Privacy Policy for the
Web Applications "sproof sign" and "sproof Ident"

3.3.1. Account usage

We process the following personal data when you create and use an account at
as a customer, or when you use sproof sign to send or sign documents at
:

• Name data;
• dates of birth (only if identified by a qualified electronic signature);
• Email data;
• mobile phone number (only when using an SMS TAN);
• Address data;
• contact details (e-mail address, telephone number);
• Company;
• additionally uploaded data (documents, images);
• signatures;
• Timestamp;
• IP address;
• Log data;

The data is transferred to our IT service provider (data processor), which is based in the EU. If a customer invites other individuals to sign a document, the name and email address of the invitee must be entered.
Alternatively, users can sign up for sproof sign using existing accounts with Google, Facebook, LinkedIn, Windows Live, or Advokat, or, in some cases, via single sign-on after integration through sproof. The following categories of data are processed in this process:

• Name data;
• Email data;
• Profile pictures (from the account in question).

The personal data is generally processed by us for the duration of the business relationship and in accordance with the legal requirements (retention obligations). The legal basis for the processing of your personal data is consent in accordance with Article 6 (1) (a) GDPR, the fulfilment of pre-contractual and contractual obligations in accordance with Article 6 (1) (b) GDPR and the fulfilment of legal obligations in accordance with Article 6 (1) (c) GDPR (in order to comply with statutory retention obligations).
The collection and processing of your data are necessary to provide you with the sproof sign service.

3.3.2. Data processing Trust service provider

The following personal data is processed by us if customers with a qualified signature wish to sign with the assistance of trust service providers (e.g. A-Trust, D-Trust, swisscom) or other providers that are necessary to provide the services of the trust service providers:

• Name data;
• Birth;
• contact details (e-mail address, telephone number);

The personal data is generally processed by us for the duration of the business relationship and in accordance with the legal requirements (retention obligations). The legal basis for the processing of your personal data is consent in accordance with Article 6 (1) (a) GDPR, the fulfilment of pre-contractual and contractual obligations in accordance with Article 6 (1) (b) GDPR and the fulfilment of legal obligations in accordance with Article 6 (1) (c) GDPR (in order to comply with statutory retention obligations).
The collection and processing of your data is necessary to provide you with the sproof sign service.

3.3.3 Stripe data processing

We work with Stripe (Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland) as our payment service provider. As a result, payment transactions on our sproof sign platform are processed through Stripe. We process the following personal data in this context:

• Name of the cardholder;
• E-mail address;
• Customer;
• Order number;
• Bank account;
• Credit card;
• the validity period of the credit card;
• Credit Card Verification Number (CVC);
• Date and time of the transaction;
• transaction amount;
• Name of the provider;
• Place.

The collection and processing of your data are necessary to provide you with the sproof sign service, in particular payment transactions.
Stripe assumes a dual role as both data controller and data processor in its data processing activities. As a data controller, Stripe uses the data you provide to comply with regulatory obligations. This is in accordance with Stripe’s legitimate interest (pursuant to Art. 6(1)(f) of the GDPR) and serves the purpose of contract performance (pursuant to Art. 6(1)(b) of the GDPR). We have no influence over this process.
As a data processor, Stripe acts to complete transactions within the payment networks. Within the framework of the data processing relationship, Stripe acts exclusively in accordance with our instructions and has been contractually obligated, within the meaning of Article 28 of the GDPR, to comply with data protection regulations.
Stripe has implemented compliance measures for international data transfers. These apply to all global activities in which Stripe processes personal data of natural persons in the EU. These measures are based on the EU Standard Contractual Clauses (SCCs).
For more information on your rights to object and request rectification with respect to Stripe, please visit: Stripe Privacy Center

3.3.4 Data processing social media plugins

We have not integrated any social media plugins into our web app. The social media buttons for social networks (e.g., Instagram, Facebook, LinkedIn) have been included on our sproof sign only as links (reference links to the social networks). If you click on this link (button), you will be redirected directly to the respective website. Please note the

3.4. Data Processing in Connection with the Use of sproof Ident

If you use sproof Ident to simplify registration, identification, or the creation of a user account, we and the company with which you complete the registration process, verify your identity, or create a user account (hereinafter referred to as the “Contract Partner”) process your personal data as joint controllers within the meaning of Article 26 of the GDPR.
The Contractual Partner acts as the single point of contact for handling and fulfilling data subjects’ rights pursuant to Articles 15 through 20 of the GDPR. You can find the Contract Partner’s contact information, for example, in its privacy policy pursuant to Articles 13 and 14 of the GDPR.
If you decide to use sproof Ident, you will be automatically redirected to our servers and an invitation to participate in sproof Ident will be displayed on your screen. In the process, your device transmits the relevant technical connection data (such as your IP address and the type and version of your web browser) to us. The data is recorded in log files and processed specifically for the operation of sproof Ident (for more detailed information, see Section 3.1, “Use of Web Applications”).

For identification, you can use your e-ID, EUDI, or an identification method provided by a third-party provider.

Identification via E-ID or EUDI: Access to your digital identity (E-ID as defined by EU Regulation 2024/1183; in Austria, ID Austria; in Germany, an identity card with online functionality, etc.) and to your EUDI is granted exclusively with your consent. If you successfully authenticate yourself by entering your correct login credentials, we will collect the data stored in your E-ID (e.g., first and last names, address including street, house number, address supplement, ZIP code, and country, as well as other data; you will be specifically informed of the data being collected in each case) and transmit this data to our contractual partner to complete the registration and set up the user account, or for identification or registration purposes.

Identification by a Third-Party Provider: We will redirect you to a third-party provider for identification purposes. The relevant subcontractors are listed below. You will be informed of the specific third-party provider and the data collected. We carry out the identification process with the third-party provider exclusively with your consent. We collect your data as part of the identification process (e.g., first and last name, address including street, house number, address supplement, ZIP code, and country, as well as other data; you will be informed of the specific data collected in the provider’s privacy policy) and transmit this data to our contractual partner for the purpose of completing the registration and setting up the user account, or for identification or registration.

The processing of data in this regard is based on the legal basis set forth in Article 6(1)(a) of the GDPR. Your consent is voluntary and may be withdrawn at any time with future effect, e.g., via privacy@sproof.com. Withdrawal of consent does not affect the lawfulness of the data processing carried out prior to the withdrawal.

Subsequently, our contractual partner processes the data transmitted by us to him to terminate or complete the registration process. Any subsequent processing by the contractual partner, e.g. for the purpose of customer administration, is carried out under the responsibility of the contractual partner in accordance with Article 4 (7) GDPR.

Please note that sproof does not store any data collected via your E-ID for a longer period of time. This data is only stored for a period of 30 days to prevent fraud and misuse and to protect against cyber attacks and is then automatically deleted. Data for authentication and consent is also anonymized or deleted after 30 days. From then on, we will not be able to assign any data to you personally.

For the technical operation of sproof Ident, we share your data with the subcontractors listed in Section 4. To this end, we have entered into data processing agreements in accordance with Article 28 of the GDPR.

4. sub-processors

	Name and Contact Information	Function and Purpose
1	OVH GmbH Christophstraße 19, 50670 Cologne, Germany Email: kundendienst@ovh.de	Data center, i.e., the provision of infrastructure. The data is processed and stored there.
2	Scaleway S.A.S 8 rue de la Ville l’Evêque, 75008 Paris, France Scaleway’s DPO: dpo@iliad.fr. Scaleway’s Privacy Team: privacy@scaleway.com Notification of a data breach: security@scaleway.com	Data center, i.e., the provision of infrastructure. The data is processed and stored there.
3	Brevo GmbH 126 Köpenicker Straße, 10179 Berlin, Germany Email: support@brevo.com	Mail server, i.e., sending emails containing invitations to digitally sign a document, other transactional emails such as reminders, password resets, etc., as well as information about our services.
Note: The following subprocessors apply only if the respective trust service providers are used.
4	Swisscom (Switzerland) Ltd Alte Tiefenaustrasse 6, 3050 Bern, Switzerland Email: datenschutz@swisscom.com Mailing Address: Swisscom (Switzerland) Ltd, Dr. Nicolas Passadelis, LL.M., Data Protection Officer, Swisscom Ltd and Swisscom (Switzerland) Ltd, P.O. Box, 3050 Bern	Creating and generating qualified electronic signatures.
5	A-Trust, LLC Landstraßer Hauptstraße 1b, E02 1030 Vienna Email: datenschutz@a-trust.at	Creating and generating qualified electronic signatures.
6	PrimeSign GmbH 2 Wielandgasse 8010 Graz, Austria Email: office@cryptas.com	Creating and generating qualified electronic signatures.
7	EID Easy OÜ A. Lauteri, No. 3 Tallinn, 10114 Estonia	Creating and generating qualified electronic signatures.
8	In.Te.S.A. S.p.A. 289 Strada Pianezza 10151 Turin Italy Email: privacy@intesa.it	Creating and generating qualified electronic signatures.
Note: The following subcontractors apply only if the respective identification procedures are used.
9	Shufti Pro (Cyprus) Limited 5 Nafpaktou Street, Latsia, 2221 Nicosia, Cyprus Email: dpo@shuftipro.com Address: 5 Nafpaktou Street, Latsia, 2221 Nicosia, Cyprus	Conducting identity verification of individuals and their identification documents/KYC processes (including personally identifiable information and background checks).
10	Governikus GmbH & Co. KG, Hochschulring 4, 28359 Bremen	Conducting identity verification of individuals and their identification documents/KYC processes.

5. automated decision-making / profiling

There is no automated decision-making, including profiling.

6. your rights as a data subject

We would also like to draw your attention to the following rights to which you are entitled as a data subject:

• Right of access from the controller about the personal data concerning you in accordance with Article 15 GDPR
• Right to rectification in accordance with Article 16 GDPR
• Right to erasure according to Article 17 GDPR
• Right to restriction of processing pursuant to Article 18 GDPR
• Right to data portability according to Article 20 GDPR
• Right to object to processing in accordance with Article 21 GDPR
• Right to withdraw consent in accordance with Article 7 (3) GDPR

Furthermore, you also have the right to lodge a complaint with the competent supervisory authority (in Austria, the data protection authority based in Vienna). In this regard, we refer you to the website of the Austrian Data Protection Authority, which can be accessed via the link www.dsb.gv.at . However, you can also contact us directly at the e-mail address privacy@sproof.com if you have any complaints.

7. stand

An update of this privacy policy may be necessary due to technical developments and new legal requirements. We will inform you in advance.

These data protection provisions are available in different languages. In the event of ambiguities or questions of interpretation, only the German version of this Privacy Policy shall prevail.