Privacy and cookie statement

This Privacy and Cookie Statement was last amended on 11 october 2022.

The services and websites of Evidos B.V. (‘Evidos’) involve the processing of privacy-sensitive data known as personal data. Evidos provides its services under various names; hence, this Privacy and Cookie Statement applies to www.ondertekenen.nl, www.signhost.com and our (mobile) application(s). The careful handling of personal data is of great importance to Evidos. Accordingly, we process and protect personal data with the greatest possible care.

We adhere to privacy law requirements when processing data. This means, among other things, that we:

• state clearly for which purposes we process personal data through the Privacy and Cookie Statement;

• try to limit the collection of personal data to data required for legitimate purposes;

• ask you for your express consent before processing your personal data in those cases in which your consent is required;

• take appropriate security measures to protect your personal data and require parties who process data on our behalf to do the same;

• respect your right to inspect, correct or delete your personal data upon request.

We are the controller in the data processing operations detailed below. In this Privacy and Cookie Statement, we explain which personal data we collect and use in our capacity as controller, and for what purpose. We recommend that you read this statement carefully.

The various roles of Evidos as ‘processor’ and ‘controller’

As briefly mentioned above, this Privacy and Cookie Statement applies in situations in which Evidos can be considered the ‘controller’, i.e. situations in which Evidos determines the purposes and means of the data processing. For example, Evidos is the controller with respect to customer administration, its employees and data processed in the context of application procedures. Evidos determines whether and, if so, which data are processed, how long these data are stored and when the processing of personal data is discontinued.

There are many situations in which Evidos, as a cloud service provider, takes on the role of ‘processor’. In that role, Evidos processes personal data on the instructions of its customers. In this case, it is the customers of the services concerned who decide that their personal data are to be processed and instruct Evidos as a supplier to do that. Evidos then carries out the instruction; it does not take any independent decisions with regard to these personal data. This includes, for example, the personal data of signatories processed via the signing service, and the documents signed through the services. Evidos is expressly not a controller with regard to these personal data. In cases such as these, you will have to be informed of the data processing by the organisation that sent the signing request to you.

Use of personal data

In using our website or service, you deposit certain details with us, which may include personal data. We collect and process these data solely for the purpose for which you provide them to us. Personal data may only be processed for specific, explicitly defined and legitimate purposes. These purposes are detailed below.

In addition, the collection and processing of your personal data is always based on one of the following legal grounds:

• You have consented to the processing of your personal data.

• Processing is necessary for the performance of the agreement and our services.

• We have a legitimate interest in the processing of your data.

• We are under a legal obligation to process your data.

Below, for each purpose we will describe the legal basis for processing your data and provide more information about our processing operations.

Purposes

The purposes for which we process your personal data are explained in more detail below.

Requesting a subscription via the website or on the basis of a quotation

You can purchase or apply for a subscription via our website. When purchasing or applying for a subscription, we will ask you to provide us with your company name, first and last name, email address, telephone number and IBAN account number, so that we can handle your request. When purchasing a subscription, you will also be asked to create an account. You will be able to add additional information in your account.

You can also request a quotation via our website or other communication channels without obligation. For this purpose, we will ask you to provide your company name, first and last name, email address and telephone number. We use that information to prepare and send the quotation, and to communicate about the quotation and the services. If you decide to sign our offer via our platform, we will also ask for the name and email address of the authorised signatory of your organisation so that we can send them the signing request.

We process the above data as part of our preparations for concluding the agreement between you and Evidos.

Provision of data to third parties

We register your data in our CRM application and online accounting package. In addition, we store the signed quotations within our IT supplier’s cloud environment.

Product-specific requirements for the purchase of services

In certain cases Evidos is obliged by law, or pursuant to obligations imposed by its suppliers, to obtain additional information from you.

As regards the delivery of iDIN, this type of service falls within the scope of the Money Laundering and Terrorist Financing (Prevention) Act (Wet ter voorkoming van witwassen en financieren van terrorisme, Wwft) and Evidos is obliged to retain certain data of the UBO (Ultimate Beneficial Owners) and the duly authorised representative. UBO data to be retained are the first and last name, company name, date of birth and nationality. Duly authorised representatives must verify themselves via iDIN, which involves the processing of their first and last name, address, postcode, email address, signature, IP address and date of birth. Pursuant to the Wwft, these data must be recorded in the context of client screening to prevent money laundering and terrorist financing.

We process the above data in order to comply with our legal obligations.

Provision of data to third parties

The above data are stored within our IT service provider’s cloud environment and will only be provided to Currence at Currence’s request. Currence is the supplier of iDIN.

Requesting an online demo, API trial account and free account

You can schedule an appointment via the website to view the online demo. After that you can start working with a free account or create a free account directly via our website. To schedule the appointment for the online demo, you will have to give us your name, email address and telephone number.

To request an API trial account, you will need to provide your company name, name, email address and telephone number. To request a free account using our portal, you will have to register your email address.

You can also request a free account (GO account). When you do so, we will ask you to provide us with a business email address and your first and last name, so that we can handle your request. You also have the option of supplementing your own data.

We will process the above data on the basis of the agreement for the provision of a trial account (including the pre-contractual phase).

Provision of data to third parties

We will include your information in our CRM application. Your data will also be processed within the cloud environment of our IT service provider.

Handling your order and provision of services

If you place an order with us via the website or agree to our offer, we will use your personal data to be able to handle the transaction properly. We will use your personal data for the provision of the services, such as informing you about the status of the services, but also to arrange the logging procedure, provide backups, create your account and perform management and support tasks.

For these purposes, we will use your name and address details, telephone number, email address and company name.

For certain aspects of the service, we use a system of credits that you need to purchase in advance; in that case we use your personal data to complete the purchase and register the credits.

We will process these data under the terms of our agreement with you.

Using our application(s)

Evidos also has an application (“Evidos”) for her services. This application is available in the Appstore of Apple and in Google Play (Console). When using the application, the application will connect with your contact list for sending a signing request. This is necessary for the use of our services, in order to invite the relevant people to sign the concerned document.

Provision of data to third parties

In this processing operation your data will be made available to the supplier of our CRM application.

Providing support

Evidos provides support in various ways, for example by email, telephone and through our chat module. For the options available to register your questions and/or incidents, see the ‘Description of Service Level (Basic)’ or, if applicable, the Service Level Agreement (SLA) you have concluded with us. For example, you can start a chat via our website or within the online environment, send an email to our support desk or ask your questions by telephone. If you send an email, a ticket will be created internally and your question will be forwarded to the relevant department.
Via our ticketing system, customers who have purchased an SLA have their own environment in which they can view details such as the status of the tickets linked to their organisation.

Depending on the method chosen, we will ask you to share certain information with us. This may be your name and address details, and possibly your email address, telephone number, customer number and any information you provide yourself. In certain cases, we process internal notes in connection with your request for support. You can also, upon express request, share a document and/or transaction receipt containing the details of signatories.

We will process these data under the terms of our agreement with you.

Provision of data to third parties

For communication via email, contact form or chat we use the services of IT service providers, such as a ticketing system, a chat module and a support tool. Finally, your data may be entered in our CRM system.

Requesting a white paper

You can request white papers via our website. The white paper will be sent to you after you have entered your company name and email. We use these data to send you the white paper and to follow up on it, for example to ask you whether the information is clear, and to invite you to a meeting or to subscribe to our newsletter.

We will process the above data on the basis of your consent.

Provision of data to third parties

Your data will be provided to the email service provider we use when sending emails. In addition, your data will be processed in our CRM application.

Communication via the contact form or by chat, telephone, email or video conference

Contact form

U heeft de mogelijkheid om vragen te stellen, een klacht in te dienen of een mogelijk beveiligingsincident te rapporteren, via een contactformulier op de website. Om u verzoek, klacht of melding in behandeling te kunnen nemen, dient u daarbij uw naam, bedrijfsnaam, e-mailadres en telefoonnummer in te vullen.

Telephone contact

If you have a question, you can also contact Evidos by telephone. In certain cases we will ask for your name, telephone number and company name, for example to be able to call you back later.

Using the chat function via the website

Our website also has chat functionality. In principle, you do not need to share any data to be able to use the chat. During the chat session, however, we may ask you to share some information, such as your company name, email address and telephone number, so that we can contact you again later.

Asking questions by email

You can also ask your questions by email, in which case we will process, as a minimum, your (business) email address and name, and any other data that you share with us.

Conference call

Finally, we can make an appointment with you for a video conference call. In such a case we will process, as a minimum, your email address to be able to send you the invitation. You then have the choice to participate in the conference call, give a user name and join with or without video functionality.

We use these data to answer your questions, communicate with you and send you the necessary information.

If you are a customer, we will process these data under the terms of our agreement with you. If you are not a customer, will we process these data on the basis of our legitimate interest in answering your questions.

Provision of data to third parties

For communication via email, contact form or chat, we use the services of IT service providers, such as a ticketing system, a chat module and a video conference tool. The suppliers of these services may become aware of your data. In addition, we process part of your data in our CRM application.

Financial administration

If you purchase services from Evidos, this will be subject to a fee. In order to collect this fee, we need certain information from you, for example to be able to execute the direct debit mandate or to send you an invoice.
If you are our supplier and we purchase services from you, we will process certain data in order to process and pay your invoice.

For these purposes, we will process your name and address details, payment details, email address, telephone number, Chamber of Commerce number, tax data, invoices, contact name, position and company name.

We will process these data under the terms of our agreement with you.

Provision of data to third parties

Your data will be recorded in our ticketing tool, CRM application and invoicing tool and by the accounting firm that handles our administration.

Supplier records

When Evidos engages suppliers, it will include specific contact information in its systems for payment and invoicing purposes, for communication purposes and with a view to the services provided by the supplier concerned. In such cases, Evidos will process the names, address details, email address, telephone number, company name and payment and invoicing details.

We will process the above data under the terms of our agreement with you.

Provision of data to third parties

We register your data in our CRM application and online accounting package. The suppliers of these services process your data on the instructions of Evidos.

Applying for a job at Evidos

Our website allows you to respond to vacancies or send an open application. You can also submit your application via other communication channels of Evidos, such as the contact page or by email. We may ask you to provide necessary information, such as your name and address details, telephone number, CV, certificate of conduct, lists of marks, diplomas, motivation letter and any references.

We will keep your data during the application procedure and for no more than four weeks after the end of that procedure. However, with your consent we may retain this information for up to one year, so as to be able to approach you should a relevant vacancy become available in the future.

We will process the above data on the basis of our legitimate interest in, for example, assessing whether we will engage you on the strength of your application and, in certain cases, on the basis of your consent as required to ultimately conclude an agreement.

Provision of data to third parties

In certain cases, we may need the help of an external recruitment services company. In such a case, we may send your data to them in the context of your application. In addition, certain data are processed within our IT service provider’s cloud environment, for example to schedule an online appointment.

Newsletters and surveys

You can subscribe to our newsletter on our website. In addition, when you contact Evidos, for example in the context of applying for a quote, the white paper or to submit a question via the contact form, you will be contacted once-only and asked whether you wish to subscribe to our newsletter. If you subscribe to the newsletter, you will receive an email periodically with news about the latest developments and to keep you informed of our services, offers and products. In addition, we may invite you to take part in a survey. For this purpose, we will use your name, company name and business email address.

If you are a customer, Evidos will inform you about new functionalities, events, training and maintenance work via its product newsletter. In that context we will process your name, company name and business email address.

We will process the above data on the basis of your consent. You can withdraw your consent at any time via the ‘unsubscribe’ link at the bottom of each newsletter.

Provision of data to third parties

We use our supplier’s email services to send the newsletters. The supplier of this service will process your data on our instructions. In the case of a survey, your data will be shared with an external survey services provider.

Organising events

Evidos regularly organises events for which you can register. If you do, we will ask you to provide your first and last name and your email address. We use these data to allow you to access the event, as well as to send you additional information afterwards. We will also ask you whether you wish to receive additional information.

We will process the above data on the basis of your consent.

Provision of data to third parties

In this context, we will send your data to the supplier of the external event application. We will also share your data with our email service provider to contact you once-only after the event. If you show more interest in the service, your data will be processed in our CRM application.

Improving our services and informing you about service-related developments

In the context of product management, Evidos registers possible new functionality suggested by its customers and users. In doing so, Evidos only processes the company name and, in certain cases, the name of the contact person.

In addition, through the account environment Evidos will inform you about new functionality, maintenance work, possible malfunctions and any other matters relevant to the services you purchase from us. In doing so, we will only process your account data to ensure that the message reaches you.

We will process these data under the terms of our agreement with you.

Provision of data to third parties

We use the email services of a third party to send the newsletters. We use an external registration tool to register new product features.

Other marketing activities

In certain cases, you may be contacted by telephone by a telemarketing agency engaged by Evidos. This agency will never contact you of its own accord, and will in this context only process your general company telephone number. During the call, you can indicate that you are interested in the services provided by Evidos and leave your details, so that we can contact you later. To that end, we may ask you to provide your name, company name, telephone number and email address.
We can also approach you by email. We will only do so with the consent of the email recipient, or using email addresses made available for this purpose.

We will process this data on the basis of your consent or on the basis of our legitimate interest in doing so.

Provision of data to third parties

Your data will be processed by the external telemarketing agency, the email service provider and/or our CRM application.

Statistics

We keep statistics on the use of our services and the website. As regards the provision of services, we keep internal statistics on the signing method used, the number of signing requests per organisation and the total number of successful transactions. We only process your company name in this context. The statistics cannot be traced back to any individual.

We will process these data based on the consent you have granted via the cookie banner and on the grounds of our legitimate interest with regard to these general statistics.

Retention periods

We will not retain the data for the aforementioned purposes longer than is necessary. This means that we will retain your data for as long as is necessary, for example, to provide our services to you, to perform the agreement, or until we are sure that you are satisfied with our services, until we have answered all your questions and as long as you are registered for our newsletter. We may need to keep your data for a longer period in connection with a statutory retention obligation, for example the obligation to retain tax records.

Provision of data to third parties

Apart from the provision of your personal data to third parties as described above, we will not share your information with other parties without your consent, unless we are required to do so by law (for example, if the police so requires in the event of a suspicion of a crime).

We enter into strict agreements with the parties that receive your data that clearly state which personal data are shared and why. We will ensure that your data are not used for any other purposes. We will also ensure that these third parties protect and destroy your data as soon as they no longer need them.

Cookies

Our website uses cookies. A cookie is a simple, small file that is sent along with pages of this website and stored by your browser on the hard disk of your computer, allowing you to be recognised. In this Privacy and Cookie Statement, the term ‘cookie’ is also meant to refer to other, similar (tracking) techniques (e.g. pixels). Third parties engaged by us place cookies on your device as well.

A pop-up indicating that clicking the ‘agree’ button on our website denotes acceptance of the cookies is displayed the first time that you visit our website. By clicking this button, you allow us to use all cookies and plug-ins as set out in the pop-up and in this Privacy and Cookie Statement. You are free to disable cookies in your browser. Please note that doing so could mean that our website will no longer function optimally.

If you visit our website(s) and consent through the cookie settings, we use the following parties (overview of all cookies):

We have no control over what the above parties themselves do with the cookies. For more information about those parties and their approach to cookies, please see their respective privacy statements (NB. always check the latest version). Cookies have a shelf-life date: some are session cookies and others are subject to a different, specific retention period (for example 26 months in the case of Google Analytics). If you wish you can remove cookies earlier. This is a manual operation; please consult the instruction guide for your browser.

Security

We take security measures to minimise the risk of misuse of and unauthorised access to personal data. For more information about the security measures that we have taken, please see our Security Statement: Certifications and Accreditations Evidos

Third-party websites

This statement does not apply to third-party websites that are connected to our website through links. We cannot guarantee that these parties will treat your personal data in a reliable or secure manner. We therefore recommend that you read the privacy statements relating to these websites before using them.

Transfer outside the EEA

Google, Airtable, Atlassian, Mailshake, Eventbrite, Hunter Web Services, Intercom, Mandrill (Mailchimp), SurveyMonkey and Pipedrive may send information to, store information in and transmit information to the United States. We have made supplementary arrangements with these parties regarding the protection of personal data. For more information, please see these parties’ privacy statements. We are aware of the ruling of the European Court of Justice of 16 July 2020, which has implications for the transfer of personal data. We are currently investigating how we can best deal with those implications. We are strongly committed to privacy and will try to do everything we can to find a suitable solution. Once we have a suitable solution, we will inform you of this via this privacy statement. If you have any questions about the processing of your personal data, please contact us using the contact details in this privacy statement.

Changes to this Privacy and Cookie Statement

We reserve the right to amend this statement. Changes will be published on this website and we will make sure that old versions remain available. We recommend that you check this statement regularly, to ensure that you are aware of these changes.

Your rights

You can contact us at any time if you have any questions or wish to know which of your personal data we hold. Please send your request to privacy@evidos.com.

You have the following rights:

• to receive an explanation of what personal data we have collected about you and how we use that data;

• to inspect the specific personal data that we have collected;

• to have errors corrected and have your personal data supplemented if they are incorrect or incomplete;

• to have personal data deleted;

• to withdraw your consent;

• to limit specific processing operations;

• to object to a particular use (for example, a processing operation based on a legitimate interest or for direct marketing purposes).

In the interests of preventing misuse and fraud, we may ask that you provide proper identification. If you wish to inspect personal details linked to a cookie, please make sure to include a copy of the relevant cookie. You will find the cookie in your browser settings.

In principle, we will comply with your request within one month. However, this term may be extended for reasons relating to the specific rights of data subjects or the complexity of the request. If we extend this term, we will inform you of that in due time.

Autoriteit Persoons

Needless to say, we will be happy to help should you have any complaints about the processing of your personal data. Under privacy law, you are also entitled to lodge a complaint with the Dutch Data Protection Agency against the processing of your personal data. To do so, please contact the Dutch Data Protection Authority.

Contact details

If you have any questions regarding your privacy and our Privacy and Cookie Statement, please send an email using the following contact details:

Evidos B.V.
Zijlweg 148a
2015 BJ Haarlem
023 737 0046