DOCUFLOWR · 2026-11-01 · DRAFT 1
Privacy notice
These pages describe the current product and identify matters requiring completion. They are not a claim that the service is ready for commercial legal operation.
Operator / controller
- Legal entity
- To be completed
- Registered address
- To be completed
- Registration number
- To be completed
- Tax number
- To be completed
- Contact email
- To be completed
- Operator country
- Singapore
- DPO email
- To be completed
1. Who handles personal data?
The operator is the controller for account administration and quote requests. For customer-uploaded documents, the customer’s and operator’s roles must be determined from the actual processing and documented in a separate data processing agreement. Operator details are still to be completed.
2. Singapore operator and international customers
The operator will be a Singapore business. The business contact details of its PDPA data protection officer must be made public; contact details and procedures remain to be completed. Where services are offered to people in the EU, GDPR applicability and any need for an EU representative require separate assessment. Safeguards for transfers outside Singapore must be documented.
3. Data and sources
The system may store supplied names, email addresses, organizations, account settings, password hashes, contacts, quote requests, PDFs, recipient details, completed fields, signature images, dates and record history. Documents and recipient details may be supplied by the sender. Hosting providers may also process technical traffic data when the browser connects to the service.
4. Purpose and legal basis
Processing supports requested accounts and document workflows, enquiries, security and evidence. The operator must finalize the lawful basis for each activity: performance of a contract, legal obligation, documented legitimate interests or consent where required. Registration is not blanket consent to marketing.
5. Recipients and service providers
Documents are accessible to authorized participants and administrators. The application runs on a Hostinger VPS and email uses the Namecheap hosting SMTP service. Some PDF and date-picker functions may request assets from cdnjs.cloudflare.com and cdn.jsdelivr.net. Provider legal entities, data centre locations and subprocessor roles still require verification.
6. Retention and deletion
Retention must be determined from document purposes, customer agreements and applicable law. Deleting an item in the interface may not physically erase it; records and backups may have separate lifecycles. Account, quote, document, record and backup retention periods and erasure procedures must be documented before finalization.
7. Rights and requests
Depending on applicable law, individuals may request information, access, rectification, erasure, restriction or portability, and may object to processing. Consent may be withdrawn for processing based on consent. For some document data, requests must be directed to the sender as controller. The contact address and competent supervisory authority must be completed for the operator.
8. Security and transfers
Access is restricted by account permissions and recipient tokens; the website uses HTTPS. PDF stamps and hash chains are not encryption of stored data. Actual hosting regions, third-country access and any necessary transfer safeguards still need verification against provider contracts.
Legal references
Singapore — Personal Data Protection Act 2012Singapore — Electronic Transactions Act 2010
GDPR — Regulation (EU) 2016/679
eIDAS — Regulation (EU) 910/2014, as amended
Original DocuFlowr text. Docusign terms are not incorporated into this service.