Privacy Policy — one2sign and Senots

Name change. Senots Sign is now named one2sign, provided at one2sign.com and related one2sign subdomains. References to "Senots Sign" in Orders, invoices, emails, Evidence Records, Certificates of Signature and other records made before this change mean one2sign. The provider (DDR Solutions Inc.), the Services and the rest of this document are otherwise unchanged. Certificates issued before October 30, 2026 are titled “Certificate of Completion”; they are the same record this document calls the Certificate of Signature.

Before launch. one2sign is not yet open. It will open when one2sign launches. Until then, only the parts of this Policy about our websites and the waitlist (Sections 3.4 and 3.7) apply. The sections about one2sign describe how it works from launch.

This Privacy Policy explains how DDR Solutions Inc. ("DDR", "we", "us", "our") handles personal information in connection with Senots, our business suite, and one2sign (formerly Senots Sign), our electronic-signature service (together, the "Services"), and our websites at one2sign.com and senots.com.

Words with capital letters have the meanings given in the Terms of Service. In short: a "Customer" is a business that has a one2sign or Senots account; an "Authorized User" is a person the Customer lets use its account; a "Recipient" is someone a Customer sends a document to through one2sign, for example to sign it; and "Customer Data" is everything a Customer and its people put into the Services.

1. Who is responsible

DDR Solutions Inc., 120 Adelaide St W, Suite 2500, Toronto, ON M5H 3V1, is responsible for the personal information described in Section 3 as ours.

Privacy Officer. Our person in charge of the protection of personal information is Deivis Diaz, CEO. You can reach them at hello@one2sign.com (subject line "Privacy") or by mail at the address above, marked "Attention: Privacy Officer".

2. Two roles: whose information is it?

When we act for our Customers. Customer Data belongs to the Customer that put it into the Services. That includes its contacts and customers, quotes and invoices, projects and time records, employee, HR and payroll records, and documents it sends for signature together with information about the Recipients. For Customer Data, we are a service provider (in Canada), processor (under the GDPR, the UK GDPR and Quebec law, where they apply), service provider or processor (under US state privacy laws) and encargado (under Mexican law). We handle it only on the Customer's instructions, under our Data Processing Agreement (the "DPA"). The Customer is the organization in control of that information (the "controller" or "responsable").

If you are a Recipient, an employee of a Customer, or one of a Customer's own clients, the Customer decides how your information is used. Please contact that business first. If you contact us, we will pass your request to the Customer and help it respond (Section 10).

When we decide for ourselves. We are the organization in control (the controller) for:

• account information about Authorized Users and the people who sign up (Section 3.1);
• billing information (Section 3.2);
• support and contact messages (Section 3.3);
• website visitors and waitlist sign-ups on senots.com, for Senots Suite, one2sign and other Senots products (Section 3.7);
• technical and security information about the use of the Services and our websites (Section 3.4); and
• the information described in Section 3.6 (weather).

3. What we collect

3.1 Account and sign-in

• Name, email address, company name, role and per-app access in the company, language, and display preferences.
• How you sign in. We do not use or store passwords. You sign in with a six-digit code or link we email you, or with your Google or Microsoft account. If you use Google or Microsoft, they send us your name, email address and an account identifier, and confirm that your email is verified. We do not receive your Google or Microsoft password, contacts or files.
• Sign-in records: the sign-in method, session start and last-seen times, your browser description (user agent), a keyed hash of your IP address, and a history of sign-in events (for example "code sent", "wrong code", "signed in") with a keyed hash of your email address and IP address. We use them to keep accounts secure and to stop repeated sign-in attempts.

3.2 Billing

• The plan, number of users, billing interval, billing email and billing address, invoices and payment status.
• Card details are collected and stored by Stripe, our payment processor, not by us. Stripe tells us only limited information, such as the customer and subscription identifiers and whether a payment succeeded.

3.3 Support and contact

If you email hello@one2sign.com, we keep your message, our reply and any files you send.

3.4 Technical and security information

When you use the Services or visit our websites, our hosting provider, Cloudflare, processes your IP address, browser type, the pages and resources requested, and times, to deliver and protect the Services. We use some of it for security, for example to limit the rate of sign-in attempts, signing-link use, checks on the public Verify page and sign-up attempts on our waitlist forms. Where we store an IP address for security, we normally store a keyed hash of it, not the address itself. The exception is the signing evidence described in Section 3.5.

Our marketing websites (one2sign.com and senots.com) set no cookies of their own, use no analytics or trackers, and load no third-party fonts. The only third-party script is Cloudflare Turnstile on our sign-up forms, which protects them from bots (Section 3.7).

3.5 Customer Data, including Recipients' information (handled for the Customer)

Depending on the apps a Customer uses, Customer Data can include:

• business records: contacts and companies, opportunities, quotes, invoices, payments received, projects, tasks, time entries, expenses and receipts, vendors, purchase orders, bank-statement lines and accounting records;
• HR and payroll records: employee directory details, job, department and manager, start and end dates, compensation and pay, payroll runs and pay lines, time off, training, one-on-one notes, benefits elections and dependants' names and dates of birth, personal details employees add (preferred name, pronouns, home address and emergency contact), and headshots. The Services do not have fields for Social Insurance Numbers or bank-account numbers;
• IT records: devices assigned to people and app access;
• files uploaded to the Services, and an audit log of who changed what and when.

Recipients of documents sent through one2sign. When a Customer sends you a document, we handle for the Customer:

• your name and email address as the sender entered them, your role (signer, approver, receives a copy, or signs in person), and, if the sender sets one, a keyed hash of your access code and the number of wrong attempts;
• if and when SMS codes are made available, your mobile number and the result of the check;
• the document, the information you enter, your signature and initials (typed, drawn or uploaded), files you attach (which may include an identity document or a cheque if the sender asks for one), and your reason if you decline;
• when you agreed to use electronic records and which version of the consent text you saw;
• when you opened, signed, declined or handed on the document;
• your IP address and the approximate location (city, region and country) that Cloudflare derives from it, recorded when you agree and when you sign, and a keyed hash of your IP address for other events;
• your browser and device description and the time zone your browser reports;
• if you choose "finish later", the progress you saved, until you finish or the document closes.

Everyone on a completed document sees the certificate of signature, which shows each person's name, email address, signature and initials, identity check, IP address, approximate location, times and device. Signing emails, the signing page and the certificate also show the sender's display name and account email address: those of the Authorized User who sent the document, recorded when it was sent (or, for a document already out for signature when this display began, when it is first emailed, viewed or certified after that) and not changed afterwards. The display name can come from the company's HR records; if there is none, only the email address is shown. DDR support staff cannot send documents. Documents started from a public shared link show only the company's name, with no sender name or email address. Signing emails come from a DDR sending address, but their reply-to address is the sender's own email address (none for a document started from a public shared link). See the Electronic Records and Signature Disclosure.

The public Verify page fingerprints a PDF in your own browser. The file is not uploaded, and the answer does not name anyone.

3.6 Weather in the top bar (optional)

If an Authorized User turns on weather, they type a place or let their browser share their location. The location is rounded to about 10 km and kept in their browser. Our server asks MET Norway (weather) and OpenStreetMap's Nominatim service (place names) about the rounded location or the typed place. We do not send them your IP address or any account information.

3.7 Website visitors and the waitlist

If you join a waitlist on senots.com, for Senots Suite, one2sign or another Senots product, we keep:

• your email address;
• the product you signed up for and the page you signed up from;
• the language of that page;
• the date and time you joined;
• the country that our hosting provider, Cloudflare, works out from your IP address (we do not store the IP address itself);
• your browser and operating system type (for example, Chrome on Windows); and
• a record of the consent wording shown to you when you joined, as proof of your consent.

Bot protection. Our sign-up forms use Cloudflare Turnstile, which checks your browser for signs of automated activity before a sign-up is accepted. To do this, Cloudflare processes technical signals such as your IP address, browser description (user agent) and details of your connection. Cloudflare states that it uses these signals only to tell people from bots and to improve Turnstile, not to identify, profile or target individuals. Cloudflare's Turnstile Privacy Addendum describes its own use of this data. Turnstile does not see what you type into the form.

Repeated sign-ups. To stop repeated sign-ups, we keep a keyed hash of your IP address for a few minutes, normally no more than 10, and then delete it automatically. We never store the address itself. Our database provider's point-in-time backups, kept for up to 30 days, may still contain the hash.

We use this information only to tell you about the launch of Senots Suite and other Senots products, and to keep our lists free of abuse. Our hosting provider, Cloudflare, stores it for us (Section 6). We do not sell or share it. If we later use an email service to send launch updates, we will add it to our Subprocessor list before we do.

We keep your sign-up until you unsubscribe or ask us to remove you, and no longer than 12 months after the public launch of the product you signed up for. When you unsubscribe, ask us to delete your sign-up, or your sign-up reaches its retention limit, we delete your email address and the other sign-up details, and keep only a minimal record that you consented: a keyed hash of your email address (not the address), the product, page and language, the version of the consent text, the dates you consented and left, and whether you unsubscribed, asked us to delete it or it reached the retention limit. We keep it for 3 years so we can show that we had your consent, then delete it. To be removed at any time, email hello@one2sign.com with the subject line "Unsubscribe" or "Privacy request".

3.8 Referrals

If you use a referral link or code, we process the code, attribution data (for example which Account referred a signup), and — only if you ask us to send an invite for you — the invitee contact details you provide, to run the program, grant account credit, and prevent abuse. When a referral code is present at signup or checkout, we may show the invitee that another one2sign customer referred them.

4. Why we use it

We do not sell personal information, do not share it for cross-context behavioural advertising, do not use it for advertising, and do not use Customer Data to train artificial-intelligence models. We do not make decisions about people based solely on automated processing.

5. Who we share it with

• Subprocessors and service providers that help us run the Services, bound by contract to protect the information and use it only for us: Cloudflare (hosting, database, file storage, network and security), Resend (email delivery), Stripe (billing and payments) and, if and when SMS codes are made available, Twilio (text-message codes). The full list, with what each one does and where, is in our Subprocessor list.
• Google and Microsoft, only if you choose to sign in with them.
• People the Customer chooses: for example, Recipients of a document receive it and its certificate; a public signing link reaches anyone the Customer gives it to; a Customer's own Stripe account receives payments its customers make.
• Authorities, when the law requires it, and only what is required (Section 9 of the DPA describes how we handle such requests for Customer Data).
• A buyer or successor, if DDR's business is merged, amalgamated or sold, under this policy and with notice to you.

6. Where your information is stored and international transfers

The Services run on Cloudflare. We ask Cloudflare to place our database and file storage in eastern North America. This is a placement request, not a residency guarantee: Cloudflare may store the data in Canada or the United States, and its global network handles requests at a data centre near the person connecting, which can be outside North America (for example, if you are travelling). Our waitlist database is in Cloudflare's western North America location (Canada or the United States); this, too, is not a residency guarantee. Our other Subprocessors process information mainly in the United States.

This means your information may be stored and processed outside your province or country, mainly in the United States, and may be accessible to courts, law-enforcement and national-security authorities there under local law. We protect it with contracts and the safeguards in Section 8.

• Quebec: before communicating personal information outside Quebec, we assess whether it will receive adequate protection, as Quebec law requires, and our contracts with Subprocessors reflect that assessment.
• EU, EEA, UK and Switzerland: where the GDPR or UK GDPR applies, transfers to DDR in Canada rely on the European Commission's adequacy decision for Canada (and the UK equivalent), and onward transfers to the United States rely on the Standard Contractual Clauses (and the UK Addendum) or the EU-U.S. Data Privacy Framework where the recipient is certified. The DPA has the details.
• Mexico: transfers to our Subprocessors are remisiones to encargados and do not need your consent. We do not make transfers that require your consent.

7. How long we keep it

Deleted information can remain in our database provider's point-in-time backups for up to 30 days before it is overwritten.

8. How we protect it

We use administrative, technical and physical safeguards suited to the sensitivity of the information, described in our Security Overview. They include encryption in transit, encryption at rest by our hosting provider, separation of each Customer's data by company, per-person and per-app access controls, exports limited to owners and admins, signing links stored only as hashes and encrypted copies, never in plain text in our database, keyed hashes of access codes, and staff access to Customer Data only through a time-limited support grant from the Customer. No system is perfectly secure.

9. Your rights

Depending on where you live, you may have the right to:

• know whether we hold personal information about you, and access it and receive a copy;
• correct inaccurate or incomplete information;
• delete it, or have it de-indexed, where the law allows;
• withdraw consent, for example to marketing emails, subject to legal or contractual limits;
• receive information you gave us in a structured, commonly used technological format (portability, including under Quebec law);
• object to or restrict some processing (GDPR, UK GDPR); in Mexico, exercise your ARCO rights (access, rectification, cancellation and opposition) and limit use or disclosure;
• opt out of the sale or sharing of personal information and of targeted advertising (we do neither) and limit the use of sensitive information (we use it only to provide the Services);
• not be treated differently for exercising these rights; and
• complain to a regulator: the Office of the Privacy Commissioner of Canada; the Commission d'accès à l'information du Québec; the Office of the Information and Privacy Commissioner of Alberta or of British Columbia; your US state attorney general or privacy agency; your EU or UK supervisory authority; or, in Mexico, the competent federal data-protection authority. We would appreciate the chance to address your concern first.

How to make a request. Email hello@one2sign.com with the subject line "Privacy request" and tell us what you want. We may need to confirm your identity, and we will ask only for what we need to do that. We respond within 30 days. Where the law allows, we may extend this once and will tell you why. You can use an authorized agent where the law allows. Requests are free unless they are clearly unfounded or excessive.

If we refuse a request, we will tell you why, in writing, and how to complain.

10. Requests about Customer Data

If your information is in a Customer's account (for example, you signed a document a business sent, or you work for a Customer), that Customer decides how to respond to your request. We will forward your request to the Customer within five business days, tell you that we did, and help the Customer respond under the DPA. Deleting a Recipient's details from a completed document can make the document unusable as evidence, so the Customer may have legal grounds to keep it.

11. Security incidents

If a security incident involving personal information we control creates a real risk of significant harm (or, in Quebec, a risk of serious injury), we will notify the affected individuals and the competent regulators as the law requires, and keep a record of every such incident. For Customer Data, we will notify the Customer without undue delay, and in any case within 72 hours of becoming aware of the incident, so that it can meet its own obligations (DPA, Section 8).

12. Cookies and similar technologies

The Services use only cookies and browser storage that are needed to run them or that remember your own choices. We do not use advertising or analytics cookies. Details are in our Cookie Notice.

Technology that locates you. The Services work out a Recipient's approximate location (city, region and country) from their IP address when they agree and when they sign, and show it on the certificate of signature; the Electronic Records and Signature Disclosure says so before the Recipient agrees. The optional weather feature uses your device location only if you choose to share it, and is off until you turn it on.

13. Emails

We send service and administrative emails (sign-in codes, security and billing notices, and changes to our terms) to Authorized Users as part of the Services. These are not marketing. If we send product news or marketing emails, we will do so only with consent as Canada's anti-spam legislation (CASL) and other laws require, identify ourselves, include our mailing address, and include an unsubscribe link that works within 10 business days.

Signing invitations and reminders are sent on behalf of the Customer that sends the document. Questions about them should go to that Customer.

14. Children

The Services are for businesses and are not directed to children. We do not knowingly collect personal information from children under 16 for our own purposes. Customers may store information about employees' dependants, such as for benefits, as part of their own records; that is Customer Data handled for the Customer.

15. Mexico: privacy notice (aviso de privacidad)

For individuals in Mexico, this policy is our privacy notice under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares. The controller (responsable) for the information in Section 2 "When we decide for ourselves" is DDR Solutions Inc., 120 Adelaide St W, Suite 2500, Toronto, ON M5H 3V1. The purposes in Section 4 are necessary for the relationship with you, except marketing emails, which you can refuse at any time by writing to hello@one2sign.com. You can exercise your ARCO rights and revoke consent as described in Section 9. A Spanish version of this notice is available on request and will be published with the Services in Mexico.

16. Changes to this policy

We will post any update here with a new version number and effective date. If a change is significant, we will tell account owners by email or in the Services before it takes effect.

17. Contact

DDR Solutions Inc. Attention: Privacy Officer, Deivis Diaz, CEO 120 Adelaide St W, Suite 2500, Toronto, ON M5H 3V1 Email: hello@one2sign.com