INBULK Electronic Signature Policy

1. Status and priority

1.1. This Policy sets out in detail the procedure for Signing on the Platform. In the event of a conflict, the Accession Agreement prevails and, for a particular document, its identified terms and the applicable law prevail.

1.2. The name of a method in the interface must correspond to its actual legal and technical nature. An OTP, a password or click-to-confirm are not called a QES if they do not meet the requirements for such a signature.

2. Roles

2.1. The following take part in Signing:

2.2. Technical integration does not make the Operator a QTSP/TSP, a CA, an RA, a TSA or a qualified validation service in the absence of confirmed status.

3. Confirmation of identity and authority

3.1. Signing consists at a minimum of: presentation of the final version of the document, Authentication, display of the company represented and of the legal effect, confirmation of intent, application of the available signature and recording of the result.

3.2. Identification of a natural person, Authentication of an Account, verification of a certificate and corporate authority are separate checks.

3.3. A valid signature or certificate does not in itself confirm a position held, internal approval, the absence of a limit, the right to dispose of goods or funds, or the ownership of an IBAN.

3.4. The Platform verifies the presence of a displayed Right to perform the relevant action to the extent actually implemented for the scenario.

4. Levels of signature and confirmation

4.1. The following methods of signature and confirmation may be applied on the Platform:

4.2. The specific level is determined by the jurisdiction, the type of document, the risk, the requirements of the Third-Party Provider and the functionality available. It is displayed before the final action.

5. Mandatory scenarios

5.1. The Statement of Accession of a Ukrainian User company is signed with a QES in accordance with the Agreement.

5.2. For a change of bank details, the granting of critical Rights, the disposal of documents of title, high-value transactions or other risk-bearing actions, the Platform may require a QES, enhanced Authentication and/or a second approval.

5.3. The mandatory level depends on the jurisdiction in which the User company is registered:

5.4. A jurisdiction is added to the table in clause 5.3 by a new edition of this Policy once a country module for the relevant country is launched. A country module is a set of Platform settings for a particular jurisdiction which determines the type of signature, the term, the provider, the composition of the evidence and the language (clause 12.3).

5.5. Until a jurisdiction is included in the table, no method of signature is presented on the Platform as legally sufficient for all documents of the country concerned. The specific method for a particular document is determined under section 4 and is displayed before the final action.

6. Signing ceremony

6.1. The Signing procedure provides for:

• display of the complete final version of the document and of all integral annexes;
• the name of the document, the parties, the company represented, the role and the basis of authority;
• the type of signature or confirmation and the provider engaged or the category of provider;
• the legal effect, the ability to decline and the period of validity;
• the ability to save the document before Signing, where the Agreement so provides;
• a separate final action which is not disguised as “Next” or as ordinary navigation;
• upon completion — the signed document or status, the result of verification and an available Signing Record.

7. Version and integrity

7.1. Before Signing, an immutable edition is created with a unique identifier and a cryptographic imprint, where supported.

7.2. A change to a signed document must be detectable. A new edition neither replaces nor deletes the previous signed file and its evidence.

7.3. The signing of annexes and attachments must make it possible to establish exactly which files formed part of the package.

8. Signature verification

8.1. The result of verification may be successful, negative, indeterminate or incomplete. Only a successfully completed verification may be displayed as “verified”.

8.2. Verification may, depending on the method, take into account integrity, the certificate, the chain of trust, revocation status, the timestamp, a trusted list, the correspondence of the person to the profile and other available data.

8.3. The unavailability of OCSP/CRL, of a trusted list or of a validation service is not automatically converted into a successful result.

8.4. Repeated verification does not create a repeated signature, Acceptance or transaction.

9. Signing Evidence Record and the Signing Record

9.1. In respect of each Signing, the Platform compiles and retains the available elements:

• the identifier of the document, the edition, the name and the hash;
• the Signatory and the company represented;
• the method of identification and Authentication;
• the displayed Right or authority snapshot, where the functionality is available;
• the text of the confirmation of intent;
• the type of signature, the provider, the certificate or identifier and the result of verification;
• the date and time of system events in UTC and, where required, local time;
• IP and device/browser information to a proportionate extent;
• the timestamp and validation evidence, where applied;
• the event ID, the idempotency key and the second approval;
• the fact of a refusal, an error, a cancellation or the unavailability of a service.

9.2. The composition of a particular Record depends on the method available. An element which is absent must not be presented as having been verified.

10. Retention, export and legal hold

10.1. Signed documents and evidence are retained in accordance with the Electronic Evidence and Retention Policy, the Privacy Policy, the term of the document, any dispute and the law.

10.2. The User may download the available signed document and the Signing Record. Export must not alter the original file.

10.3. Deletion is suspended for the duration of a dispute, an investigation or a lawful request.

11. Incidents

11.1. Upon the compromise of a key, a certificate, an Account or a means of Authentication, new Signings may be suspended, evidence preserved and the status of documents verified.

11.2. A compromise occurring after Signing does not automatically annul the document; the consequences are determined by the actual circumstances, the moment of the compromise, the law and the decision of the parties or of a competent authority.

11.3. The User notifies the Platform Operator and the provider without delay and initiates blocking or revocation where applicable.

12. Providers and country modules

12.1. The current providers, their legal entities, countries, statuses, supported signature types and privacy roles are set out in the register or on the signing screen.

12.2. A change of provider does not require a new edition of the Agreement unless it changes the legal effect, material privacy terms or the obligations of the User; such changes are notified.

12.3. The specific features of a particular jurisdiction are established by a country module, which may determine a different type of signature, term, provider, evidence and language.

13. Changes

13.1. Material changes to this Policy apply prospectively. The edition displayed and recorded before the action is the one used for signing.

14. Contacts

14.1. Questions concerning this Policy — [email protected].

Sources and legal basis

This document has been prepared having regard to the Accession Agreement as the source of highest priority, to the public INBULK documentation in so far as it describes actual or planned working processes, and to the applicable legislation. Public pages which conflict with the Agreement do not determine legal consequences.

• The Accession Agreement to which the User has acceded.
• Law of Ukraine “On Electronic Documents and Electronic Document Circulation” No. 851-IV.
• Law of Ukraine “On Electronic Identification and Electronic Trust Services” No. 2155-VIII.
• Regulation (EU) No 910/2014 (eIDAS) in the cases where it applies.

Version history