> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://support.contracthero.com/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# QES and data protection: what gets sent where during signing

Signing a contract with a qualified electronic signature involves more than one party: ContractHero, our signature service provider **eidEasy**, and the trust service provider that verifies your identity (depending on the method, for example Adacom, A-Trust, D-Trust, SignMe or Swisscom AIS). This article sets out what moves between them, and what ContractHero keeps.

## What's in it for you

When a data protection request, an audit, or your legal team comes asking, you can show exactly what leaves your system. That saves a round of questions and makes QES explainable to works councils and data protection officers.

## How it works

Signing passes through three stages.

### 1. From ContractHero to eidEasy

When the signature run starts, we send:

* our API credentials
* the contract's file name
* the complete PDF document

We do **not** send personal master data as separate fields — no name, no email address, no phone number.

### 2. From you to eidEasy and the trust service provider

You enter your identification data directly with them during signing:

* a phone number for the one-time password (OTP) by SMS
* a photo of your ID card or passport, including issuing country
* a brief liveness check using your smartphone camera (not a video call)
* your acceptance of that provider's terms

None of this reaches ContractHero.

### 3. Back to ContractHero

Once signing finishes, we receive the signed PDF. What we store alongside it:

* the signed document
* the eidEasy transaction ID
* the status of the signature run
* the time of signing

We do not store the identity data returned to us.

## Common questions

### Why send the whole document instead of just a hash?

Because a QES is created to the PAdES standard, which embeds the signature inside the PDF itself. That requires the actual file — a hash isn't enough.

### Does the transmitted document contain personal data?

Possibly, yes. The signer's name appears in the visible signature fields in the PDF, and the file name and contract text may contain personal data of their own. We don't send separate personal data fields, but the document itself goes across in full.

### Does ContractHero store my identification data?

No. We never receive the ID photo or the verification recording, and we don't store the identity data returned to us. Certificate data sits inside the signature in the PDF, as it does with any qualified signature.

### How do I get my identification data deleted?

That's handled by the trust service provider you identified yourself with. Note that statutory retention periods can apply to qualified signature procedures and may prevent immediate deletion. The provider can tell you the exact periods and conditions.

### How do I tell which provider I used?

From the signature record in the signed PDF. You'll also find it in the confirmation email for the signature.

## Good to know

* **eidEasy's own emails are switched off.** ContractHero sends the signing invitation itself.
* **Who controls the data.** For personal data held in your company's ContractHero account, your company is the controller, not ContractHero. We process it on your company's behalf.
* **Identity is checked once per provider.** Once you've verified with a provider, the ID step is skipped on your next signature through that same provider.
* **No legal advice.** We can explain the technical process. The legal assessment belongs with your legal team or data protection officer.

## Related articles

* [QES Signing Process (Recipient) – Step by Step](https://support.contracthero.com/en-us/article/qes-signing-process-recipient-step-by-step-1qrx9fg/)
* [FES or QES? The difference and when to use which signature](https://support.contracthero.com/en-us/article/fes-or-qes-the-difference-and-when-to-use-which-signature-15bwp2n/)
* [How to Request an Electronic Signature in ContractHero (FES & QES)](https://support.contracthero.com/en-us/article/how-to-request-an-electronic-signature-in-contracthero-fes-qes-1kbch7s/)