Data Use, Ownership and Processing Policy

This Policy establishes the rules governing the use, processing, access, retention, sharing, export, transfer, and deletion of documents and data processed via the Doconti platform.

It applies to professional Clients, administrators, authorised users, associated companies, and other invited users, to the extent of their respective roles.

This Policy is complemented by the Data Processing Agreement, which governs situations in which Doconti acts as a processor.

2.1. Doconti does not acquire ownership over documents, content, or information entered into the platform.

2.2. The use of content by Doconti is limited to the contracted purposes, lawful instructions, legal obligations, and necessary technological operations.

2.3. Doconti may not commercialise, licence to third parties for independent exploitation, or use the documents to develop its own commercial databases.

2.4. Ownership of documents and rights of access or use belong to the legally entitled individuals or entities, in accordance with their nature and existing legal relationships.

2.5. The inclusion of a document in a Doconti environment does not, in itself, alter legally existing rights of ownership, confidentiality, or access.

3.1. The Client is responsible for ensuring the lawfulness of the collection, entry, and processing of documents.

3.2. It is the Client's responsibility to determine the document procedures required under tax, accounting, employment, and commercial law.

3.3. Doconti does not automatically validate the authenticity, tax compliance, or legal sufficiency of documents.

3.4. The receipt of a document on the platform does not, in isolation, prove compliance with the legal obligations of the accounting firm or associated company.

3.5. Doconti may provide technical receipts of transmission, date, status, or processing, without these being equivalent to public certifications or legal authentications.

4.1. Each Client has a working environment subject to access controls.

4.2. The content of one Client shall not be made available to another Client without a lawful basis and valid authorisation or instruction.

4.3. The fact that two accounting firms associate the same NIF does not grant them reciprocal access.

4.4. An entity may be associated with more than one accounting firm where legitimate professional relationships exist.

4.5. Doconti does not presume that the first accounting firm to register a NIF holds exclusive rights over all documents associated with that entity.

5.1. The Client is responsible for assigning, maintaining, and revoking permissions for its users.

5.2. Access must be configured based on functional necessity.

5.3. An authorised user may not access documents that fall outside the scope of the granted permissions.

5.4. Doconti may implement access categories, including administration, viewing, uploading, validation, organisation, and export.

5.5. Changes to permissions take effect regarding future access, without necessarily deleting historical logs of previously performed operations.

6.1. Associated companies may receive invitations, links, or specific access to deliver documents.

6.2. The invitation does not constitute an autonomous Doconti subscription.

6.3. The recipient must only access the functionalities expressly authorised.

6.4. The Client issuing the invitation is responsible for determining the purpose of the request and its lawfulness.

6.5. Doconti may implement authentication mechanisms, link expiration, access restrictions, and misuse prevention.

6.6. The invited company does not automatically acquire full access to the accounting firm's environment or its internal documents.

6.7. The company may exercise legal rights of access and data protection against the competent responsible entity, without prejudice to Doconti's assistance obligations.

7.1. Doconti may integrate documents received via electronic mail, communication channels, external services, APIs, or manual upload, provided that the corresponding functionality is available and authorised.

7.2. The Client is responsible for the lawfulness of the integration, compliance with terms of external services, and access authorisation.

7.3. Doconti may cease supporting integrations that present security risks, incompatibilities, or restrictions imposed by the respective providers.

7.4. There is no guarantee of receipt of all documents sent through networks, accounts, or systems that are outside Doconti's control.

7.5. Unreceived, rejected, or incorrectly processed documents must be identified and handled in accordance with available mechanisms and the legal allocation of responsibilities.

8.1. It is for the controller to determine the appropriate retention periods, taking into account applicable statutory obligations.

8.2. Portuguese tax and accounting legislation sets out specific document retention obligations, which may reach or exceed ten years, depending on the legal regime and document type.

8.3. Doconti does not automatically assume the statutory long-term archiving obligation where such obligation falls upon the company, the accountant, or another entity.

8.4. Contracting Doconti does not relieve the Client from maintaining adequate procedures for document retention, export, and retrieval.

8.5. Retention on the platform depends on the active contractual relationship, off-boarding periods, valid instructions from the controller, and statutory obligations applicable to Doconti.

9.1. The Client may export the documents that it is lawfully authorised to access and retrieve from the platform.

9.2. Export shall be carried out using the means and formats provided by Doconti.

9.3. Wherever technically feasible, standard export must preserve the original files and essential metadata for identification and organisation.

9.4. Doconti is under no obligation to provide its source code, proprietary algorithms, confidential internal structures, or processing tools as part of an export.

9.5. Export does not automatically delete documents from the platform.

9.6. Doconti may require enhanced authentication for bulk export operations.

10.1. General principle

The termination of a relationship between a company and its accountant does not result in an automatic transfer of documentation to another accounting firm.

10.2. Protection of confidentiality

Doconti shall protect the professional and commercial information of the previous accounting firm, as well as personal data and documents subject to third-party rights.

10.3. Lawfulness of the request

Any transfer must be based on an appropriate legal basis and instructions from a competent or lawfully authorised entity.

Proof of identity and authority of representation of the requester may be required.

10.4. Scope of documentation

The following must be distinguished, as the case may be:

• a) Original documents belonging to the company or which it is entitled to receive;
• b) Accounting documents whose disclosure is legally required;
• c) Personal documents subject to the GDPR;
• d) Internal documents of the accounting firm;
• e) Notes, templates, methodologies, and other elements protected by intellectual property rights or confidentiality;
• f) Audit and security logs of Doconti itself.

10.5. Selective transfer

Doconti may implement selective export or transfer procedures, restricted to data covered by lawful rights and instructions.

10.6. Conflicts between parties

Where conflicting instructions or a substantiated dispute exist, Doconti may request clarification and provisionally restrict the disputed operation, to the extent necessary.

Doconti does not determine the ownership of documents by discretionary decision.

10.7. Overriding statutory obligations

No provision may be construed as authorisation to hinder compliance with legal obligations, data subjects' rights, court orders, or determinations of competent authorities.

10.8. Logging of operations

Transfer operations may be logged for security, auditing, and legal defence purposes, in compliance with the principles of data minimisation and retention.

11.1. Doconti may process documents using AI features for the contracted purposes.

11.2. Processing may comprise text extraction, field identification, categorisation, duplicate detection, inconsistency detection, and information organisation.

11.3. Use must adhere to the principles of purpose limitation, data minimisation, and security.

11.4. Documents and personal data shall not be used by Doconti to train general AI models.

11.5. Doconti may use effectively anonymised statistical information, where it is not possible to identify or re-identify data subjects by reasonably available means, for performance analysis and platform improvement.

11.6. Pseudonymised personal data remain subject to the GDPR.

11.7. AI-generated outputs must be validated by the Client before being used for accounting, tax, legal, or professional purposes.

12.1. During the subscription, the Client may request or carry out content deletion operations, in accordance with the available permissions and functionalities.

12.2. Following contract termination, Doconti shall make available the export period provided for in the Terms of Use.

12.3. Once that period has expired, data subject to deletion shall be removed from active systems in accordance with the applicable technical and contractual procedures.

12.4. Residual backup copies may remain during the previously defined technical retention cycle, protected against ordinary use.

12.5. Data whose retention is required by law may be retained for the strictly necessary period and with restricted access.

12.6. The deletion of personal data shall comply with the GDPR and valid instructions from the controller.

13.1. Technical access to Client content shall only take place where there is a legitimate purpose and demonstrable necessity.

13.2. Whenever support requires viewing actual documents, Doconti shall seek to use authorisation, minimisation, and logging mechanisms.

13.3. Doconti may use technical data and anonymised information to diagnose errors without consulting the full content of documents.

13.4. Access to content shall not be used for commercial or competitive purposes, or purposes unrelated to the provision of the service.

14.1. Contractual breach may result in the suspension of processing or upload functionalities.

14.2. Doconti may impose proportionate restrictions for security reasons or non-payment.

14.3. Suspension does not grant Doconti ownership over documents.

14.4. Doconti shall observe contractual export deadlines and legally enforceable obligations, including those surviving during payment disputes.

14.5. Permanent deletion of data shall comply with the foreseen procedures and may not be used to unlawfully hinder the exercise of rights.

15.1. Doconti may disclose information where there is a valid legal obligation or order from a competent authority.

15.2. Requests shall be assessed regarding their lawfulness and scope.

15.3. Disclosure shall be limited to legally required information.

15.4. Unless prohibited by law, Doconti shall endeavour to inform the entity responsible for the data regarding the request.

A breach of this Policy may result in:

• Restriction of functionalities;
• Revocation of credentials;
• Suspension of access;
• Contractual termination, where legally permissible;
• Notification to competent authorities, where required or justified.

Any measures applied must be substantiated and proportionate.

In matters regarding the processing of personal data, the GDPR, applicable legislation, and the Data Processing Agreement shall prevail to the extent that it contains valid specific terms.

This Policy is without prejudice to mandatory rights of data subjects or legal obligations of professional secrecy and confidentiality.

Privacy contact: [Privacy e-mail — to be completed]

Legal contact: [Legal e-mail — to be completed]

Operating entity: [Company name — to be completed]