Data Controller
Company details
- Name
- Visatech S.R.L
- Address
- Via del Lauro 9, Milan, Italy — 20121
- Registration
- Italian Company Registry
Data protection contact
- dpo@docxbuddy.com
- Phone
- Available on request
- Response time
- Within 30 days
Your Rights Under GDPR
Six rights, four of which you can start from this page.
Right to access
Request a copy of the personal data we hold about you.
Right to rectification
Ask us to correct any inaccurate or incomplete personal data.
Right to erasure
Request deletion of your personal data — the right to be forgotten.
Right to data portability
Receive your data in a structured, commonly used, machine-readable format.
Right to restrict processing
Ask us to limit how we use your personal data while we address your concerns.
Right to object
Object to certain kinds of processing, including direct marketing.
Data We Collect and Why
| Category | What we collect | Purpose | Retention |
|---|---|---|---|
| Account information | Name, email, password (encrypted) | Account creation and management | Until account deletion |
| Document data | Uploaded files and content | Providing document processing services | 30 days after deletion |
| Usage data | Service interaction logs | Service improvement and analytics | 12 months |
| Payment information | Billing details, via payment processor | Processing payments | As required by law (7 years) |
Legal Basis for Processing
- Contract performance
- Processing necessary to provide our document services under our terms of service.
- Legitimate interests
- Processing for service improvement, security, and fraud prevention.
- Consent
- For marketing communications and optional features. You can withdraw consent at any time.
- Legal obligations
- Processing required by law, such as tax records and regulatory compliance.
International Data Transfers
Where data leaves the EU, these safeguards travel with it.
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Encryption of all data in transit and at rest
- Regular security audits and assessments
- Preference for EU-based data centres where available
Third-party processors
- Supabase
- Database and authentication USA
- Stripe
- Payment processing USA / EU
- Amazon S3
- Document storage EU (Milan)
- OpenRouter
- AI processing USA
Data Breach Procedure
If a breach occurs, these five steps run in order.
- 1
Notify the authorities
Supervisory authorities are informed within 72 hours.
- 2
Inform those affected
Without undue delay, where the risk to individuals is high.
- 3
Document
Record all breach details and the remedial actions taken.
- 4
Remediate
Take immediate steps to minimise the impact.
- 5
Review
Analyse what happened and improve the security measures.
How to Exercise Your Rights
What to include
- Proof of identity, so we do not hand your data to someone else
- A clear description of your request
- The specific data or processing you are concerned about
We respond within 30 days.
Lodge a Complaint
If our answer does not satisfy you, you can go to a supervisory authority.
Italian Data Protection Authority
Garante per la protezione dei dati personali
Piazza Venezia 11, 00187 Roma, Italy
Your local authority
You can also contact the data protection authority where you live.
Find your local authorityQuestions about your data?
We are here to help you understand and exercise your rights.