Privacy Policy

ACORD.AR S.A.S., domiciled in the Argentine Republic, is the data controller of personal data collected through the Platform easy-contract.co ("the Platform").

Data Protection Officer contact: privacy@easy-contract.co

We collect the following categories of personal data:

Registration data: name, email address, password (stored in hashed encrypted form).

Usage data: IP address, browser type, operating system, pages visited, access dates and times, actions performed on the Platform.

Transaction data: payment history, payment method (processed by third-party payment providers; we do not store full card numbers).

Signature data: when signing a document, we record the IP address, browser user agent, approximate geolocation (city level), exact date and time, and a unique session identifier.

Data contained in documents: uploaded documents may contain personal data of third parties. In this case, the User acts as data controller of such data.

We use personal data for the following purposes:

a) Service provision: processing documents, managing electronic signatures, generating the chain of evidence.

Account management: authentication, technical support, service communications.

Billing: payment processing, invoice issuance.

Security: fraud detection and prevention, unauthorized access and illicit activities.

Legal compliance: response to judicial requests or competent authorities.

Service improvement: aggregated and anonymized statistical analysis of Platform usage.

We do not use personal data for profiling, automated decisions with legal effects, or third-party marketing.

The processing of personal data is based on the following legal bases, pursuant to Argentina's Personal Data Protection Act (Ley 25.326) and Article 6(1) of the GDPR (EU):

a) Contract performance (GDPR Art. 6(1)(b)): the processing is necessary for the provision of the contracted service.

Consent (GDPR Art. 6(1)(a)): for the sending of commercial communications and the use of non-essential cookies. Consent may be withdrawn at any time.

Legitimate interest (GDPR Art. 6(1)(f)): for Platform security and fraud detection.

Legal obligation (GDPR Art. 6(1)(c)): for compliance with tax, accounting and document retention obligations.

Personal data is retained for the period necessary to fulfill the purposes described:

- Account data: during the account's validity plus thirty (30) days after cancellation.

Signature data and audit trail: five (5) years from document signing, in compliance with legal retention obligations.

Transaction data: ten (10) years, in compliance with Argentine tax and accounting obligations.

Usage data: twelve (12) months, for security and performance analysis.

After the indicated periods, data is securely deleted or irreversibly anonymized.

Personal data may be processed on servers located outside the Argentine Republic, specifically in cloud service provider infrastructure with data centers in South America and the United States.

Such transfers are made with adequate safeguards in accordance with Disposition 60-E/2016 of the Agency for Access to Public Information and GDPR Chapter V, including:

- Standard contractual clauses approved by the European Commission (SCCs)

Transfer impact assessments where applicable

Compliance with international security standards (SOC 2 Type II, ISO 27001)

For transfers to countries outside the EEA that do not have an adequacy decision from the European Commission, additional safeguards are applied pursuant to Art. 46 of the GDPR.

Under Argentina's Personal Data Protection Act (Ley 25.326) and GDPR Articles 15 to 22, data subjects have the right to:

a) Access (Art. 15 GDPR): request information about stored personal data and obtain a copy thereof.

Rectification (Art. 16 GDPR): correct inaccurate or incomplete data.

Erasure (Art. 17 GDPR, "right to be forgotten"): request deletion of data when no longer necessary, consent is withdrawn, or the data subject objects to processing.

Restriction of processing (Art. 18 GDPR): request the restriction of processing in certain circumstances.

Portability (Art. 20 GDPR): receive personal data in a structured, commonly used and machine-readable format, and transmit it to another controller.

Objection (Art. 21 GDPR): object to data processing based on legitimate interest.

No automated decisions (Art. 22 GDPR): not to be subject to decisions based solely on automated processing that produce legal effects.

Right to withdraw consent: Where processing is based on consent, the data subject may withdraw it at any time without affecting the lawfulness of processing prior to withdrawal.

Account and data deletion: The User may request the complete deletion of their account and all associated personal data by sending an email to privacy@easy-contract.co or by accessing easy-contract.co/legal/delete-account. The request will be processed within thirty (30) days, subject to legal retention obligations.

To exercise these rights, contact privacy@easy-contract.co. Responses will be provided within ten (10) business days (thirty days for requests under the GDPR, pursuant to Art. 12(3)).

Right to lodge a complaint: The data subject has the right to lodge a complaint with the Agency for Access to Public Information (AAIP) of the Argentine Republic, or with the competent supervisory authority in their country of residence within the EEA if they consider that the processing of their data infringes the GDPR.

We implement technical and organizational security measures, including:

- AES-256 encryption for data at rest

TLS 1.3 for data in transit

Two-factor authentication (TOTP)

Role-based access controls

Continuous security monitoring

Periodic penetration testing

Staff training in data protection

For inquiries about this Privacy Policy: privacy@easy-contract.co

ACORD.AR S.A.S. Argentine Republic