General Terms and Conditions

The Services are provided in the form of a subscription (hereafter referred to as the "Subscription"), based on one of the following options:

• The Application Package
  The Client takes out a Subscription to the application accessible on the Website (hereafter referred to as the "Application"), for each of the Users he has previously selected for this purpose.
• The API Package
  Yousign may provide the Client with an API (hereafter referred to as the "API") which the Client must incorporate within its IT system. To this end, Yousign will provide the Client with an access link to the API by any appropriate written means, including e-mail.
  
  Documentation to integrate the API may be accessed on the Website. Yousign may also provide the Client with technical support in accordance with the conditions mentioned in the article entitled "Technical support".

When taking out a Subscription, the Client opens a Customer Account on the Website either by:

• completing the form provided for this purpose on the Website. To do so, the Client must supply the mandatory information as indicated. Any incomplete registration will result in the request to open the Customer Account being declined.
• submitting a request to open a Customer Account to Yousign in writing, who will in return send a link allowing the Client to activate its Customer Account and choose a password, by any appropriate means including by e-mail.

The opening of the Customer Account will result in the allocation of a Customer Space enabling it to manage its use of the Services, in such form and using such technical resources that Yousign considers most appropriate.

It shall then be the Client’s responsibility to select one or several administrators from among the Users, who will be responsible for managing the Users’ access to the Services, opening User Accounts for them and allocating personal login details and asking them to choose their passwords.

The Client agrees to ensure that the Users do not allow any third party to use the User Accounts in their place or on their behalf, failing which it will assume full liability for such use. It expressly acknowledges that any use of the Services with these login details will be considered to have been performed by the respective Users themselves.

The Client expressly acknowledges and accepts that the Users are solely liable for protecting the confidentiality of their login details and passwords. It agrees to immediately contact Yousign by any appropriate means including e-mail if it appears that a User Account has been used without its User's knowledge.

The Client may also directly contact Yousign at the contact address shown on the Website to subscribe to the Services. To do so, it should supply Yousign with the appropriate information and documents to enable it to identify its requirements and expectations.

Based on this information and these documents, Yousign will issue a Quotation stating the characteristics of these specific Services, their prices and payment terms. Unless stated otherwise, this Quotation is valid from one month as from its issue date. Unless approved by the Client within this deadline, it will lapse.

The Client must approve the Quotation within the above-mentioned deadline by any appropriate means including e-mail. Once the Client has approved the Quotation, it shall open a Customer Account on the Website if it has not already done so, in accordance with the abovementioned conditions.

When taking out the Subscription on the Website, the Client accepts these general conditions by checking a box in the registration form.

If the Client has ordered specific Services, any approval of a Quotation, whether express or implicit, constitutes full and unreserved acceptance of these general conditions, with the applicable version being that in force on the date of the Quotation concerned.

This acceptance can only be full and unreserved. Any acceptance subject to reservations will be considered as null and void. Any Client who does not agree to be bound by these general conditions may not order Services from Yousign.

The Client has the possibility at any time to change its Subscription, to combine both packages mentioned in the "Subscription via the Website" article or to modify the specific Services ordered from Yousign.

Any requests from the Client to modify the Subscription packages and/or the specific Services mentioned in the Quotation may be submitted by one of the following means:

• These requests may be negotiated directly between the Client and Yousign. If the Parties reach an agreement, the modifications will be the subject of an additional Quotation or a new Quotation, the terms of which will take precedence over the former version. Unless stated otherwise on the new Quotation, the commitment periods will be identical to those of the first Quotation.
• The Client may also enter the details of its request via the Website. When these requests have been processed, information concerning these modifications will be accessible to the Client via his Customer Space.

Yousign supplies the electronic signature Service in accordance with the following conditions, depending on the Subscription package taken out by the Client and the desired signature level.

Characteristics of the signatures

The electronic signature Service enables a User to sign Client Documents and/or to have them signed by one or several Third-Party Signatories.

Depending on which package the Client has subscribed to, this Service is supplied subject to the terms shown below:

• If the Client has subscribed to the Application Package, each User has the possibility to personally sign Client Documents and/or to have them signed by Third Party Signatories.
• If the Client has subscribed to the API Package, the Client may choose one of the following options:
  • either purchasing a pack with a set number of electronic signatures to be used over a given period; or
  • the right to use a maximum number of electronic signatures over a given period, with supplementary charges for any additional electronic signature.

The signature process

Yousign proposes two levels of electronic signatures: either a simple electronic signature or an advanced electronic signature within the meaning of the eIDAS Regulation, this being a signature allowing an unequivocal identification of its author, to be used under its exclusive control, and detecting any subsequent modification to the signed document.

The process of using the electronic signatures, whether simple or advanced, is described in the Certification Policies.

In accordance with the conditions described in the article "Requesting a Quotation for Specific services" the Client may request to handle one or several stages in this process itself. In this case, the Client expressly acknowledges and accepts that it will be the sole responsible for handling these stages.

If a Client Document needs to be signed by one or several Third-Party Signatories, it is the Client’s responsibility to supply Yousign with the contact details, including the last name, first name, e-mail address and telephone number of the said Third-Party Signatories, by any means appropriate.

Upon receipt of this information, Yousign will send each of the Third-Party Signatories a link by any appropriate means, allowing them to sign the Client Documents based on the process described in the Certification Policies.

Evidence File

Upon each signature of a Client Document, a Evidence File is created containing all the data and information concerning the electronic signature process used, and all items and information making it possible to identify the Users and Third-Party Signatories having signed the Client Documents, their "hash" and, where applicable, the certificate associated with the advanced electronic signature and the general terms of use of the electronic signatures.

In the event that the electronic signature process for a Client Document is the subject of dispute or litigation, the Client shall be able to use the Certification Policies and the Evidence File made available to it in the Customer Space.

The Evidence File is stored by the Third-Party Archiver for a period of ten (10) years as from the date it is established, with its storage period unaffected in any way by the expiry or termination of its agreement, regardless of the grounds thereof.

Yousign can provide the Client with an archiving area reserved for the Client Documents which the Client wishes to archive, for storage purposes for a period of ten (10) years (hereafter referred to as the "Archiving Period"), under conditions guaranteeing their durability and integrity.

The Client hereby declares that having been informed of and accepting that Yousign has assigned the electronic archiving Service to the Third-Party Archiver. Yousign guarantees to the Client that the Third-Party Archiver is certified to supply a Service compliant with the applicable standards in the field of electronic archiving, including the NF Z42-013 and NF Z42-026 standards or any other standards which would replace them.

At the end of the Archiving Period, the Parties may discuss in good faith the renewal of the Archiving Service, for a new period of ten (10) years. If the Client does not wish to renew the Archiving Service, Yousign will destroy and/or return the archived Client Documents to him at his request.

The Client shall be able to access the archived Client Documents during the Subscription period via the Customer Space.

In the event that its Subscription is terminated before the end of the Archiving Period, Yousign agrees to inform the Third-Party Archiver of this in writing, providing it with all appropriate information concerning the Client and the Users in order that the Client Documents may be archived until the end of the Archiving Period.

Yousign can provide the Client with a pack containing a set number of electronic timestamps, enabling the Client to provide a definite date and time for the documents, data and files of his choice (hereafter referred to as the "Timestamped Data").

The timestamps provided to the Client are qualified timestamps within the meaning of the eIDAS Regulation, i.e., electronic timestamps which:

• Link the date and time to the Timestamped Data in a manner which reasonably excludes the possibility of them being modified without detection;
• Are based on an accurate time clock linked to Coordinated Universal Time;
• Are signed or stamped by means of an electronic signature or an advanced electronic seal or an equivalent method.

Each timestamp from the pack takes the form of a file including an alphanumeric footprint (or "hash") specific to each item of Timestamped Data, with the associated date and time of the timestamp (hereafter referred to as the "Timestamped Data").

Yousign can provide the Client with a pack of server seal signatures.

Yousign can supply two categories of server seal signatures: either intended only to guarantee the integrity of the Client Documents on which the server seal and signature are applied, or to also make it possible to prove that these Client Documents were issued by the Client in its capacity as a legal person.

In this second case, the creation of the server seal involves the collection of information concerning the legal person for which it is issued. The collection process is described in the certification policies.

For the performance of the server seal signature Service, the Client sends Yousign the Client Documents concerned, by any appropriate means, along with the details of the desired server seal signature category. Yousign performs the server seal signature on the Client Documents and makes these available to the Client via its Customer Space.

Yousign also establishes and stores an Evidence File under the same conditions as those described in the article "Electronic Signature Service".

The process of collecting information concerning the bearer of the electronic seal and the creation of the Evidence File is described in the Certification Policies.

At the Client's request, except under force majeure circumstances, Yousign can guarantee continuous access to the Services 24 hours a day, 7 days a week, in addition to the availability levels and the management and incident resolution levels specified in the service level agreement accessible on the Website (hereafter referred to as the "Service Availability").

Any Client having subscribed to the Service Availability option expressly acknowledges and accepts that in view of the complexity of the Internet, the unequal capacity of various sub-networks, peak User traffic at certain times and various bottlenecks over which Yousign has no influence, Yousign's liability is limited to the operation of its servers, whose external limits are constituted by their connection points.

Yousign may not be considered liable (i) for the speed of its servers, (ii) for the slowing of its servers due to external causes, and (iii) for poor transmission due to the failure of or problems with these networks.

The Client acknowledges and accepts that the Service Availability option does not cover all breakdowns or interruptions caused by telecommunications operators or Internet service providers.

Yousign provides technical support involving assistance and advice for all questions concerning the integration of the API and the use of the Services.

According to the option chosen by the Client, technical support is accessible by e-mail and/or by telephone, using the contact details mentioned on the Website, from Monday to Friday, excluding days not worked or public holidays, from 9 AM to 6 PM.

According to the needs identified, Yousign will estimate its response time and nature, and will inform the Client thereof.

Yousign agrees to host the Client Documents and Evidence Files based on a best effort obligation, pursuant to the customs and best practices of the profession, on servers located in the European Union, and by a professional hosting service provider itself exercising its activities pursuant to the customs and best practices of the profession.

Yousign agrees to provide the Client with sufficient storage and processing capacity for the operation of the Services, pursuant to the customs and best practices of the profession.

Yousign agrees to deploy all technical means and resources pursuant to accepted practices, required to guarantee the security of and access to the Services, to the Client Documents and to the Evidence Files, regarding the protection and monitoring of the infrastructure, the management of physical and/or electronic access to this infrastructure and the deployment of detection, prevention and data recovery measures to protect the servers from malicious acts.

Yousign agrees to take all appropriate precautions regarding the nature of the data and the risks arising from the automatic processing of data performed for the purpose of the Services, to guarantee the security of the Client Documents and the Evidence Files, and in particular to ensure that these are not deformed or damaged, or accessed by any unauthorised third party.

At the Client's request, Yousign can supply training services and support with the deployment of the abovementioned Services. As part of this support, Yousign can also customise the Customer Space by adding the Client's logo.

For the performance of the services, Yousign can either allocate the number of man-days required according to the requirements expressed by the client, or provide for a maximum number of man-days, which the Client will then consume according to the services it wishes to benefit from.

The terms for the performance of the services, including the choice of allocation method for the man-days, are stipulated in the Quotation.

Yousign reserves the possibility to propose any other Service of its choosing, in the form and with the features and technical resources it considers most appropriate to provide the said Services.

The prices of the Services are shown on the Website or, where applicable, in the Quotation. Unless stated otherwise, they are shown in euros, excluding VAT.

Yousign reserves the right to propose promotional offers or price reductions at its sole discretion and in accordance with terms which it alone will determine.

Any Subscription period started is payable in full.

Beyond its initial period, the price of a Subscription may be revised by Yousign at any time, at its sole discretion. The Client will be informed of these modifications and of the date on which the new price will be applied by Yousign by any appropriate written method (including by email) a minimum of one (1) month before the start date of the notice period mentioned in the article "Term".

Once it has taken effect, the new price will apply when the Subscription is renewed. If the Client does not accept the new price, it must terminate its Subscription in accordance with the conditions mentioned in the article "Term". Failing this, it will be considered as having accepted the new price.

Unless specifically agreed otherwise by the Client and Yousign:

• The prices of the Application Package or the API Package are payable on their subscription date, then at each renewal date.
• The purchase prices of the packs of electronic signatures, electronic time dates and electronic seals, in addition to the archiving area, are payable at the time of order.

The payment details for the prices of specific Services are shown in the Quotation.

These amounts will be billed by means of invoices, issued to the Client by any appropriate means. Unless agreed otherwise between the Client and Yousign, these invoices should be settled at thirty (30) days EOM.

The Client is hereby informed and expressly accepts that any late or overdue payment or any part of a sum remaining unpaid at its payment due date will automatically result in Yousign invoicing for late payment interest, with no notice required, at a rate of three (3) times the official interest rate, based on all sums payable by the client in addition to fixed compensation of forty (40) euros towards recovery costs.

Furthermore, following a failure to pay a sum at its payment due date, and with this sum not being settled within fifteen (15) calendar days following the receipt by the Client of formal notice to comply sent by registered letter with proof of receipt, this remaining unheeded, Yousign reserves the right to suspend the Services and to demand payment in full of all sums owed by the Client without prejudice to the provisions of the article entitled "Penalties for non-compliance".

Yousign and the Client both agree to observe the regulations applicable to the processing of personal data, including the French data protection act of 6 January 1978 (hereafter referred to as the "Loi Informatique et Libertés") and the GDPR.

Yousign implements a personal data protection policy, the characteristics of which are explained in the document entitled "Privacy Policy", which the Client is hereby urged to inspect.

Yousign is authorised to process the personal data necessary to providing the Services on the Client's behalf.

The nature of the operations performed regarding the personal data is the collection, processing and hosting of the personal data of the signatories of the Client's documents in the context of the provision of the Services.

The end purpose(s) of the processing is the performance of the Services.

The personal data processed is data identifying the signatories of the Client's documents.

The categories of data subjects are clients and business partners of the Client.

For the performance of the Services, the Client shall provide Yousign with information concerning the persons (staff and Third-Party Signatories) signing his documents.

The Client is the data controller for the abovementioned personal data. The personal data supplied by the Client to Yousign for the purpose of performing the Services remains the sole property of and under the sole responsibility of the Client.

Yousign is involved exclusively in the capacity of subcontractor regarding personal data.

Yousign agrees to:

• Only process the personal data necessary for the performance of the Services;
• Process the personal data pursuant to the Client's instructions as documented. If Yousign considers that an instruction violates the GDPR or any other legal provision under European Union law or the laws of the member states concerning data protection, it will immediately inform the Client thereof. Furthermore, if Yousign is required to transfer data to a third-party country or an international organisation under the terms of European Union law or the laws of a member state with which it needs to comply, it must inform the Client of this legal obligation before processing takes place, unless the concerned applicable law prohibits the provision of such information for reasons of public interest;
• Guarantee the confidentiality of the personal data processed in the context of the provision of the Services;

• Ensure that the members of its workforce authorised to process the personal data:
  • Agree to respect its confidential nature or are subject to an appropriate legal confidentiality obligation;
  • Receive the necessary training in the field of the protection of personal data.

• Take account of the protection of personal data by default and from the design stage onwards regarding all tools, products, applications or services.
• Subcontracting: Yousign may use the services of another subcontractor (hereafter referred to as the "sub-processor") to perform specific processing activities. In this case, it will inform the Client beforehand in writing of any planned adding or replacing of other subcontractors. This information must clearly state the processing subcontracted activities, the identity and contact details of the subcontractor and the dates of the subcontracting agreement. The Client has a minimum period of 30 days as from the date on which this information is received to submit any objections. This subcontracting may only proceed if the data controller has not issued an objection by the agreed deadline.
• The sub-processor is required to comply with Yousign's obligations on behalf of the Client and in accordance with the Client’s instructions. It is Yousign's responsibility to ensure that the sub-processor provides the same sufficient guarantees concerning the implementation of appropriate technical and organisational methods to ensure that the processing meets the requirements of the European data protection regulations. If the sub-processor does not fulfil its obligations concerning data protection, Yousign will be considered fully liable towards the Client for the performance of the other subcontractor’s of its obligations.
• The data subjects' right to information: It is the responsibility of the Client to supply information to the data subjects concerned by the processing operations at the time the data is collected.
• The data subjects’ entitlement to exercise their rights: To the extent possible, Yousign must help the Client to fulfil its obligation to respond to requests from data subjects wishing to exercise their rights including: the right of access, right of rectification, rights of deletion and opposition, right to the limitation of processing, the right to data portability and the right not to be the subject of an automated individual decision (including profiling).
  
  When the data subjects submit requests to Yousign to exercise their rights, Yousign must immediately forward these requests by email to the email address supplied for this purpose by the Client to Yousign.
• Notification of personal data breaches: Yousign will notify the Client of all personal data breaches within a maximum period of forty-eight (48) hours after becoming aware of this, by email, sent to the abovementioned address. This notice will be accompanied by any documentation necessary to enable the Client to notify the relevant supervisory authority of this breach if necessary.
• Assistance from Yousign to help the Client fulfil its obligations: If necessary, Yousign will assist the Client with regard to requirements from the supervisory authorities, including the Commission Nationale Informatique et Libertés (CNIL - French data protection authority), regarding the performance of impact studies concerning data protection and the prior consulting of the supervisory authority as indicated in the GDPR.

• Security measures: Yousign agrees to implement the following security measures:
  • The pseudonymisation and encryption of personal data;
  • Means and resources making it possible to guarantee the consistent privacy, integrity, availability and resilience of the processing systems and services;
  • Means and resources making it possible to re-establish the availability of the personal data and access to the latter within appropriate timescales in the case of physical or technical incidents;
  • A procedure aimed at testing, analysing and evaluating the effectiveness of the technical and organisational methods for guaranteeing the security of the processing operations.

• Data Lifecycle: At the end of the Services, at the Client's choice, Yousign agrees to destroy or return to the Client all personal data processed on its behalf for the performance of the Services.
  
  If this option is chosen, the return of data must be followed by the destruction of all existing copies in Yousign’s IT systems. Once destroyed, Yousign must provide written proof of such destruction in writing.
• Data protection officer: Yousign will provide the Client with the name and contact details of its data protection officer, if it has appointed one, pursuant to article 37 of the GDPR.

• Register of categories of processing activities: Yousign hereby declares that it maintains a written register of all categories of processing activities performed on the Client’s behalf, containing:
  • The name and contact details of the Client on behalf of whom it operates, of any possible subcontractors, and, where applicable, of the data protection officer;
  • The categories of processing performed on behalf of the Client;
  • Where applicable, transfers of personal data to a third-party country or to an international organisation, including the identification of this third-party country or international organisation and, in the case of the transfers mentioned in article 49, paragraph 1, second subparagraph of the GDPR, documents confirming the existence of the appropriate guarantees;
  • Insofar as possible, a general description of the technical and organisational security measures, including (as required):
    • The pseudonymisation and encryption of personal data;
    • Means and resources making it possible to guarantee the consistent privacy, integrity, availability and resilience of the processing systems and services;
    • Means and resources making it possible to re-establish the availability of the personal data and access to the latter within appropriate delays in the case of physical or technical incidents;
    • A procedure aimed at testing, analysing and evaluating the effectiveness of the technical and organisational methods for guaranteeing the security of the processing.

• Documentation: Yousign will provide the Client with the necessary documentation to demonstrate compliance with all of its obligations and to allow for the performance of audits, including inspections, by the Client or any other auditor appointed by it, and to contribute to these audits.
  
  During such audits, the Client or the auditor appointed by him will not be authorised to access Yousign's business secrets, its strategic information or any information that Yousign is committed to keeping strictly confidential. Yousign may oppose any inspection or verification measure by the Client or the auditor appointed by it that is likely to give them access to such data or information, with no possibility for the Client to submit any complaints or claims on these grounds. In any event, the Client will ensure that the auditor and more generally the staff performing the said audit are subject to appropriate confidentiality obligations.

The Client is required to fulfil the obligations incumbent upon it in application of the GDPR, including those concerning the obligation to inform, at the time the personal data is collected, the data subjects concerned by the processing operations of the maintenance of the register of processing activities performed, and more generally compliance with the principles of the GDPR.

The Client furthermore agrees to:

• Provide the subcontractor with the data mentioned in the processing characteristics;
• Record in writing all instructions concerning the processing of the data by Yousign;
• Ensure that Yousign meet all of the obligations provided for in the GDPR, both before and during the processing;
• Supervise the processing, including through the performance of audits and inspections of Yousign, in accordance with the conditions described above.