Schedule a Call

SignBulb GDPR Compliance

What it is, what we are doing, and what you can do

The GDPR became enforceable on May 25, 2018, and increased oversight for global privacy rights and compliance. At SignBulb, we have embraced GDPR requirements. This guide is intended to help our customers understand SignBulb’s GDPR posture.

Note: This is not intended as a comprehensive legal analysis of GDPR.

What is the GDPR?

  • Adopted: April 14, 2016
  • Effective: May 25, 2018

The GDPR replaced EU Directive 95/46/EC and introduced a unified, stronger privacy framework across all EU member states. Unlike its predecessor, the GDPR applies immediately in all member states without local laws.

Key purpose: Strengthen, harmonize, and modernize EU data protection law and enhance individual rights and freedoms, treating privacy as a fundamental human right.

How Does the GDPR Work?

Major principles and changes:

  • Expansion of scope: Applies to all organizations in the EU and globally to organizations processing EU citizens’ data (“extraterritoriality”).
  • Expanded definitions: Broader definition of personal data and special categories of data.
  • Expanded individual rights:
    • Right to be forgotten – Request deletion of personal data.
    • Right to object – Prohibit certain uses of personal data.
    • Right to rectification – Request correction of incomplete or incorrect data.
    • Right of access – Know what personal data is processed and how.
    • Right of portability – Request transfer of data to another organization.
  • Stricter consent requirements: Consent must be explicit, specific, and separate for each processing activity. Silence, inactivity, or pre-ticked boxes do not count.
  • Strict processing requirements:
    • Provide fair and transparent information about processing.
    • Contact details for the data controller.
    • Purpose limitation and data minimization.
    • Retention limits.
    • Legal basis (contract, consent, or legitimate interest).

Who Does GDPR Affect?

GDPR applies broadly to:

  • Any organization operating in the EU (controllers and processors).
  • Any organization outside the EU offering goods/services to EU residents or monitoring their behavior (extraterritoriality).

Key Definitions

  • Data Subject: Any identifiable natural person.
  • Personal Data: Any information relating to a data subject (e.g., names, emails, IPs, financial data, biometric data, location).
  • Special Categories of Data: Sensitive data (e.g., health, race, religion) requiring stronger safeguards.
  • Processing: Any operation performed on personal data (collection, storage, use, transfer, deletion, etc.).
  • Controller: Determines purpose and means of processing.
  • Processor: Processes data on behalf of the controller.
  • In most cases: You (customer) = Controller; SignBulb = Processor.

How Does SignBulb Comply with GDPR?

  • Reviewing and updating internal processes, procedures, systems, and documentation.
  • Supporting customer requests regarding GDPR rights.
  • Monitoring developments such as Schrems II on EU-US data transfers.
  • Using Standard Contractual Clauses (SCCs) where applicable for data transfers.
  • Engaging with third-party subprocessors only after due diligence.

Supporting Individual Rights

  • Right to be forgotten – Customers can terminate their account anytime.
  • Right to object – Option to opt out of data science projects.
  • Right to rectification – Update account settings or contact SignBulb.
  • Right to access – Transparency via Privacy Policy; contact for details.
  • Right to portability – Request export of account data to a third party.

How SignBulb Processes Data

  • Third-party Sub-processors for business analytics, cloud infrastructure, email notifications, payments, customer support.
  • We maintain an up-to-date list of subprocessors on our website.

Do You Need to Comply with GDPR?

Yes, if your organization processes personal data of EU residents. Consult legal or professional advisors regarding GDPR obligations.

Risks of Non-Compliance

Failure to comply can result in fines up to €20 million or 4% of global annual turnover, whichever is higher.

Key Takeaway

  • SignBulb is HIPAA compliant and aligned with GDPR.
  • SignBulb acts as a processor; customers remain controllers.
  • Compliance is shared responsibility – SignBulb provides tools and support; customers meet their obligations.
  • For more information, review our Privacy Policy or contact [email protected].

GDPR Requirements Table

GDPR Requirement GDPR Reference Actor(s) Actions Taken
Lawful Basis Article 6, Article 11 Shared SignBulb: Establishes a lawful basis to process personal data. Data Subject: Provides consent where consent is the lawful basis.
Processing children’s personal data Article 8 SignBulb Does not distinguish between different types of personal data and does not knowingly collect children’s personal data.
Data protection by design Article 25 Shared SignBulb: Collects only the minimum personal data necessary for operations. Customer: Manages content within the SignBulb platform.
Data Protection Impact Assessments Article 35 Shared SignBulb: Assigns responsible staff to perform necessary DPIAs. Customer: Determines what content is shared with business partners and may assist SignBulb as processor.
Encryption Article 32 Shared SignBulb & Customer: Ensure security compliance. All personal data is encrypted in transit and at rest using AES-256 bit encryption.
European Data Protection Board Article 68 Shared SignBulb & Customer: Monitor EDPB guidance and adapt practices accordingly.
Personal data inventory Article 30 Shared SignBulb & Customer: Maintain required records of processing activities.
Right to erasure Article 17 Shared SignBulb: Staff appointed to respond to erasure requests. Data Subject: Exercises their right to erasure as facilitated by SignBulb.