is deemed an expression of your intent. For transactions that the law does not subject to a particular form (form-free transactions, cf. Art. 11 Swiss Code of Obligations (CO)), the electronic signature satisfies the formal validity. Where the law mandatorily requires written form or a qualified electronic signature (QES) for a Document, evidona is not suitable for this purpose; evidona does not offer QES.

Legal review: Confirm the robustness of the consent solution for form-free transactions as well as notes on form reservations (Art. 11 et seq. CO).

2. Signature Level Achieved

The signature level achieved per signature is determined server-side and recorded in the Evidence Bundle:

  • Advanced electronic signature (AES): when you sign as a registered, authenticated user with an account and confirmation via one-time code (OTP).
  • Simple electronic signature (SES): when you sign as a Guest Signer without an account and your identity is confirmed solely via email or telephone number (one-time code/OTP).

evidona does not warrant a qualified electronic signature (QES). A future additional legal document review (identity verification) may enable a higher level; it is currently not part of this process.

Legal review: Confirm the classification of AES (account + OTP) and SES (guest + OTP) under ZertES/eIDAS.

3. Data We Process

For carrying out the signature and for evidentiary purposes, we process: your name, your email address or telephone number, the confirmation of the one-time code (OTP), your IP address and technical device information as well as timestamps. The purpose of this processing is to confirm your identity in the signing process, to deliver the Document, and to build a tamper-evident record. This data is required for a traceable and verifiable signature.

4. Evidence Bundle

For each signing run, a sealed Evidence Bundle is generated. It contains a qualified timestamp, a SHA-256 integrity hash of the Document, your Signer metadata as well as the signature log. The Evidence Bundle proves that the Document existed at a specific point in time in a specific, unaltered state (integrity) and by whom it was signed. If the content of a Document is subsequently altered, the SHA-256 hash no longer matches.

5. Representation (“on behalf of” / Deputy)

If you sign “on behalf of” another person or as their deputy, you confirm that you are authorised to provide the signature for the represented person. The signature is attributed to the represented person; the representation is noted in the Evidence Bundle. You are responsible for ensuring that a corresponding power of attorney or authorisation actually exists.

Legal review: Review the attribution and proof of the power of representation (Art. 32 et seq. CO) as well as its presentation in the Evidence Bundle.

6. Controller, Retention and Data Protection

The controller under data protection law for the Document you sign is the organisation that invited you. SimplyConnect operates the cloud at *.evidona.ch as a processor for the organisation and is the controller for the evidentiary record (integrity interest) as well as for account, billing and usage data. The Document content is automatically deleted after a period set by the organisation or its plan (default: 90 days); evidona does not archive Documents. Only the Evidence Bundle or the evidentiary record is retained longer. Hosting and data storage take place in Germany / the EU. Details are governed by the privacy policy. The operator of the cloud is SimplyConnect GmbH, Schulstrasse 2b, 5426 Lengnau, Switzerland (UID CHE-160.031.708), represented by Daniel Baumann; contact office@simplyconnect.ch, data protection datenschutz@simplyconnect.ch.

7. Self-Hosting Operation

If evidona is operated on the organisation’s own infrastructure (self-hosting), then SimplyConnect GmbH is exclusively a software provider (licensor) and not the operator of the instance. In this case, the respective organisation is the operator and sole controller. Your data is processed on its infrastructure; SimplyConnect does not obtain any access to it and makes no warranty as to the validity or evidentiary value of the signatures generated on customer infrastructure. Please direct concerns regarding data protection and the signature to the operating organisation.

Legal review: Review the delineation of responsibility towards third-party signers in self-hosting (liability gap) as well as the triggering of a connected-service DPA by the future phone-home document review.

8. Status and Language

The German version is authoritative; the English version is a non-binding translation. French and Italian versions will follow. Status: see the version information at the bottom of the page.

← Back to home