Privacy and Personal Data Processing Policy (GDPR) for the Vchasno Sign Service

1. General Provisions and Legal Bases

1.1. This Privacy and Personal Data Processing Policy describes how VCHASNO SERVICE LIMITED LIABILITY COMPANY (hereinafter referred to as ‘we’, the ‘Company’, or the ‘Operator’) collects, uses, stores, and transfers the personal data of any person who uses the Vchasno Sign online service (hereinafter referred to as the ‘User’ or ‘Data Subject’), available at http://sign.vchasno.ua/eu-sign (hereinafter referred to as the ‘Service’).

1.2. By using the Service, registering in the system, or signing documents using the Service’s infrastructure, the User gives consent and confirms that they have read the terms governing the processing of their personal data in accordance with the Law of Ukraine on Personal Data Protection and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR).

1.3. The main legal bases for processing data are:

• processing necessary to provide document signing services, intermediary services, and verification of the signatory’s identity;
• ensuring cryptographic security, legal significance, evidentiary value, and long-term storage of signed documents;
• compliance with Ukrainian and EU legislation on electronic trust services, financial accounting, and tax accounting;
• cases specifically provided for by the Service’s functionality.

2. Categories of Personal Data

To ensure the operation of the Service, the Operator processes the following categories of personal data of Users and their representatives:

• last name, first name, and patronymic;
• job title (if provided);
• business entity/company name (if provided);
• taxpayer registration number (RNOKPP) or its equivalent;
• email address (if provided);
• IP address, date and time of signing, and browser and device information.

3. Mandatory Cross-Border Data Transfers and Involvement of Third Parties

The User understands and gives unconditional consent that, to enable the creation, display, verification, and validation of electronic signatures in accordance with European international standards (eIDAS), their personal data is transferred to and processed by the Operator’s engaged international partners and processors (including through the use of technological infrastructure and secure servers within the European Union):

• Cloud infrastructure provider (Amazon Web Services / AWS, EEC, Ireland): provides data storage and hosting under a Data Processing Agreement (DPA) in accordance with Article 28 GDPR;
• The eID Easy signing and document management service (Republic of Estonia) provides functionality for creating, displaying, transferring, and storing electronic documents;
• The qualified trust service provider Certum (Republic of Poland) performs the issuance, verification, identification, authentication, and validation of QES/eIDAS certificates in accordance with the requirements of the eIDAS Regulation.

4. Purposes of Data Processing

Personal data is processed exclusively for the purposes of:

• ensuring the proper operation of the Service and providing intermediary services for the electronic signing of contracts;
• verifying the authority and identity of Signatories;
• ensuring the cryptographic integrity of documents and QES/eIDAS validation;
• sending technical messages, confirmations, and notifications about the status of document signing;
• complying with Ukrainian and EU legislation on trust services, financial accounting, tax accounting, and archival recordkeeping.

5. Rights of the Data Subject

5.1. Under Chapter III of the GDPR and the Law of Ukraine on Personal Data Protection, every Data Subject has the right to:

• access their personal data and obtain a copy (Article 15 GDPR);
• have inaccurate data rectified or incomplete data completed (Article 16 GDPR);
• have data erased (the ‘right to be forgotten’) (Article 17 GDPR), except where retention is required by legislation on electronic trust services or archiving;
• restrict processing (Article 18 GDPR) and exercise the right to data portability (Article 20 GDPR);
• object to data processing (Article 21 GDPR);
• withdraw consent at any time (where processing was based on consent);
• lodge a complaint with the Office of the Ukrainian Parliament Commissioner for Human Rights or with the relevant Data Protection Authority in an EU country (in particular, Estonia or Poland).

5.2. The User has the right to request the erasure of their personal data or documents uploaded to the Service. To exercise this right, a written request must be sent to: [email protected].

Documents signed by two or more parties cannot be unilaterally deleted at the request of one signatory, as they constitute a joint legal transaction and are retained to protect legal interests and comply with legal requirements (Article 17(3) GDPR). Such a document may only be deleted with the written consent of all parties who signed it or by a court order. In the absence of consent from all parties, the Service may restrict access to the document without destroying it.

5.3. The Operator maintains an internal Record of Processing Activities (RoPA under Article 30 GDPR), ensures that Data Processing Agreements (DPAs) with third parties are regularly updated, implements procedures to block non-essential analytics until the user’s consent has been obtained, and applies internal procedures for responding to data security incidents.

6. Data Retention Periods and Security

6.1. Personal data is retained for as long as necessary to achieve the purposes of its processing, but for no less than the periods prescribed by Ukrainian and EU legislation on electronic identification, trust services, taxation, and archiving.

The standard retention period is at least 5 (five) years after the User stops using the Service or the signed contracts expire. Documents and data that provide evidence of legal transactions or legal claims, or that are subject to long-term archival retention requirements, may be retained for 10 to 25 years in accordance with applicable law.

After the specified retention periods have expired, personal data is securely erased or irreversibly anonymised.

6.2. The Operator and its international partners (Estonia and Poland) apply appropriate technical and organisational measures to protect personal data against unauthorised or unlawful access, alteration, disclosure, or destruction (including SSL/TLS encryption in transit, encryption at rest, pseudonymisation, and access controls).

7. Changes to the Policy

The Company reserves the right to amend this Policy. Notices of material changes are published in the Service or sent to the User’s email address. Continued use of the Service signifies the User’s acceptance of the updated terms.

8. Contact Information

For matters concerning personal data processing, the exercise of rights, or communication with those responsible for data protection, the User may contact VCHASNO SERVICE LLC at: [email protected].