GDPR

Last updated: [DATE]

This page explains how SigMonster Pty. Ltd. (ABN 49 639 500 299, ACN 639 500 299) ("SigMonster", "we", "us") meets its obligations under the EU General Data Protection Regulation and the UK GDPR. Please read it together with our Privacy Policy.

1. Our role: controller and processor

• Controller: we decide how to handle the personal information we collect to run our own business, for example account and sign-in details, billing contacts, support requests, website analytics and marketing.
• Processor: when an organisation uses SigMonster to manage its people's email signatures, we process that information on the organisation's instructions. The organisation is the controller. If your signature is managed by your employer or organisation, please contact them first about your data.

2. Data Processing Agreement

We offer a Data Processing Agreement (DPA) under Article 28 GDPR to customer organisations. The DPA forms part of our Terms of Service. Contact support@sigmonster.net to request one.

3. Legal bases

• Contract: to provide the service you or your organisation signed up for, including onboarding and service emails.
• Legitimate interests: to secure, maintain and improve the service, and to send existing customers marketing about similar SigMonster products, with an unsubscribe link in every email.
• Consent: for analytics cookies, and for any other marketing where consent is required. You can withdraw consent at any time.
• Legal obligation: for example, keeping tax and billing records.

4. Service providers

We use a small number of service providers. Those marked * are sub-processors: they process data we handle on behalf of customer organisations, and are listed in our Data Processing Agreement. The others only process data we handle as controller (for example billing and marketing).

All other systems, including our identity and authentication services, are self-hosted on our own infrastructure. We'll give customer organisations at least 30 days' notice before adding or replacing a sub-processor, as set out in our Data Processing Agreement.

5. International transfers

Our servers are in the United States. Where we transfer personal data from the EU or UK, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, or an adequacy decision where one applies.

6. Signature images and view counts

Signature images are publicly hosted so they can appear in emails you send. Anyone who receives your email, or has the image link, can see what's in your signature, and recipients can forward your emails to others. Please don't put anything in your signature you wouldn't want shared publicly.

We count how many times each signature image is viewed. We don't identify or track email recipients, and we don't keep per-view records. Like any web service, our servers keep short-lived technical logs (see Retention below).

7. Your rights

If you're in the EU or UK, you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• have your data deleted;
• receive your data in a portable, machine-readable format;
• restrict or object to processing, including objecting to direct marketing at any time;
• withdraw consent where we rely on it;
• complain to a data protection authority.

How to make a request: email support@sigmonster.net. We'll verify your identity and respond within one month. Once a deletion request is confirmed, we delete your data within 24 hours. Data exports are provided in a machine-readable format such as JSON.

If your data is managed by your organisation, we may refer your request to them or help them respond, as their processor.

8. Retention

• Account and signature data: kept while you or your organisation remain a customer, then removed through our offboarding process or on a confirmed deletion request.
• Backups: deleted data is fully removed from backups within 30 days.
• Web server logs: deleted within 7 days at most.
• Billing and tax records: kept as long as the law requires.

9. Security

All data is encrypted in transit and at rest. Access is strictly limited to those who need it, and credentials are stored in secure key vaults.

10. Data breaches

If a personal data breach affects customer data, we'll notify affected customer organisations without undue delay, and within 48 hours of detecting it, so they can meet their own reporting obligations. Where we're the controller, we'll notify the relevant authority within 72 hours where required, and tell affected people where the law requires.

11. Cookies

For visitors in the EU and UK, analytics cookies (Google Analytics) are only set after you opt in through our cookie banner. Essential cookies needed to run the service are always on. You can change your choice at any time.

12. Automated decisions

We don't make automated decisions that have legal or similarly significant effects on individuals.

13. Contact and complaints

Email support@sigmonster.net. If you're not satisfied with our response, you can complain to your local data protection authority (in the UK, the Information Commissioner's Office).