Scroll
Reading this policy does not exempt you from reading the provisions of clause 9a of the General Conditions of the Digital Certificate Issue Agreement.
The protection of privacy and Personal Data is a fundamental commitment of the company to its customers and users of its services.
DigitalSign – Certifier Digital, S.A., legal person No 507 015 851, based at Largo Padre Bernardino Ribeiro Fernandes, No 26, 4835-489 Nespereira, Guimarães, hereinafter abbreviated DigitalSign, is a Qualified Confidence Service Provider (PQSC), as such considered at European Union level, under Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 as amended by Regulation (EU) 2024/1183 of 11 April 2024 (EIDAS Regulation), appearing on the Portuguese trust list, available here, being subject to the supervision of the National Security Office, as a supervisory body, for the provision of various trusted services and, in particular, for the issue of Qualified Digital Certificates, for strict compliance with the applicable legal rules in this matter, in particular Decree-Law No 12/2021 of 9 February, which ensures the implementation in the internal legal order of Regulation (EU) 910/2014 on electronic identification and trust services for electronic transactions in the internal market.
DigitalSign meets demanding confidentiality and information security parameters and is certified according to ISO/IEC 27001.
DigitalSign advises the reading of this document, and the consultation of the Clauses of the General Conditions for DigitalSign Personal Data, available for consultation on our website, as well as in the Digital Certificate issue contract, as both constitute the DigitalSign commitment to the protection of its customers' data under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, "RGPD"), and Law No 58/2019 of 8 August.
This privacy policy covers the following services:
1.1 Account management in our services;
1.2 identification and certification services for the issue of digital certificates;
1.3 Electronic signature, electronic seal and time stamp services;
1.4 Services related to SigningDesk;
1.5 Invoicing;
1.6 technical and operational support;
1.7 provision and processing of reports with commercial information;
1.8 training activities (e.g. webinars) on the use of services;
1.9 issuing qualified electronic certificates of attributes;
1.10 Qualified validation and preservation services of electronic signatures and seals.
Some services have their own privacy policies that prevail over the present for these services, namely the User Privacy Policy of the Remote Identity Validation Service, the SigningDesk Privacy Policy and the DigitalSign Apps Privacy Policy (IDCheck and DS Wallet). The use of cookies on our website is governed by the Cookie Policy.
To facilitate the understanding of this policy, the following definitions are used:
information relating to an identified or identifiable natural person, directly or indirectly, such as identifiers, or other specific elements relating to their physical, physiological, genetic, mental, economic, cultural or social identity.
the operation or a set of operations carried out on personal data or on personal data sets by automated or non-automatic means, such as:
(a) the collection, registration, organisation, structuring, conservation, adaptation or alteration, recovery, consultation, use;
(b) disclosure by transmission, dissemination or any other means of making available, or
(c) comparison or interconnection, limitation, erasure or destruction.
the natural or legal person, public authority, service or body other than the data subject, controller, subcontractor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;
the natural or legal person, public authority, agency or other body which, individually or jointly with other entities, determines the purposes and means of processing personal data;
the natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
an independent public authority which, in the case of Portugal, is the National Data Protection Commission (CNPD), which is responsible for monitoring the correct application of the personal data protection legislation;
Computer files containing a sequence of numbers and letters that uniquely identify a user's Internet access device, but may contain other information such as your browsing preferences on a particular site. Cookies are downloaded via the browser to the internet access device (computer, mobile phone, tablet, etc.) when accessing certain websites.
The person responsible for the collection and processing of your personal data will be DigitalSign, because it provides you with the service and, in this context, decides which data is collected, means of processing and purposes for which the data is used.
In the services where you deal with personal data on behalf of business customers, for example when an organization uses SigningDesk to collect signatures from its own customers, DigitalSign acts as a subcontractor and is responsible for the processing of that organisation, to which the holder should address first.
DigitalSign also has a data protection officer (Data Protection Officer, or DPO), who (i) monitors the compliance of data processing with applicable standards, (ii) is a contact point with the customer or user for clarification of issues relating to the processing of their data by DigitalSign, (iii) cooperates with the supervisory authority, (iv) provides information and advises the controller or processor about their obligations in the context of privacy and data protection. Contact our Data Protection Officer via email: dpo@digitalsign.pt or by letter to the address indicated in point 7.
Personal data is any information of any kind and on any medium relating to an identified or identifiable natural person.
A natural person who can be identified directly or indirectly, e.g. by name, identification number, location data, electronic identifier or other elements enabling him to be identified, shall be considered identifiable.
The customer or user, a natural person, to whom the data relates and who has enjoyed the DigitalSign products and services. The Customer will be the person who concludes the DigitalSign contract, and you are the person who uses DigitalSign products and services, which may not correspond to the customer. In this regard, DigitalSign informs that it also protects personal data and respects the rights of customers and users.
Data categories
Examples
Identification and contacts
Full name, address, civil or tax identification numbers, payment and billing data, email address and telephone contact
Other identification data
Quality of representative and/or member of a particular company/entity
Services
Products and services acquired or subscribed
Identity verification data
Image and data of the identification document, photograph and video of the face, video conference recording and, where applicable, biometric data, processed under the User's Privacy Policy of the Remote Identity Validation Service
Data on certificates and trust services
Certificates issued and their status, signature, seal and validation records
Technical data
IP address, access records, device identifiers and navigation data
Consent: when you have your written consent, orally or by validating an option, prior, free, informed, specific and unequivocal. In the case of the processing of personal data of children under 13 years of age, who may be subject to prior consent, DigitalSign shall require consent from holders of parental responsibilities, including for the purpose of providing services, by electronic means (Article 8 GDPR and Article 16 of Law No 58/2019);
Execution of contracts and pre-contractual proceedings: where processing of personal data is necessary for the conclusion, execution and management of the contract concluded with DigitalSign, including for the purposes of issuing Digital Certificates, for the management of contacts, information and requests, for the management of billing, collection and payments;
Compliance with legal obligation: where processing of personal data is necessary to comply with a legal obligation to which DigitalSign is subject, such as the reporting of data required by any judicial or administrative authority for compliance with the law, or the retention of identification data and certificates imposed by the EIDAS Regulation and Decree-Law No 12/2021;
Legitimate interest: where the processing of personal data corresponds to a legitimate interest of DigitalSign or third parties, such as the processing of data for fraud detection, revenue protection, network security and information or improvement of the quality of services.
The sending of commercial communications by electronic means to natural persons depends on your prior consent, unless you are a DigitalSign customer and communications relate to products or services similar to those you have acquired, in which case you may object at any time (Article 13a of Law No 41/2004 of 18 August).
In the processing of your Customers' Personal Data, DigitalSign observes the principles of lawfulness, loyalty, transparency, limitation of purposes, minimization of data, accuracy, limitation of conservation, integrity, confidentiality and responsibility.
As provided for in clause 9a of the general conditions of the Digital Certificate issue contract, DigitalSign undertakes to ensure the confidentiality and confidentiality of all Personal Data of its Customers whose knowledge is not intended for public disclosure.
Your personal data is processed by DigitalSign only for the period necessary for the achievement of the defined purpose or, as applicable, until you exercise your right of opposition, right to be forgotten or withdraw consent. After the respective period of storage has elapsed, DigitalSign shall eliminate or anonymise the data where they are not to be retained for a different purpose and, in this sense, except as regards compliance with the data retention obligation which has served as the basis for the provision of its services, for a minimum legal period of 7 years from the expiry of the certificate, as provided for in Article 13(f) of the Legal System for Electronic Documents and the Digital Signature, corresponding to the updated version of Decree-Law No 12/2021 of 9 February.
Purposes
Examples of Purposes (not exhaustive)
Marketing and Sales
Marketing or sale of new products or services (with consent when required)
Customer Management and Service Provision
Management of contacts, information or requests; installation management, activation, revocation or renewal of services; invoicing management, collection and payments; recording of calls (and video conferences) and communications under the contractual relationship, if applicable
Identity check
Verification of the identity of the applicant before issuing qualified certificates, either in person or at a distance
Use of SaaS software solutions
Creating user accounts and managing the use of tools.
Security and fraud prevention
Detection and prevention of fraud and abuse, security of systems
Accounting, Tax and Administrative Management
Accounting, billing; tax information, including sending information to the tax authority
Compliance with legal obligations
Preservation of Digital Certificates issued for the legal period of 7 years from their expiry pursuant to Article 13(f) of the Legal System for Electronic Documents and Digital Signature, corresponding to the updated version of Decree-Law No 12/2021.
DigitalSign processes and preserves your personal data according to the purposes for which they are processed.
However, due to the fact that DigitalSign is a qualified provider of trusted services, it is legally bound to retain the data that has served as the basis for the provision of its services for a minimum legal period of 7 (seven) years from the expiry of the certificate, as provided for in Article 13(f) of the Legal System for Electronic Documents and the Digital Signature, corresponding to the updated version of Decree-Law No 12/2021.
Thus, and where there is no specific legal obligation, the data will be processed only for the period necessary for the purposes of the collection and preservation of the data, and always in accordance with the law, the guidelines and decisions of the CNPD, or the competent supervisory authority under the law, as applicable. The personal data collected by DigitalSign will therefore be processed and retained for the purpose of the performance of the contract and during the respective execution period.
At the end of the contract, we shall retain only the following data for the specified time limits: the data that served as the basis for the issue of qualified certificates for 7 years from the expiry of the certificate (Article 13(f) of Decree-Law No 12/2021); the data that served as the basis for issuing qualified electronic certificates of attributes for 7 years from their expiry, applying DigitalSign to the same rules for the retention of qualified certificates; the accounting and billing documents for 10 years (Article 40 of the Commercial Code and Article 123(4) of the IRC Code). Otherwise, the processing and preservation of the personal data of the Customers may occur only by express consent, for the purpose of ensuring rights or obligations related to the contract, or when legitimate interests justify it, to that precise extent.
We collect your personal data when you wish to purchase a pre-contractual DigitalSign service and for the purpose of contractual execution. In fact, the personal data required by DigitalSign are the personal data necessary for the provision of its services (e.g. for issuing, billing and/or renewal of Digital Certificates and access to other services made available). The collection may be made through the registration of the user on the website, and through the completion of the respective form, through the DigitalSign website, or through a video conferencing specifically addressed to that purpose, if this option applies and is chosen by the Customer, in accordance with the User's Privacy Policy of the Remote Identity Validation Service. Data can also be collected through DigitalSign mobile applications in accordance with their privacy policy.
DigitalSign may also access, collect or confirm personal data on public administration and private entities websites, in particular to confirm the accuracy and actuality of your identification and contact details.
Right of access: the right to obtain confirmation of what your personal data are collected and processed by DigitalSign, as well as to obtain information about them, for example, what the purposes of the processing are, what the retention times, among others, and the right to see/listen or obtain copies, for example, of invoices, written agreements or calls and videoconferencings in which you are involved and recorded.
Right to rectify: the right to request the rectification of your personal data which is inaccurate or to request that incomplete personal data be completed, such as address, NIF, email, telephone contacts, among others.
Right to erasure of data or «right to be forgotten»: the right to obtain the erasure of your personal data, provided that there are no valid grounds for its retention, such as the cases where DigitalSign has to keep the data for the purpose of complying with legal obligations (in particular, the legal obligation to retain digital certificates issued for a minimum legal period of 7 years from expiry), such as compliance with the legal obligation to preserve for investigation, detection and prosecution of crimes, or also because a judicial process is under way.
Right to portability: the right to receive the data provided to us in digital format of current use and automatic reading or to request the direct transmission of your data to another entity that becomes the new controller of your personal data, if technically possible.
Right to withdraw consent or right of opposition: the right to object or withdraw your consent at any time to data processing, such as in the case of processing data for marketing purposes, provided that there are no legitimate interests that prevail over your interests, rights and freedoms, such as the defence of a right under judicial proceedings.
Right of limitation: right to request limitation of the processing of your personal data in the form of: (i) suspension of processing or (ii) limitation of the scope of processing to certain categories of data or purposes of processing.
Right not to be subject to automated individual decisions: the right not to be subject to any decision taken solely on the basis of automated treatment, including the definition of profiles, which takes effect in its legal sphere or significantly affects it in a similar way, except in the cases provided for in Article 22 of the GDPR, where it may obtain human intervention, express its point of view and challenge the decision.
Through registration as users, customers or potential users may Customers have access to the various services provided by DigitalSign and, in particular, carry out the order order of the services they wish to purchase, among other features available such as the management of orders made in the area reserved for customers ("See Account").
If there is already registration on the user's website, just log in by entering the email and its password defined when registering. This keyword guarantees the user access to the management of the services in the respective reserved area and if, on the contrary, there is no registration on the user's website, the registration request requires the introduction of the user's NIF and, subsequently, the definition of the email and access password.
At the time of the initial registration, DigitalSign, such as mandatory data, the respective NIF of the user, invoicing name, contact name, address, port/walk number, postal code, city, country and telephone, and as optional data, the mobile phone are also requested. The data provided by users will only be used in performing the services selected by the user for which they were provided, not being added to another list, made available to other entities or used to send unrelated information.
DigitalSign uses cookies on your website to improve the performance and browsing experience of personal data subjects, increasing on the one hand the speed and efficiency of response and, on the other hand, eliminating the need to repeatedly introduce the same information. For more information see our Cookies Policy, available for consultation on our website.
DigitalSign only defines profiles to tailor marketing communications when the holder has consented to it. It shall not take exclusively automated decisions that produce legal effects or significantly affect the holder, with the exception of the remote identity verification by reading the chip of the identification document (NFC flow), described in the own policy of that service, which is permitted by Article 22(2) of the GDPR and where the holder may always request the intervention of a human operator.
The right to lodge a complaint with the CNPD, or any other competent supervisory authority under the law, in addition to the company or Data Protection Officer, if you consider that the processing of your data by DigitalSign violates the applicable legal regime.
The exercise of its rights shall be free of charge, unless it is a manifestly unfounded or excessive request, in which case a reasonable fee may be charged taking into account the costs. It should take into account, inter alia, that the exercise of its data erasure rights, withdrawal of consent or limitation rights may only be exercised in so far as they do not prevent DigitalSign from complying with any legal obligation.
The information shall be provided in writing but, if requested, may be provided orally. In this case, DigitalSign must verify its identity by other than oral means. The reply to the requests should be provided within one month of receipt of the request, extended for another two months where necessary, taking into account the complexity and number of applications, in which case the holder will be informed of the extension and the reasons for the extension (Article 12(3) of the GDPR).
By Letter
Largo Padre Bernardino Ribeiro Fernandes, No 26, 4835-489 Nespereira, Guimarães
By email
Your personal data may be transmitted to subcontractors to treat them on behalf and on behalf of DigitalSign. In this case, DigitalSign shall take the contractual measures necessary to ensure that subcontractors respect and protect the personal data of the holder. Data may also be transmitted to third parties other than DigitalSign or subcontractors, in particular companies with which DigitalSign develops partnerships, where the holder has consented, or to entities to whom the data has to be communicated under the law.
The data may also be communicated to the National Security Office as a supervisory body and to the conformity assessment bodies auditing the qualified services of DigitalSign, to the extent necessary for the performance of those tasks.
The data included in the certificates (e.g. the name and, where applicable, the organisation and email address) shall be visible to those who receive documents signed or sealed with those certificates, and the information on the status of the certificates (valid or revoked) shall be made available through validation services.
DigitalSign does not transfer personal data to third countries or international organisations outside the European Economic Area. If necessary, it will only do so with the guarantees provided for in Chapter V of the GDPR and will update this policy in advance.
DigitalSign websites may contain links to other third-party websites, products or services that have no relation to DigitalSign or are not covered by this Privacy Policy.
The collection or processing of personal data requested by those third parties is your sole responsibility, and DigitalSign cannot be held liable under any circumstances for the content, accuracy, veracity or legitimacy of those Websites or for the misuse of data collected or processed through them.
We alert DigitalSign customers and users to this fact and to the need, before using websites, products or applications, to read and accept the rules on the processing of personal data defined by those third parties.
DigitalSign has implemented appropriate logical, physical, organisational and security measures necessary and sufficient to protect your personal data from destruction, loss, alteration, dissemination, unauthorized access or any other form of accidental or unlawful treatment. DigitalSign has implemented:
A) logical security requirements and measures, such as the use of firewalls and intrusion detection systems in their systems, the existence of a strict policy on access to systems and information and the registration of actions by DigitalSign employees on personal data of customers or users;
B) Physical security measures, including strict control of access to DigitalSign's physical installations by employees, partners and visitors, as well as very restricted and permanently monitored access to DigitalSign's essential technological infrastructures;
C) means of data protection from the design ("privacy by design") using technological means such as mask, encryption, pseudonymization and anonymization of personal data and also a set of preventive measures favourable to privacy ("privacy by default");
(d) scrutiny, audit and control mechanisms to ensure compliance with security and privacy policies;
E) a programme to raise awareness and train DigitalSign employees and partners;
F) Access rules for customers or users to certain products or services, such as the introduction of a password, to enhance control and security mechanisms.
DigitalSign may update or re-adjust this Policy, as well as its Cookie Policy, and the general conditions concerning Personal Data, with these changes being properly advertised, indicating the current version and date of the last update.
Version 2.0 – approved on 21/10/2026
