The protection of your personal data is an important matter for us. We collect, process and use your personal data in compliance with the content of this privacy notice, as well as the applicable data protection regulations, in particular the General Data Protection Regulation (GDPR) and the Telemedia Act (TMG).
This privacy notice serves as information pursuant to the requirements of the General Data Protection Regulation (GDPR), in particular Articles 12 et seq., and provides you with the information on how we collect and process your data when utilizing the Adobe Sign service.
With Adobe Sign you can prepare and send documents to request an electronic signature from multiple parties, manage and track documents for signature, complete and sign a document.
With Adobe Sign you can prepare and sign any document that requires a signature. Documents may come from various operational areas like Sales, Human Resources, Procurement, Legal, Marketing, Finance and more. Generally known document types are, for example sales orders / contracts, employee contracts, consent notes, supplier agreements, purchase orders, non-disclosure agreements, frame contracts, statements of work, Letters of Intent, invoice approvals or even meeting approvals.
You may sign a document as a party or in exercise of your work entitlement. Below, we provide some examples.
Documents to which you are a party:
Documents which you sign in exercise of your work entitlement:
Basically, when utilizing Adobe Sign, you act as a Sender and/or as a Signer of documents.
As a Sender you prepare and send a document for signature and get multiple parties to sign a document. Depending on the business case, you may also act as a Signer. Each Sender has a user account in Adobe Sign.
As a Signer you complete and sign a document. As long as you are not a Sender in Adobe Sign, you do not have an Adobe sign user account.
At the end of the signing process both, Sender and Signer, receive a copy of the signed document.
Bertelsmann SE & Co. KGaA, Carl-Bertelsmann-Str. 270, 33311 Gütersloh, Germany (herein-after referred to as “Bertelsmann”) manages the Bertelsmann Adobe Sign tenant, creates Bertelsmann companies within Adobe Sign and provides the Adobe Sign service to various Bertelsmann companies. The Bertelsmann companies determine the specific purpose and use of Adobe Sign including the maintenance of company specific Adobe Sign Senders in their local context and utilize Adobe Sign for their document signing processes. As such, the Bertelsmann company that sends a document for signature to you is the Controller for the processing of your data.
Adobe Systems Software Ireland Limited, 4-6 Riverwalk, City West Business Campus, Saggart D24, Dublin, Ireland (hereinafter referred to as “Adobe”) is the technical provider of Adobe Sign. As a Processor pursuant to Art. 28 GDPR, Adobe is strictly bound to the instructions of the Controller and not entitled to process data concerning you for any other purposes or in any other way, unless obligated otherwise by applicable law.
The Controller is bound by the strict regime of GDPR during the processing of your data and is potentially subject to even further national regulation in your country of residence.
If and when your Bertelsmann Company uses a single sign on solution (SSO), please, contact them for information on data exchanged between Adobe Sign and the SSO application.
As a Sender of a Bertelsmann company you receive a Welcome e-mail from your Bertelsmann company, as soon as your Bertelsmann company creates a user account for you in Adobe Sign. During the document signing process, Signers and Senders receive Please Sign, Signed and Filed, Reminder, Cancelled Transaction e-mail notifications from Adobe Sign.
Irrespective of your role in Adobe Sign, your computer automatically transmits your IP-address, browser type and version, operating system, internet service provider, date, time and state of your access as well as the referring website to Adobe Sign. In addition, Adobe Sign creates technically required server-log-files. Apart from your IP-address, aforementioned data do not qualify as personal data as these cannot be traced back to you. An IP address is only personal data, unless it is a static address or your internet service provider adds additional information about you. Furthermore, Adobe Signs records time stamps as you trigger events during the signing process, e.g. document created, document emailed, document viewed, document signed, signed document mailed, document cancelled, document rejected as audit trail for processing your document. This audit trail is visible to all parties in the signing process.
Depending on your role, Adobe sign processes additional personal data.
For the Sender
Account creation for a sender requires recording of your e-mail address, your Bertelsmann Company affiliation and your Adobe Sign authorizations. You yourself are entitled to maintain your Adobe Sign profile adding e.g. phone numbers, e-mail signatures, delegation of authorizations (e.g. deputy), signatures and initials, language preferences.
For the Signer
In order to prepare and send a document, the Sender solely records your e-mail address. However and depending on the document, the Sender may require you to record your e.g. initials, title, company and other data on document level.
Bertelsmann utilizes Adobe Sign to simplify and accelerate the signing process, thereby in-creasing process efficiency and avoiding distribution and collection of documents via e-mail or postal services. Using Adobe Sign therefore represents a significant legitimate legal interest of Bertelsmann and Bertelsmann companies as Controllers. Art. 6 (1) lit. f GDPR justifies processing of personal data for such purposes. Your interest as an individual is especially reflected by your rights of objection, rectification and access regarding the data processed by each Controller. In addition, your interests are also reflected in the fact that Controllers only require the minimum set of data to be recorded as required by the signing process and document type.
Due to opening clauses in the GDPR, there might be national laws – in particular regarding labor law – applicable in addition.
Unless indicated otherwise at the time of the collection of your personal data, we erase your personal data if the retention of that personal data is no longer necessary (i) for the purposes for which they were collected or otherwise processed, or (ii) to comply with legal obligations (such as retention obligations under tax or commercial laws).
Apart from Adobe (see chapter 5), your data as recorded in your profile, in documents, signing transactions or Adobe Sign e-mails as applicable for the signing process is only transferred to or accessed by the parties – in general Senders and Signers – involved in the signing process. You can obtain involved parties, data shared and corresponding e-mail addresses from Adobe Sign generated Please Sign, Signed and Filed, Reminder, Cancelled Transaction e-mail notifications and attached documents. Please note, that Signers can be employees of Bertelsmann external companies.
Adobe processes your data in data centers in Germany. As such, your data – when using Adobe Sign – are not transferred outside the EU (European Union)/EEA (European Economic Area). Whenever Adobe affiliates or Adobe service providers have access to your data in maintenance circumstances for Adobe Sign and are located outside the EU/EEA, Bertelsmann has taken adequate additional safeguards with Adobe to secure an equivalent level of data protection as enshrined in the GDPR in the form of Standard-Contractual Clauses (Controller to Processor) pursuant to Art. 46 (2) lit. c GDPR. You can request a copy of these clauses from Bertelsmann. Within the signing process your data may be transferred outside the EU/EEA, when involved parties are located outside the EU/EEA (see chapter 10 for data transferred).
You have all rights as an individual (data subject) pursuant to Chapter III of the GDPR. These rights are explained below and can be claimed from each Controller indicated above (see chapter 5) separately.
Your right to restriction pursuant to Art. 18 GDPR is warranted by design in the Service by means that any document can only be accessed by the involved parties for the specific pur-poses that are linked with that document. Nonetheless, you have the right to request further restriction of data processing concerning you in accordance with Art. 18 GDPR. You have the right to object to the processing of your data pursuant to the pre-requisites of Art. 21. In addition, you have the right to lodge a complaint with a supervisory authority which is either responsible for the respective Controller or which is responsible at your place of residence.
Cookies are small text files that are saved to your computer when visiting a website. The cook-ies that are saved are attributed to the web browser used by you. When the website is visited again, the web browser returns the content of the saved cookies, thus enabling the application to recognize you and to provide certain functionalities, e.g. to maintain a language choice made by you. Certain cookies are deleted when you log out or end the browser session (“transient cookies” or “session cookies”). Other cookies are saved for a specific period of time (“temporary cookies”) or indefinitely (“persistent cookies”). Temporary cookies are automatically deleted when the defined period of time expires. The privacy and security settings of your browser enable cookies to be deleted at any time and also enable you to configure the use of cookies in accordance with your preferences.
The use of Adobe Sign requires session cookies. These are technically necessary in order to perform the signing process. Session cookies are necessary to authenticate the user and to operate a consistent session. Moreover, Adobe Sign uses temporary cookies to ensure basic Adobe Sign functions and usability features that guide you throughout the signing workflow. These temporary cookies are Adobe Creative Cloud, Google Inc. and Walk Me. For the use of both these categories of cookies, Art. 6 (1) lit. f constitutes the legal basis, whereas an intuitive user experience and support in using the Adobe Sign features is our legit-imate interest.
On your request the Sender will provide you with the contact details of the Controller’s Data Protection Officer.
Date of this Data Privacy Notice: May 15, 2020