Privacy Policy

1. Data controller

The controller responsible for the processing of your personal data is:

2. Applicable principles

We process your data in accordance with the following principles of Article 5 of the GDPR:

• Lawfulness, fairness and transparency: we clearly inform you about what we do with your data.
• Purpose limitation: we only use it for the purposes we communicate to you.
• Data minimization: we request only the essential data.
• Accuracy: we keep data up to date and correct inaccurate data.
• Storage limitation: we do not keep data longer than necessary.
• Integrity and confidentiality: we apply encryption, access control and audit.
• Accountability: we can demonstrate our GDPR compliance at all times.

3. What data we collect

Depending on the type of interaction, we may collect the following categories:

We do not process special categories of data (health, ethnic origin, political opinions, etc.) unless essential for a specific service and always with explicit consent or appropriate legal basis.

4. Purposes and legal basis

Depending on the activity, the legal basis and purpose are different. This table summarizes each case:

5. Retention periods

We keep the data strictly for the periods necessary:

• Sales requests (demo, contact): 2 years from the last contact, unless there is a contractual relationship.
• Clients: during the term of the contract and, after its termination, until the statute of limitations on potential liabilities (generally 5 years under commercial regulations and 6 years under tax regulations).
• Tax and accounting data: 6 years (art. 30 of the Spanish Commercial Code).
• Newsletter: until you withdraw your consent.
• Candidates: 1 year, unless express consent is given for future processes.
• Security and access logs: 12 months, unless a longer legal obligation applies.

After these periods, the data is blocked (available only for legal requirements) and finally securely deleted.

6. Recipients and data processors

We do not sell your data. We only share it with whoever is strictly necessary:

• Public administrations, judges and courts: when there is a legal obligation.
• Banks: to manage collections and payments.
• Legal advisors and auditors: under a duty of confidentiality.
• Data processors: service providers acting on our behalf under contract (art. 28 GDPR), such as:

All of them sign a data processor agreement in accordance with Article 28 of the GDPR and are subject to the required guarantees.

7. International transfers

By default, your data is hosted on servers located in the European Union. When a processor involves a transfer outside the European Economic Area (for example, to the US), we apply appropriate guarantees:

• Standard Contractual Clauses approved by the European Commission (Decision EU 2021/914).
• Transfer Impact Assessment (TIA) where applicable.
• Supplementary technical measures (encryption, anonymization, etc.).

You can request a copy of the guarantees applied by writing to dpo@dokuflex.com.

8. Your rights

As a data subject, you have the following rights recognized in articles 15 to 22 of the GDPR and 12 to 18 of the LOPDGDD:

9. How to exercise your rights

You can exercise these rights free of charge through any of these channels:

• Email: dpo@dokuflex.com (recommended)
• Postal mail: Paina Nuevas Tecnologías SL – Data Protection Officer, Pau Claris 162, 08037 Barcelona

To verify your identity we may request a copy of an official document. We will respond within a maximum of one month, extendable by two more months if the request is complex, informing you of the extension.

If you believe we have not properly addressed your request, you can file a complaint with the AEPD (see next section).

10. Complaint to the AEPD

You have the right to file a complaint with the Spanish Data Protection Agency (AEPD) if you believe that the processing of your personal data infringes the regulations:

• Electronic office: www.aepd.es
• Postal address: C/ Jorge Juan, 6. 28001 Madrid
• Phone: 901 100 099 / 912 663 517

Before going to the AEPD, we recommend contacting our DPO; we can normally resolve any queries directly.

11. Automated decisions and profiling

Some Dokuflex processes may include artificial intelligence components (for example, data extraction from invoices with OCR). These processes do not produce significant legal effects on data subjects and are always reviewable by a human.

We do not profile for advertising purposes without your express consent. We do not take decisions exclusively based on automation that significantly affect your rights.

12. Minors

Dokuflex services are aimed at professionals and companies. We do not knowingly process data from minors under 14 years old. If you detect that a minor has provided us with data without parental consent, let us know at dpo@dokuflex.com and we will proceed to delete it.

13. Data security

We apply technical and organizational measures appropriate to the risk, including:

• TLS 1.3 encryption in transit and AES-256 at rest.
• Role-based access control (RBAC) and multi-factor authentication (MFA).
• Access and change audit logs.
• Encrypted backups with retention and regular recovery exercises.
• Annual penetration tests and vulnerability management.
• Mandatory staff training in data protection and security.
• ISO 27001 certification and compliance with Spain's ENS (Medium category).

In case of a security breach that poses a risk to your rights, we will notify you without undue delay and communicate to the AEPD within a maximum of 72 hours.

14. Data Protection Officer (DPO)

We have a Data Protection Officer as a single point of contact for privacy matters:

• Email: dpo@dokuflex.com
• Postal mail: Paina Nuevas Tecnologías SL – DPO, Pau Claris 162, 08037 Barcelona

The DPO oversees GDPR compliance, advises the company and acts as liaison with the AEPD.

15. Amendments to this policy

We may update this policy to reflect legal, technical or operational changes. We will indicate the date of the last update at the beginning of the document. If the change is significant, we will notify you by email or by a prominent notice on the website before it enters into force.

16. Contact

If you have any questions about this policy or about the processing of your data:

• General email: hola@dokuflex.com
• Data protection / DPO: dpo@dokuflex.com
• Form: contacto.html