Privacy Policy

1. Regulatory Framework & Scope

eSignPh complies with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations (IRR), and all circulars and advisories issued by the National Privacy Commission (NPC) of the Philippines.

This policy applies to individuals who create, upload, dispatch, view, or sign documents using our platform, whether as account holders or as invited external signatories.

2. Information We Collect

To establish legal enforceability, non-repudiation, and audit integrity, eSignPh collects the following categories of information:

3. Legal Grounds & Purposes of Processing

We process personal data based on the following legal grounds under Section 12 and 13 of the Data Privacy Act:

• Fulfillment of a Contract: Generating legally binding electronic contracts requested by document senders and participants.
• Compliance with Legal Obligations: Preserving evidentiary records and certificates required by the Electronic Commerce Act (RA 8792) and the Supreme Court Rules on Electronic Evidence.
• Legitimate Interests: Preventing signature forgery, detecting security incidents, and ensuring document non-repudiation.

4. Audit Trail & Certificate of Completion

Under legal standards for electronic evidence, an electronic signature requires clear proof of identity and attribution. For this reason, eSignPh compiles a permanent Certificate of Completion appended to the executed document. This certificate permanently records:

• Signer full legal name and verified email address.
• Exact timestamp of signature completion recorded in UTC.
• Signer IP address and browser user-agent.
• Cryptographic SHA-256 hashes verifying that the document content was unchanged after signing.

Note: Once an envelope is completed and cryptographically sealed, the audit trail embedded within the Certificate of Completion cannot be altered without voiding the document's cryptographic integrity.

5. Data Security & Storage Architecture

eSignPh implements rigorous organizational, physical, and technical security measures in compliance with NPC regulations:

• Encryption in Transit: All HTTP communications are protected using Transport Layer Security (TLS 1.2 and TLS 1.3).
• Encryption at Rest: Stored documents and audit logs are encrypted using enterprise AES-256 storage encryption.
• Access Control: Signatory access is restricted to cryptographically generated 256-bit unguessable tokens. Senders authenticate via timed 6-digit OTP codes.
• Separation of Tenancy: Each document envelope exists with dedicated UUID keys and relational isolation.

6. Data Sharing & Third Parties

eSignPh does not monetize, sell, or rent personal data to third parties. We share data solely with trusted infrastructure service providers strictly necessary to execute our services:

• Cloud storage providers for encrypted object storage.
• Digital Signature Services (DSS) for cryptographic document sealing.
• Transactional mail relays for delivering signing invitations and completion notifications.

7. Data Subject Rights

Under Republic Act No. 10173, data subjects possess distinct statutory rights:

• Right to be Informed: To know what personal data is collected and how it is used.
• Right to Access: To request copies of personal information held by the platform.
• Right to Rectification: Senders may correct inaccurate recipient email addresses before an envelope completes execution.
• Right to Erasure or Blocking: Draft documents may be deleted at any time by the sender. For legally completed documents, erasure requests are subject to statutory retention obligations under contractual and evidentiary law.

8. Data Protection Officer (DPO) Contact

For privacy inquiries, rights requests, or complaints, please reach out to our designated Data Protection Officer: