Privacy notice
Last updated 5 November 2026
SiteSign is operated by [Your company legal name] (company number [company number]), [registered address]. We are registered with the Information Commissioner’s Office (registration [ICO registration number]). Contact us about your data at [contact email].
Who is responsible for your data
When your employer uses SiteSign to send you safety documents, your employer is the controller of the signing records and we act as its processor, following its instructions. For your login details, security logs and support, we are the controller. Your employer’s own privacy notice explains how it uses your signed records.
What we collect and why
| Data | Why | Lawful basis |
|---|---|---|
| Name, email address, position, role | To create your login and let your employer assign documents to you | Contract / legitimate interests |
| Signature (drawn strokes), comments, date and time of signing, confirmation you read the document | To record that you received and understood a safety document | Employer’s legal obligations under health and safety law; legitimate interests |
| Device type (browser and operating system) and internet (IP) address when you sign | To strengthen the evidence that you signed, and to diagnose problems | Legitimate interests |
| If you sign in person on a manager’s device: your name, signature, and the manager recorded as witness | To record signatures from people without their own login or email | Employer’s legal obligations; legitimate interests |
| Technical error reports (what went wrong, the page, browser type — no document contents) | To find and fix faults. Kept for 90 days | Legitimate interests |
| Audit log of actions (publishing, signing, support access) | Security, fraud prevention and accountability | Legitimate interests |
We do not collect your location, we do not use advertising or analytics trackers, and we do not make automated decisions about you.
Where it is stored and who sees it
- Data is stored with our hosting provider, Supabase, in its London (UK) data centre, encrypted in transit and at rest.
- Your employer’s administrators can see signing records for their company only. Other companies cannot.
- The SiteSign platform owner can access data to give you support. Every support access is written to an audit log that your employer’s administrators can see.
- We do not sell your data. Our sub-processors work under data processing agreements:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, logins and document storage | London, UK |
| Netlify | Serving the website | Global network (US company; UK transfer safeguards apply) |
| Resend | Sending invite, signing-request, reminder and account emails (your name and email address) | US (UK International Data Transfer Addendum / UK–US data bridge) |
| Stripe | Subscription payments for company admins (billing contact and payment details — SiteSign never sees card numbers) | UK/EU and US (UK transfer safeguards apply) |
How long we keep it
Signed and archived safety documents are kept for 3 years after archiving by default. Your employer decides how long its records are kept: it may keep them longer where the law requires (for example, health surveillance or hazardous substances), or delete them sooner, for example once a copy is held in its own systems. Login data is kept while your account is active.
Your rights
Under UK GDPR you can ask to see your data, correct it, delete it, restrict or object to its use, and receive a portable copy.
- From Account → Your data you can download a copy of your data and delete your login yourself.
- Signed safety records belong to your employer’s legal record-keeping, so they are retained when you delete your login, but are unlinked from it.
- Contact [contact email] for anything else. If you are unhappy with our response, you can complain to the ICO at ico.org.uk or on 0303 123 1113.
Cookies
We use only the storage strictly necessary to keep you logged in. See our cookie notice.