This Acceptable Use Policy (the "AUP") forms part of the Terms of Service (the "Terms"). It applies to every Customer and Authorized User of Senots and one2sign (the "Services"), provided by DDR Solutions Inc. ("DDR"). Capitalized terms have the meanings given in the Terms and the E-Signature Terms.
Customer is responsible for making sure its Authorized Users follow this AUP.
1. General rules
Do not use the Services to:
- break any law or regulation, or help anyone else do so;
- infringe or misappropriate anyone's intellectual property, privacy, publicity or other rights;
- store, send or distribute content that is unlawful, defamatory, harassing, hateful, threatening, sexually exploitative of minors, or that promotes violence;
- collect or process Personal Information without a lawful basis, or in breach of the notice and consent requirements of Data Protection Laws;
- discriminate unlawfully in employment, housing, credit, insurance or other decisions;
- carry out activities subject to Canadian or US sanctions, or deal with sanctioned persons; or
- operate any service for which a failure of the Services could lead to death, personal injury or severe environmental damage.
2. Electronic signatures: forgery, impersonation and fraud
Do not use one2sign or any electronic-signature feature to:
- forge a signature, or apply a signature, initials or approval for someone else, including by signing on someone's behalf through an in-person signing session or by opening another person's signing link, unless that person has given you legal authority to sign for them and the Document says so;
- impersonate any person or organization, including by putting a false sender name, company name, logo or email address on a Document or message, or by sending as an Authorized User other than yourself;
- obtain signatures, payments, identity documents or banking details by deception, including phishing, fake invoices, advance-fee schemes, false employment or rental offers, and documents designed to look like they come from a government, bank, court or other organization;
- alter a Document after it has been signed and present it as the signed original, or misrepresent the result of a check on the Verify Page;
- misrepresent what a Document is or what signing it means, or hide material terms from a Recipient;
- pressure, threaten or trick a Recipient into signing, or obtain the signature of a person who you know lacks legal capacity;
- use one2sign for Documents that the law does not allow to be signed electronically, unless you have decided to accept that risk with advice (E-Signature Terms, Section 3); or
- ask Recipients to attach identity documents, cheques, banking details or other sensitive information that you do not genuinely need for the Document.
3. Unsolicited signature requests and spam
- Send Documents only to people you have a real reason to transact with. Do not send signature requests, reminders or shared links to lists of people who do not expect them.
- Do not use one2sign to send marketing. A signature request, its message, its private note and its Document must not be used to promote products or services to people who have not agreed to receive commercial messages. Canada's anti-spam legislation (CASL) and the US CAN-SPAM Act apply to commercial electronic messages, and Customer is the sender of every message sent at its request.
- Do not use bulk send or public shared links to harvest information or to reach people who have not asked to deal with you.
- Do not get around sending limits, for example by creating several Accounts, rotating senders or splitting a bulk send.
- Respect Recipients' choices. If a Recipient declines, asks you to stop or asks to sign another way, do not keep sending them the same request.
- Keep complaint and bounce rates low. DDR may pause sending for an Account whose messages generate complaints, bounces or spam reports well above normal levels.
- Do not use referral tools to spam or to buy reviews. Do not send referral invites to people who have not agreed to hear from you, and do not offer or request reviews, ratings or testimonials in exchange for referral credit or any other incentive from DDR.
4. Security and integrity of the Services
Do not:
- access, or try to access, another Customer's data, an Account you are not authorized to use, or any part of the Services you have not been given access to;
- probe, scan or test the vulnerability of the Services, or bypass any security, authentication, rate limit, plan limit or sending limit, except under a written agreement with DDR (Section 7 explains how to report a vulnerability);
- upload or send malware, or files designed to exploit software (including malformed PDFs);
- interfere with or disrupt the Services, including by excessive automated requests, denial-of-service attacks or scraping;
- use the Services or the Verify Page to build a database of Documents, signers or companies, or to monitor other Customers;
- share sign-in codes or links, or let one person's sign-in be used by several people; or
- use the Services to store or process data the Services are not designed to protect, such as full payment-card numbers (Terms, Section 7.3).
5. Sensitive information
When using HR, payroll, benefits and e-signature features, Customer must:
- collect only the Personal Information it needs, and tell people why;
- use the access settings to limit who can see pay, personal details, headshots, attachments and one-on-one notes; and
- delete sensitive information, such as attached identity documents, when it is no longer needed.
6. What DDR may do
If DDR reasonably believes that this AUP has been breached, DDR may, in proportion to the breach and as the Terms (Sections 10 and 11) allow: remove or disable access to content; disable a signing link or a public shared link; cancel Documents that are out for signature; pause sending; suspend an Authorized User or the Account; terminate the Agreement; and report the matter to the authorities. Where the risk is immediate, such as active phishing, malware, or material DDR is legally required to act on, DDR may act first and explain afterwards. Child sexual abuse material is reported to the authorities without notice and without exception. DDR does not monitor Customer Data as a matter of course and has no obligation to do so. Where DDR needs to look at Customer Data to investigate, Section 8.3 of the Terms applies.
If you think DDR got it wrong. Write to hello@one2sign.com and a person will review the decision. If a suspension was DDR's mistake, DDR will restore access to the Account.
7. Reporting abuse and vulnerabilities
- To report a fraudulent or abusive Document, a phishing email that uses the one2sign or Senots name, or spam sent through the Services, write to hello@one2sign.com with the subject line "Abuse report", and include the email you received (with its headers) or the Verification Code.
- To report a security vulnerability, write to hello@one2sign.com with the subject line "Security report". Please do not access other people's data, degrade the Services or disclose the issue publicly before DDR has had a reasonable time to fix it. DDR will not take legal action against good-faith research that follows these rules.
- Claims of copyright or trademark infringement are handled under the Copyright and IP Policy.
8. Changes
DDR may update this AUP as described in Section 21.1 of the Terms.