Privacy Policy
1. Who we are
PenlyDoc is operated by:
vertexly s. r. o.Karpatské námestie 7770/10A, 831 06 Bratislava - Rača, Slovak Republic
Company ID (IČO): 57 900 523
Registered in the Commercial Register of the Municipal Court Bratislava III, section Sro, insert no. 204775/B
Questions about personal data: privacy@penlydoc.com. Support: support@penlydoc.com. We have not appointed a data protection officer, because the law does not require one for our activities; the address above handles all privacy matters.
2. Two roles: controller and processor
The General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Slovak Act No. 18/2018 Coll. on the protection of personal data distinguish who decides about data (the controller) and who only works with it on someone else's instructions (the processor).
- Documents and the people who sign them. The organisation that uploads a document and invites people to sign it (our customer) is the controller. We are its processor under the data processing terms in section 9 of our Terms of Service. If you signed a document and have a question about it, the organisation that sent it is your first contact; we will help it answer.
- Accounts, billing, this website and service e-mails. Here vertexly s. r. o. is the controller.
3. People who sign documents
When an organisation sends you a document through PenlyDoc, the following is processed on its behalf:
| Data | Why |
|---|---|
| Your name and e-mail address, and the language the organisation chose for you | To send you the invitation, reminders, the signing code and the signed copy |
| The document and anything you type, tick or draw in it, including your signature (drawn or typed) | To produce the signed document |
| Evidence of signing: date and time of each step (opened, agreed to sign electronically, signed or declined), your IP address, browser (user agent), the text of the consent you accepted, a one-time code if the organisation requires one (we store only a hash of it), and the reason if you decline | To prove later who signed what and when. This evidence is added to the certificate of completion at the end of the signed PDF and kept in a history that cannot be changed unnoticed |
The legal basis is the organisation's: usually the performance of a contract with you or steps before one (Art. 6(1)(b) GDPR), or its legitimate interest in being able to prove an agreement (Art. 6(1)(f)). We do not use this data for any purpose of our own.
You do not need an account to sign. The signed PDF carries a digital seal; anyone you give it to can check it at penlydoc.com/verify. That check reads the file in memory and does not store it.
4. Organisations and console users
| Data | Why | Legal basis |
|---|---|---|
| Organisation name, branding (name shown to signers, colour, logo), default language, websites allowed to embed the signing page, custom link domain, webhook address | To provide the service as the organisation set it up | Contract (Art. 6(1)(b)) |
| Your name, e-mail address, role in the organisation, language, notification settings, date of sign-up and last sign-in | To let you sign in and work with your team | Contract (Art. 6(1)(b)) |
| Sign-in codes (only a keyed hash, valid 10 minutes) and team invitations (only a hash of the link) | Password-free sign-in | Contract (Art. 6(1)(b)) |
| API keys (only a hash and the first characters), when each key was last used | To let your systems connect, and to show you which key is in use | Contract (Art. 6(1)(b)) |
| IP addresses and counts of sign-in attempts and sent documents | To stop abuse: brute force, spam and phishing through new accounts | Legitimate interest in a safe service (Art. 6(1)(f)) |
| Messages you send to support | To answer you | Contract or legitimate interest |
Service e-mails (sign-in codes, invitations, notifications you switched on in Settings) are part of the service. We do not send marketing e-mails.
5. Visitors of penlydoc.com
Our web server receives your IP address, the page requested, the time and your browser's user agent, and keeps them in technical logs to deliver the page and to protect the service (Art. 6(1)(f)). We use no analytics, no advertising pixels and no third-party fonts on the public pages.
7. Who else receives data
Only the service providers we need to run PenlyDoc, each bound by a data processing agreement:
| Provider | What for | Where |
|---|---|---|
| Hetzner Online GmbH, Germany | Servers, database and document storage | European Union |
| Resend, Inc., USA | Delivery of e-mails (invitations, codes, notifications) | Sending from the EU (Ireland); company in the USA, see section 8 |
| Cloudflare, Inc. (cdnjs) | Delivers the open-source PDF viewer the console and signing page load; it receives your IP address and browser details when the viewer loads | Global network; see section 8 |
Webhooks and embedding are set up by the organisation: when it connects its own system, PenlyDoc sends that system the status of its documents. Beyond that we disclose data only when the law obliges us to, for example to a court or authority, and only as far as required. We never sell personal data.
8. Transfers outside the EU
Documents and the database stay in the EU. Where a provider in section 7 may access data from the USA, the transfer relies on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can ask us for a copy of the relevant safeguards.
9. How long we keep data
- Documents, signatures and their evidence are kept for as long as the organisation keeps its account, because the signed document and its proof are the point of the service. The organisation can ask us to delete a document or all of its data at any time; we then delete it within 30 days, except where the law obliges us to keep it.
- Accounts: until the organisation closes its account or removes you from its team; then within 30 days.
- Sign-in codes expire after 10 minutes; invitations after 7 days.
- Server logs: at most 30 days.
- Backups: overwritten in a 14-day cycle, so deleted data disappears from backups within 14 days of its deletion.
- Invoices and accounting records: as long as Slovak accounting and tax law requires (usually 10 years).
10. Security
Connections are encrypted (HTTPS with HSTS). Every signed PDF is sealed so that any change is visible, and its stored fingerprint is checked whenever it is read. The history of each document is chained by hashes, so a removed or altered entry is detected. Passwords do not exist; sign-in codes, invitation links and API keys are stored only as hashes. Access to servers is limited to the people who run the service. If a breach ever puts your data at risk, we inform the organisation, the authority and, where required, you, as Articles 33 and 34 GDPR require.
11. Your rights
You have the right to access your data, to have it corrected, deleted or restricted, to receive it in a portable format, and to object to processing based on legitimate interest (Articles 15 to 21 GDPR). Where processing is based on consent, you can withdraw it at any time.
Write to privacy@penlydoc.com. We answer within one month. For documents an organisation sent you, we pass your request to that organisation and help it answer, because it decides about that data.
You can also complain to a supervisory authority, in particular in the EU country where you live or work. In Slovakia that is the Úrad na ochranu osobných údajov Slovenskej republiky, Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk.
We do not make decisions about you based solely on automated processing, and we do not profile you.
12. Changes and contact
If we change this policy, we publish the new version here with a new date; for important changes we tell organisations by e-mail in advance. Contact: vertexly s. r. o., Karpatské námestie 7770/10A, 831 06 Bratislava - Rača, Slovak Republic, privacy@penlydoc.com.