The GDPR / DPDP toolkit: DPA, privacy requests, export and erasure
What SignSpry gives organisations and individuals for data-protection duties: the DPA, privacy requests, data export and deletion.
SignSpry gives you the tools to meet your own data-protection duties and to answer people who ask about their data. Everything below works under the GDPR, the UK GDPR, India's DPDP Act and US state privacy laws.
Who is responsible for what
- Your documents (envelopes, recipients, field values, audit trails) belong to your organisation. You decide what they contain and why. SignSpry processes them for you, as your processor.
- Account, billing, support and website data about you and your colleagues is SignSpry's own. SignSpry answers requests about that directly.
For organisations (admins)
| You need to | Where | What happens |
|---|---|---|
| Sign a Data Processing Agreement | Account menu → Privacy & data → Data Processing Agreement | Enter your name and job title, tick the box confirming your authority, press Accept the DPA. Then Download signed copy (PDF) whenever you need it. |
| Prove signer consent | Privacy & data → Download consent records (CSV) | One row per signer consent, including which US ESIGN disclosure version they saw and when. |
| Take everything with you | Privacy & data → Export everything | A ZIP with every envelope, audit trails and a SHA-256 manifest. See Taking your data with you. |
| Close the organisation | Privacy & data → Delete this organisation | A 30-day grace period, then permanent deletion. |
| Limit how long documents stay | Admin → Signing defaults | Automatic purging. See Retention and automatic purging. |
The DPA is published at /legal/dpa. It covers roles and instructions, sub-processors, security measures, assistance with data-subject requests, deletion and return, and the transfer terms: the EU Standard Contractual Clauses, with the UK addendum and Swiss adjustments where they apply. If the text is ever updated, the page shows "The text has changed since you last accepted it" and you can accept the new version.
For individuals
- Any signed-in member can use Download my data (JSON) on Privacy & data to get their profile, security history, settings and the envelopes they sent or were asked to sign. Delete my account removes their name and email and signs them out everywhere. It is refused if they are the only person or the only admin in the organisation. See Download or delete your own data.
- Anyone, with or without an account, can use the public privacy request form. Choose to see or copy your data, delete it, correct it, opt out of sale, sharing or marketing, or something else, and pick the law that applies to you (GDPR, UK GDPR, US state laws, DPDP, or another country).
- Advertising measurement can be switched off at Your privacy choices. A browser's Global Privacy Control signal is honoured automatically.
What happens to a request
- You send the form and get an email with a confirmation link. It works for 72 hours, and the request starts when you confirm.
- You see a reference and a date by which SignSpry will answer. That is usually 30 days, or 45 days under US state laws.
- For SignSpry's own data, SignSpry sends you a report by email and, if you asked for deletion, anonymises your user and removes contact details from support, email and marketing records. If that would leave an organisation without an admin, a person resolves it first.
- If the request is about documents an organisation sent you, SignSpry forwards it to that organisation's admins, because they control that data. They answer you directly.
- You get a written reply when the request is closed. If a US request is declined, replying "Appeal" within 60 days starts an appeal.
Where the data is
All customer data is hosted in Mumbai, for every customer worldwide. See Where your data is, and how it is backed up.