- We collect what we need to run e-signing: your Matchouse profile, the documents you send, and evidence of who signed and when.
- For documents you send, you are in control of the data and we process it for you.
- We don’t sell personal data, and we don’t use your documents to train AI or for advertising.
- You can ask to access, correct or delete your data at any time.
1. Who we are
This policy explains how Percy Real Estate Ltd, trading as Matchouse (“we”, “us”), handles personal data when you visit our website, use the Bloc Sign app, or sign a document sent through Bloc Sign. We are registered in England and Wales under company number 15525233, and our registered office is 25 Cabot Square, London, England, E14 4QZ. You can contact us about privacy at support@blocsign.io.
We process personal data under the UK GDPR and the Data Protection Act 2018. Your Matchouse account itself, which you use to sign in, is covered by the Matchouse Privacy Policy.
2. Our role
We play two different roles depending on the data:
- Controller: for our customers’ account and workspace data, billing and plan status, website visitor data, and the security and audit records we keep to run and protect the Service.
- Processor: for the documents our customers upload and the personal data of the people they send them to (signers, witnesses and form respondents). The customer who sends the document is the controller. If you signed a document, the sender is your first point of contact for questions about it.
3. What we collect
If you use Bloc Sign to send documents
- Profile data from Matchouse when you sign in: name, email address, and the agencies, businesses or professional profile you belong to, with your role in each.
- Plan data: whether your Matchouse organisation has an active subscription. We don’t receive or store card details.
- Settings: timezone, branding logo, API keys (stored as hashes) and webhook settings.
Documents and signing
- Document content: the PDFs and images uploaded, the fields placed on them, and the values entered.
- Signer details: names and email addresses entered by the sender, or by a signer inviting a witness.
- Signatures: drawn, typed or uploaded signature and initials images, and stamps.
- Audit evidence: IP address, browser and device (user agent), and timestamps for events such as sent, opened, started, signed and declined, along with any reason given for declining, and SHA-256 hashes of each document.
Emails
Records of the signing invitations, reminders and completion emails we send, so they can be tracked and resent.
Website and technical data
- Server logs: IP address, request time, pages requested and browser type, used for security and troubleshooting.
- Analytics, only if you allow it in cookie settings. See our Cookie policy.
4. How and why we use it
| Purpose | Legal basis (UK / EU GDPR) |
|---|---|
| Provide the Service: sign-in, workspaces, sending, signing, tracking, generating signed PDFs and audit logs | Performance of our contract with you. For signer data, we act on our customer’s instructions. |
| Send signing invitations, reminders and completion emails | Contract, and on the sender’s instructions |
| Apply plan limits by checking subscription status with Matchouse | Contract |
| Keep the Service secure, prevent fraud and abuse, and keep evidence that a document is genuine | Legitimate interests in a secure and trustworthy service |
| Respond to support requests | Contract or legitimate interests |
| Send service notices, such as changes to these terms | Contract or legal obligation |
| Website analytics and marketing measurement | Your consent, which you can withdraw at any time |
| Meet legal, tax and regulatory obligations | Legal obligation |
We do not sell personal data. We do not use document content to train AI models or for advertising.
5. Who we share it with
- Other parties to a document: signers see the document and the fields addressed to them. Completed documents and audit logs, including signer names, emails, IP addresses and signatures, go to the sender and to the signers.
- Matchouse: to sign you in and to check your subscription status.
- Service providers who process data for us under contract: cloud hosting and storage providers, email delivery providers, security and error-monitoring providers, and analytics providers, which we only use if you allow analytics in cookie settings.
- Integrations you set up: if you configure webhooks or use the API, we send event data to the endpoints you choose.
- Authorities and advisers: where the law requires it, or to protect rights, safety and property, and to professional advisers under confidentiality.
- A buyer or successor: if our business is reorganised or sold, subject to this policy.
6. International transfers
If personal data is transferred outside the UK or the European Economic Area, we use recognised safeguards such as adequacy decisions or standard contractual clauses (with the UK addendum where needed). You can ask us for a copy.
7. How long we keep it
- Documents, signed PDFs and audit logs: for as long as the workspace keeps them. When a workspace is closed, we keep its data for a reasonable period afterwards and then delete it, unless deletion is requested earlier and legally possible. Copies in backups are removed on our normal backup cycle.
- Account data: for the life of your account, and for a reasonable period after it closes in case of disputes.
- Server and security logs: only as long as needed for security, fraud prevention and troubleshooting.
- Records we must keep by law, such as financial records, for the required period.
Audit evidence exists to prove what happened, so we may keep the audit records of a completed document for as long as the document itself is kept.
8. How we protect it
All traffic uses HTTPS. Session cookies are HTTP-only and secure. Completed documents are sealed with a PKCS#7 digital signature and fingerprinted with SHA-256, so changes can be detected. Access is limited by workspace and role, and API keys are stored as hashes. No system is perfectly secure, so if a breach affects your data, we will tell you and the relevant authorities as the law requires.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to our use of your personal data, to receive it in a portable format, and to withdraw consent at any time. To exercise these rights, email support@blocsign.io. We may need to verify your identity first, and we will respond within one month.
If your data is in a document someone sent you, we may pass your request to the sender as the controller, because deleting it could affect the evidence of an agreement.
You also have the right to complain to a data protection authority, such as the UK Information Commissioner’s Office (ico.org.uk/make-a-complaint) or the regulator where you live. We’d appreciate the chance to resolve your concern first.
10. Children
Bloc Sign is not intended for anyone under 18. If a document involves a minor, the sender is responsible for obtaining any consent needed from a parent or guardian.
11. Changes to this policy
We may update this policy. We will change the “Last updated” date at the top and, for significant changes, tell customers by email or in the app.
12. Contact
Matchouse Privacy Team, Percy Real Estate Ltd (trading as Matchouse), 25 Cabot Square, London, England, E14 4QZ. Privacy requests: support@blocsign.io. General enquiries: hello@blocsign.io.
We have not appointed a data protection officer. If we are required to appoint one, or a local representative, we will publish their contact details here.