Privacy policy

1. Who we are

Doqubox is a product of Aer Software Solutions B.V., registered with the Dutch Chamber of Commerce (KvK) under number 27332530, with its registered office in Amsterdam and its offices at Koepelplein 1E, 2031WL Haarlem, the Netherlands.

2. Scope and roles

This policy covers account users and external senders and recipients. Doqubox acts as:

• Controller for its own customer relationships, billing, legal obligations, website analytics, and platform security and abuse prevention where it independently determines the purposes.
• Processor for customer documents and metadata, recipient verification, workspace users, permissions, activity records, and security supporting that processing. The customer organization is generally the controller.

3. Personal data we process

• Account details: name, email address, role, and language.
• Authentication and verification data: sessions, IP addresses, browser information, and email or SMS verification records.
• Files and metadata; request and transfer details such as senders, recipients, subjects, and status.
• Billing and payment data, support communications, and operational logs.
• With consent, website analytics data such as cookie identifiers, page views, and events.

4. Purposes and legal bases

For Doqubox's own controller activities:

• Customer administration, billing, and support: contract performance if you are a contracting party; otherwise our legitimate interest in managing business relationships.
• Accounting and statutory reporting: legal obligations.
• Platform security and abuse prevention: our legitimate interest in protecting the service.
• Optional website analytics: your consent.

5. Security and encryption

Files and their metadata, including original filenames and file types, are end-to-end encrypted in the sender's browser and decrypted in the recipient's browser. Account, verification, billing, log, and email or SMS delivery data are outside this encryption.

Additional controls include encryption in transit, encrypted file storage, access restrictions, and monitoring. See the security page.

6. Recipients and subprocessors

We use providers for hosting, email, SMS verification, payments, and optional website analytics. Their roles, data categories, and locations are in the subprocessor list. The DPA governs processing on customers' behalf, including subprocessor notice and objection rights.

7. International transfers

If personal data is processed outside the EEA, we apply appropriate safeguards under GDPR, such as an adequacy decision or Standard Contractual Clauses (SCCs), where required.

8. Retention

The retention policy sets out periods and deletion criteria by data category. Customer instructions and the DPA govern customer data; data for our own purposes is kept only as necessary or legally required.

9. Your rights

Depending on the processing, you may request access, correction, erasure, restriction or portability, object to processing, and complain to a supervisory authority, including the Dutch Autoriteit Persoonsgegevens.

For data processed on a customer's behalf, address your request to that organization first. Doqubox assists as required by law.

10. Changes

We may update this privacy policy. The latest version is always available on this page.