Legal
Nossic eSign terms
Version 1 · 12 October 2026
In short
- Anyone with a Nossic ID and a verified email address can send documents with Nossic eSign, free. You accept these terms before you send your first document.
- Your documents are private to your account. Nobody else using Nossic eSign can see them; the people you send a document to see only that document.
- Use it only for genuine documents you're entitled to send. No spam, fraud, phishing or impersonation.
- For the people you send documents to, you are the controller of their personal data and Nossic processes it for you, under part 2.
These terms are between Nossic ("we") and you, the person sending documents with Nossic eSign ("you"). They apply alongside our privacy notice, which explains how we handle your own account data. People who only sign documents don't need to accept them.
Part 1: Using Nossic eSign
1. The service
You can upload PDFs, place fields for each signer, and send them by email link or to a signer's Nossic ID. When everyone has signed, we seal the document with a certificate of who signed, when, and from which IP address and browser, and send everyone a copy. The service is free, provided as it is, and we may change or stop features. We'll give reasonable notice before stopping the service, so you can download your documents.
2. Your documents are yours
- Only your account can see, change, send or delete the documents you create.
- A signer sees the document you sent them, your name and verified email address, any message you wrote, and the names of the other signers. They don't see other signers' email addresses or your other documents.
- A document sent to a Nossic ID appears in that person's Nossic eSign under "Sent to you" when they're signed in with a Nossic ID whose verified email address is the one you entered.
- The completed, sealed document, including its certificate page, goes to every signer. The certificate lists each signer's name, email address, IP address and browser, which is what makes it useful as evidence.
3. Fair use
You must not use Nossic eSign:
- to send spam, or documents people didn't expect from you;
- for fraud, phishing, or pretending to be someone else or another organisation;
- to send anything unlawful, or that you don't have the right to share;
- to collect passwords, payment card details or similar through document fields;
- to get around the limits below, for example with several accounts.
Our signing emails show your name and verified email address and tell people that Nossic didn't write the document. Anyone can report misuse to abuse@nossic.uk. If we believe an account breaks these terms, we may stop it sending documents, cancel documents waiting for signatures, and close the account.
4. Limits
To keep the service fair and stop misuse, each account can upload up to 30 documents, send up to 20 and have us send up to 100 signing emails in any 24 hours, store up to 1 GB, and send a reminder to the same person at most once an hour. Each document can have up to 20 signers and 25 MB. We may change these limits.
5. Electronic signatures and your documents
Electronic signatures are valid in the UK (Electronic Communications Act 2000) and the EU (eIDAS) for most documents, but not for everything: some documents, such as certain deeds, wills and property transfers, have their own rules. It's up to you to decide whether an electronic signature is right for your document. We don't give legal advice, and we're not a party to your documents.
6. Keeping and deleting documents
- Your documents stay until you delete them, or delete your account. Drafts nobody has touched for 180 days are deleted.
- You can delete any document that isn't waiting for signatures; cancel it first if it is. Download anything you need to keep before you delete it.
- Deleting your Nossic ID in My Nossic account deletes all your Nossic eSign documents. Copies we've already emailed to signers stay with them.
7. Responsibility
We take care to keep Nossic eSign running and your documents safe, but because it's a free service we can't promise it will always be available or error-free. As far as the law allows, we aren't responsible for indirect losses, or for losses caused by documents you or your signers send. Nothing in these terms limits liability that the law doesn't allow us to limit, or your rights as a consumer.
Part 2: Data processing for your signers
This part meets Article 28 of the UK GDPR and the EU GDPR. When you send a document, you decide why and how your signers' personal data is used, so you are the controller and we are your processor. If you use Nossic eSign only for personal or household matters, data protection law may not apply to you, but we still handle the data as described here.
8. The processing
| Subject matter | Providing Nossic eSign: storing your documents, sending them to signers, collecting signatures and sealing the result. |
|---|---|
| Duration | While you use Nossic eSign, then until the data is deleted under section 6. |
| Nature and purpose | Storing and showing documents; emailing signers or delivering to their Nossic ID; recording what each signer does; adding their signatures and filled-in fields to the document; making the sealed copy and certificate. |
| People | The people you send documents to, and anyone named in your documents. |
| Personal data | Signers' names and email addresses; their signatures, initials and the text they fill in; when they opened, signed or declined; IP address and browser; and whatever personal data your documents contain. |
| Special categories | Only if your documents contain them. You're responsible for having a lawful basis for any such data you include. |
9. Your instructions
We process the data only on your documented instructions: these terms and what you do in Nossic eSign. If the law makes us do otherwise, we'll tell you first unless the law forbids it. We'll tell you if we think an instruction breaks data protection law. We don't use your documents or your signers' data for our own purposes, sell them, or use them to train AI models. We may look at an account's documents only when needed to investigate a report of misuse, a security problem, or to meet a legal obligation.
10. Confidentiality and security
Everyone at Nossic who can access the data is bound to keep it confidential. We protect it with appropriate technical and organisational measures (Article 32), including: documents encrypted with AES-256 where they're stored; encryption in transit (HTTPS); signing links stored only as hashes; every document query limited to its owner's account; servers in a private network reachable from the internet only through our gateway; access limited to authorised staff; encrypted backups; and keeping software up to date.
11. Sub-processors
You authorise us to use these sub-processors:
| Sub-processor | What for | Where |
|---|---|---|
| DigitalOcean | The gateway server that carries encrypted traffic between the internet and our servers | London, UK |
| Thundercloud | The mail server that sends signing emails and completed copies | UK |
Documents are stored and processed on Nossic's own servers in the UK. We'll give at least 30 days' notice on this page before adding or replacing a sub-processor, so you can object, and we hold each sub-processor to data protection terms as strict as these. We won't transfer the data outside the UK or the European Economic Area unless the law allows it and the required safeguards are in place.
12. Helping you
- Signers' rights: you can see, download and delete your documents yourself. We'll help with anything you can't do yourself, and pass on to you any request a signer sends us about your documents.
- Breaches: we'll tell you without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting your documents, with the information you need to meet your own duties.
- Assessments and audits: we'll give reasonable help with data protection impact assessments and consultations with regulators, and the information you reasonably need to show these terms are being met.
13. Your part
- You need a lawful basis for sending each document and for the personal data in it, and must tell your signers how you use their data where the law requires it.
- Only send documents to people who expect them, at email addresses you're entitled to use.
Changes and questions
We may update these terms to reflect changes in the law or the service. If a change materially affects you, we'll ask you to accept the new version before you next send a document. If these terms conflict with any other terms between us about personal data, part 2 wins. These terms are governed by the law of England and Wales; if you live elsewhere in the UK or in the EU, you keep the protection of your local consumer law and courts. Questions: privacy@nossic.uk. Misuse: abuse@nossic.uk.