This is a courtesy translation. The German version is legally authoritative.
Privacy Policy
We take the protection of your personal data very seriously. Processing is carried out in accordance with the GDPR. Certain processing steps — in particular the automatic recognition and analysis of document content — are technically necessary to provide the contractually agreed service and are carried out automatically.
1. Controller
Nibsy Tech Ltd
71-75 Shelton Street
Covent Garden
London WC2H 9JQ
United Kingdom
Email: datenschutz@dokuscan.com
2. What data do we process?
2.1 Registration data
Purpose: Provision and administration of your user account
Legal basis: Art. 6 (1)(b) GDPR (performance of a contract)
- Email address
- Password (stored encrypted, no plaintext access possible)
- Registration date and time
- IP address at the time of registration
2.2 Document and scan data
Purpose: Text recognition, AI analysis and field extraction
Legal basis: Art. 6 (1)(b) GDPR (performance of a contract)
- Uploaded files (PDF, JPG, PNG)
- Fields extracted from documents (e.g. names, dates, amounts, addresses — depending on the template)
- Template configurations (field names, types, hints)
- Upload timestamps and technical metadata
- Extraction status and confidence score
2.3 Payment data
Purpose: Processing of scan packages
Legal basis: Art. 6 (1)(b) GDPR (performance of a contract)
- Payment status and package ID
- Transaction reference of the payment service provider
- Time of payment
Credit card or bank account data is not stored on DokuScan servers. Processing is carried out exclusively via Mollie B.V.
2.4 Usage data
Purpose: Service optimization, abuse detection and system security
Legal basis: Art. 6 (1)(f) GDPR (legitimate interest)
- Login times and frequency
- Features and settings used
- Browser type and version
- IP address (anonymized after a short period)
- Error messages and technical logs
3. Storage location and security
All documents and extracted data are stored exclusively on servers in Germany (EU). Personal data is not transferred to third countries without an adequate level of data protection.
Nibsy Tech Ltd is based in the United Kingdom. Data transfers between the EU/EEA and the United Kingdom are covered by an adequacy decision of the European Commission.
Security measures
- SSL/TLS encryption for all data transfers
- Encrypted file storage in an EU data center (Frankfurt)
- Access control and complete data separation between accounts
- Regular security and software updates
- Daily encrypted backups (location: EU)
- Automatic detection and blocking of attack attempts
4. Text recognition and AI processing
4.1 Text recognition
Uploaded documents are first checked for embedded text. Digital PDFs are read directly. Scanned documents and photos without embedded text are processed using text recognition (OCR) on servers in Germany. Extracted text data is assigned to your account and not used for other purposes.
4.2 AI-based field extraction
To reliably extract the defined fields, the text content obtained from documents is analyzed using AI models. Processing is carried out by specialized third-party AI services operating exclusively in EU data centers.
- Processing exclusively in EU data centers
- Used only to analyze your documents as part of contract performance
- Your documents or extracted data are never used to train AI models
- No profiling for purposes other than document processing
- No transmission of complete documents — only the text content relevant for extraction is processed
Legal basis: Art. 6 (1)(b) GDPR (performance of a contract). This AI-based processing is technically necessary to provide the contractually agreed service.
4.3 Processing of personal data contained in documents
Depending on the type of document uploaded, documents may contain personal data of third parties (e.g. names on delivery notes, employee data on timesheets). Responsibility under data protection law for the lawfulness of processing this data lies with the user as the controller within the meaning of the GDPR. Upon request, we provide a data processing agreement (DPA).
5. Retention period
| Data type | Retention period |
|---|---|
| Account data | Until termination and expiry of statutory retention periods |
| Uploaded documents | Until manually deleted by the user or account closure |
| Extracted data | Until deleted by the user or termination of the contract |
| Payment references | 10 years (statutory retention obligation) |
| Technical log files | Generally up to 30 days |
| Backup data | Up to 90 days (rolling backups) |
After termination of the contract, data is permanently deleted or anonymized within 30 days, unless statutory retention obligations prevent this.
6. Your rights
You have the following rights regarding your personal data:
Right of access (Art. 15 GDPR)
Information about the personal data we process
Right to rectification (Art. 16 GDPR)
Correction of inaccurate or incomplete data
Right to erasure (Art. 17 GDPR)
Deletion of your data under the conditions set out in the GDPR
Right to restriction (Art. 18 GDPR)
Restriction of processing in certain cases
Right to data portability (Art. 20 GDPR)
Transfer of your data in a common, machine-readable format
Right to object (Art. 21 GDPR)
Objection to processing based on legitimate interest
To exercise your rights, please contact: datenschutz@dokuscan.com
7. Cookies
7.1 Technically necessary cookies
Technically required for the website to function — no consent required:
- Session cookie: Manages your login status (deleted when the browser is closed)
- CSRF token: Protection against cross-site request forgery attacks
- Language setting: Stores your selected language (DE/EN/PL/ES)
7.2 No advertising or tracking cookies
DokuScan does not use advertising cookies, social media trackers or cross-site tracking. No usage profiles are created for advertising purposes.
8. Third-party providers
8.1 Payment processing — Mollie B.V.
We use Mollie B.V., Keizersgracht 313, 1016 EE Amsterdam, Netherlands, to process scan packages. Only the data necessary for payment processing is transmitted. Mollie processes data in accordance with the GDPR. Further information at mollie.com/en/privacy.
8.2 File storage — AWS S3 (EU Frankfurt)
Uploaded documents are stored encrypted on Amazon S3 in the EU Frankfurt region (eu-central-1). No transfer to other AWS regions takes place. Amazon processes data on the basis of a data processing agreement pursuant to Art. 28 GDPR.
8.3 AI processing (EU region)
Third-party AI services operated exclusively in EU data centers are used for field extraction. No complete documents are transmitted — only the text content relevant for extraction. Use for training or other purposes is contractually excluded.
8.4 Hosting and infrastructure
DokuScan is operated on dedicated servers in Germany. All service providers used are bound by data processing agreements pursuant to Art. 28 GDPR.
9. Data processing on behalf of users
Where users process personal data of third parties via DokuScan (e.g. employee data on timesheets, customer data on delivery notes), DokuScan acts as a processor within the meaning of Art. 28 GDPR in this context. Upon request, we provide a data processing agreement (DPA).
Requests to: datenschutz@dokuscan.com
10. Changes to this privacy policy
We reserve the right to amend this privacy policy to adapt it to changes in the law or to changes in our service. In the event of material changes, we will inform you by email or directly within the application. The date of the last update is shown at the bottom of this page.
11. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority regarding our processing of personal data. The competent supervisory authority for hosting in Germany is:
Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI)
Graurheindorfer Straße 153
53117 Bonn, Germany
www.bfdi.bund.de
Questions about data protection:
Email: datenschutz@dokuscan.com
Response time: Usually within 48 hours
Last updated: April 2026 · Version 1.0