Privacy Policy – evidona Cloud

Draft – pending legal review. The German version is authoritative; this English version is a non-binding translation.

This privacy policy describes how we process personal data in connection with the evidona cloud service provided via *.evidona.ch (hereinafter the “Service”). It applies exclusively to the cloud offering. This privacy policy does not apply to self-hosted operation on the Customer’s own infrastructure (see Sections 2 and 7).

1. Controller and Data Protection Contact

The controller responsible for the processing described below is:

SimplyConnect GmbH, Schulstrasse 2b, 5426 Lengnau, Switzerland (UID CHE-160.031.708), represented by Daniel Baumann (hereinafter “SimplyConnect”, “we” or “us”).

General contact: office@simplyconnect.ch. Data protection enquiries: datenschutz@simplyconnect.ch.

Legal review: Clarify the requirement to appoint a data protection advisor (revFADP/Swiss DPA) as well as an EU representative or data protection officer (Art. 27 / Art. 37 GDPR).

2. Scope and Applicable Law

This privacy policy applies to the processing of personal data in the evidona cloud Service. The Swiss Data Protection Act (revFADP/Swiss DPA) applies, as well as, where relevant, the EU General Data Protection Regulation (GDPR).

It concerns the following persons: the Customer / Organisation and its Authorised Users (account holders and users) as well as the Signers and Guest Signers invited to sign.

Excluded from self-hosting: If the Customer operates the software on its own infrastructure (self-hosting), the Customer is the sole controller and operator. In this case, SimplyConnect acts exclusively as licensor and does not process the personal data arising in that context. The license agreement (software license agreement) applies, not this privacy policy.

3. Categories of Data Processed

In the Service, we process in particular the following categories of personal data:

  • Account data: information about the Organisation and the Authorised Users (name, business email address, role, login credentials and multi-factor authentication factors, language settings).
  • Uploaded documents: the files uploaded by the Customer for signing and their content. These are only retained briefly (see Section 6); evidona does not archive the Documents.
  • Signer data captured in the signing room: name, email address (mandatory) and – where delivery of a one-time code (OTP) by SMS is chosen – the Signer’s telephone number.
  • OTP and signature logs: technical log data of the signature event, including the time, delivery and confirmation of the one-time code (OTP) as well as the IP address and device information (e.g. user agent) captured at the time of signing.
  • Evidence Bundle / proof record: the sealed proof generated for each signing run, containing a qualified timestamp, a SHA-256 integrity hash, Signer metadata and the signature log. This is retained for a longer period (see Section 6).
  • Billing data: plan, order and invoicing information as well as the data required for payment processing (payment processing is carried out via an external payment service provider, see Section 8).
  • Future identity verification data (IDV): for the planned “legal document review” (identity verification), additional identification data will be processed in the future. This feature is not yet active; the details will be supplemented upon introduction.

Legal review: Define the specific data fields of the future identity verification (IDV/KYC) as well as their legal basis and retention before activation.

We process the data for the following purposes and on the following bases:

  • Provision of the Service (performance of contract): management of accounts and Authorised Users, execution of the signing workflows, invitation and authentication of Signers, and generation of the Evidence Bundle. The basis is the performance of the contractual or usage relationship established with the Customer or the Signer (Art. 31 revFADP/Swiss DPA; Art. 6(1)(b) GDPR).
  • Integrity and preservation of evidence (legitimate interest): generation and longer-term retention of the proof record in order to ensure the integrity and subsequent verifiability of a signature. The basis is our overriding legitimate interest in robust evidence (Art. 6(1)(f) GDPR; Art. 31(1) revFADP/Swiss DPA).
  • Security and abuse prevention (legitimate interest): logging, detection and prevention of abuse, fraud and security incidents, as well as ensuring secure operation. The basis is our legitimate interest in the security and integrity of the Service (Art. 6(1)(f) GDPR; Art. 31(1) revFADP/Swiss DPA).
  • Billing (contract and legal obligation): processing of billing and invoicing data for the performance of the contract and to comply with commercial- and tax-law retention obligations (Art. 6(1)(b) and (c) GDPR; Art. 31 revFADP/Swiss DPA in conjunction with the statutory obligations under the Swiss Code of Obligations (CO)).

5. Signature Level and Evidence Bundle

The level achieved for each signature is determined server-side and recorded in the Evidence Bundle. evidona uses an honest two-tier model:

  • Advanced electronic signature (AES): where the signature is provided by a registered, authenticated Authorised User who has an account and confirms via a one-time code (OTP).
  • Simple electronic signature (SES): where the signature is provided by a Guest Signer who does not have an account and confirms solely via a one-time code (OTP) delivered by email or SMS.

The planned “legal document review” (identity verification) is envisaged as a future higher level. evidona does not offer a qualified electronic signature (QES) and does not warrant one.

For each signing run, an Evidence Bundle is generated that includes a qualified timestamp, a SHA-256 integrity hash, the Signer metadata and the signature log. It enables subsequent verification that the Document has remained unchanged since signing, and by whom and when it was signed. The details of the signature level are governed by the GTC and the consent to electronic signing.

Legal review: Confirm the robustness of the AES classification (account + OTP) under ZertES/eIDAS as well as the data protection design of the future identity verification.

6. Retention and Deletion

  • Uploaded documents: The content of uploaded and signed Documents is automatically deleted after a defined period (default: 90 days, configurable per Organisation or plan). evidona does not archive the Documents. The Customer is responsible for downloading completed Documents in good time and retaining them itself.
  • Proof record / Evidence Bundle: The proof record (SHA-256 hash, timestamp, Signer metadata, signature log) is retained for a longer period in order to keep the integrity of a signature permanently verifiable. It does not contain the content of the Document itself.
  • Billing data: Invoicing and accounting data are retained to comply with statutory retention obligations (under the Swiss Code of Obligations (CO), generally around 10 years).
  • Account data: We process account data for the duration of the contractual relationship and subsequently delete or anonymise it, unless a statutory retention obligation prevents this.

Legal review: Bindingly define the specific retention period of the proof record as well as the commercial-/tax-law retention period of the billing data (Swiss Code of Obligations (CO), VAT Act).

7. Processing on Behalf and Roles

In cloud operation, a shared allocation of roles applies:

  • Documents uploaded by the Customer: With respect to the content of the uploaded Documents and the personal data contained therein, we act as processor and the Customer / Organisation as controller. The Data Processing Agreement (DPA), which governs the processing on our behalf, applies in addition.
  • Account, billing and usage data as well as the proof record: For this data, we are ourselves the controller. We maintain the proof record on our own responsibility on the basis of our own integrity interest (see Sections 4 and 6).

In the case of self-hosting, this allocation of roles does not apply: there, the Customer is the sole controller and there is no DPA with SimplyConnect, as long as no personal data is transmitted to the licensor. A future document review connected to the licensor (“phone home”) would, to that extent, trigger a connected-service DPA.

Legal review: Confirm the delineation of controller/processor for the proof record as well as the triggering of a connected-service DPA in the case of a connected self-hosting document review.

8. Processors and Recipients

To provide the Service, we engage carefully selected processors. These include:

  • Hosting / infrastructure: data centre and hosting providers in Germany / the EU.
  • Payment service provider: Mollie or Payrexx (for handling billing).
  • Email and SMS delivery: providers for the delivery of notifications and one-time codes (OTP) by email and SMS.
  • Future IDV/KYC provider: for the planned identity verification; the provider has not yet been selected and will be named before introduction.

We do not disclose data to third parties for their own purposes. Disclosure takes place only to the processors named and, to the extent legally required, to competent authorities.

Legal review: Confirm the final selection and naming of the processors (hosting, payment service provider, email/SMS delivery, IDV provider) as well as their inclusion in the processor register of the DPA.

9. Hosting, Data Location and Transfer to Third Countries

Hosting and data storage take place in Germany / the EU (not in Switzerland). The transfer of personal data between Switzerland and the EU is covered by the mutual adequacy of the data protection levels.

To the extent that, in an individual case, a transfer to a country without an adequate level of data protection becomes necessary, we base such transfer on appropriate safeguards (in particular standard contractual clauses / SCC) and supplementary measures.

Legal review: Confirm the actual hosting locations as well as any transfers to third countries (sub-processors) and the safeguards required for them (SCC).

10. Data Security

We take appropriate technical and organisational measures to protect personal data, in particular: transport encryption (TLS) during transmission, encryption of stored data (encryption at rest), role-based access control and authorisation management, confirmation of identity in the signing process via a one-time code (OTP), and a tamper-evident sealed Evidence Bundle to safeguard integrity. In doing so, we control the time source, the signature log and the integrity seal.

11. Rights of Data Subjects

Under the applicable law, data subjects have in particular the right to information, rectification, deletion, restriction of processing, data release or portability, as well as the right to object to processing and to withdraw consent that has been given.

Please direct requests to datenschutz@simplyconnect.ch. If the request concerns the content of Documents uploaded by the Customer, we forward it as processor to the responsible Customer or act on the Customer’s instructions (see Section 7).

Limit on deletion in the case of the proof record: The right to deletion does not apply without limitation. We retain the proof record (Evidence Bundle) even after deletion of the document content, since our legitimate interest in the permanent verifiability of the integrity of a signature as well as statutory retention obligations preclude its deletion.

12. Supervisory Authorities

You have the right to lodge a complaint with a supervisory authority. In Switzerland, the competent authority is the Federal Data Protection and Information Commissioner (FDPIC). Where the GDPR applies, a competent data protection supervisory authority in the EU may additionally be contacted.

Legal review: Determine and name the lead EU supervisory authority (hosting location Germany).

13. Children and Cookies

The Service is aimed at Organisations and their Authorised Users as well as at invited Signers and is not intended for children.

In the Service, we use exclusively technically necessary cookies or local-storage entries that are required for login, session and security. In the Service, we do not use any marketing or analytics trackers (e.g. Google or LinkedIn); such tools relate exclusively to our marketing website and are addressed in its separate privacy policy.

14. Changes to this Privacy Policy

We may amend this privacy policy with reasonable advance notice, for example in the event of changes to the Service or the legal situation. The version published in the Service from time to time is authoritative. The German version is authoritative; the English version is a non-binding translation. Status: see the version information at the bottom of the page.

← Back to home