1. Data Controller
The controller of personal data is:
CoreApp Technologies s.r.o.
Nove sady 988/2
602 00 Brno - Stare Brno
Company ID: 11725575
VAT ID: CZ11725575
E-mail: hello@getdocumio.com
(hereinafter "Controller")
2. What personal data we process
Data provided by the user
- first and last name,
- e-mail address,
- phone number,
- data entered into forms,
- signature,
- data contained in documents and forms.
Technical and operational data
- IP address,
- device and browser information,
- operating system,
- time zone and time-related data,
- audit and security logs,
- session identifiers,
- cookies and similar technologies.
Data generated while using the service
- history of actions in forms,
- information about document signing,
- verification data (e.g. OTP codes),
- metadata related to electronic signatures and audit trail.
3. Purposes of processing
Service provision
- operation and availability of Documio,
- management of user accounts,
- generation of documents and forms,
- electronic signing of documents,
- security and audit trail assurance.
Contract performance
- billing and accounting,
- order and subscription management,
- customer support.
Legitimate interest
- protection against misuse,
- fraud prevention,
- security monitoring,
- service improvement and analytics.
Marketing and commercial communication
- sending commercial communications,
- information about product updates and new features.
Marketing communications are sent only in compliance with applicable law, and users can unsubscribe at any time.
4. Legal basis for processing
We process personal data based on:
- contract performance under Art. 6(1)(b) GDPR,
- compliance with legal obligations under Art. 6(1)(c) GDPR,
- legitimate interest under Art. 6(1)(f) GDPR,
- data subject consent under Art. 6(1)(a) GDPR where required.
5. Data retention period
We retain personal data only for as long as necessary:
- for the duration of the contractual relationship,
- for periods required by law,
- for the period necessary to protect legal claims,
- for the duration of the user account.
Audit and security records may be retained longer to protect the Controller's legitimate interests.
6. Recipients of personal data
Personal data may be disclosed to the following categories of recipients:
- cloud and hosting providers,
- e-mail service providers,
- analytics and monitoring providers,
- payment service providers,
- external IT suppliers and infrastructure administrators,
- public authorities when required by law.
The Controller only uses partners that provide sufficient safeguards for personal data protection.
7. Data transfers outside the EU
Some services may be provided outside the European Union.
In case of transfers of personal data outside the EU, such transfer is carried out only in compliance with GDPR requirements, in particular through:
- adequacy decisions,
- standard contractual clauses,
- other appropriate safeguards.
8. Cookies
The service uses cookies and similar technologies for:
- website functionality,
- user login,
- security,
- analytics and traffic measurement,
- marketing activities.
Details may be provided in a separate Cookie Policy or in the cookie banner.
9. Data subject rights
Users have the right to:
- request access to personal data,
- request correction of inaccurate data,
- request erasure of personal data,
- request restriction of processing,
- object to processing,
- receive data in a structured format,
- file a complaint with a supervisory authority.
The supervisory authority in the Czech Republic is the Office for Personal Data Protection (UOOU).
10. Security
The Controller adopts appropriate technical and organizational measures to protect personal data against:
- unauthorized access,
- loss,
- misuse,
- damage or disclosure.
11. Electronic signatures and audit records
Documio may process data related to electronic signatures, identity verification, and document audit trails.
These data may include:
- signature timestamp,
- IP address,
- device technical information,
- audit logs,
- verification mechanisms (e.g. OTP),
- document metadata,
- document hashes and related security information.
These data are used for:
- proving document integrity,
- documenting the signing process,
- increasing trustworthiness of electronic signatures,
- protection against fraud and misuse.
12. Changes to this policy
The Controller reserves the right to amend or update this policy at any time.
The current version will always be published on the Documio website.
13. Contact details
If you have any questions about personal data protection, you can contact us at:
CoreApp Technologies s.r.o.
Nove sady 988/2
602 00 Brno - Stare Brno
E-mail: hello@getdocumio.com