Privacy Policy

Doctile · doctile.lv and doctile.eu · Approved and effective from June 5, 2026

The purpose of this Privacy Policy is to provide natural persons (hereinafter — persons) with information about how SIA “Doctile”, registration No. 40203744576, legal address Sietnieku iela 3–1, Mārupe, Mārupe municipality, LV-2167, Latvia (hereinafter — “Doctile”, “We”), as the data controller within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter — GDPR), collects, uses, stores, and protects personal data when You use the websites doctile.lv and doctile.eu and the Doctile services (hereinafter — the “Service”).

1. Controller and contact information

Data controller: SIA “Doctile”, registration No. 40203744576, legal address: Sietnieku iela 3–1, Mārupe, Mārupe municipality, LV-2167, Latvia.

Contact for privacy matters: privacy@doctile.eu

General inquiries: info@doctile.eu

Doctile has not appointed a Data Protection Officer (DPO), as the scale and nature of Doctile’s data processing does not meet the criteria of GDPR Article 37. All questions regarding personal data processing can be sent to the email address above: privacy@doctile.eu.

2. What personal data we process

Depending on Your relationship with Doctile, we process the following categories of personal data:

2.1. Account data

• First name, last name
• Email address
• Password (stored in hashed form, bcrypt or similar algorithm)
• Phone number (if voluntarily provided)
• Company name, registration number, legal address (for business customers)

2.2. Payment data

• Billing address and other details
• Payment history (invoices, receipts, last 4 digits of payment methods)

We do not store full payment card data — payments are processed by Stripe Payments Europe Ltd. (a PCI DSS Level 1 certified processor) in accordance with its applicable privacy policy.

2.3. Document and content data

• Customer and supplier data from invoices, receipts, contracts (names, addresses, registration numbers, bank accounts, payment amounts)
• OCR-recognized text and metadata fields (date, amount, VAT, accounting code)
• Uploaded files (PDF, JPG, PNG, XML PEPPOL BIS)

2.4. Technical data

• IP address (anonymized for storage)
• Browser type, language, screen resolution
• Pages visited, interaction with the Service, error logs
• Identifiers generated by cookies and similar technologies (see the Doctile Cookie Policy)

2.5. Communication data

• Content of support requests (emails, chat correspondence)
• Content of surveys and feedback

3. Processing purposes and legal basis

We process personal data only within the scope of the GDPR and based on the legal provisions contained therein:

To safeguard individuals’ legal interests, We always carry out an assessment to ensure that Our interests do not override the data subject’s rights and freedoms. You may request such an assessment (LIA) in writing.

4. Data retention periods

We retain personal data only for as long as necessary for the purpose of processing or as required by law:

• Account data — for the duration of the active contract and 30 (thirty) days after account deletion (to allow the account to be restored).
• Accounting documents (invoices, receipts, contracts) — 5 (five) years in accordance with Article 28 of the Accounting Law.
• Payment history — 5 (five) years.
• Support correspondence — 2 (two) years after the last interaction.
• Marketing consent and correspondence — until consent is withdrawn or 3 (three) years after the last interaction.
• Technical logs — 12 (twelve) months (for investigating security incidents).
• Cookies — see the Cookie Policy.

5. Data recipients and processors

Personal data may be received by the following third parties, with whom We have concluded data processing agreements (DPAs) in accordance with GDPR Article 28:

We do not sell or provide personal data to third parties for marketing or other commercial purposes without Your explicit consent.

6. Data transfers outside the EU/EEA

Doctile’s core operations and personal data storage take place within the territory of the European Union. In certain cases, some service providers (e.g., Google Analytics, Microsoft Clarity, Meta Pixel) may also process technical data outside the EU/EEA, including in jurisdictions deemed adequate.

In all such data transfer cases, appropriate safeguards under GDPR Article 46 are used — Standard Contractual Clauses (SCCs), as well as additional technical and organizational measures (data encryption, IP anonymization, pseudonymization). You may request a copy of the applicable mechanisms by writing to privacy@doctile.eu.

7. Your rights (GDPR Chapter III)

As a data subject, You have the following rights:

• Right of access to Your data (Article 15) — to obtain confirmation and a copy.
• Right to rectification (Article 16) — to request correction of inaccurate data.
• Right to erasure / “to be forgotten” (Article 17) — where the data processing is no longer necessary.
• Right to restrict processing (Article 18) — to suspend data processing in certain cases.
• Right to data portability (Article 20) — to receive Your data in a structured, machine-readable format.
• Right to object to processing (Article 21) — particularly in cases of direct marketing and legitimate interests.
• Right to withdraw consent (Article 7(3)) — at any time, without affecting processing carried out prior to withdrawal.
• Right to lodge a complaint with a supervisory authority — the Data State Inspectorate (www.dvi.gov.lv), Elijas iela 17, Riga, LV-1050.

To exercise any of these rights, please write to privacy@doctile.eu. We process requests within 30 (thirty) days of receipt. In more complex cases, the deadline may be extended by a further 60 (sixty) days, of which You will be notified.

8. Security measures

We implement appropriate technical and organizational measures in accordance with GDPR Article 32:

• Encryption of data at rest and in transit (AES-256, TLS 1.2+).
• Access control based on roles and the principle of least privilege.
• Two-factor authentication (2FA) for administrator accounts.
• Regular security backups and restoration tests.
• Security incident logging and monitoring.
• Staff training on data protection and confidentiality agreements (NDAs).
• Regular security vulnerability assessments.

9. Personal data breaches

In the event of a personal data breach, We:

• Notify the Data State Inspectorate without undue delay, and no later than 72 (seventy-two) hours after becoming aware of the breach (Article 33).
• In cases of high risk, without undue delay also notify the affected data subjects (Article 34).
• Take measures to mitigate the consequences of the breach and prevent recurrence.

10. Processing of children’s personal data

The Doctile Service is not intended for persons under 16 years of age. We do not knowingly collect data about children under 16 years of age. If we learn that such data has been collected without parental or guardian consent, we will delete it without delay. For collecting data of children older than 16, We obtain the consent of the child’s legal representative.

11. Automated decision-making

We do not carry out fully automated decision-making that could produce legal effects concerning You or significantly affect You (within the meaning of GDPR Article 22). OCR and document classification are technical support tools — the final decision is always made by the user.

12. Changes to the Policy

We may update this Privacy Policy. We will notify You of material changes by email or within the Service at least 30 (thirty) days before they take effect. The current version is always available on the websites doctile.lv and doctile.eu.

13. Contact information

Questions and requests regarding personal data processing:

• Email: privacy@doctile.eu
• Postal address: SIA “Doctile”, Sietnieku iela 3–1, Mārupe, LV-2167, Latvia
• Supervisory authority: Data State Inspectorate, Elijas iela 17, Riga, LV-1050, www.dvi.gov.lv

Effective from June 5, 2026. Version 1.0.

SIA “Doctile”, reg. No. 40203744576
Sietnieku iela 3–1, Mārupe, LV-2167, Latvia
info@doctile.eu