Privacy Policy

The controller of the information, with respect to information collected by the Company for its own independent purposes, is:

Taltul Technologies Ltd.

Company no.: 517339271

Trade name: Israeli Signature (Hatima Israelit)

Brand / system name in English: israelisign

Service website / domain: israelisign.com

Email for privacy enquiries: management@israelisign.com

Should the Company appoint a privacy protection officer, an information security officer or another dedicated role in the field of privacy or information security, their details will be published or provided in accordance with the provisions of law, to the extent required.

This policy applies to any person whose personal information is collected, provided, stored or processed within the Services, including:

business owners and service providers who use the System; employees, representatives or persons authorized on behalf of business owners; end customers of business owners; persons who sign documents through the System; customers or recipients in respect of whom clarification of an engagement, payment, cancellation, non-attendance, non-payment or an alleged breach is required; visitors to the website or the application; persons contacting customer service; recipients of notices or documents; and any other person whose information is provided to the Company within the Services.

In this policy, the following terms shall have the meaning set out beside them, unless expressly stated otherwise or unless the context requires otherwise:

"Company" - Taltul Technologies Ltd., which operates the Services under the trade name "Israeli Signature" (Hatima Israelit) and the brand name "israelisign".

"Services" or "System" - the website, the digital system, the signing system, the document creation system, the contract management system, record retention services, signature documentation services, support services, payment processing and payment services, the basic initial contract drafting service, API interfaces, integrations, and any other ancillary service that the Company may offer from time to time.

"Business owner" - a service provider, business, company, licensed dealer (osek murshe), exempt dealer (osek patur), private entity, organization or commercial entity that uses the System for the purpose of managing engagements, obtaining customers' signatures, producing documents, retaining records, managing documentation, handling orders, payments, clarifying enquiries or clarifying disputes.

"User" - any person who uses the website, the System, the application (to the extent it exists) or the Company's Services, including a business owner, primary user, secondary user, recipient, signatory, end customer, website visitor or any other person whose information is processed within the Services.

"Primary user" - the holder of the business account or the person managing the account on behalf of the business owner, including a person authorized to create additional users, manage permissions, upload documents, send documents for signature, manage payments or use the Services on behalf of the business owner.

"Secondary user" - an employee, representative, authorized person, agent or other party acting on behalf of the business owner or under its account, in accordance with the permissions allocated to it in the System.

"End customer" - a customer of the business owner, including a person who receives an offer, orders a service, signs a document, provides details, cancels an order, fails to attend a scheduled appointment, fails to pay, or in respect of whom it is alleged that they breached a contractual undertaking.

"Recipient" - a person to whom a document, link, notice, form, signature request, reminder, service notice, payment notice, clarification notice or any other communication is sent through the System.

"Signatory" - a person who is required to sign, approves, indicates consent, enters details, opens a document, views a document or performs another action in connection with a document sent through the System.

"Personal information" - any information relating to an identified or identifiable individual, directly or indirectly, including name, identity number, contact details, address, payment details, IP address, digital identifiers, signature, usage data, document content, correspondence, records, engagement details, login data, security data and any other data deemed personal information under law.

"Information of a particularly sensitive nature" - as defined in the Protection of Privacy Law, including information of the types specified in law, and in particular medical information, biometric information, sensitive financial information, information about a person's private affairs, location data, information about minors, information subject to a special duty of confidentiality, or any other information which, under law or by its nature, requires heightened caution.

"Statistical information" or "aggregate information" - information that does not identify a particular person and does not reasonably allow them to be identified, including statistical data, aggregate usage data, performance metrics, fault data, load data, general usage data and anonymous or non-identifying data.

"Processing" - any action performed on personal information, including collection, receipt, retention, storage, organization, use, viewing, copying, disclosure, transfer, delivery, granting access, cross-referencing, modification, correction, deletion, destruction or anonymization.

"Owner of a database" (controller) - the party that determines, alone or jointly with another, the purposes of processing information in the database, all in accordance with its definition under law.

"Holder" or "processor" - a party that holds or processes personal information on behalf of the owner of a database or in accordance with its instructions, all in accordance with the law and the circumstances of the matter.

"Law" - any statute, regulation, order, directive, regulatory instruction, case law or other binding provision applicable to the Services, the Company, the business owner or the information, as the case may be, including the laws of privacy protection, information security, consumer protection, electronic signature, communications, electronic commerce and payment processing.

"Service providers" or "third parties" - providers of hosting, cloud, infrastructure, development, maintenance, information security, communications, mailing, SMS, WhatsApp, email, payment processing, payments, signing, verification, professional, legal or accounting advice, as well as any other party assisting the Company in providing the Services, all as needed and subject to law.

4.1 With respect to information collected by the Company for its own independent purposes, including for opening an account, account management, billing, collection, customer service, support, marketing, information security, prevention of misuse, managing the engagement with business owners, clarifying enquiries, clarifying disputes, handling payments, preserving legal rights and complying with legal requirements - the Company may act as the controller of the information.

4.2 With respect to information that a business owner enters, uploads, stores, sends or processes through the System concerning its customers, employees, representatives, suppliers, signatories or recipients - including documents, customer details, correspondence, records, forms, contracts, signature data and engagement data - the business owner may be deemed the controller of the information, and the Company may act as a holder or processor of the information on its behalf, depending on the circumstances, the purposes of processing and the provisions of law.

4.3 The business owner is responsible for ensuring that it has appropriate authorization, consent or a legal basis for the collection, provision, uploading, retention and processing of personal information in the System, including with respect to end customers, recipients, signatories, employees, representatives or other third parties. This includes the business owner’s responsibility for providing appropriate notices to data subjects, obtaining consents to the extent required, complying with disclosure obligations, preserving data subjects’ rights, and refraining from uploading excess information or information of a particularly sensitive nature that is not required for the Services.

4.4 When the Company uses information for its own independent purposes, including for information security, prevention of fraud or misuse, clarification of disputes, handling payments, preservation of legal rights, conduct of proceedings, defending against claims, service improvement or compliance with legal requirements - the Company may also process the information as an independent controller, depending on the circumstances and applicable law.

4.5 For general clarification only, and without derogating from a specific examination according to the circumstances of each case, the following are examples of the Company’s possible status with respect to key types of information:

a. A business owner’s account, billing, subscription, support and marketing details - source of the information: the business owner or its representatives. Possible status of the Company: controller of the information.

b. Documents, end-customer details, signatures and records uploaded or sent by a business owner - source of the information: the business owner, the end customer, the signatory or the recipient. Possible status of the Company: holder or processor of the information on behalf of the business owner, as the case may be, and in certain cases also an independent controller with respect to operational, security, documentation, billing and rights-preservation data.

c. Signature data, system records, IP address, time of opening, time of viewing and time of signing - source of the information: the System, the users, the signatories and the recipients. Possible status of the Company: controller or holder of the information, depending on the purpose of processing.

d. Information required for the clarification of an engagement, payment, cancellation, non-attendance, non-payment or dispute - source of the information: the business owner, the end customer, the signatory, the recipient, the System or other relevant parties. Possible status of the Company: controller or holder of the information, depending on the circumstances, the purpose of processing and applicable law.

4.6 Where a separate data processing arrangement or data processing addendum between the Company and the business owner is required, the provisions of that arrangement shall apply, to the extent signed or approved, in addition to this Privacy Policy and the Terms of Use.

The Company may collect and process the following types of information, according to the nature of the use of the Services:

5.1 Information about business owners - full name, business name, licensed-dealer number, company number, address, telephone, email, role, login details, permission details, billing details, invoice details, subscription details, details of the engagement with the Company, documents uploaded to the System, contract templates, records, correspondence, service enquiries and documentation of actions performed in the System.

5.2 Information about end customers, signatories and recipients - full name, identity number where required, telephone, email, address, order details, service details, appointment or event date, documents sent for signature, contract content, digital or electronic signature, consent approvals, time of viewing the document, time of signing, IP address, device type, browser type, verification data and documentation of actions in the System.

5.3 Technical and operational information - IP address, device identifiers, browser type, operating system, login data, time of connection, security data, log files, fault data, usage data, actions performed in the System, permission data, verification data and documentation of security events.

5.4 Information relating to documents and signatures - document content, contract templates, document versions, identity of the document sender, identity of the signatory, time of sending, time of opening, time of signing, means of verification, signature, delivery confirmations, viewing confirmations, system data evidencing the signing process and any additional documentation required to prove the engagement or the action performed.

5.5 Information relating to basic initial contract drafting - for the purpose of basic initial contract drafting, the Company may collect and process information required to prepare the text, including the business owner’s field of activity, the type of services it provides, general contact details, cancellation policy, advance amounts, payment terms, service times, general business risk details and any other information the business owner provides for the purpose of preparing a basic text.

It is clarified that, within this service, the Company does not seek to receive excess information or information of a particularly sensitive nature that is not required to prepare the basic text. The business owner is requested not to provide information that is not necessary, and in particular not to provide medical, biometric, intimate personal or other sensitive information, unless this is clearly and legitimately required for the engagement.

5.6 Information relating to the clarification of engagements, payments and disputes - where clarification is required in connection with a document, engagement, order, cancellation, non-attendance, non-payment, alleged breach or a dispute between a business owner and an end customer, the Company may receive and process information including, among other things: the business owner’s details, the end customer’s details, the signed contract, the time of signing, the amount of the transaction or payment, the reason for the dispute, the circumstances of the alleged breach, records, correspondence, cancellation notices, reminder notices, documentation of non-attendance, documentation of non-payment, details of a service that was provided, not provided or cancelled, payment details, and any information the Company requires for the purpose of clarifying the matter, retaining records, handling enquiries, preventing misuse, information security or exercising rights under law.

5.7 Payment and payment-processing information - for the purpose of payment for the Services, the Company may process transaction details, charge amount, charge date, means of payment, payment status, invoice details, transaction approval number, details required for the prevention of fraud, as well as additional information required for billing, credit, transaction disputes (chargebacks), refunds or accounting management. The Company uses or may use the payment-processing and payment services of Isracard and/or anyone on its behalf. The Company does not retain full credit card details in its systems, unless this is permitted and required by law and subject to appropriate security procedures. To the extent payment details are retained for the purpose of recurring charges, this will be done through a payment-processing provider or an appropriate payment-services provider, in accordance with law and the applicable security standards.

5.8 Information of a particularly sensitive nature that users upload to the System - the Company does not ask users to upload information of a particularly sensitive nature that is not necessary for the Services. Nevertheless, a business owner, end customer or other user may upload to the System documents, correspondence or records that include information of a particularly sensitive nature.

Users and business owners are requested not to upload to the System information of a particularly sensitive nature, including medical, biometric, intimate personal information, information about minors, excess financial information, information subject to a special duty of confidentiality or information that is not reasonably required for the Services, unless there is a clear and legitimate justification for doing so and it is done in accordance with law.

The Company is entitled, but not obligated, to restrict, delete, remove or block access to information that on its face appears to be excess, unnecessary, unlawful, offensive, dangerous from an information-security standpoint or that was uploaded in breach of this policy or the Terms of Use.

The provision of some of the information depends on the user’s will and consent. However, without providing certain information, it may not be possible to open an account, use the System, send a document for signature, sign a document, make a payment, receive support services, receive a basic contract text, retain records, clarify a claim with respect to a document or receive another service from the Company.

Where information is required for the purpose of an engagement, identification, information security, compliance with legal requirements, making a payment, handling a document, proving a signature, clarifying a dispute or preserving rights, failure to provide it may prevent or limit the provision of the service.

7.1 When collecting personal information from an individual, the Company will provide them, directly or through the business owner as applicable, with an appropriate notice in accordance with law, including as to the identity of the party collecting or receiving the information, the purposes of collecting the information, the types of information collected, whether there is a legal obligation to provide the information or whether its provision depends on the will and consent of the data subject, the possible consequences of failing to provide the information, and the types of parties to whom the information may be disclosed.

7.2 Where the information is collected directly by the Company, the Company will act to provide the data subject with such notice within a registration screen, an online form, the Terms of Use, the Privacy Policy, a system notice, an email notice, an SMS notice, WhatsApp or any other appropriate means, according to the circumstances.

7.3 Where information is provided to the Company by a business owner with respect to an end customer, signatory, recipient, employee, representative, supplier or other third party, the business owner is responsible for providing that person with an appropriate notice regarding the provision of the information to the Company and its processing within the Services, and for obtaining any consent, authorization or other legal basis required under law.

7.4 Without derogating from the business owner’s obligations, the Company is entitled to provide supplementary privacy notices to end customers, signatories or recipients, including within a signature link, a digital form, a system notice, a landing page, a service notice or a document sent through the System.

7.5 The Company and the business owner, as applicable, will act so that the information provided to the data subject is clear, accessible and adapted to the circumstances of the information collection, all subject to law and the Company’s status with respect to the specific information.

The Company may use personal information for the following purposes:

1. Providing access to the website, the application and the System.

2. Opening a user account, account management and identity verification.

3. Managing engagements with business owners and end customers.

4. Creating documents, editing templates and sending documents for signature.

5. Performing digital or electronic signing and documenting the signing process.

6. Retaining proofs, records, signature data and system data.

7. Providing a basic initial contract service to business owners from defined target audiences.

8. Adapting a basic contract template to the type of service of the business owner, without providing individual legal advice.

9. Preventing disputes and clarifying claims with respect to a document, signature, order, cancellation, non-attendance, non-payment or an alleged breach.

10. Retaining documentation and records for the purpose of clarifying engagements, payments, services, enquiries and disputes.

11. Sending notices to recipients, signatories or end customers regarding documents, signatures, reminders, payments, clarifications or service notices.

12. Handling enquiries, clarifications, complaints, claims, payment demands, negotiations, the exercise of rights or defending against lawsuits.

13. Making payments, payment processing, billing, credit, invoice management and handling transaction disputes (chargebacks).

14. Providing customer service, technical support, handling faults and improving the service.

15. Information security, prevention of fraud, prevention of misuse, control, documentation and integrity checks.

16. Analysis of statistical data and improvement of the System, as far as possible in an aggregate or non-identifying manner.

17. Sending operational updates, system notices, alerts, documents, signature confirmations, payment confirmations and legal notices.

18. Sending offers, marketing updates or commercial information, subject to law and the required consents.

19. Compliance with the requirements of any law, judicial order, instruction of a competent authority or regulatory obligation.

The Company will process personal information only for permitted purposes and in accordance with law, including where processing is required for the provision of the Services, managing the engagement with users, retaining records and signature data, information security, prevention of fraud, clarification of disputes, handling payments, providing customer service, preserving rights, complying with legal obligations, conducting legal proceedings or defending against them, and where appropriate consent has been given to the extent required under law.

The System enables the creation, sending, signing, retention and documentation of digital documents. In this context, the Company may retain data evidencing the signing process, including the identity of the signatory, contact details, IP address, time of viewing, time of signing, document version, means of verification, delivery confirmations, actions performed in the System and additional technical data.

It is clarified that, unless expressly stated otherwise in writing, the Company does not present itself as a "certification authority" under the Electronic Signature Law, does not issue certified electronic certificates, and does not undertake that any signature performed in the System will constitute a "certified electronic signature" under law. Should the Company offer such services in the future, this will be done in accordance with law and the relevant regulation.

The user and the business owner are responsible for ensuring that the document they wish to create, send or sign through the System may indeed be signed by electronic or digital means under the law applicable to it, and that there is no special requirement for it regarding a particular type of signature, notarial certification, witnessing, an original document, signing before a competent authority or any other formal requirement. The Company is not responsible for the unsuitability of using the System for a document for which the law requires a special formal requirement, unless it has expressly undertaken to do so in writing.

The Company may use the signature data and documentation for the purpose of proving the fact of the signature, the time of the signature, the identity of the signatory, the document version, the parties’ consent, the clarification of disputes, the enforcement of rights or defending against claims.

The Company may use automated tools, including tools for information processing, classification, analysis, control, anomaly detection, generation of insights or artificial intelligence, for the purpose of operating the Services, improving them, information security, support, assisting in producing documents, adapting templates, analysing usage, identifying faults or preventing misuse.

To the extent the Company uses such tools to produce texts, recommendations, insights or other outputs, it is clarified that these outputs are provided as general and operational assistance only, and do not constitute legal advice, a legal opinion, an undertaking as to a result, or a substitute for independent and professional examination.

The user and the business owner are responsible for checking the accuracy, completeness, suitability and legality of the outputs before relying on them, using them or providing them to third parties. The Company will not be responsible for business, legal or other decisions made on the basis of an automated output, unless expressly determined otherwise in writing and subject to law.

Within the Services, the Company may enable business owners to retain documents, signature data, records, correspondence and documentation of actions, for the purpose of managing engagements, clarifying orders, cancellations, non-attendance, non-payment, alleged breaches, customer enquiries, payment demands or disputes.

The Company may review, retain, process and cross-reference information relating to a document, signature, end customer, business owner, transaction amount, circumstances of the dispute, records, correspondence, documentation of notices and any other information required for the purpose of providing the Services, handling enquiries, clarifying claims, preventing misuse, information security, preserving rights or complying with legal requirements.

The Company is entitled to use this information for the purpose of checking the validity of a signature or document; checking records; clarifying an enquiry or dispute; providing customer service; technical support; preventing fraud or misuse; preserving legal rights; conducting negotiations; taking proceedings permitted under law; or defending against claims.

It is clarified that the Company does not automatically determine the merits of the claims of a business owner or an end customer, and does not regard the mere provision of information to the System as conclusive proof of the correctness of a claim. The Company is entitled to demand additional records, to limit the handling of an enquiry, to refrain from action or to transfer the handling to the appropriate party, at its discretion and in accordance with law.

The Company does not sell personal information to third parties. However, the Company may disclose personal information or enable access to it to third parties, to the extent required for the purposes set out in this policy, including:

cloud and server hosting providers; development, maintenance and technical support providers; information security providers; communications, email, SMS, WhatsApp or system-message providers; signing, verification, identification or documentation providers; payment-processing and payment providers, including Isracard; accountants, legal advisers, lawyers, professional advisers and other professionals required for the purpose of providing the Services, handling enquiries, clarifying disputes, complying with legal requirements or preserving rights; competent authorities, courts, enforcement offices or other parties where required by law; parties to a transaction or document, where required for the purpose of providing the service; parties involved in clarifying an enquiry, engagement, payment, dispute, claim or legal proceeding, where required and in accordance with law; and any other party to whom the user has consented to the disclosure of the information.

The Company will act to disclose to third parties only the information reasonably required for the purpose for which it is provided, and will act to engage with material providers under appropriate arrangements for confidentiality, information security and limited use of the information.

The Company will act, with respect to material providers that process personal information on its behalf, to engage in appropriate contractual arrangements that include, as applicable, an undertaking to maintain confidentiality, to use the information only for the purposes of the service, to take appropriate information-security measures, to assist in handling security incidents, to limit access to the information and to return or delete information at the end of the engagement, subject to law and technical limitations.

The Company uses or may use the payment-processing services of Isracard, or other companies, for the purpose of collecting payments, subscription fees, commissions, one-time charges, recurring charges, payments for services, or any other payment related to the Company’s Services.

When making a payment, transaction details, payer details, the charge amount, the charge date, a transaction identifier, the means of payment, required verification details and technical data may be transferred to Isracard or processed through it for the purpose of carrying out the payment processing, verifying the transaction, preventing fraud, handling refunds, transaction disputes (chargebacks), clarifications, complying with legal requirements and managing accounting records.

The Company does not retain full credit card details in its systems, unless this is required and permitted by law and subject to appropriate security measures. To the extent it is possible to retain a means of payment for the purpose of future or recurring charges, this will be done through the payment-processing provider or an appropriate payment-services provider.

The use of Isracard’s services or those of another company may also be subject to the privacy policy, terms of service and security procedures of Isracard or of the other company.

16.1 The Company will retain personal information for as long as required for the purposes for which it was collected or processed, including for the purpose of providing the Services, account management, retaining documents, proving a signature, clarifying disputes, handling payments, complying with legal requirements, accounting management, preserving legal rights, preventing fraud and information security.

16.2 The Company will act not to retain personal information beyond what is reasonably required for the purposes of processing, subject to law, the relevant agreements, legal, accounting, regulatory, security and operational needs, and the need to preserve the rights of the Company, the users or third parties.

16.3 Without derogating from the foregoing, the Company may set different retention periods according to the types of information, including:

a. Account, subscription and permission details - for as long as the account is active, and for an additional period after the end of the engagement to the extent required for clarification, documentation, defending against claims, complying with legal requirements or preserving rights.

b. Signed documents, signature data, delivery confirmations, viewing confirmations, records and documentation of signing actions - for as long as required for the purpose of providing the Services, proving a signature, proving an engagement, clarifying a dispute, preserving rights, complying with legal requirements or conducting proceedings.

c. Payment data, invoices, receipts, charges, credits and transaction disputes - for the period required by law, according to accounting and tax needs, and for the purpose of clarifying payments, collection, refunds or preserving rights.

d. Log data, information-security data, documentation of logins, user actions, IP addresses, permissions, changes to documents, viewings, downloads, deletions and system actions in general - up to 7 years, or for a longer period where required for the purpose of clarifying an incident, dispute, legal proceeding, demand of a competent authority, information security, prevention of fraud or preservation of rights.

e. Service enquiries, complaints, clarifications, correspondence and support documentation - for as long as required for the purpose of handling the enquiry, improving the service, control, defending against claims, preserving rights or complying with legal requirements.

f. Statistical, aggregate or anonymous information - the Company is entitled to retain it without time limit, to the extent it does not identify a particular person and does not reasonably allow them to be identified.

16.4 The Company may delete, anonymize, restrict access to or cease processing of personal information when the information is no longer required for the purposes for which it was retained, all subject to law, technical limitations, backups, information-security needs and the preservation of rights.

16.5 It is clarified that the deletion of information from active systems does not necessarily result in immediate deletion from every backup, archive, log or disaster-recovery system, and the Company will act to limit access to such information and to delete or overwrite it in accordance with the relevant backup cycles and procedures, subject to law.

The Company may enable the retention, viewing, downloading, export and management of documents, signature data, correspondence, records and additional data through the System. However, retaining information in the System does not derogate from the responsibility of the business owner or the user to keep copies, backups, original documents or records as required by law, according to their business needs and at their discretion.

The Company recommends that users keep an independent and separate backup of material documents, signed documents, records, invoices, payment confirmations and any information they require for legal, accounting, business or regulatory purposes.

Should the engagement end, access to the account be blocked or information be deleted in accordance with this policy or the terms of service, it may not be possible to restore the information after the elapse of the period set for this purpose. It is the user’s responsibility to export or download the information it requires in good time, subject to the technical options provided in the System.

The Company attaches great importance to information security and takes reasonable and accepted measures to protect personal information against unauthorized access, unauthorized use, modification, loss, disclosure, copying or harm.

These measures may include, as applicable: encryption of communications, access permissions, user controls, identification and verification means, access documentation, backups, monitoring of actions, separation of permissions, security procedures, training, periodic checks, use of secure infrastructure providers and limiting access to information according to role-based need.

The Company will act, to the extent required by law, to classify the databases under its responsibility, to prepare a database definitions document, to determine the level of information security applicable to each database, to examine the need for its periodic update, and to perform the actions required under the Protection of Privacy Law, the Protection of Privacy Regulations (Information Security), and any other relevant provision of law.

However, no technological system is entirely immune from intrusion, fault, misuse or a security incident. Therefore the Company cannot guarantee absolute immunity, but will act in accordance with law in the event of a security incident requiring examination, handling or reporting.

The Company will act to keep confidential personal information, documents, signature data, correspondence, records and business data uploaded to the System or provided to it within the Services, and will not disclose them to third parties other than in accordance with this Privacy Policy, the terms of service, the user’s consent, for the purpose of providing the Services, for the purpose of complying with legal requirements, for the purpose of information security, for the purpose of clarifying disputes or in order to preserve the rights of the Company, the users or third parties.

This undertaking does not apply to information that was lawfully known to the Company before it was provided, information that became public not as a result of a breach of an undertaking by the Company, information that the Company is required to disclose under law, a judicial order or the demand of a competent authority, or information provided to providers, advisers or professionals subject to appropriate confidentiality or information-security obligations.

Business owners are responsible for ensuring that only persons authorized on their behalf receive access to the business account and the information contained in it. A business owner is required to take care to use strong passwords, keep access details confidential, revoke permissions for employees or representatives who have ended their role, and manage permissions according to genuine need.

The Company is entitled to document users’ actions in the System, including logins, viewings, changes to documents, sending of documents, signatures, deletions, downloads, payment actions, clarification actions, support actions and actions relating to the management of documents or disputes, and this for the purposes of security, control, support, clarification of disputes and proof of actions.

To the extent the Company enables the use of API interfaces, connection to external systems, integrations, webhooks or the transfer of information between the System and third-party services, their use will be subject to express authorization, the terms of service, this policy and the provisions of law.

The user is responsible for ensuring that any external system to which information is transferred meets the legal, information-security and privacy requirements applicable to it, and that there is appropriate authorization to transfer the information to it.

The Company is entitled to restrict, suspend or revoke access to API interfaces or integrations where there is concern of improper use, abnormal load, harm to information security, unauthorized transfer of information, breach of law or breach of the terms of service.

22.1 Personal information may be stored, processed, backed up or accessible through servers, cloud systems, infrastructure providers, support providers, information-security providers, communications providers, payment-processing providers or technological services located outside Israel.

22.2 The transfer of personal information outside Israel, to the extent carried out, will be done in accordance with the provisions of law applicable to the transfer of information outside the borders of the State, including the Protection of Privacy Regulations (Transfer of Information to Databases Abroad), 5761-2001, and any other relevant regulatory provision.

22.3 The Company will act, to the extent required by law, so that the transfer of information outside Israel is made to a country or party that maintains an appropriate level of protection of the information, or under another appropriate legal mechanism permitted by law, including appropriate contractual undertakings, information-security measures, use restrictions, a duty of confidentiality and an undertaking not to transfer the information to additional parties other than in accordance with law and the relevant agreements.

22.4 The Company will act to take reasonable measures to ensure that material providers that process personal information outside Israel undertake to use the information only for the purposes for which it was provided, to maintain its confidentiality, to take appropriate information-security measures, to assist in handling security incidents, and to return or delete information at the end of the engagement, to the extent required and possible under law and according to technical limitations.

22.5 The user confirms that the use of cloud-based services, signing services, payment-processing services, communications services, support services, information-security services or third-party providers may involve the processing of information outside Israel, all in accordance with this policy, the terms of service and the provisions of law.

The Company may send users operational and service notices, including notices regarding the opening of an account, signature confirmations, documents for signature, reminders, system updates, payment notices, security notices, demands to complete details or records, clarification notices or legal notices.

Operational, legal, security notices, signature notices, payment notices, notices regarding a document for signature, notices regarding the clarification of an engagement or notices required for the purpose of providing the service - are not necessarily marketing notices, and the Company is entitled to send them to the extent they are required for the provision of the service or for the exercise of its rights.

In addition, the Company may send marketing notices, offers, updates and commercial information, subject to obtaining consent to the extent required by law. A user is entitled to request to remove itself from a marketing mailing list in accordance with the removal instructions appearing in the notice or by contacting the Company.

It is clarified that even after removal from marketing mailings, the Company may continue to send operational, legal, security or service notices that are not marketing notices.

24.1 The website, the System and the application (to the extent it exists) may use cookies, digital identifiers, pixels, measurement tools, analytics tools, advertising tools and similar technologies, for the purpose of the proper operation of the Services, information security, identifying users, saving preferences, analysing usage, improving the service, measuring performance, preventing fraud, adapting content and marketing.

24.2 The types of cookies and similar technologies that may appear on the website or in the System include, among others:

a. Essential cookies - cookies required for operating the website and the System, logging in, security, saving consent preferences, preventing fraud and basic use of the Services. These cookies may always be active, since without them it may not be possible to provide the Services properly.

b. Functional cookies - cookies used to save user preferences, improve the user experience, adapt the interface, save language, save settings or provide additional convenience functions.

c. Analytics cookies - cookies or measurement tools used to understand how the website or the System is used, including the number of visitors, pages viewed, duration of use, source of arrival, actions in the System, faults and improvement of the service.

d. Performance cookies - cookies used to examine the performance of the website or the System, loading times, the proper functioning of functions, loads, errors and improving the stability of the service.

e. Marketing or advertising cookies - cookies used to display advertisements, measure campaigns, adapt marketing messages or analyse advertising effectiveness, to the extent the Company uses them and in accordance with law.

f. Third-party cookies - cookies or similar technologies operated by external providers, such as analytics, advertising, information-security, communications, support or other integrated-service providers.

24.3 The Company may use essential cookies required for operating the service, securing it, logging users in and maintaining the proper functioning of the System. Use of non-essential cookies, including analytics, performance, marketing or advertising cookies, will be done in accordance with law, and where necessary subject to the display of an appropriate notice or the obtaining of consent.

24.4 To the extent a cookie preference management mechanism is operated on the website or in the System, the user will be able to choose which types of non-essential cookies are approved, change its choice or withdraw consent, subject to technical limitations and law.

24.5 The user can change the settings of its browser or device so as to block or delete cookies. Blocking or deleting certain cookies may impair some of the Services, prevent logging in, impair the security of the service, or prevent proper use of the System.

24.6 To the extent the Company uses third-party advertising, measurement or analytics tools, those parties may process information in accordance with their own privacy policy. The Company recommends that the user review the privacy policy of those third parties, to the extent relevant.

25.1 In accordance with law, a person whose personal information is held in a database may be entitled to review the information, to request its correction or deletion if it is found to be incorrect, incomplete, unclear or not up to date, and to exercise additional rights to the extent available to them under law.

25.2 Requests regarding review, correction, deletion or other clarification with respect to the information may be sent to: management@israelisign.com

25.3 In order to handle a request, the Company is entitled to request reasonable identification details, contact details, records or additional information required in order to verify that the requester is the person to whom the information relates or a person authorized to act on their behalf.

25.4 The Company will examine each request in accordance with law, its status with respect to the specific information, the identity of the controller of the information, the purposes of processing, its legal obligations, information-security needs and the rights of third parties.

25.5 The Company is entitled to reject a request, in whole or in part, where there is legal justification for doing so, including where the retention of the information is required for the purpose of fulfilling a legal obligation, conducting legal proceedings, proving a signature, clarifying a dispute, handling payments, preventing fraud, information security, preserving the rights of the Company or third parties, or where the request cannot reasonably be performed from a technical or legal standpoint.

25.6 Where the matter concerns information of an end customer, signatory or recipient that was entered, uploaded or sent to the System by a business owner, the Company may refer the requester to the relevant business owner, to the extent the business owner is the controller of the information. However, the Company will examine each request in accordance with law and its status with respect to the specific information.

25.7 To the extent the provisions of foreign law apply to a particular processing, including data protection laws applicable to residents of other countries, the data subject may have additional rights, and the Company will examine such requests in accordance with the applicable law, to the extent it applies.

A business owner that uses the System and uploads to it information about end customers, employees, representatives, recipients or other third parties declares that it provides the information lawfully, that it has appropriate authorization or a legal basis for providing the information, and that it has provided those persons with an appropriate notice regarding the provision of the information to the Company and its processing within the Services.

A business owner undertakes not to upload to the System information that is not required for the purposes of the Services, and not to upload information of a particularly sensitive nature or excess information unless this is reasonably and legitimately required for the purpose of the engagement, the signing, the management of the document, the clarification of an enquiry, the handling of a payment or the preservation of rights.

27.1 The business owner is solely responsible for the content of the documents it creates, edits, approves, uploads, sends or manages through the System, for the correctness of its customers’ details, for obtaining the required consents from them, for providing appropriate notices to data subjects, for ensuring the document’s suitability for its needs, and for ensuring that the use of the System is made in accordance with all law.

27.2 Without derogating from the foregoing, the business owner is responsible for ensuring that it has appropriate authorization or a legal basis for sending documents, signature requests, notices, reminders, payment notices, clarification notices or any other communication to end customers, signatories, recipients or third parties.

27.3 The Company is not responsible for the content of a document created, edited, approved, uploaded or sent by the business owner, including where a general template, an auxiliary tool, an initial text, an operational service or a technological system provided by the Company is used, unless determined otherwise in an express agreement and subject to all law.

27.4 The business owner is responsible for checking the suitability of the document, its text, legality, completeness, accuracy and suitability for its needs, its business, its customers and applicable law, before sending it, having it signed or relying on it.

27.5 The Company is entitled, but not obligated, to check documents, templates, records, signature data or enquiries for the purpose of providing the Services, preventing misuse, clarifying enquiries, information security, complying with law or preserving rights. The mere performance of such a check, to the extent carried out, will not impose on the Company responsibility for the content of the document or its legal validity, unless determined otherwise expressly and in writing.

An end customer that received a notice, document, signature request, payment notice, reminder, clarification notice or other communication through the System is entitled to contact the Company or the business owner, as applicable, for the purpose of clarifying the source of the communication, the identity of the business owner, the details of the document or the engagement, and its rights with respect to the information.

The Company is entitled to refer the requester to the business owner where the business owner is the controller of the information, but will examine each enquiry in accordance with its status with respect to the information and in accordance with law.

The Company and the business owners using the System are required to act in accordance with the principle of data minimization, so that only information reasonably required for the purposes of the Services, the signing, the management of the document, the payment, the clarification of enquiries, the clarification of disputes or the preservation of rights is collected, uploaded and retained.

Users are requested not to upload to the System excess information, irrelevant information or information of a particularly sensitive nature that is not clearly and legitimately required for the use of the Services.

The user undertakes not to use the System for the purpose of providing false information, misleading, impersonation, applying unfair pressure, improper collection, sending unlawful messages, infringing privacy, uploading information obtained unlawfully, or uploading documents, signatures, records or engagement details that are not correct, complete or authorized.

In addition, the user undertakes not to perform or attempt to perform any action that may harm the integrity, availability, security or functioning of the System, including attempts at intrusion, circumvention, scanning, data mining, the use of bots, crawlers or scrapers, creating an unreasonable load, sending spam, uploading malicious code, viruses, trojan horses, performing reverse engineering, circumventing security mechanisms or using the interfaces not in accordance with the authorization granted.

The Company is entitled to restrict, suspend or block use of the System, to delete or restrict access to information, to revoke permissions, to demand the removal of content or to take additional steps, where there is reasonable concern of misuse, harm to the rights of a third party, breach of law, harm to information security, breach of the terms of service or harm to the proper operation of the System.

The Services are not intended for independent use by minors under the age of 18. Where a document or service concerns a minor, the business owner is responsible for ensuring that the consent of a parent or guardian has been given to the extent required by law, and that the information provided to the Company in connection with the minor is the minimal information required for the purpose of the engagement or the service.

If it comes to the Company’s attention that information about a minor was collected unlawfully or without appropriate authorization, the Company may be contacted and it will examine the request according to the circumstances and law. The Company is entitled to demand records or to delete information provided unlawfully or that is not reasonably required.

The website, the applications or the System may include links to websites, systems, services or content of third parties. The Company is not responsible for the privacy policy, terms of use, security or content of those third parties. Use of third-party services is subject to the policy and terms of that third party.

In the event of a merger, acquisition, restructuring, sale of activity, transfer of assets, investment, establishment of a partnership, assignment of rights or transfer of the Company’s activity to a third party, the Company may transfer personal information to the parties relevant to the transaction, provided that the receiving party assumes appropriate undertakings to safeguard the information or acts in accordance with law.

The Company is entitled to retain and process personal information where this is required for the purpose of preserving its rights or the rights of third parties, including for the purpose of clarifying claims, handling complaints, preventing misuse, preventing fraud, examining breaches, enforcing agreements, handling payments, clarifying disputes, filing a lawsuit, conducting legal proceedings, defending against proceedings, or complying with the demand of a competent authority.

The Company is entitled to update this Privacy Policy from time to time, including due to a change in the Services, a technological change, a business change, a regulatory change or a change in law.

The binding version is the current version published on the website or in the application. In the event of a material change, the Company will make reasonable efforts to notify users by appropriate means, such as a notice on the website, in the application, by email or by another means.

For questions, requests or enquiries regarding privacy, the Company may be contacted at the following details:

Taltul Technologies Ltd.

operating the service under the trade name: Israeli Signature (Hatima Israelit)

Brand / system name in English: israelisign

Service website / domain: israelisign.com

Email for privacy enquiries: management@israelisign.com

The Company will examine privacy enquiries in accordance with law, this policy, its status with respect to the specific information and the circumstances of the matter.