Privacy Policy

SignWay is an electronic signature platform that lets individuals and businesses in South Africa send, sign, and seal documents online. SignWay is a product of GigWay (Pty) Ltd (registration number 2022/302503/07), a company incorporated in South Africa and based in Tshwane, South Africa.

For any privacy-related question, or to exercise your rights under POPIA, contact our Information Officer:

• Information Officer: Letlhogonolo Modiga
• Email: privacy@signway.co.za
• Address: 9781 Zone 1

GigWay (Pty) Ltd, as the responsible party for SignWay, is registered with the Information Regulator of South Africa as required by POPIA.

We collect the following personal information:

• Account information you give us when you register: your name, email address, password (stored securely and never in plain text), and — if you provide it — your mobile number.
• Document and signing information: documents you upload, the names and email addresses (and, where provided, mobile numbers) of the signers you invite, the signatures and any information signers enter into a document, and the completed sealed document.
• Audit and security information: for every signing action we record the date, time, IP address, and device/browser information, to create the audit trail that gives each signed document its legal integrity.
• Payment information: if you subscribe to a paid plan, payment is processed by our payment provider (PayFast). We do not store your full card details on our systems.
• Technical information: basic information about how you access and use the service, collected to keep the service secure and working.

You may choose to upload documents that contain other people's personal information (for example, a signer's ID number in a contract). When you do, you are responsible for having a lawful basis to process that information, and we process it on your behalf as your operator.

We use your personal information to:

• create and manage your account;
• deliver signing requests to the people you invite, by email and (where a number is provided) SMS;
• generate, seal, and store completed documents and their audit trails;
• verify signer identity where you enable one-time PIN verification;
• process payments and manage your subscription;
• keep the service secure, prevent fraud and misuse, and comply with our legal obligations;
• respond to your support requests and communicate with you about the service.

We do not sell your personal information, and we do not use the contents of your documents for advertising.

We process your personal information on the following bases under POPIA:

• Performance of a contract — to provide the service you have signed up for.
• Your consent — which you give when you create an account and agree to this policy, and which you may withdraw at any time.
• Legitimate interests — to secure the service, prevent fraud, and maintain the integrity of signed documents.
• Legal obligation — where the law requires us to keep certain records.

When you invite signers, we process their information as your operator (processor), acting on your instructions.

We share personal information only with service providers ("operators") who help us run SignWay, under agreements that require them to protect it and use it only for the purposes we set. These include:

• Supabase — secure database, file storage, and authentication.
• Resend — sending transactional emails (signing requests, confirmations, notifications).
• SMSPortal — sending SMS notifications and one-time verification codes.
• PayFast — processing subscription and bundle payments.

We may also share information where we are legally required to do so, or to protect our rights, users, or the security of the service. We do not sell or rent your personal information to anyone.

Your information is stored securely by our service providers. Some of these providers store or process data on servers outside South Africa. Where information is transferred outside the country, we take reasonable steps to ensure it receives a level of protection consistent with POPIA, including relying on providers who are bound by comparable data-protection commitments.

We keep your personal information only for as long as necessary:

• Account information — for as long as your account is active.
• Completed signed documents and their audit trails — we retain these while your account is active and for a reasonable period afterwards, because a signed document may need to be relied on later as a legal record. You can request deletion, subject to any legal record-keeping requirements.
• One-time verification codes — stored only as a secure hash and deleted shortly after they expire.
• Mobile numbers — kept only as long as needed to deliver notifications and codes.

When information is no longer needed, we delete or de-identify it. Full periods are set out in our Data Retention & Deletion Policy.

You have the right to:

• ask what personal information we hold about you and request a copy;
• ask us to correct or update information that is inaccurate;
• ask us to delete information, subject to any legal requirement for us to keep it;
• object to certain processing, and withdraw consent where processing is based on consent;
• lodge a complaint with the Information Regulator.

To exercise any of these rights, contact our Information Officer (section 1). You also have the right to complain to the Information Regulator of South Africa (inforeg.org.za).

We take reasonable technical and organisational measures to protect your information, including encrypted storage, access controls, hashed passwords and verification codes, and tamper-evident sealing of completed documents. No system is perfectly secure, but we work to protect your information and to notify you and the Regulator if a breach affecting your personal information occurs, as required by POPIA.

SignWay uses strictly necessary cookies and local storage required to keep you signed in and to remember your workspace. These cannot be switched off.

On our public website (home, pricing, verification and legal pages) we also use Google Analytics 4 to understand how the site is used — for example which pages are visited and how visitors find us. Analytics is only loaded after you choose "Accept analytics" in our cookie notice, is never loaded inside your signed-in workspace or on signing links, and IP addresses are anonymised. Google Analytics may transfer this usage data outside South Africa; Google acts as our operator under POPIA for this purpose. You can change your choice at any time by clearing your browser's site data for SignWay, and declining analytics has no effect on your use of the service.

We may update this policy from time to time. When we make material changes, we will update the "last updated" date and, where appropriate, notify you.

Questions about this policy or your personal information? Contact our Information Officer at privacy@signway.co.za.

This document is starting content pending legal review and is not legal advice.