Privacy policy
This is a translation for information only; the Spanish version prevails. This policy explains how we handle personal data on multidocs.es and in the MultiDocs service, in line with Regulation (EU) 2016/679 (GDPR) and Spain's Ley Orgánica 3/2018 (LOPDGDD). It's written to be understood: if anything is unclear, write to us.
1. Data controller
- Owner: EXAMFY SOFTWARE, S.L.
- Tax ID (NIF): B56684905
- Address: Carrer del General Palafox, 8, 08860 Castelldefels, Barcelona (Spain)
- Email: info@multidocs.es
- Phone: 935 958 798
- Data protection officer: getexamfy@delegadoproteccion.com
- Trading name: MultiDocs
- Website: multidocs.es
2. Summary
- If you sign a document yourself with “Sign for free”, the document is processed on your own phone or computer: we don’t receive it or keep it. We only keep its digital fingerprint so it can be verified.
- If you send it by email, we deliver it to the recipient and don’t keep a copy.
- If you ask someone else to sign, we keep the document encrypted only for as long as needed and delete it 30 days after it’s signed.
- We don’t sell data, we don’t run advertising and we don’t use tracking cookies.
3. What data we process, why and on what legal basis
| Situation | Data | Purpose and legal basis |
|---|---|---|
| Browsing the website | IP address, browser and pages visited, in the server’s technical logs | Showing the website and keeping it secure, and counting anonymously and in aggregate which pages are visited (Vercel Web Analytics, without cookies and without storing the IP) to improve it. Legitimate interest (Art. 6.1.f GDPR). |
| Signing a document yourself | The document and your signature never leave your device. We only receive its digital fingerprint (a code that can’t be used to rebuild the document) and the date | So anyone can check in “Verify” that the document hasn’t been changed. Legitimate interest (Art. 6.1.f). |
| Emailing a document you’ve signed | The document, the recipient’s email, your email, your name and your message (if you write them) | Sending the email you ask us to send. Performance of the service (Art. 6.1.b). We don’t keep a copy. |
| Asking someone else to sign | The document; your name and email; the signer’s name and their email or mobile number; your message; the details they fill in and their signature; the date, time, IP and browser they sign from | Providing the signing service and generating the certificate. Performance of the service (Art. 6.1.b). See section 4. |
| Confirming your email before sending | Your email, a one-time code (we only keep its fingerprint) and a technical cookie on your device | Checking that the email is yours and that nobody sends documents in your name. Performance of the service (Art. 6.1.b) and legitimate interest in the security of the service (Art. 6.1.f). |
| Creating your account | Your name, your email, your organisation (if you enter it) and the technical confirmation cookie | Giving you access to the dashboard and the service. Performance of the contract (Art. 6.1.b). |
| Receiving MultiDocs news | Your email and your name | Sending you occasional news and tips about MultiDocs if you’re a user (you’ve signed up or sent documents) and haven’t objected. Article 21.2 of Spain’s LSSI-CE and legitimate interest (Art. 6.1.f). You can object when signing up by ticking “I don’t want to receive news” and unsubscribe with the link in every email. |
| Checking a document in “Verify” | Only the PDF’s digital fingerprint, calculated on your device; the document isn’t sent | Telling you whether the document is genuine. Legitimate interest (Art. 6.1.f). |
| Booking a call | Name, email and the chosen time, entered in Google’s booking calendar | Arranging the video call you ask for. Pre-contractual steps at your request (Art. 6.1.b). Google Calendar acts as a provider (Google Ireland Ltd.). |
| Requesting a demo or writing to us | Name, email, organisation, sector and your message | Replying to you and, if you ask, showing you the product. Pre-contractual steps at your request (Art. 6.1.b). We won’t send you news just because you asked for a demo. |
| Paying customers | Contact and billing details | Managing the contract and meeting tax and accounting obligations (Art. 6.1.b and 6.1.c). |
4. The signer’s data
When someone sends you a document with MultiDocs, the person or organisation that decides to ask for your signature and why (the sender) is the controller of your data in that document. EXAMFY SOFTWARE, S.L. acts as data processor: we process it only to deliver the document to you, collect your signature and any details you’re asked for, and hand the signed document to the sender, under the data processing agreement. If the sender asks you for a photo of your ID, it is added on a page of the signed document, with a stamp stating that it is only valid for that document. We don’t keep the photo on its own.
If you’re unsure why you’ve been asked for a document, ask the sender. If you want to exercise your rights, you can do so with them or write to us and we’ll pass it on.
5. How long we keep it
- Documents sent for signature: deleted from our servers 30 days after being signed. If they aren’t signed, the link expires and they’re deleted 30 days after sending. The signed document and its certificate are emailed to the sender and the signer, who can keep them.
- Evidence log for each signature (names and emails of the sender and signer, dates and times, IP, browser and the document’s digital fingerprints, without the document): 5 years from signing, so the signature can be proven if there’s a claim (general limitation period under article 1964 of Spain’s Código Civil). Legal basis: the parties’ legitimate interest in being able to prove the signature (Art. 6.1.f GDPR).
- Users and contacts (email, name, organisation, when you used the service and whether you accept news): while you use the service and up to 2 years after the last time. If you unsubscribe from news, we only keep the fact that you don’t want it, so we can respect that.
- Confirming your email: the code expires after 15 minutes and is deleted within a day; the cookie that remembers your device lasts 6 months.
- Emails of a document you signed yourself: we don’t keep a copy of the document.
- Server technical logs: as long as our hosting provider keeps them for security, usually a few days.
- Documents archived in your account (MultiDocs plan): while you keep the account, also if you go back to the free plan. If you close the account, they’re deleted within 30 days.
- Demo requests and contacts: for as long as the conversation lasts and up to a year after, unless you ask us to delete them sooner.
- Customer data: for as long as the contract lasts and afterwards for the periods required by law (for example, six years for accounting records).
6. Who we share data with
If you choose to send the link by WhatsApp or SMS, you send the message yourself from your own phone: we don’t send it or access those apps.
We don’t pass data to third parties unless the law requires it. To provide the service we use these providers, who act as processors or sub-processors under contract and with adequate safeguards:
| Provider | What for | Where the data is processed |
|---|---|---|
| Vercel Inc. | Website hosting, processing of documents sent for signature and encrypted storage | European Union: Frankfurt (Germany) |
| Vercel Inc. (Web Analytics) | Anonymous, aggregated count of website visits, without cookies and without storing the IP | According to Vercel’s infrastructure (anonymous data) |
| Resend (Plus Five Five, Inc.) | Sending the service’s emails (invitations, notifications and signed documents) | European Union: Ireland |
Documents and personal data are processed and stored in the European Union. Vercel and Resend are based in the US: if their staff ever accessed the data from there (for example, to give technical support), that access is covered by the EU-US Data Privacy Framework and by standard contractual clauses.
7. Security
The website always runs over an encrypted connection (HTTPS). Documents sent for signature are kept in private, encrypted storage, and each one can only be accessed with a personal link that’s impossible to guess. Every signed document includes a digital fingerprint (SHA-256) that lets you check it hasn’t been changed.
8. Your rights
You can ask for access to, correction or deletion of your data, restriction of or objection to its processing, and its portability, by writing to info@multidocs.es or to our data protection officer (getexamfy@delegadoproteccion.com) and saying which right you want to exercise. We’ll reply within one month at most.
If you think we haven’t handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).
9. Children
The service isn’t aimed at children under 14. When a school asks for a document about a child to be signed, the signature is collected from their parents or legal guardians.
10. Changes
If we change this policy, we’ll publish the new version here with its date. If the change is significant and we have your email, we’ll let you know.