Data Processing Agreement

Whoever gathers signatures gathers personal data. You, as Creator, are the controller of the data of those who sign your cause. Causfy processes it on your behalf: it gathers the signatures, issues the certificates, stores them encrypted and delivers them to you.

Causfy cannot by itself read what it stores: the data of each signature is encrypted so that only you can open it, with your passkey.

The processing lasts while the cause is active or paused and, once it is finished, until you confirm that you have decrypted the certificates or, at the latest, 90 days. Afterwards, Causfy erases what it was storing.

You accept this agreement when you publish your first cause. It forms part of the Terms for Creators.

1.1. The controller is you, the Creator: the person or organisation holding the Account from which the cause is published.

1.2. The processor is CAUSFY GLOBAL TECHNOLOGIES, S.L., whose details are set out at the end of this document.

1.3. This agreement applies to every cause you publish from your Account. You accept it when publishing the first, and it remains in force for the following ones.

1.4. Words with an initial capital have the meaning given to them by the Terms for Creators.

2.1. Gather the signatures of your cause: the name and email of each signer, confirm the email with a code and check that nobody signs twice.

2.2. When the cause requires verified identity, check the identity of the signer with their explicit consent: read their document, check that they are a real person and compare their face with the photo on the document, on a machine of Causfy’s own with no internet connection, without keeping images or biometric templates; and compute a pseudonymised code of their document to prevent them from signing the same cause twice.

2.3. Issue the Certificate of each signature, seal it and record its fingerprint on the public blockchain.

2.4. Keep the encrypted Certificates in custody and deliver them to you when you download them, once you have verified your identity.

2.5. Send the updates of your cause to those who asked to receive them, when you send them from the Platform.

2.6. Updates may only report on the cause and its progress. They may not be used to send commercial communications or to promote other causes, products or services.

2.7. Show publicly the number of signatures, their breakdown by country and, for each recent signature, only the initial of the signer’s name followed by four asterisks and how long ago they signed.

2.8. Causfy does not process that data for any other purpose, whether its own or a third party’s.

3.1. The processing begins with the first signature of your cause and lasts while the cause is active, that is, published or paused.

3.2. The Certificates can only be downloaded when you finish the cause, and a finished cause cannot be activated again. You download them encrypted and decrypt them on your own device.

3.3. The processing ends when you confirm on the Platform that you have decrypted the Certificates, or 90 days after the finish if you have not confirmed before then, after notifying you. In both cases Causfy erases all the data of the signers of that cause. Before confirming, check that your copy is complete and readable: afterwards, Causfy will no longer be able to deliver it to you again.

4.1. The data subjects are those who sign your cause.

4.2. The data is what the Certificate contains: name and email; the text of the petition; the date and time; the country from which it was signed, whether the connection went through a VPN, a proxy or Tor, and the browser and operating system; the method by which they identified themselves and, where there is one, the authority that did so; and the record of the verification steps. In addition, if the signer asked for updates, their email in order to send them; a pseudonymised code of their email, specific to this cause, to prevent duplicate signatures; and, in signatures with verified identity, their first name and surname, the type, country and number of their document, their age in years and the result of the verification. The verification itself leaves no image or biometric data stored.

4.3. Some causes may reveal the political opinions, beliefs or trade union membership of whoever signs them. For that reason the signature is gathered with the signer’s explicit consent, and for that reason this data is processed with the security measures of section 7.

5.1. Causfy processes the data solely following your instructions, which are those set out in this agreement and those you give by using the features of the Platform. If a rule obliges Causfy to process it otherwise, it will inform you beforehand, unless that same rule prohibits it.

5.2. You commit to using your signers’ data only for the cause and to prove support before its Addressee; not to sell, transfer or use it for any other purpose; to attend to the rights they ask you to exercise; to download the Certificates, confirm that you have decrypted them and keep them in custody; and to erase your copy of the Certificate of whoever deletes their signature, when Causfy informs you.

5.3. If Causfy considers that an instruction of yours infringes data protection legislation, it will tell you.

Signature platforms have a reputation for living off the data of those who sign. Causfy is built so that this cannot happen, and not by a promise, but by how it is constructed.

6.1. The data of each signature is encrypted so that only you can open it, with your passkey. Causfy cannot by itself decrypt what it stores, nor can its staff, nor anyone who gained access to its servers or its database.

6.2. What Causfy does see, and why: the initial of the name, for the public list; the country, for statistics; the date; and the pseudonymised code of the email, to prevent duplicate signatures.

6.3. The data of a signature is in the clear only while it is taking place, in memory: sending the code, confirming it, generating and sealing the Certificate and sending the confirmation email. If the signer asked for updates, their email is also decrypted for an instant when you send one, and discarded.

6.4. For that reason Causfy does not sell, rent or transfer the data of those who sign: the only thing it could hand over is encrypted files that it cannot open.

6.5. Causfy’s staff are bound to secrecy regarding any data they might come to know in the course of their work, and that duty continues when the processing ends.

7.1. Causfy does not store any personal data of a signer in the clear, except those indicated in 6.2.

7.2. The personal data of each signature is encrypted with its own key, wrapped to a key of the cause that can only be opened with your passkey.

7.3. The code to prevent duplicate signatures is computed with a secret key safeguarded in Causfy’s secrets manager and the identifier of the cause, so that it does not allow signatures of different causes to be linked.

7.4. Identity verification runs on a machine of Causfy’s own with no internet connection, reachable only from Causfy’s servers through an encrypted channel. The audit log is chained so that any tampering is detected.

7.5. If you lose all your passkeys and your recovery code, the encrypted Certificates of your Account cannot be recovered. That is the consequence of Causfy being unable to read them.

8.1. To provide the service Causfy relies on other providers, which process your signers’ data on behalf of Causfy and under its same obligations:

8.2. You give Causfy general authorisation to use these providers and to change them. Causfy will notify you of any change in advance, and you may object; if you object, you may finish your cause and download the Certificates.

8.3. Causfy is answerable to you for what its providers do.

8.4. Transfers. When a sub-processor processes data outside the European Economic Area, the transfer is covered by the EU-US Data Privacy Framework or by the European Commission’s standard contractual clauses, of which Causfy will provide you with a copy.

9.1. Signers’ rights. Causfy makes available to them the links in the confirmation email to delete their signature and unsubscribe from updates. If a signer exercises another right before Causfy, Causfy will forward the request to you without delay. If they exercise it before you, Causfy will give you the information you need to deal with it.

9.2. Security incidents. Since nobody at Causfy can read your signers’ data, an incident here does not mean that someone has read it. It may mean that encrypted files have been lost or erased, and then you lose those Certificates; that someone has taken encrypted files they cannot open; or that something happened in the minutes in which a signature was in the clear while it was taking place. In any of those cases, the law obliges Causfy to inform you without undue delay, with the information it has, so that you decide what to do as controller. If the data affected was unreadable, the law itself exempts you from notifying the signers.

9.3. Causfy will notify you of any security breach affecting your signers’ data within a maximum of 48 hours from becoming aware of it.

9.4. Assessments and consultations. Causfy will help you, with the information at its disposal, if you have to carry out an impact assessment or consult the supervisory authority. Causfy makes its impact assessment of identity verification available to you.

10.1. When the processing ends, Causfy erases the encrypted Certificates, the encrypted emails and the encrypted full names of your signers. What is erased may remain for up to 30 days in encrypted backups, unused, and if they had to be restored the pending erasures are applied again first.

10.2. The Cause remains published in finished status, with its text and its signature counter, which is a number and not personal data. The fingerprint of each Certificate on the blockchain also remains, which is permanent, cannot be erased and does not contain personal data either. The list of initials is erased.

10.3. Your copy of the Certificates is yours from the moment you download it, and you keep it under your own responsibility.

11.1. Causfy will provide you with the information necessary to demonstrate that it complies with this agreement.

11.2. You may request an audit, directly or through an independent auditor, with reasonable notice and without interrupting the service. Causfy may offer you a recent audit report instead.

12.1. You accept this agreement when you publish your first cause. It forms part of the Terms for Creators and is governed by the same law and the same courts.

12.2. Causfy may modify it. Substantial changes are communicated with at least thirty calendar days’ notice.

12.3. Who the processor is.

CAUSFY GLOBAL TECHNOLOGIES, S.L.

NIF B88744602

C/ Princesa 31, planta 2, puerta 2, 28008 Madrid, España

Registro Mercantil de Madrid, Sección 8.ª, Hoja M-888274, Inscripción 1.ª

• Data protection: