Legal
The MySign Electronic Signature Platform is operated by MySign.co.uk Group Limited
Last updated — January 2025
MySign.co.uk Group Limited (trading as MySign) is committed to protecting your privacy and personal data.
This Privacy Policy explains how we collect, use, store, and protect your personal information when you use MySign to sign documents electronically.
This Privacy Policy should be read in conjunction with our Signatory Terms and Conditions.
We process your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection laws.
MySign.co.uk Group Limited is the data controller for personal data processed through MySign when you sign documents.
Company Name: MySign.co.uk Group Limited (trading as MySign)
Email: [email protected]
If you have any questions about how we process your personal data, please contact us using the details above.
When you use MySign to sign a document, we collect the following categories of personal data:
To verify your identity and ensure the security of the signing process, we collect:
When you provide information during the signing process, including your name, email, and responses to verification questions.
The person or organisation requesting your signature may provide us with your contact details.
We automatically collect technical data such as IP address, device fingerprint, and location when you use MySign.
We obtain identity verification data from:
We use your personal data for the following purposes:
Legal basis: Performance of a contract (facilitating your signature of documents)
Legal basis: Consent (which you provide when proceeding to sign), legitimate interests (preventing fraud and ensuring signature authenticity), and legal obligation (compliance with financial crime regulations where applicable)
Legal basis: Legitimate interests (maintaining evidence of transactions), legal obligation (compliance with eIDAS and electronic signature regulations)
Legal basis: Legitimate interests (protecting our service and users from fraud and security threats)
Legal basis: Legal obligation
Legal basis: Legitimate interests (improving and developing our service)
Legal basis: Performance of a contract, legitimate interests (communicating effectively with users)
We may share your personal data with the following categories of recipients:
The person or organisation that requested your signature will receive:
We work with QTSPs to provide certain eIDAS-compliant signature services. These providers may process your signature data in accordance with their own obligations under eIDAS.
We share necessary personal data with:
We use third-party service providers for:
These providers act as data processors on our behalf and are contractually obligated to protect your data.
We may share your personal data with:
We only share data when legally required or to protect legal rights.
We may share data with lawyers, auditors, accountants, and other professional advisers where necessary for legal, audit, or business advisory purposes.
If we are involved in a merger, acquisition, or sale of assets, your personal data may be transferred to the new owner, subject to the same privacy protections.
Some of our service providers and verification providers may be located outside the United Kingdom. Where we transfer your personal data internationally, we ensure appropriate safeguards are in place, including:
You can request more information about specific international transfers by contacting us.
We retain your personal data for different periods depending on the purpose:
Retention period: Minimum of 6 years from the date of signature
Reason: Legal and regulatory requirements, including the Limitation Act 1980 and evidence retention obligations
Retention period: 6 years from the date of verification
Reason: Fraud prevention and compliance with financial crime regulations
Retention period: 6 years as part of the audit trail
Reason: Evidence of the signing process and fraud prevention
Retention period: 3 years from the last communication
Reason: Customer service and record-keeping
After the retention period expires, we will securely delete or anonymise your personal data unless we are required by law to retain it longer (for example, if the data is subject to legal proceedings).
Under UK data protection law, you have the following rights:
You have the right to request a copy of the personal data we hold about you. This is known as a Subject Access Request (SAR).
You have the right to request correction of inaccurate or incomplete personal data.
You have the right to request deletion of your personal data in certain circumstances. However, this right is limited where we are required to retain data for legal or regulatory purposes (such as maintaining audit trails and signature records).
You have the right to request that we restrict processing of your personal data in certain circumstances, such as while we verify the accuracy of disputed data.
You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another data controller where technically feasible.
You have the right to object to processing of your personal data where we rely on legitimate interests as the legal basis. We will stop processing unless we have compelling legitimate grounds that override your interests.
Where we process your data based on consent, you have the right to withdraw consent at any time. However, this will not affect the lawfulness of processing before withdrawal.
You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your personal data properly.
ICO Contact Details:
To exercise any of these rights, please contact us using the details in the "Who we are" section above. We will respond to your request within one month, although this may be extended by up to two months for complex requests.
We implement appropriate technical and organisational security measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage. These measures include:
While we take all reasonable steps to protect your data, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.
In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, we will notify you and the ICO as required by law.
Important Information About Soft Credit Checks:
Credit reference agencies we work with may include Experian, Equifax, and TransUnion. When we search your records, the credit reference agencies will record this as a soft search quotation search.
For more information about how credit reference agencies process your data, please visit their websites or contact them directly.
MySign uses cookies and similar tracking technologies to:
For more information, please see our Cookie Policy.
MySign is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you are under 18, you must not use MySign to sign documents.
If we become aware that we have collected personal data from a child under 18, we will take steps to delete that information as soon as possible.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons.
When we make material changes, we will notify you by:
The updated Privacy Policy will take effect on the date specified at the top of the document. Your continued use of MySign after changes are made constitutes your acceptance of the updated Privacy Policy.
We recommend that you review this Privacy Policy periodically.
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:
Data Protection Contact:
MySign.co.uk Group Limited (trading as MySign)
Email: [email protected]
We will respond to all privacy-related enquiries within one month of receipt.