DocuSign Privacy Statement

This document is DocuSign's global Privacy Notice, governing the collection, use, storage, and disclosure of personal data across DocuSign's products and services, with legal bases including consent, contractual necessity, and legitimate interests depending on jurisdiction. The notice states that DocuSign collects identifiers, contact data, device and usage data, geolocation, payment information, and the contents of documents processed through its platform, and the terms authorize sharing this data with service providers, business partners, and in connection with corporate transactions such as mergers or acquisitions. A notable operational distinction is DocuSign's role as both a data controller (for account and marketing data) and a data processor (for customer-submitted document content), meaning the privacy protections applicable to document content depend substantially on the enterprise customer's own data agreements rather than this notice alone. The notice engages GDPR and UK GDPR for EEA and UK users, CCPA and CPRA for California residents, and references additional regional frameworks including Brazil's LGPD, Australia's Privacy Act, and Canadian PIPEDA; cross-border data transfer mechanisms including Standard Contractual Clauses are referenced for EU data flows. Material compliance considerations include the adequacy of consent mechanisms for marketing communications, the scoping of processor versus controller obligations for enterprise customers, and the exercise of data subject rights across multiple applicable regimes.