Privacy Policy

1. Controller

Nibsy Tech Ltd
71-75 Shelton Street
Covent Garden
London WC2H 9JQ
United Kingdom
Email: datenschutz@dokuscan.com

2. What data do we process?

2.1 Registration data

Purpose: Provision and administration of your user account
Legal basis: Art. 6 (1)(b) GDPR (performance of a contract)

• Email address
• Password (stored encrypted, no plaintext access possible)
• Registration date and time
• IP address at the time of registration

2.2 Document and scan data

Purpose: Text recognition, AI analysis and field extraction
Legal basis: Art. 6 (1)(b) GDPR (performance of a contract)

• Uploaded files (PDF, JPG, PNG)
• Fields extracted from documents (e.g. names, dates, amounts, addresses — depending on the template)
• Template configurations (field names, types, hints)
• Upload timestamps and technical metadata
• Extraction status and confidence score

2.3 Payment data

Purpose: Processing of scan packages
Legal basis: Art. 6 (1)(b) GDPR (performance of a contract)

• Payment status and package ID
• Transaction reference of the payment service provider
• Time of payment

Credit card or bank account data is not stored on DokuScan servers. Processing is carried out exclusively via Mollie B.V.

2.4 Usage data

Purpose: Service optimization, abuse detection and system security
Legal basis: Art. 6 (1)(f) GDPR (legitimate interest)

• Login times and frequency
• Features and settings used
• Browser type and version
• IP address (anonymized after a short period)
• Error messages and technical logs

3. Storage location and security

Nibsy Tech Ltd is based in the United Kingdom. Data transfers between the EU/EEA and the United Kingdom are covered by an adequacy decision of the European Commission.

Security measures

• SSL/TLS encryption for all data transfers
• Encrypted file storage in an EU data center (Frankfurt)
• Access control and complete data separation between accounts
• Regular security and software updates
• Daily encrypted backups (location: EU)
• Automatic detection and blocking of attack attempts

4. Text recognition and AI processing

4.1 Text recognition

Uploaded documents are first checked for embedded text. Digital PDFs are read directly. Scanned documents and photos without embedded text are sent for text recognition (OCR) to a specialized service provider acting as a processor (see section 8.3). Extracted text data is assigned to your account and not used for other purposes.

4.2 AI-based field extraction

To reliably extract the defined fields, the text content obtained from documents is analyzed using AI models. Processing is carried out by specialized third-party AI services operating exclusively in EU data centers.

• Processing exclusively in EU data centers
• Used only to analyze your documents as part of contract performance
• Your documents or extracted data are never used to train AI models
• No profiling for purposes other than document processing
• Depending on the document and extraction mode, either the recognized text or, in image mode, the images of the document pages are transmitted — solely for extraction

Legal basis: Art. 6 (1)(b) GDPR (performance of a contract). This AI-based processing is technically necessary to provide the contractually agreed service.

4.3 Processing of personal data contained in documents

Depending on the type of document uploaded, documents may contain personal data of third parties (e.g. names on delivery notes, employee data on timesheets). Responsibility under data protection law for the lawfulness of processing this data lies with the user as the controller within the meaning of the GDPR. Upon request, we provide a data processing agreement (DPA).

4.4 Email inbox

If you use the inbox function of a template, we process the emails sent to the inbox address. We store the supported attachments (PDF and common image formats) and the sender address as a note on the scan; the email body is not stored. Attachments are processed like a manual upload. If processing fails, we send a notice to the sender address. Emails are received through a specialized email service provider acting as a processor (see section 8.5).

5. Retention period

After termination of the contract, data is permanently deleted or anonymized within 30 days, unless statutory retention obligations prevent this.

6. Your rights

You have the following rights regarding your personal data:

To exercise your rights, please contact: datenschutz@dokuscan.com

7. Cookies

7.1 Technically necessary cookies

Technically required for the website to function — no consent required:

• Session cookie: Manages your login status (deleted when the browser is closed)
• CSRF token: Protection against cross-site request forgery attacks
• Language setting: Stores your selected language (DE/EN/PL/ES)

7.2 No advertising or tracking cookies

DokuScan does not use advertising cookies, social media trackers or cross-site tracking. No usage profiles are created for advertising purposes.

8. Third-party providers

8.1 Payment processing — Mollie B.V.

We use Mollie B.V., Keizersgracht 313, 1016 EE Amsterdam, Netherlands, to process scan packages. Only the data necessary for payment processing is transmitted. Mollie processes data in accordance with the GDPR. Further information at mollie.com/en/privacy.

8.2 File storage — AWS S3 (EU Frankfurt)

Uploaded documents are stored encrypted on Amazon S3 in the EU Frankfurt region (eu-central-1). No transfer to other AWS regions takes place. Amazon processes data on the basis of a data processing agreement pursuant to Art. 28 GDPR.

8.3 Text recognition and AI processing

For text recognition (OCR) and field extraction we use specialized service providers as processors. The AI services for field extraction are operated exclusively in EU data centers. Where processing outside the European Economic Area cannot be ruled out for text recognition, it takes place on the basis of an adequacy decision or standard contractual clauses (Art. 44 et seq. GDPR). Only the content required for processing (text or page images) is transmitted. Use for training or other purposes is contractually excluded.

8.4 Hosting and infrastructure

DokuScan is operated on dedicated servers in Germany. All service providers used are bound by data processing agreements pursuant to Art. 28 GDPR.

8.5 Email reception

To receive emails sent to inbox addresses we use a specialized email service provider as a processor. Where processing outside the European Economic Area cannot be ruled out, it takes place on the basis of standard contractual clauses (Art. 44 et seq. GDPR).

9. Data processing on behalf of users

Where users process personal data of third parties via DokuScan (e.g. employee data on timesheets, customer data on delivery notes), DokuScan acts as a processor within the meaning of Art. 28 GDPR in this context. Upon request, we provide a data processing agreement (DPA). The DPA includes the list of sub-processors used.

Requests to: datenschutz@dokuscan.com

10. Changes to this privacy policy

We reserve the right to amend this privacy policy to adapt it to changes in the law or to changes in our service. In the event of material changes, we will inform you by email or directly within the application. The date of the last update is shown at the bottom of this page.

11. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority regarding our processing of personal data. The competent supervisory authority for hosting in Germany is:

Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI)
Graurheindorfer Straße 153
53117 Bonn, Germany
www.bfdi.bund.de

Last updated: April 2026 · Version 1.0