How ChickenSign handles personal data

chickensign.com is owned and operated by FCOMS UK CIC, a Community Interest Company registered in England and Wales (“FCOMS UK CIC”, “we”, “us”). FCOMS UK CIC is the data processor for ChickenSign.

• Company number: 15086338
• Registered office: Office 2, 2nd Floor, 309 High Street, West Bromwich, B70 8LX
• ICO registration number: ZB604152
• Phone: 0300 561 0600

For privacy questions, message @justarieldotcom at x.com/justarieldotcom, or phone 0300 561 0600.

Account data. FCOMS UK CIC decides how sender accounts, billing, security logs, website visits, and support messages are used. That is the data needed to run ChickenSign itself.

Documents and signer details. FCOMS UK CIC is the data processor for the person who sends a document (the “sender”). The sender decides what goes into the document and who signs it, and decides how that data is used. ChickenSign does not produce those documents and does not use them for its own purposes. Uploaded documents are stored and processed only to deliver the signing service on the sender’s instructions, including the signing room and the evidence record. If you signed a document and want a copy of it, or want your data corrected or deleted, contact the sender first. FCOMS UK CIC will help them respond.

Senders (account holders)

• Name, email address, and account login details. Two-factor authentication data, if you turn it on.
• Billing details for the Unlimited plan. Card payments are handled by our payment processor. We do not store full card numbers.
• The documents you upload, the field positions you place, and signer names and email addresses you enter.
• API keys. We store only a SHA-256 hash of each key, and webhook endpoint URLs.
• Messages you send us about the service.

Signers (people who receive a signing link)

• Name and email address, as provided by the sender.
• The signature, initials, dates, and ticks you add.
• Audit data: when the link was opened, the consent wording you accepted, and the London time of each step. The signing certificate records those events. It does not record your IP address or a browser user-agent string.
• SHA-256 fingerprints of the document when it is sent, and again once everyone has signed.

Website visitors

• Standard server and security logs (which can include IP address, user agent, and pages requested), processed by the providers that host the site.
• We do not use a separate analytics tool.

We ask senders not to put special-category data (health, race, religion, biometrics, and similar) into documents unless they already have a lawful reason to.

ChickenSign does not sell document data and does not send marketing email.

We use service providers (sub-processors). Each processes data only on our instructions. The providers named below are the ones that can be identified from how chickensign.com is reached and how its mail is sent. Account data and uploaded documents are stored by the providers that host the application and its database. Card payments are taken by our payment processor. We do not publish those providers’ names on the site.

We also share data when the law requires it, or to protect our rights or users’ safety.

Signers’ completed documents and proof of signing are emailed to the sender, every signer, and any “copies” addresses the sender adds.

Some providers may process data outside the UK (for example in the US). Where they do, we rely on UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or the UK-US Data Bridge, as applicable to that provider.

• Documents and audit records: six years by default, which is the usual limitation period for a simple contract in England and Wales. Senders can choose twelve years. Senders can delete a document earlier; after that its certificate code stops verifying. Keep your own copy of signed documents.
• Sender accounts: while the account is open. Closing the account removes the account profile. Documents you have not deleted stay until you delete them or the retention period you chose ends.
• Billing records: for as long as UK tax and accounting law requires us to keep them.
• Security logs: only for as long as we need them to run and protect the service, then they are deleted or overwritten.

Document text is locked when sent. SHA-256 fingerprints make later changes detectable. Signing links are private. API keys are stored as hashes. Senders can turn on two-factor authentication. Traffic to chickensign.com is encrypted in transit (HTTPS).

You can ask to access, correct, delete, restrict, or port your data, and you can object to processing based on legitimate interests. Contact @justarieldotcom at x.com/justarieldotcom. We will reply within one month. If FCOMS UK CIC holds your data only as processor for a sender, we will pass your request to them and help them respond.

You can complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint or 0303 123 1113. We would appreciate the chance to sort it out first.

The desk uses a strictly necessary session cookie so you stay signed in. We do not set advertising or analytics cookies. Signing links do not require a cookie.

We’ll update this notice when our practices change, and change the “last updated” date. Significant changes will be emailed to account holders.