Privacy Policy

1. Introduction

This Privacy Policy explains how K Sign Co ("K Sign", "we", "our", or "us") collects, holds, uses, discloses, and otherwise handles personal information in connection with the K Sign platform, website, application programming interfaces (APIs), electronic signature services, forms, workflow automation tools, payment collection features, and related services (the "Services").

K Sign is based in, and operates the Services from infrastructure hosted in, Australia. We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth) (the "Privacy Act") and the Australian Privacy Principles (the "APPs"), and, where applicable to particular individuals or activities, other data protection laws.

This Privacy Policy forms part of, and should be read together with, the K Sign Terms of Service (the "Terms") and, where K Sign processes personal information on behalf of a business customer, the Data Processing Agreement (the "DPA"). By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy.

2. Scope and Our Role

This Privacy Policy applies to personal information we handle about visitors to our website, individuals who register for or administer an account, authorised users of a customer's account, and individuals who interact with the Services as signatories, form respondents, payers, or recipients of documents and communications.

K Sign as Controller

We act as a controller (responsible entity) when we determine the purposes and means of processing — for example, in relation to our own account holders, billing, website visitors, marketing, and the administration and security of the Services. This Privacy Policy governs that handling.

K Sign as Processor

We act as a processor (service provider) on a customer's behalf when a customer uploads documents, builds forms, collects responses, or otherwise submits content through the Services. In that case the customer is the controller, the customer's own privacy notice governs the individuals concerned, and our handling is governed by the Terms and the DPA rather than this Privacy Policy.

Customer Responsibility

Where K Sign acts as a processor, the relevant customer is responsible for establishing a lawful basis for collection, for providing privacy notices to individuals, and for obtaining any consents required. K Sign does not control, and is not responsible for, the content a customer chooses to collect or the purposes for which the customer uses it.

3. Personal Information We Collect

The personal information we collect depends on how you interact with the Services. We collect the following categories of information.

Information You Provide to Us

Account and identity information (name, email, phone, job title, employer); billing and transaction information (billing address, plan, payment records); profile and preference information (language, time zone, notification settings); support and correspondence (enquiries, support tickets); and marketing information (survey responses, event registrations, subscription preferences).

Information We Collect Automatically

Usage and log data (actions taken, feature usage, pages viewed, timestamps); device and connection data (IP address, browser type, operating system, device identifiers, referring URLs); cookies and similar technologies (as described in the Cookie Policy); and audit and event data generated by signing and form-completion workflows.

Information We Receive from Others

Information from a customer when you are invited to use the Services as a user, signatory, respondent, or payer; information from third-party services and integrations (identity verification, single sign-on, connected payment providers); and information from our service providers and partners that assist us in operating, securing, and improving the Services.

Information Within Customer Content

Documents, forms, and submissions processed through the Services may contain personal information about third parties chosen by the customer. We process this content on the customer's behalf as a processor and do not control what it contains. We do not use such content for our own purposes except as needed to provide, secure, and support the Services, or as permitted by the DPA.

4. Sensitive Information

Sensitive information is a special category of personal information under the Privacy Act, and includes information about an individual's health, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record, and biometric information.

We do not seek to collect sensitive information about our own account holders except where it is reasonably necessary for a function or activity and either you have consented or the collection is otherwise permitted by law.

A customer may choose to collect sensitive information from individuals through forms or documents created using the Services. Where this occurs, the customer acts as the controller, is responsible for obtaining any consent required, and must comply with the restrictions on restricted and sensitive data set out in the Terms. K Sign processes such information only as a processor on the customer's behalf.

5. How We Use Personal Information

As a controller, we use personal information for the following purposes:

Core Service Provision

To create, administer, and secure accounts, authenticate users, and to provide, operate, maintain, and improve the Services.

Billing and Support

To process and manage subscriptions, billing, and payments owed to K Sign; and to provide customer support and respond to enquiries.

Communications

To send service and administrative communications, including notices about changes to the Services, security, or terms; and to send marketing communications where permitted, subject to your right to opt out.

Security and Legal

To monitor, detect, prevent, and investigate fraud, abuse, security incidents, and breaches of the Terms; to comply with our legal obligations; and to establish, exercise, or defend legal claims.

Analytics and Improvement

To understand how the Services are used and to develop new features and functionality. We may also create aggregated or de-identified data for analytics, benchmarking, and research. We do not attempt to re-identify de-identified data except as permitted by law.

6. Artificial Intelligence and Automated Processing

The Services may include features that use artificial intelligence, machine learning, or automated processing, such as suggestions, data extraction, summarisation, and field detection.

Where these features process personal information, we do so to provide the relevant functionality. We do not use customer content to train generally available foundation models except where described in this Privacy Policy or agreed in writing with the relevant customer.

We do not make decisions producing legal or similarly significant effects about individuals based solely on automated processing without a lawful basis. Outputs generated by these features are provided for assistance only and should be reviewed by a person before being relied upon.

7. Cookies and Similar Technologies

We and our service providers use cookies, pixels, local storage, and similar technologies to operate the website and the Services, remember your preferences, maintain sessions, measure usage, and improve performance.

We use strictly necessary cookies to deliver core functionality, and, subject to your choices where required, functional, analytics, and performance cookies. You can manage non-essential cookies through our cookie controls or your browser settings. Disabling some cookies may affect the functionality of the Services.

Further detail about the specific cookies we use is set out in the Cookie Policy.

8. How We Disclose Personal Information

We do not sell personal information. We disclose personal information only as described below.

Service Providers and Subprocessors

We disclose personal information to service providers that perform functions on our behalf, such as cloud hosting, infrastructure, analytics, communications, customer support tooling, and security services. These providers are permitted to use the information only to perform services for us and are subject to confidentiality and data protection obligations.

Payment Providers

Fees payable to K Sign are processed by our payment processor, to which limited billing information is disclosed for that purpose. Where a customer connects its own payment provider to collect payments from its own payers, that provider acts independently and handles payer information under its own terms and privacy policy.

Within Customer Workflows

When you participate in a signing or form workflow, relevant information is disclosed to the customer that initiated the workflow and to other participants as required to complete it, such as completed documents and audit records.

Legal and Protective Disclosures

To comply with applicable laws, lawful requests, court orders, or regulatory or governmental requirements; to enforce the Terms and other agreements; to detect, prevent, or address fraud, security, or technical issues; and in connection with a corporate transaction such as a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality protections.

9. Data Hosting, Residency, and Cross-Border Transfers

The Services are operated from infrastructure hosted in Australia, and personal information processed through the Services is primarily stored in Australia, unless otherwise stated in this Privacy Policy or agreed in writing.

Limited Offshore Access

Certain operational functions, such as support, monitoring, and specific third-party integrations, may involve limited access to or processing of personal information from outside Australia. Where this occurs, we take reasonable steps to ensure recipients handle the information consistently with the APPs and applicable law.

Cross-Border Safeguards

Where we disclose personal information to overseas recipients, we take reasonable steps in the circumstances to ensure the recipient does not breach the APPs, which may include contractual safeguards. Where K Sign processes personal information as a processor, cross-border transfers are addressed in the DPA and the Subprocessor List.

10. Data Security

We maintain commercially reasonable technical and organisational measures designed to protect personal information against unauthorised access, use, alteration, disclosure, and loss. These measures may include encryption in transit, access controls, network protections, logging, and regular review of our practices.

Security is a shared responsibility. You are responsible for keeping your account credentials confidential, configuring access appropriately, and securing the devices and systems you use to access the Services.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Where we are required by law to notify you or a regulator of an eligible data breach, we will do so in accordance with the applicable requirements, including the Notifiable Data Breaches scheme under the Privacy Act.

11. Data Retention

We retain personal information for as long as it is needed for the purposes described in this Privacy Policy, including to provide the Services, comply with our legal, accounting, and reporting obligations, resolve disputes, and enforce our agreements.

Where we act as a processor, retention and deletion of customer content are governed by the customer's instructions, the Terms, and the DPA. Following termination, customer content is handled in accordance with the retrieval and deletion provisions of the Terms, subject to residual copies in backups and any retention required by law.

When personal information is no longer required, we take reasonable steps to destroy it or to de-identify it.

12. Your Privacy Rights and Choices

Subject to applicable law, you may have the following rights in relation to personal information we hold about you as a controller.

Access and Correction

You may request access to the personal information we hold about you, and request correction of personal information that is inaccurate, out of date, incomplete, or misleading.

Marketing and Cookies

You may opt out of marketing communications at any time using the unsubscribe mechanism or by contacting us. You may also manage cookie preferences as described in the cookies section.

Deletion and Restriction

Where applicable law provides, you may request deletion of, or object to or restrict certain handling of, your personal information.

How to Exercise Your Rights

You can exercise these rights by contacting us using the details in the contact section. We may need to verify your identity before responding. We will respond within the timeframes required by applicable law. There is generally no charge to make a request, although we may charge a reasonable fee for access in limited circumstances permitted by law.

Requests Directed to a Customer

Where we hold personal information as a processor on a customer's behalf, we will refer requests we receive from individuals to the relevant customer and will assist the customer to respond in accordance with the DPA. Individuals should direct such requests to the customer that collected their information.

13. Children's Privacy

The Services are intended for use by businesses and individuals in a professional or commercial context and are not directed to children. We do not knowingly collect personal information from children in circumstances that would require parental consent under applicable law. If you believe a child has provided us with personal information, please contact us so that we can take appropriate steps.

14. Third-Party Services and Links

The Services may link to, or integrate with, third-party websites, applications, and services, including identity verification providers, single sign-on providers, and connected payment providers. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party service you use in connection with the Services.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to the Services, our practices, or legal requirements. We will post the updated Privacy Policy and update the effective date. Where a change is material, we will provide additional notice by a reasonable means, which may include notice within the Services or by email. Your continued use of the Services after the effective date constitutes acknowledgement of the updated Privacy Policy.

16. How to Contact Us and Make a Complaint

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or would like to make a complaint about how we have handled your personal information, you can contact our privacy contact at: K Sign Pty Ltd, Attention: Privacy Officer — Email: [email protected]

Complaints Process

If you make a privacy complaint, we will acknowledge it and respond within a reasonable period, and we will let you know if we need more information to investigate. We will tell you the outcome of our investigation and the steps we propose to take.

Escalation to the Regulator

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au. Individuals outside Australia may also have the right to lodge a complaint with their local data protection authority.