Terms of Service

1. Provider and scope

These Terms govern the use of PenlyDoc at penlydoc.com, its console, signing pages, API and embedding script (together, the "Service"), provided by:

"We" means vertexly s. r. o. "Customer" or "you" means the organisation that creates a PenlyDoc account, and the people it invites to its team. "Signer" means anyone invited to sign, approve or receive a document. Signers who only sign do not enter into a contract with us; for them our Privacy Policy applies.

By creating an organisation you confirm that you may act for it and accept these Terms on its behalf.

2. The service

PenlyDoc lets you upload a document, mark where people sign, send it by e-mail or show it inside your own product, and receive a signed PDF. Each signed PDF carries a digital seal (PAdES) and a certificate of completion with the evidence of each step. The Service also offers templates, team accounts, branding, a custom link domain, webhooks, an API and automatic reminders and notifications.

3. Electronic signatures and their legal effect

Signatures made in PenlyDoc are electronic signatures within the meaning of Regulation (EU) No 910/2014 (eIDAS). Under its Article 25 an electronic signature cannot be denied legal effect or admissibility as evidence solely because it is electronic. The seal on the PDF shows that the document has not changed since signing; the certificate of completion records who signed, when and from which device.

PenlyDoc is not a qualified trust service and does not create qualified electronic signatures. Some documents need a qualified signature, a handwritten signature, a notary or another form by law (for example certain real estate, family, inheritance or consumer credit documents, depending on the country). You decide whether an electronic signature is suitable for your document and the people signing it, and you remain responsible for that choice. We do not give legal advice.

Identity of signers: by default a signer is identified by access to their e-mail inbox, or by your own product when you embed the signing page; you can additionally require a one-time code. Checking that the right person signs beyond this is your responsibility.

4. Accounts, teams and API keys

• Give correct information when you sign up, and keep it current.
• Sign-in works with a code sent to your e-mail. Protect access to that inbox: whoever controls it can sign in.
• Owners and admins decide who belongs to the team and what role they have. You are responsible for what your team members and your API keys do.
• API keys are like passwords for your systems. Keep them on your server, never in a browser or app, and revoke a key in the console as soon as it may have leaked.
• Tell us at support@penlydoc.com without delay if you suspect misuse of your account.

5. Acceptable use

You may not use the Service to:

• send unsolicited mass messages, or invite people who have no reason to receive a document from you;
• deceive people: phishing, impersonating another organisation or person, or collecting passwords, payment card or bank details under false pretences;
• send documents or content that are illegal, infringe the rights of others, or contain malware;
• get people to sign without them understanding what they sign, or forge a signature;
• break or test the security of the Service without our written permission, overload it, or get around its limits;
• resell the Service or build a competing product from it, unless agreed with us in writing.

New organisations have daily limits for sending documents and invitations during their first days. We may change these limits to protect signers and the reputation of our e-mail.

6. Your content

Documents, templates, branding and data you put into PenlyDoc remain yours. You give us the right to store, process, transmit and display them only to provide the Service to you, including generating the signed PDF and its certificate. You confirm that you have the right to upload them and to send them to the signers you invite, including any legal basis needed under data protection law.

The Service, its software, design and the PenlyDoc name belong to us. You may use them only as these Terms allow. If you send us feedback, we may use it without obligation to you.

7. Fees

The Service is currently provided free of charge, within the limits shown in the console. If we introduce paid plans, we will publish their prices and tell you at least 30 days before any fee applies to your organisation; nothing becomes payable without your agreement to a paid plan.

8. Availability and changes

We work to keep PenlyDoc available and secure, back up data daily and fix faults promptly, but we do not guarantee uninterrupted availability. Maintenance, updates and events outside our control can interrupt it. We may improve and change the Service; if a change removes a feature you rely on in an important way, we will tell you in advance where we reasonably can.

We may change these Terms. We will publish the new version here and notify owners of organisations by e-mail at least 30 days before important changes take effect. If you do not agree, you can close your account before then; continued use after the date means acceptance.

9. Data processing terms

This section is the agreement under Article 28(3) GDPR for the personal data in documents and about signers that we process on your behalf ("Customer Data").

1. Roles. You are the controller of Customer Data; we are your processor. You decide why and how it is processed; we process it only on your documented instructions, which are these Terms and what you set up and do in the Service, unless EU or Slovak law requires otherwise, in which case we tell you first unless the law forbids it.
2. Subject and duration. Processing serves the electronic signing of your documents for as long as you use the Service, plus the deletion periods in clause 9.
3. Data and people. Categories: names, e-mail addresses, the content of documents, signatures, form entries, IP addresses, browser details, timestamps and other evidence of signing. Data subjects: signers, approvers, people receiving copies, and anyone named in your documents. Do not upload special categories of data (Art. 9 GDPR) or data about criminal convictions unless you have a legal basis and have checked that our measures are adequate for it.
4. Confidentiality. Only people who need it to run the Service have access, and they are bound to confidentiality.
5. Security. We maintain appropriate technical and organisational measures (Art. 32 GDPR), including encryption in transit, hashed credentials, tamper-evident seals and history, access control, EU hosting and daily backups. We may update them as long as the level of protection does not fall.
6. Sub-processors. You authorise the sub-processors listed in section 7 of the Privacy Policy. We bind each to data protection obligations equivalent to these, and remain responsible for them. We announce a new sub-processor at least 30 days in advance on that page and by e-mail to owners; you may object for a reasonable data protection reason, and if we cannot address it, you may close your account.
7. Transfers. Customer Data is stored in the EU. Any access from outside the EEA is covered by an adequacy decision or the Standard Contractual Clauses.
8. Assistance. We help you, as far as reasonably possible, to answer requests from data subjects, to secure the data, and with impact assessments and consultations with authorities. We forward to you any request a data subject sends us about Customer Data.
9. Breaches. We notify you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting Customer Data, with the information you need for your own notifications.
10. Deletion and return. You can download your signed documents at any time. When you close your account, or ask us to delete data, we delete Customer Data within 30 days and from backups within the following 14 days, unless EU or Slovak law requires us to keep it.
11. Audits. We make available the information necessary to show compliance with Article 28 and allow reasonable audits, with reasonable notice, at your cost and without access to other customers' data.

10. Liability

We are liable without limitation for damage caused intentionally or by gross negligence, for injury to life, body or health, and where the law does not allow liability to be limited.

Otherwise, for business customers: we are not liable for lost profit, lost business or indirect damage, and our total liability per calendar year is limited to the fees you paid us in the 12 months before the damage, or EUR 500 if that is higher. We are not liable for the content of your documents, for your choice to use an electronic signature (section 3), for e-mails that recipients' providers delay or reject, or for faults of your own systems connected through the API or webhooks.

You indemnify us against claims of third parties arising from documents you send or from your breach of section 5, including reasonable legal costs.

11. Term, suspension and termination

The agreement runs for an indefinite period. You can end it at any time by asking us to close your organisation at support@penlydoc.com; download your signed documents first. We can end it with 30 days' notice by e-mail.

We may suspend an account or block sending immediately if it seriously breaches section 5, endangers the security of the Service or other customers, or if the law requires it. We tell you the reason unless the law or an investigation forbids it, and restore access once the cause is removed.

After termination we delete your data as described in section 9, clause 10. Sections 6, 10 and 13 survive termination.

12. Consumers

PenlyDoc is meant for businesses and organisations. If you use it as a consumer, the mandatory consumer protection rules of your country of residence apply in addition to these Terms, and the limitations in section 10 apply only as far as those rules allow. Consumers in the EU can also use the online dispute resolution platform of the European Commission and, in Slovakia, alternative dispute resolution before the Slovak Trade Inspection (Slovenská obchodná inšpekcia).

13. Law, disputes and final provisions

These Terms are governed by the law of the Slovak Republic, excluding its conflict of laws rules and the UN Convention on Contracts for the International Sale of Goods. Disputes with business customers are decided by the courts of the Slovak Republic competent for our registered office; mandatory rules on the jurisdiction for consumers are not affected.

If a provision is invalid, the rest remains in force and the invalid provision is replaced by a valid one closest to its purpose. You may not transfer this agreement without our consent; we may transfer it to a successor of our business with notice to you. These Terms are written in English; translations are for convenience, and the English version prevails.

Questions: support@penlydoc.com.