Privacy policy

Version 2026-10-20

Privacy at Marketizo Sign

This notice explains how data is processed when contracts are prepared, sent, viewed, electronically accepted and stored via Marketizo Sign. This section supplements the general privacy policy and applies when you use Marketizo Sign.

1. Who is responsible for the processing

Marketizo Digital e.U., Simmeringer Hauptstraße 24, 1110 Vienna, Austria. For questions and requests about your data, write to office@marketizo.com. Company register number: FN 561722m; VAT ID: ATU77282726.

2. Where the data comes from and what we process

We take the signers' names, business contact details, company, country and role from existing business communication, the CRM, or information provided by the contracting party or its representative. We receive other data from you and from your actions on the signing page.

• Data named in the contract, contact details of the contracting parties, recipients and the statement of authority to represent.
• The text and locked PDF version of the contract, document versions, category and status, as well as the typed name and the attached signature drawing.
• Data on sending the invitation and code, access to the PDF, confirmation of access to the email address, acceptance or rejection, and the express declaration of acceptance of the contract.
• Server time of events, IP address where available, browser data, technical session identifiers and security logs.
• Document fingerprints (hashes) and an evidence package that makes it possible to check whether the stored version differs from the accepted one.

The drawing is stored as a representation of the signature together with the document. We do not record the pressure or dynamics of the handwriting and do not use the drawing for biometric identification of a person. The email code confirms access to the mailbox; it is not an independent check of a person's identity.

3. Purposes and legal bases

For preparing and performing a contract with you as a natural person, processing is based on Art. 6(1)(b) GDPR. For business contacts of representatives of the contracting parties, organising the signing, preventing misuse and proving that the agreement was concluded and what it contains, we rely, where applicable, on legitimate interests under Art. 6(1)(f) GDPR: reliable business operations, security, and the establishment, exercise or defence of legal claims. Where there is an obligation to retain business records, the corresponding processing is based on Art. 6(1)(c) GDPR.

The statement “Prihvatam ugovor” (“I accept the contract”) expresses the intention to conclude the contract. It is not consent to receive marketing messages. We do not use data from this process for marketing just because you signed a contract.

4. Who receives the data

Access is limited to authorised people at Marketizo who need it for the stated purposes. Parties and required signers of the same contract may receive the final PDF and the evidence record with the data and statements of the other signers, including the technical data it contains. That's why we only enter the data needed for that agreement into a shared contract.

• Vercel provides application hosting and request processing.
• Supabase provides the database for documents, signatures and records. The project database is set up in a European region.
• Google Workspace is used to send invitation links and one-time codes from office@marketizo.com. In doing so it receives the recipient's address and the content of the message; the signature drawing and the full PDF are not part of the OTP message.

Data may be shared with legal advisers, accountants, courts or authorities where this is necessary for their lawful duties, a legal obligation, or establishing and defending claims. The mere fact that someone has received an invitation does not give them access to other contracts or the CRM.

5. International processing

The database's European region does not mean that all processing by every provider takes place exclusively in the EU. Hosting, email delivery, support and sub-processors may involve countries outside the European Economic Area. The relevant mechanisms for these transfers, including the EU Standard Contractual Clauses where applicable, are governed by the contracts with each provider. You can request information on the specific safeguards applied, and how to obtain a copy of them, at office@marketizo.com.

Provider documents: Vercel DPA, Supabase DPA and Google Cloud Data Processing Addendum.

6. How long we keep data

The period depends on the purpose and the type of document. We keep the contract and the evidence package for as long as they are needed for the contractual relationship, applicable statutory retention obligations, and the establishment, exercise or defence of legal claims. In deciding, we take into account the end of the relationship, applicable retention and limitation periods, and whether there is an open dispute. Once there is no longer a need, we delete or anonymise the data. Where there is an obligation or a legitimate need to keep it longer, we restrict access to that purpose.

We assess unsigned drafts and closed invitations based on whether they are still needed for negotiations, as evidence or for another stated purpose. Archiving in the application is not in itself deletion. You can send a deletion request, or ask about the retention period for your specific document, to office@marketizo.com.

A signing invitation is valid for seven days, an OTP code for ten minutes and an access session for thirty minutes. These are access periods, not periods for deleting the contract. After the process is complete, the portal allows downloads for a limited time; after that you can request a copy from us. Sent messages in mailboxes and backups have their own retention and recovery cycles.

7. Required data and your choices

The recipient's contact details, the contracting party's data, confirmation of access and the express declaration are required for this electronic process. Without them, signing via Sign cannot be completed. The signature drawing is optional in addition to the typed name. If you don't want to use this process, or believe the invitation was sent to the wrong person, contact us so we can look at another suitable way of concluding the contract.

In the signing portal we use an essential cookie for the session and for security mechanisms. We don't include marketing pixels or ad tracking on the Sign pages. Visits to the main website are covered by its own cookie notice.

8. Your rights

Subject to the conditions of the GDPR, you can request access to and a copy of your data, rectification, erasure, restriction of processing and, where applicable, data portability. You have the right to object to processing based on legitimate interest. If any additional processing is based on your consent, you can withdraw it for the future without affecting the lawfulness of earlier processing. Send requests to office@marketizo.com; to protect the data, we may ask for reasonable confirmation of your identity.

Erasure is not unconditional if the data is still needed because of a legal obligation or for legal claims. We handle corrections of data in a concluded contract in a way that preserves a reliable record of the previous agreement. Withdrawing consent to a separate processing activity does not in itself terminate the contract.

You can contact the Austrian supervisory authority, the Österreichische Datenschutzbehörde (Austrian Data Protection Authority), or the competent authority in the country of your habitual residence, your place of work or the alleged infringement.

9. Automated decisions and type of signature

Sign does not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Art. 22 GDPR. Technical checks of the code and of access serve the security of the process.

This process is a simple electronic signature. The privacy notice, the OTP and the server-side records do not turn it into a qualified signature, nor do they guarantee that every contract is valid. Where a special form is required, a corresponding separate process is used.