Sign HUB — Application Privacy Policy

Version 1.0 — in force since 19 August 2026

Application	Sign HUB — electronic signature for Bitrix24
Controller / processor	HUB DESPACHOS Y PYMES, S.L. (tax ID B76816875)
Registered address	Avenida Benito Pérez Armas, 2 - PTL 2,6 B, Santa Cruz de Tenerife, España
Data protection contact	[email protected]
Effective date	19 August 2026
Version	1.0

1. Scope of this policy

This policy explains what data the application Sign HUB accesses in your Bitrix24 account, why, where it goes and how long it is kept.

It covers the application, not the corporate website of HUB Consultores. The processing of the final signer's data is described in the Platform Privacy Policy, and the licence to use the application is governed by the End User Licence Agreement.

2. Who is who

Application	Sign HUB
Provider	HUB DESPACHOS Y PYMES, S.L. (tax ID B76816875), Avenida Benito Pérez Armas, 2 - PTL 2,6 B, Santa Cruz de Tenerife, España
Contact	[email protected]
Bitrix24	Platform on which the application runs. It is not the provider of the application.

3. Roles under the GDPR

The role is assessed purpose by purpose:

Data in your CRM. You are the controller; HUB Consultores acts as your processor and follows your instructions (Art. 28 GDPR, see the Data Processing Agreement).
Signature evidence. Its retention follows HUB Consultores's own policy and is not decided by you; for that specific processing HUB Consultores acts as controller. This evidence is expressly excluded from the scope of the Data Processing Agreement, and it is why uninstalling does not erase it.

4. Legal bases

Operating the application on your account	Performance of the contract (Art. 6.1.b GDPR): the End User Licence Agreement you accept on installation.
Processing the data in your CRM	Your own legal basis as controller. HUB Consultores processes it only on your instructions.
Retaining the signature evidence	Legitimate interest (Art. 6.1.f GDPR) in being able to prove the signature and defend against claims, aligned with the five-year limitation period for personal actions (Art. 1964 of the Spanish Civil Code) and with Art. 17.3.e GDPR.

The retention of evidence is not presented as a legal obligation: no rule imposes that period on a non-qualified trust service provider. Because the basis is legitimate interest, you retain the right to object described in section 13, and you may request the balancing test on which it relies.

5. Permissions requested and why

CRM	Read the record and its attached PDF, and write back the result.
Business processes	Provide the automation rules and triggers for sending and signing.
Embedding	Show the application's tab inside the record.
Users (basic)	Read the name of the employee sending the document, so it appears as the sender of the email.
Custom field settings	Create the Smart Process and the file field used to archive signed documents, at the administrator's request.
Notifications	Notify the person you choose when a signature is completed.

The application does not access custom fields in user profiles, nor telephony, tasks, calendars, drive or email.

6. What the application reads from Bitrix24

The record from which the document is sent (contact, company, deal or Smart Process item).
The PDF to be signed, attached to that record.
Name and email of the recipient contact.
Name of the employee assigned to the record.

7. What the application writes to Bitrix24

Timeline entries and the signed PDF as an attachment.
Items in the Smart Process used to archive signatures, if enabled.
The Smart Process and its file field, created once at the administrator's request.
Notifications to the person configured to receive them.

8. What is stored outside Bitrix24

To provide the signature and preserve its evidentiary value:

Signed PDF and its traceability certificate, in encrypted storage with object-lock (WORM) protection, when the storage backend supports it.
Signer's data: name, identity document as declared, email, IP address, browser user-agent, document hash and consents given.
Access credentials (OAuth tokens) for your account.
Your configuration: branding, email templates and preferences.

9. Retention

Documents and their evidence are kept for a minimum of 5 years under object-lock (WORM) protection, when the storage backend supports it, which prevents their alteration or deletion during that period, including by HUB Consultores. Credentials and configuration are kept while the application remains installed.

10. Subprocessors

Email delivery, storage, payments and the qualified seal rely on third-party providers, listed with their purpose, location and safeguards in Subprocessors. Changes to that list are announced with 30 days' notice.

11. International transfers

Documents, evidence and the qualified seal are processed within the EEA: storage in the European Union and the qualified trust service provider in Spain.

Transactional email delivery and subscription payments are provided from the United States and rely on the 2021 Standard Contractual Clauses together with the Data Privacy Framework. The location of the Bitrix24 platform itself depends on the region you contracted with Bitrix24. Each provider, its location and its safeguard are detailed in Subprocessors.

12. What happens when you uninstall

Always: the access credentials for your account are deleted. Bitrix24 also revokes the application's permissions, so it can no longer read or write anything in your account.
If you tick "Clear application data": your configuration is deleted as well, including your signing certificate.
Never: documents already signed and their evidence, for the reason given in sections 3 and 4. What the application had already written into your account (timeline entries, archive items) stays in your account, under your control.

13. Your rights

You may exercise access, rectification, erasure, objection, restriction and portability by writing to [email protected]. We reply within one month, extendable by two further months where the request is complex (Art. 12.3 GDPR).

Erasure does not extend to evidence still within the retention period of section 9: Art. 17.3.e GDPR allows it to be kept for the establishment, exercise or defence of legal claims. In that case the data is blocked, meaning it is kept solely at the disposal of the courts and authorities and is not used for any other purpose.

You may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

14. Security

Encryption in transit and at rest, object-lock (WORM) storage for evidence when the storage backend supports it, encrypted credentials, one-time password verification before signing, and access restricted to the personnel required to operate the service.

15. Changes to this policy

Each new version is published at this same address with its own version number and effective date, and is announced within the application. The changelog below records what changed.

16. Contact

HUB DESPACHOS Y PYMES, S.L. — Avenida Benito Pérez Armas, 2 - PTL 2,6 B, Santa Cruz de Tenerife, España — [email protected]

Changelog

1.0 — 19 August 2026

First version specific to the Application. Adds the legal bases per purpose, the international transfers section and the blocking of evidence in response to an erasure request.