Privacy Policy

PRIVACY POLICY AND PERSONAL DATA PROCESSING

Pavlodar, Republic of Kazakhstan
Effective date: 5 September 2026

This Privacy Policy (the “Policy”) explains how personal data is processed when using https://signaturum.com, the account area, API and Signaturum services. For the international version, the controller is DigitalTown LLP, BIN 240340004389 (the “Controller”, “Administration”, “we” or “us”), unless a specific order or separate agreement expressly identifies another entity.

1. GENERAL PRINCIPLES, ROLES AND SCOPE

1.1. This Policy applies to registration, authentication, payments, support, digital deposit/timestamping, invisible watermarking and detection, API, protected storage, protected video/PDF viewing, monitoring, crawler and other Signaturum functionality.

1.2. We process personal data lawfully, fairly and transparently, limit it to what is reasonably necessary for stated purposes, and seek not to retain identifiable data longer than required for the service, security, legal obligations, dispute resolution and protection of rights.

1.3. Use of the Website does not replace separate consent where consent is legally required. Optional cookies, marketing, certain cross-border activities or sensitive data will use the consent mechanism required by applicable law.

1.4. For account, billing, support, security and our own product analytics, we generally determine purposes and means. Where a business customer submits personal data of employees, clients, viewers or recipients through API, storage, viewer, watermarking, crawler or other B2B functions solely under its instructions, controller/processor roles may be governed by a DPA, order or other specific terms.

1.5. A User submitting third-party personal data is responsible for an appropriate legal basis, required notices and consents. Unless law or contract requires otherwise, we are not obliged to verify authority for every automated record before processing.

1.6. Enterprise integrations may also be governed by a DPA, SLA, NDA and/or security schedule, which prevail for their subject matter.

2. CATEGORIES OF DATA AND CONTENT WE MAY PROCESS

2.1. Depending on the Service, we may process:

  • a) User-provided data: name/company name, email, phone, country/region, organisation details, tax/business identifiers where required, profile, support communications, order, tariff, licence and account settings.
  • b) Technical/automatically generated data: IP address, request date/time, session/device identifiers, browser/OS, language, referrer, cookies/local storage, authentication/API/rate-limit/webhook/error/anti-fraud/security logs and aggregated performance telemetry.

2.2. Files are handled differently by Service. With local hashing, a source file may remain in the browser/application and only the fingerprint/metadata are transmitted. With server-side watermarking/detection, API processing, conversion or protected viewing, the file or a technically necessary part may be uploaded and temporarily processed on Signaturum infrastructure. Storage retains files according to tariff/settings/agreement. Crawler may fetch publicly available pages, images, files, URLs, previews and technical features. This Policy therefore does not promise that a file “never leaves the device”.

2.3. Traceability may process a watermark ID, recipient ID, distribution ID, delivery date/method, domain, IP, user agent, view/open times, viewing events and technical logs. Wherever practicable these should be pseudonymous. The mapping to an individual may be held by the business customer, Signaturum or both, depending on architecture and agreement.

2.4. Full payment-card details are normally entered with the payment provider. We may receive payment status, amount, currency, transaction ID, masked card information and data needed for accounting, refunds, anti-fraud and support, but should not receive the full card number/CVV unless the payment architecture expressly requires it.

3. PURPOSES AND LEGAL BASES

3.1. Personal data may be processed only to the extent reasonably necessary for the following purposes and on an applicable lawful basis:

  • a) Contract/User requests: registration, authentication, selected Services, watermarking/detection, deposit, API, storage, viewer, crawler, certificates/reports, notifications, support, billing and refunds.
  • b) Legitimate interests/security where permitted: account/infrastructure security, fraud/abuse prevention, diagnostics, load management, compatibility, internal audit and establishment/defence of legal claims.
  • c) Legal obligations: accounting/tax, lawful authority requests, mandatory retention, sanctions/export-control and other compliance duties.
  • d) Consent where required: optional marketing, certain analytics/advertising cookies, certain cross-border activities or other processing requiring consent. Consent may be withdrawn prospectively as provided by law.

4. DATA SUBJECT RIGHTS

4.1. Depending on applicable law, a person may request information, access, correction, restriction, deletion/destruction, withdrawal of consent, a copy/portability, objection and other statutory rights. Where Signaturum processes data solely on behalf of a business customer, a request may be referred to that customer.

4.2. We may reasonably verify identity, account ownership or representative authority and may refuse or limit a request where law permits, including for legal obligations, security, rights of others or legal claims.

4.3. EEA/UK and GDPR-style regimes: where applicable, rights may include access, rectification, erasure, restriction, portability, objection, withdrawal and complaint to a supervisory authority. If a representative or DPO is legally required, current contact details will be published.

4.4. California and certain U.S. state laws: where applicable, rights may include know/access, correction, deletion, portability, opt-out of certain “sale”, “sharing” or targeted advertising, and non-discrimination. As of this Policy's effective date, we do not sell personal data for monetary consideration.

4.5. Brazil, Japan and other jurisdictions: where LGPD, APPI or other local law applies, we provide the rights and procedures required by that law, including access, correction, deletion/anonymisation, disclosure information and withdrawal where applicable.

4.6. Requests may be sent to support@signaturum.com and will be handled within the period required by applicable law.

5. STORAGE LOCATION, LOCALISATION, CROSS-BORDER TRANSFERS AND BLOCKCHAIN

5.1. Storage/processing locations depend on the contracting entity, data category, selected Service and providers. We arrange processing with regard to mandatory localisation requirements and use applicable legal, organisational and technical safeguards for international transfers.

5.2. Data may be shared with cloud/hosting, CDN, email, analytics, error monitoring, payment, anti-fraud, support and other providers only as reasonably necessary for their functions.

5.3. If the User initiates publication of a hash, identifier or technical data to a public blockchain/distributed ledger, that record may become public, replicated and practically immutable. We cannot guarantee deletion from the public network after confirmation. Only the minimum fingerprint or pseudonymous identifier should be placed on-chain.

5.4. Deletion from Signaturum systems does not remove an already published blockchain record, independently held third-party copies, backups until normal rotation completes, or records we must retain by law.

6. RETENTION AND DELETION

6.1. Account data is generally retained while active and afterwards for the period needed for settlements, refunds, security, disputes, legal claims and mandatory retention. Technical/security logs may have separate limited periods based on event type and risk.

6.2. Files submitted for one-time server-side watermarking/detection/conversion may be temporarily held in working storage, queues, caches and backup mechanisms as technically necessary for processing, retry, delivery, diagnostics and security, then deleted/de-identified under the internal lifecycle unless Storage or another long-term service is selected.

6.3. Storage files are retained until User deletion, end of the relevant service/tariff or another product/order period, subject to a technical backup-deletion period. Crawler findings, URLs, screenshots/previews, detection results and evidence logs may be retained longer for monitoring history, evidentiary continuity, security or legal claims.

6.4. Where a single period cannot be stated in advance, we consider purpose, sensitivity, risk, contract duration, evidentiary need, statutory retention and secure anonymisation.

7. SECURITY, COOKIES, ANALYTICS, AUTOMATION AND CHILDREN

7.1. We use measures proportionate to risk, which may include access controls, logging, encryption where appropriate, secret/key management, backups, monitoring, updates, anti-fraud, rate limits and incident response. No method is absolutely secure and we do not warrant that every incident is impossible.

7.2. If an incident occurs, we take reasonable containment/remediation steps and notify data subjects/authorities where and when required by law.

7.3. Users are responsible for passwords, API keys, tokens, webhook secrets and secure integration configuration.

7.4. Necessary cookies/local storage may be used for authentication, security, language and core functionality; optional analytics/marketing technologies are used subject to applicable consent rules.

7.5. Watermark/detection algorithms automatically analyse digital content but are not designed by themselves to make decisions producing legal effects for an individual. An automated detection result should not be the sole basis for punitive action without reasonable contextual review.

7.6. The Services are not specifically directed to children and we do not knowingly request data from children below the applicable age of independent consent.

8. DISCLOSURES, AUTHORITY REQUESTS, CHANGES AND CONTACT

8.1. We do not disclose personal data arbitrarily. Disclosure may be made to providers needed to operate the Services; successors in a reorganisation, financing or sale subject to safeguards; professional advisers under confidentiality; and authorities or others where required by law, binding process, protection of rights, fraud/security prevention or protection of life/health.

8.2. We may assess the legal validity and scope of authority requests and, where permitted, seek to limit disclosure to what is reasonably necessary.

8.3. In a merger, reorganisation, financing, asset sale or product transfer, data may be disclosed to a potential or actual successor subject to confidentiality and applicable law.

DigitalTown LLP
BIN 240340004389
140007, PAVLODAR OBLYSY, PAVLODAR QALASY, AǴAIYNDY DÚISEMBINOVTER KÓSHESI, 1/15 ST-E
Email: support@signaturum.com