1. Controller
Timeshare Global Solutions Limited (Finnish business ID 3496293-7), the provider of the Signer service at signer.fi.
Privacy contact: info@signer.fi
2. Whose data we process
- Senders with a Signer account: name, email address and a protected hash of the password (we never store the password itself), the signature requests sent and the PayPal reference of each payment. We never see or store card details.
- Signers: name, email address, role, phone number (if the sender adds one for the text message), a Finnish personal identity code or business ID (only if the sender asks for it), the drawn signature or typed name and the audit trail: timestamps, IP address and browser details.
- Documents uploaded by senders and the data they contain.
- People who contact us: name, email address, company and message.
3. Purposes and legal bases
- Providing the service (invitations, reminders, signing, the final document): the contract with the sender, and the sender's instructions as regards the signers.
- Proving a signature afterwards with the audit trail: legitimate interest of the sender and the signers.
- Payments and bookkeeping: legal obligations.
- Security and preventing misuse (e.g. limiting login attempts, logs): legitimate interest.
- Answering enquiries: legitimate interest and the request of the person contacting us.
For the content of documents, Signer acts on behalf of the sender. The sender is responsible for having the right to process the data in the document and to send it to the signers.
If you sign a document that a company has sent under its own name and logo (for example through the API), your data is processed on behalf of that company and under its own retention periods and privacy policy.
4. Service providers
- Hostinger: server infrastructure
- Resend: email delivery
- GatewayAPI: text message delivery
- PayPal: payment processing
We do not sell data or use it for advertising. Data is disclosed to authorities only where the law requires it. If data is transferred outside the EU/EEA, the transfer relies on the European Commission's standard contractual clauses or another lawful transfer mechanism.
5. Retention
- Completed signed documents and their audit trails: 5 years from signing, so that a signature can be proven if needed.
- Unfinished, declined, cancelled and expired requests: 12 months.
- Account data: as long as the account is in use.
- Payment records: for the statutory bookkeeping period.
- Server logs: up to 12 months. Enquiries: up to 24 months.
6. Cookies
Signer uses only a strictly necessary session cookie that keeps you signed in. We do not use tracking or advertising cookies.
7. Security
All traffic is encrypted (HTTPS). Signing links are personal and unguessable, passwords are stored only as a protected hash and login attempts are limited. The integrity of each document is verified with a SHA-256 hash.
8. Your rights
You have the right to access your data, to have inaccurate data corrected, to have data erased, to restrict processing, to data portability and to object to processing based on legitimate interest. Data relating to a signed document cannot be erased before the end of the retention period if it is needed to prove the signature. Requests: info@signer.fi.
You may lodge a complaint with a data protection supervisory authority, in Finland the Office of the Data Protection Ombudsman (tietosuoja.fi).
Updated 5 November 2026.