Privacy Policy

Doconti recognises the importance of protecting personal data, particularly in the context of accounting document management, where financial, commercial, tax, employment data and confidential information may be processed.

This Policy explains how personal data is collected, used, retained, shared and protected in connection with the use of Doconti.

Doconti undertakes to comply with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability set out in the GDPR.

The platform is operated by:

• Entity: [Company name — to be completed]
• NIPC: [NIPC — to be completed]
• Registered office: [Address — to be completed]
• General contact: info@doconti.pt
• Privacy contact: [Privacy e-mail — to be completed]
• Data Protection Officer: [Data Protection Officer, if any — to be completed]

Doconti may act in different legal capacities depending on the purpose of the processing.

3.1. Controller

Doconti acts as controller when it determines the purposes and essential means of using data necessary for its own activity, namely:

• User registration and authentication;
• Contract administration and invoicing;
• Management of payments and subscriptions;
• Operational communications;
• Technical support and request management;
• Fraud prevention;
• Platform security;
• Management of communication preferences;
• Compliance with legal obligations;
• Technical and statistical analysis of service performance, respecting data minimisation.

3.2. Processor

With respect to documents and information processed under instructions from Clients, Doconti generally acts as processor, within the meaning of Article 4(8) and Article 28 of the GDPR.

In these cases, Doconti does not independently determine the purposes of the processing.

The controller may be the accounting firm, the company whose documents are processed, or another entity, depending on the legal relationship and the processing actually carried out.

The qualification of the parties is not altered by mere contractual designation, with their actual functions prevailing.

Doconti may process, to the extent necessary, the following categories.

4.1. Identification data

Name, email address, telephone contact, job title, professional entity, NIF or NIPC, where applicable, and user identifiers.

4.2. Contractual and financial data

Contracted plan, billing history, payment status, transaction references and billing contact information.

Full payment card details are processed by the contracted payment service providers, in accordance with their role and applicable rules.

4.3. Technical and security data

IP address, device information, browser, session identifiers, date and time of access, authentication and operation logs, technical errors and usage metrics.

4.4. Documents and data provided by Clients

These may include, among others:

• Invoices, receipts and credit notes;
• Bank statements and documents;
• Tax and accounting documents;
• Contracts and correspondence;
• Commercial documents;
• Employment and payroll documentation;
• Identification of employees, suppliers and clients;
• Data of natural persons included in the documents;
• Other elements legitimately and necessarily uploaded by the Client.

Certain documents may contain special categories of personal data or third-party information. The processing thereof requires a lawful basis, necessity and appropriate safeguards.

When acting as controller, Doconti uses personal data based on the grounds set out below.

When Doconti acts as processor, the determination of the lawful bases concerning the content rests with the respective controller.

6.1. A company or natural person may receive an invitation to submit documents to an accounting firm via Doconti.

6.2. The invitation is issued on the initiative and under the responsibility of the sending entity, insofar as it determines the recipients and the purpose of the request.

6.3. Doconti may process the data necessary to deliver the invitation, authenticate the recipient, receive documents and record the transaction.

6.4. The guest's access is limited to the features and documents legitimately made available to them.

6.5. Doconti does not use the contact details of invited companies for its own marketing campaigns merely because they were invited.

6.6. Where Doconti acts as processor, the controller must provide data subjects with the information required by law.

7.1. Doconti may use artificial intelligence tools to extract, organise, recognise, classify or interpret information contained in documents.

7.2. Such processing is intended for the performance of the contracted services or documented instructions from the controller.

7.3. Doconti does not use Clients' document content to train general artificial intelligence models, create products that exploit third-party data or commercialise information.

7.4. AI technology providers that receive personal data are subject to assessment and appropriate contractual terms concerning confidentiality, security, purpose and use.

7.5. Data sent to AI providers must be limited to what is necessary to perform each operation.

7.6. Any international transfer must comply with applicable legal requirements.

7.7. Doconti will not use Clients' document data for solely automated decisions producing legal effects or similarly significant effects concerning natural persons, unless a valid legal framework exists and the safeguards required by law are implemented.

Data may be processed or made available, to the extent strictly necessary, to the following categories:

• a) Hosting and technological infrastructure providers;
• b) Authentication and security service providers;
• c) Artificial intelligence service providers;
• d) Email and communication services;
• e) Payment and billing providers;
• f) Contractually authorised technical support providers;
• g) Public or judicial authorities, where a legal obligation exists.

Doconti does not sell personal databases to third parties.

Access by service providers is conditional upon a legitimate purpose, proportionate security measures and an appropriate contractual instrument.

9.1. As an architectural and procurement policy, Doconti prioritises the processing and storage of data within the European Economic Area.

9.2. The actual location of the services, including AI, support and backup providers, is described in the list of sub-processors published at [Sub-processor list address — to be completed].

9.3. Whenever personal data is transferred to countries outside the European Economic Area, Doconti will comply with Chapter V of the GDPR.

9.4. Transfers may be based on an adequacy decision of the European Commission or on appropriate safeguards, including standard contractual clauses and supplementary measures where necessary.

9.5. The existence of an international provider does not imply unlimited authorisation to use the data.

9.6. The data subject may request additional information regarding the applicable safeguards, subject to confidentiality and security duties.

Doconti retains personal data only for the period necessary for the legitimate purposes and applicable legal obligations.

The following criteria apply:

Account data: for the duration of the contractual relationship and, following its termination, for the period necessary to comply with legal obligations, resolve disputes and defend legal claims.

Billing data: for the periods legally required for the retention of accounting and tax documentation.

Clients' documents: for the term of the service and for the periods defined in the Data Processing Agreement and in the valid instructions of the controller.

Security logs: for a period proportionate to the purpose of preventing, investigating and auditing incidents, as defined in the internal retention schedule and disclosed where legally required.

Marketing data: until withdrawal of consent, valid objection or termination of the purpose, as applicable.

Backups: in accordance with the technical retention cycles provided for in the Security Policy and the Data Processing Agreement.

The statutory obligation to retain certain tax documents does not mean that Doconti is obliged to host them indefinitely after the termination of the contract.

Doconti will implement technical and organisational measures appropriate to the risk, including, as applicable:

• Protection of communications;
• Data encryption;
• Access control;
• Logical segregation of environments and Clients;
• Management of credentials and permissions;
• Event monitoring and logging;
• Backups;
• Incident response procedures;
• Supplier control;
• Confidentiality of authorised persons.

The description of the measures actually implemented is set out in the Security Policy and the applicable contractual documentation.

No technological system can guarantee the absolute elimination of all risks.

Under the GDPR, and subject to the respective requirements, data subjects may exercise the rights of:

• Information and access;
• Rectification;
• Erasure;
• Restriction of processing;
• Data portability;
• Objection;
• Withdrawal of consent;
• Not being subject to certain solely automated decisions.

Requests concerning processing for which Doconti is controller may be sent to [Privacy e-mail — to be completed].

Doconti will respond within the time limits set out in applicable law, as a rule within one month, without prejudice to legally permitted extensions.

Where the request relates to documents processed by Doconti on behalf of an accounting firm or other entity, it may be forwarded to the competent controller.

Doconti will provide the assistance legally and contractually incumbent upon it.

13.1. The deletion of an account does not necessarily result in the immediate erasure of all personal records relating to payments, legal obligations or security.

13.2. With regard to Clients' content, return or deletion will be carried out in accordance with the legitimate instructions of the controller and the Data Processing Agreement.

13.3. The portability of personal data is subject to the requirements and limits of Article 20 of the GDPR and does not necessarily equate to full access to all commercial, professional or confidential documents stored on the platform.

13.4. Doconti will protect the rights of third parties and the confidentiality of information that cannot be legitimately disclosed.

Doconti may use cookies and local storage technologies to ensure:

• a) Authentication and session maintenance;
• b) Security and fraud prevention;
• c) Technical functioning of the application;
• d) Legitimate user preferences;
• e) Performance measurement and usage analytics, where permitted;
• f) Marketing and advertising, where applicable and duly authorised.

Strictly necessary cookies may be used as permitted by law.

Non-essential cookies depend on prior consent, where legally required.

The user may accept, reject or manage categories of cookies via the respective preferences mechanism.

The actual list of cookies, purposes, providers and retention periods shall be made available at Cookie Policy.

Doconti may send communications relating to features, updates or campaigns as permitted by applicable law.

Promotional communications shall be subject to the appropriate lawful basis and must provide a simple opt-out or cancellation mechanism, as required by law.

Operational messages essential to contract performance are not considered, by that circumstance alone, to be advertising communications.

16.1. Doconti will maintain procedures for the detection, investigation, containment and documentation of security incidents.

16.2. When acting as processor, it will notify the controller of any personal data breaches of which it becomes aware, without undue delay.

16.3. When acting as controller, it will assess the need to notify the Comissão Nacional de Proteção de Dados (CNPD) and the affected data subjects, pursuant to Articles 33 and 34 of the GDPR.

16.4. Any public communication of incidents will respect legal requirements, system security and the rights of the parties involved.

Without prejudice to any other administrative or judicial remedy, data subjects may lodge a complaint with the:

Comissão Nacional de Proteção de Dados (CNPD)

Website: www.cnpd.pt

Doconti may update this Policy whenever relevant legal, technological or organisational changes occur.

Material changes will be communicated through appropriate means.

Information on the version in force and the date of the last update will be maintained.

For queries regarding this Policy, data protection or the exercise of rights:

Entity: [Company name — to be completed]

Email: [Privacy e-mail — to be completed]

Address: [Address — to be completed]