GDPR & Data Protection

When you use WeGoSign to send documents for signature, we act as a data processor on your behalf. You (or your organization) remain the data controller for the personal data contained in your documents.

This means:

• You determine what personal data is included in documents
• You decide who receives documents and for what purpose
• We process data only according to your instructions
• We implement appropriate technical and organizational measures to protect the data

For business and enterprise customers, we offer a Data Processing Agreement that covers:

• Subject matter and duration of processing
• Nature and purpose of the processing
• Types of personal data processed
• Categories of data subjects
• Obligations and rights of the controller
• Sub-processor authorizations
• Data breach notification procedures
• Audit rights

We process personal data based on the following lawful bases:

• Contract Performance: Processing necessary to provide our services to you as outlined in our Terms of Service.
• Legitimate Interests: Processing for fraud prevention, security, and service improvement, balanced against your rights.
• Legal Obligations: Processing required to comply with applicable laws, regulations, and legal processes.
• Consent: Where required, we obtain your explicit consent before processing (e.g., marketing communications).

When we transfer personal data outside of Nigeria or the European Economic Area (EEA), we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs): We use EU-approved SCCs for transfers to third countries.
• Adequacy Decisions: We may transfer data to countries recognized as providing adequate protection.
• Data Residency Options: Enterprise customers can choose regional data storage to minimize cross-border transfers.

We use carefully selected sub-processors to help deliver our services. All sub-processors are bound by data protection agreements and are subject to our security requirements.

We retain personal data only for as long as necessary:

• Account Data: Retained while your account is active and for 30 days after deletion request.
• Signed Documents: Retained according to your organization's settings and applicable legal requirements (typically 7 years for legal documents).
• Audit Logs: Retained for the document retention period plus any additional legal requirements.
• Usage Analytics: Aggregated and anonymized data may be retained indefinitely for service improvement.

In the event of a personal data breach, we will:

• Notify affected data controllers within 72 hours of becoming aware
• Provide full details of the breach and affected data
• Document all breaches in our internal register
• Implement remediation measures to prevent recurrence
• Assist you in meeting your notification obligations to supervisory authorities and data subjects

We implement privacy by design and by default in our product development:

• Minimal data collection - we only collect what's necessary
• Purpose limitation - data is used only for stated purposes
• Access controls - strict limitations on who can access data
• Encryption by default - all sensitive data is encrypted
• Privacy impact assessments for new features

For any questions or concerns about data protection, or to exercise your rights: