GDPR Privacy Notice (EU / EEA / UK appendix)
Effective date: April 20, 2026
Plain English, first
This page is an appendix to the Privacy Policy for people in the European Economic Area, the United Kingdom, or Switzerland. The main Privacy Policy still applies to you; this page adds the details your local law requires, written in plain language.
- Your rights: access, correct, delete, export, restrict, object, withdraw consent, and complain to a regulator.
- How to use them: Profile → Privacy for self-serve; email privacy@signroad.com for anything we cannot do in-app.
- Response time: we respond within 30 days. If a request is complex we may extend by another 60 days and tell you.
- Cost: free for normal requests. We may charge for clearly excessive repeats, and we tell you before we do.
- Regulator: you have the right to complain to the data-protection authority where you live.
1. Scope
This notice applies if you are a resident of the European Economic Area, the United Kingdom, or Switzerland ("EEA/UK user") using Signroad. It supplements the main Privacy Policy; to the extent of a conflict, the notice that gives you more protection applies.
2. Controller and DPO
- Controller: SignRoad, 1309 Coffeen Avenue, Suite 1200, Sheridan, WY 82801, USA.
- Privacy contact: privacy@signroad.com.
- EU Data Protection Officer: privacy@signroad.com.
- EU representative (Art. 27): appointed once user population in the EU warrants it; contact privacy@signroad.com for the current representative.
3. Legal bases (recap)
| Purpose | Legal basis |
|---|---|
| Create and authenticate your account | Contract (Art. 6(1)(b)) |
| Run core features (sign assignment, goals, boards, letters) | Contract |
| Generate personalized Whispers from your in-app content | Contract |
| Send operational email (receipts, security alerts) | Contract |
| Send product-update email | Consent (Art. 6(1)(a)) |
| Analytics cookies | Consent |
| Detect and prevent abuse, fraud, automated attacks | Legitimate interests (Art. 6(1)(f)) |
| Maintain backups and short-lived logs | Legitimate interests |
| Comply with legal obligations (tax, subpoena, regulator request) | Legal obligation (Art. 6(1)(c)) |
4. Your rights
As an EEA/UK user, you have the rights listed below. You can exercise all of them at privacy@signroad.com, or through the self-serve tools in Profile → Privacy.
- Right to information and access (Art. 13–15). Get a copy of your personal data and information about how we process it. The in-app data export (Profile → Privacy → Download my data) fulfills this for your in-app content; email for anything it does not cover.
- Right to rectification (Art. 16). Correct inaccurate personal data. Most fields are editable in-app.
- Right to erasure / "right to be forgotten" (Art. 17). Delete your account and associated personal data. Self-serve from Profile → Privacy → Delete my account. Some data may be retained longer when a legal obligation requires it — we tell you when that applies.
- Right to restriction of processing (Art. 18). Ask us to pause processing while a question is resolved. Email privacy@signroad.com.
- Right to data portability (Art. 20). Receive your data in a structured, machine-readable format. The in-app export delivers JSON plus a markdown summary.
- Right to object (Art. 21). Object to processing based on legitimate interests or direct marketing. For direct marketing, use the unsubscribe link in any marketing email; we stop immediately. For other legitimate-interest processing, email us and we weigh the objection under the GDPR test.
- Right to withdraw consent (Art. 7(3)). Where processing is based on consent (analytics, marketing), you can withdraw it at any time. Withdrawal does not affect processing that already happened.
- Right not to be subject to automated decisions with legal effect (Art. 22). Signroad does not make legally significant decisions about you using solely automated means.
- Right to lodge a complaint (Art. 77). You can complain to your local data-protection supervisory authority. The list of authorities is maintained by the European Data Protection Board at https://edpb.europa.eu/about-edpb/about-edpb/members_en. In the UK, the Information Commissioner's Office at https://ico.org.uk.
We do not retaliate for exercising any of these rights.
5. How to make a request
- In-app: Profile → Privacy → Download my data / Delete my account / Cookie settings.
- By email: privacy@signroad.com, subject line "GDPR request", from the address on the account you want to act on. If you cannot use that address, include enough information for us to verify your identity without asking for more than we need.
- Timing: we respond within 30 days. Complex or high-volume requests may need another 60 days; we notify you in writing and explain why.
- Cost: free. We may charge a reasonable fee, or refuse, for clearly unfounded or excessive repeats, and tell you before we do.
6. International transfers
Where we transfer your personal data outside the EEA/UK, we rely on:
- the EU-US Data Privacy Framework, where the recipient is certified under it;
- Standard Contractual Clauses (Module 2 or 3, as appropriate) for transfers to other jurisdictions;
- the UK International Data Transfer Addendum for transfers out of the UK;
- supplementary technical and contractual measures where needed.
You can request a copy of the transfer safeguards used for a specific provider by emailing privacy@signroad.com.
7. Children in the EEA/UK
Signroad is not directed at children under 16. In jurisdictions that set a higher digital-consent age under GDPR Article 8 (e.g., 13, 14, or 15 in some Member States), the minimum use age matches that local threshold without parental consent, and is 16 by default where the threshold is not lower.
8. Retention (EEA/UK detail)
| Data | Retention period |
|---|---|
| Account and in-app content while active | While your account is active |
| Deleted account | 30-day soft-delete window, then permanent deletion |
| Backups | Roll off within 35 days of deletion |
| Operational logs | 30 days; truncated/hashed IPs in longer aggregates |
| Audit log (security events) | 12 months, then aggregate-only |
| Financial records | As required by applicable tax and accounting law |
| DMCA and legal hold records | Duration of the matter and applicable statute of limitations |
9. Automated decision-making
We do not use automated decision-making that has legal or similarly significant effects on you. Personalized Whispers and sign assignment are content features, not decisions about access, pricing, or rights.
10. Contact and complaints
- Privacy: privacy@signroad.com
- Data Protection Officer: privacy@signroad.com
- Postal: SignRoad, Privacy Team, 1309 Coffeen Avenue, Suite 1200, Sheridan, WY 82801, USA
- Local data-protection authority: see https://edpb.europa.eu (EU/EEA) or https://ico.org.uk (UK).
Attribution
Adapted from Automattic's Legalmattic template and extended to cover GDPR/UK GDPR specifics common in privacy notices. Original and this adaptation are both licensed under CC-BY-SA 4.0.