Australia · Version 2 · October 2026 · Effective date: 4 October 2026 · Applies to Office Vault EasySign, operated by Office Vault Technology (Pty) Ltd
Scope. This notice applies to the Australian deployment of Office Vault EasySign, served at au.au.easysign.officevault.io. The South African deployment is a separate installation with its own notice. Other products in the Office Vault range are covered by their own policies and are hosted differently.
In short. We collect what we need to run a signing service: your account details, the documents you upload, and a record of who opened and signed them. Your documents, the application and the database all sit in Australia. We don't sell your data and we don't use your documents to train AI models.
Office Vault EasySign is operated by Office Vault Technology (Pty) Ltd (Reg. No. 2020/835556/07), a company registered in South Africa, of 56 Church Street, Olivedale, Johannesburg North, Randburg, 2188, South Africa.
We are not an Australian company and we say so plainly. There is no Australian subsidiary, ABN or resident director. We run an Australian installation of the service, with Australian hosting, from a South African company.
Because we carry on business in Australia and collect personal information here, we have an Australian link under section 5B of the Privacy Act 1988 (Cth), and this notice is written to the Australian Privacy Principles (APPs).
One thing we will not be vague about. A business with an annual turnover under A$3 million is generally a small business operator and exempt from the Privacy Act under section 6D. On turnover, we are below that line today. We apply the Australian Privacy Principles anyway, as a matter of how we intend to run this service, and we are considering opting in to be treated as an APP entity under section 6EA.
We would rather tell you that than let you assume statutory coverage that a lawyer would later find is not there. If formal coverage matters to your organisation, ask us before you roll this out — it is a decision we are willing to make.
For personal information inside documents you send — your signers' names, email addresses and signatures — you decide what is collected and why. We hold and process it to deliver the signing service you asked for, on your instructions.
Privacy contact: Suniel Seejiram, Founder
privacy@officevault.co.za · +27 10 500 1589
| Category | Examples | Why |
|---|---|---|
| Account information | Name, work email, company name, hashed password, plan — and, only if you choose to save them, your signature and initials, which you can remove at any time | To create and secure your account |
| Document content | The PDFs you upload and the fields placed on them | To display, sign and seal the document |
| Signer information | Signer name, email address, signature image, and any details they type into fields | To deliver the document and record the signature |
| Billing information | Your plan and invoice history. We take no card payments in Australia yet — see section 5 | To keep proper accounting records |
| Signing evidence | IP address, timestamps, device information, and — only with the signer's permission — approximate location | To produce the audit trail and certificate that make a signature defensible |
| Usage information | Documents sent, feature use, error reports, feedback you submit | To operate, support and improve the Service |
We collect this from you directly, and from signers when they open and complete a document you sent them (APP 3.6). We do not buy personal information from anyone.
Sensitive information as defined in the Privacy Act is not something the Service asks for. If you place it inside a document you send, we hold it as document content and treat it with the same protections, but you should satisfy yourself that you have the consent APP 3.3 requires.
We collect personal information because it is reasonably necessary to provide the signing service (APP 3.2): to create your account, deliver documents to the people you nominate, record signatures with evidence that stands up, bill you, keep the Service secure, and meet legal and tax obligations.
Optional items — approximate location capture on a signature — are collected only with the signer's express permission, and refusing does not prevent them signing.
We are deliberately specific here, because "hosted in Australia" is used loosely by a lot of software:
Three things leave the country whatever you do, and all three are named in the next section: transactional email, payment processing, and our support access. A fourth — document reading by Mistral — leaves only if you switch it on. We would rather list four exceptions than write "hosted in Australia" and leave you to discover them.
| Recipient | Service provided | Location |
|---|---|---|
| Amazon Web Services, Inc. | Document storage (S3) | Australia (ap-southeast-2, Sydney) |
| Amazon Web Services, Inc. | Application and database hosting | Australia (ap-southeast-2, Sydney) |
| Zoho Corporation (ZeptoMail) | Transactional email: signing invitations, reminders, completion notices. Carries the recipient's name, email address and the document title | Outside Australia |
| Mistral AI SAS | Only if you use the free contract check, or switch on AI features in your account. The text of the document you submit is sent to Mistral to be read, and the reading is sent back. Nothing else about your account is sent | Outside Australia (France) |
| Paddle.com Market Ltd | Takes payment for subscriptions as the seller of record. Carries your name, email address, billing address and card details, which you give to Paddle directly — full card numbers never reach us | Outside Australia (United Kingdom) |
| Office Vault Technology (Pty) Ltd — our own staff | Operating the Service and answering support requests you raise. Support may see your account details and document titles | South Africa |
Mistral is the only one of these that reads what a document says, and it is the only one you have to switch on. Every other recipient above handles your documents as files — storing them, delivering a link, taking a payment — without anything reading the words inside. If you never use the contract check and never turn on AI features, nothing is ever sent to Mistral.
Mistral keeps a copy for about 30 days. They retain what is sent to them, and what they send back, for roughly 30 days for abuse monitoring, and then delete it. Zero-retention is an arrangement offered on their highest plan and we do not have it, so we are not going to tell you your document is not stored there. We will say so here if that changes.
Cross-border disclosure (APP 8 and section 16C). Three disclosures leave Australia whatever you do: transactional email through Zoho, payment processing through Paddle, and access by our own staff in South Africa who operate the Service and answer support requests. A fourth — the text of a document sent to Mistral in France — happens only where you use the contract check or switch on AI features, and section 16C applies to it in the same way.
Under section 16C, where we disclose personal information to an overseas recipient, an act by that recipient which would breach the APPs is treated as a breach by us, and we are accountable for it. We are not asking you to consent your way around that, and we are not relying on the section 8.2(a) "substantially similar law" exception. We accept the accountability and have contracted with these recipients accordingly.
South Africa's Protection of Personal Information Act 4 of 2013 imposes obligations broadly comparable to the APPs, and our staff there operate under it.
Payments. Subscriptions in Australia are sold by Paddle.com Market Ltd as the seller of record. Paddle is the merchant you contract with for the payment itself: it takes your card details on its own checkout, charges you, handles GST, and issues your receipt. Full card numbers never reach our servers and we cannot see them. We see your plan, your billing email, and the last four digits and brand of the card so we can show you which card is on file.
Paddle handles the billing information it collects under its own privacy notice, as the controller of that information. This notice covers what we hold. Your documents and signing records stay with us, in Australia, and are not shared with Paddle.
We do not sell personal information, we do not disclose it for advertising, and we do not use your documents to train artificial intelligence models.
APP 11.2 requires us to destroy or de-identify personal information once it is no longer needed for a permitted purpose. Our schedule:
| Category | Retention period |
|---|---|
| Documents, signatures and audit trails | For as long as the account exists. Cancelling a subscription does not delete anything — it stops new documents being sent, and everything already signed stays available to view, download and verify. If the account is closed, we keep them for a further 30 days and then securely delete them, or return them on written request. A signed document's evidentiary value depends on its audit trail, so we never prune it. |
| User account records | Duration of the account plus 12 months, for audit and dispute resolution. |
| Financial and billing records | 7 years from the date of the transaction. Both Australian and South African tax legislation require this period. |
| Security records of refused sign-ins | 90 days. When a sign-in is refused — a wrong password, a locked-out address, a rate limit — we record the time, the IP address it came from and the email address that was tried. It is how we tell a customer who cannot get into their own account apart from somebody working through a list of addresses. It is deleted automatically after 90 days, and sooner if the account it relates to is closed. |
| Feedback and support correspondence | 12 months from submission, unless an ongoing matter requires longer. |
Documents you delete move to Trash and can be restored. Permanently deleting a document removes it and its audit record, and cannot be undone.
You can close your account yourself in Settings. Closing signs everyone in the organisation out, stops your subscription and cancels anything still out for signature. Your signed documents and their audit trails are kept for 30 days from that point so you can ask us for copies, and are then permanently deleted. Financial records are kept for the period in the table above, because tax legislation requires it.
Data breaches. If a data breach is likely to result in serious harm to anyone whose information we hold, we will notify the affected individuals and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. Where we suspect a breach but are not yet sure it is notifiable, we will complete our assessment within 30 days and act as soon as we are.
If you need more detail about how we protect your information — for a security review or a vendor questionnaire — contact us at support@officevault.co.za.
Under APP 12 you may ask what personal information we hold about you and ask for a copy. Under APP 13 you may ask us to correct anything that is wrong, out of date, incomplete or misleading. Write to privacy@officevault.co.za.
We will respond within 30 days. Access is free; if a request is genuinely large we may charge for the cost of producing it, and we will tell you the amount before we do any work. If we refuse a request, we will tell you why in writing and how to complain.
If you are a signer rather than an account holder, the business that sent you the document decided what to collect — please contact them first, and we will assist them in responding.
If you hold an EasySign account, we may email you about the Service itself — new features, changes to your plan, security notices, and occasional short surveys. APP 7 permits this where you would reasonably expect it, and every one of these emails carries an unsubscribe link, as the Spam Act 2003 requires. Unsubscribing never affects your account or the documents you have signed.
You may ask us at any time not to use your information for direct marketing, and to tell you where we got it. We will action either request free of charge and within a reasonable period.
We do not market to your signers. Someone who receives a document from you through EasySign is your contact, not ours. We will not add them to a mailing list, and we will not send them anything beyond the emails needed to deliver and complete that document.
If you send us feedback, we may quote it anonymously. We will not attach your name, your company or your email address to a public quote without asking you.
Complain to us first, at privacy@officevault.co.za. We will acknowledge within 5 business days and respond substantively within 30 days.
If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner:
GPO Box 10163, Sydney NSW 2001 · 1300 363 992 · oaic.gov.au
EasySign uses only what it needs to work: a session token to keep you signed in, and local storage for your preferences. We do not use advertising or third-party tracking cookies.
Nobody under 18 may open an EasySign account or sign a document as a signer. Our account holders and signers are adults.
A document one of our customers sends may nevertheless contain information about a child — a school indemnity naming a student, an insurance form listing a dependant, a beneficiary nomination.
The Privacy Act 1988 does not set a fixed age at which a person can deal with their own information. It asks whether the individual has the capacity to understand and consent. The Office of the Australian Information Commissioner’s guidance is that this is assessed case by case, and that a person aged 15 or over can generally be presumed to have that capacity unless something suggests otherwise. Below that, a parent or guardian ordinarily acts for them.
Making that assessment is the customer’s responsibility, not ours. The organisation sending the document decides what it contains, who receives it, and whose consent is needed. We handle the document on their instruction under APP 6: we do not read it for our own purposes, and we do not use anything in it to build a profile, train a model or market to anyone.
Practically, we cannot tell you whether a particular document holds a child’s information — the file is encrypted and we do not inspect its contents. So we do not apply a separate retention rule to it. It is kept, and destroyed, exactly as section 6 describes for the account that sent it.
If you are a parent or guardian who has signed something through EasySign and you want access to what is held about your child, ask the school, employer or organisation that sent it to you. They hold the record and can act on it under APP 12. If you cannot get a response from them, contact us at support@officevault.co.za and we will help you reach the right person.
If a child has opened an account or signed as a signer in their own right, that is outside what this service is for. Tell us and we will remove it.
We will update this notice as the Service changes, and will tell you about material changes by email or in the app. The version and date at the top of this page always reflect the current text.