CodSign, developed by Codweb SAS (hereinafter "CodSign," "we," or "the platform"), is the data controller and processor for the personal data processed through its electronic document signature platform, available at codsign.co and app.codsign.co. This Privacy Policy and Personal Data Processing Policy (the "Policy") describes what information we collect, the purposes for which we use it, who we share it with, and what rights you have over it, in compliance with Colombian Law 1581 of 2012, Decree 1377 of 2013 (compiled into Sole Regulatory Decree 1074 of 2015), and other applicable Colombian data protection regulations.
1. Information we collect
Account information: When you register as a platform user, we collect your name, email address, phone number (optional), company name, billing details, and encrypted password.
Usage information: We log actions performed on the platform: documents created, signers added, documents signed or rejected, and dashboard access logs (IP, device, date, and result).
Signer information: When you send a document for signing, we collect the signer data you provide: name, email, and, if you enable mobile notification, phone number. Signers do not need to create a CodSign account to sign.
Technical evidence of the signing process: For each signature we collect and retain the evidence that supports its validity: IP address, device type, operating system, browser and user agent, the exact date and time of each event (sent, opened, signed, rejected), the image or stroke of the captured handwritten signature, and the cryptographic fingerprint (SHA-256 hash) of the original and signed documents.
Verification codes: When SMS or WhatsApp verification is enabled, we generate a one-time code sent to the signer's declared phone number to confirm that the person signing controls that channel.
Payment information: Payments are processed by external gateways (Wompi, PayPal). CodSign does not directly store credit card or banking information.
Cookies and browsing data: We use technical cookies necessary for platform functionality and analytics cookies (anonymous) to improve the experience. You can manage cookies from your browser settings.
2. How we use your information
We use the collected information to:
Service delivery: Send documents, notifications (email, SMS, WhatsApp), automatic reminders, and manage each document's lifecycle.
Verification and certification: Confirm the declared identity of each signer, generate the audit certificate for each document, and enable its public verification via a code or QR code.
Security: Detect unauthorized access, prevent fraud, and maintain audit trail integrity.
Billing: Process payments, generate invoices, and maintain transaction history.
Product improvement: Analyze aggregated, anonymous platform usage to improve features and user experience.
Communications: Send you product updates, security alerts, or relevant information. You can unsubscribe at any time.
3. Signer data: controller and processor roles
When you use CodSign to send a document for signature, you — as the sender — act as the Data Controller for the personal data of your signers (name, email, phone) that you provide to us, and you represent that you have the authorization or legal basis required to share that data with us for the sole purpose of managing the signing process.
With respect to that data, Codweb SAS acts as Data Processor on the sender's behalf. Additionally, as a direct controller, Codweb SAS collects and retains the technical audit evidence (IP, device, date and time, document fingerprint) that the platform itself generates as part of the certification service.
Before signing, each signer must expressly accept the processing of their personal data under this Policy via the consent checkbox presented during the signing process. That acceptance constitutes the authorization required by Law 1581 of 2012 for the data CodSign processes directly.
4. Sharing information with third parties
CodSign does not sell, rent, or share your personal information with third parties for advertising or commercial purposes. We share information only in the following cases:
Service providers: Companies that support our operations: payment gateways (Wompi, PayPal), cloud infrastructure, and SMS and WhatsApp Business API providers (such as Infobip). These providers only access information necessary to provide the service.
Legal requirements: When required by competent authorities, court orders, or to comply with applicable legal obligations in Colombia.
Business transfer: In case of merger, acquisition, or asset sale, data may be transferred to the new owner under the same privacy conditions.
5. International data transfers
Some of our cloud infrastructure and messaging providers may store or process information outside Colombia. In those cases, we adopt reasonable contractual and technical safeguards to require adequate protection levels consistent with Law 1581 of 2012, even where the destination country lacks a compliance declaration from Colombia's Superintendence of Industry and Commerce.
6. Storage and security
Your information is stored on secure servers with restricted access. We implement the following security measures:
Encryption: All communications use HTTPS/TLS. Passwords are stored with secure hashing (bcrypt or equivalent).
Document certification: Each signed document is sealed with the platform's own digital certificate (PKCS#7 standard) and a SHA-256 fingerprint is calculated for it, allowing any later alteration to be detected.
Access control: Role-based access (Administrator / Collaborator) with an audit log of every action.
Strong authentication: 2FA (two-factor authentication) support with apps like Google Authenticator.
Access logs: Log of all logins with IP, device, and result for detecting unauthorized access.
Masking in public verification: The public verification page for a document shows signer data partially masked (for example, email addresses), to protect their personal information from third parties.
Retention: We retain documents and associated data while your account is active. You can request deletion or anonymization of your personal data at any time by writing to [email protected]; we will handle your request within the legal timeframes described in the "Your rights" section, unless legally required to retain it or needed to preserve the audit evidence of already-signed documents for evidentiary purposes.
7. Security incident management
In the event of any incident that compromises the security of the personal data we manage and poses a real risk to our users' information, we will notify Colombia's Superintendence of Industry and Commerce within the timeframes required by law, and affected data subjects when applicable, disclosing the nature of the incident, the data involved, and the measures taken to mitigate it.
8. Your rights (Habeas Data)
Under Colombian Law 1581 of 2012 and Decree 1377 of 2013, as the data subject you have the right to:
Know, update, and rectify: Your personal data held by us, particularly if it is partial, inaccurate, incomplete, or outdated.
Request proof of the authorization: Granted for the processing of your data, unless the law exempts you from this requirement.
Be informed: About the use we have given your personal data, upon request.
Revoke authorization and/or request deletion: Of the data, when the constitutional and legal principles, rights, and guarantees are not respected, unless there is a legal or contractual duty to retain it.
Access free of charge: Your personal data that has been processed.
File complaints: Before Colombia's Superintendence of Industry and Commerce (SIC) for violations of personal data protection regulations, once the consultation or claims process with us has been exhausted.
To exercise any of these rights, write to [email protected] with the subject "Personal data rights." We will respond within the legal timeframes (10 business days for consultations, 15 business days for claims).
9. Cookies
Technical cookies: Necessary for platform functionality (session, authentication). Cannot be disabled.
Analytics cookies: Used to understand how users interact with the platform (anonymous, aggregated data). Can be disabled from your browser.
Third-party cookies: Some integrated services (payment gateways, support) may set their own cookies subject to their privacy policies.
10. Minors
CodSign is not directed at individuals under 18. We do not intentionally collect data from minors. If we discover we have collected data from a minor without their legal guardian's consent, we will delete it immediately.
11. Changes to this policy
We may update this Policy periodically. When we do, we will update the "last updated" date and, for significant changes, notify you via email or a prominent notice on the platform.
12. Contact
If you have questions or wish to exercise your personal data rights, contact us:
Company: Codweb SAS
Tax ID (NIT): 901144915-0
Email: [email protected]
WhatsApp: +57 304 645 0798
Location: Medellín, Antioquia, Colombia