Privacy policy

Version dated 2 September 2026

This Privacy Policy explains how DoxyChain sp. z o.o. processes personal data in connection with the use of the DoxyChain website, applications and services. Information about cookies and similar technologies is provided in a separate Cookies Policy.

1. Controller and contact details

The controller of personal data processed for the purposes described in this Privacy Policy is DoxyChain sp. z o.o., with its registered office in Warsaw at ul. Złota 75A/7, 00-819 Warsaw, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0000805663, NIP 7010946739 and REGON 384458655 ("DoxyChain", "we", "us" or "our").
‍
You can contact us regarding personal data protection matters:
- by email at contact@doxychain.com;
- orby post at DoxyChain sp. z o.o., ul. Złota 75A/7, 00-819 Warsaw, Poland.

DoxyChain has appointed a Data Protection Officer. You can contact the Data Protection Officer by email at iod@doxychain.com or by post at DoxyChain's registered office, marking the correspondence for the attention of the "Data Protection Officer".

2. When DoxyChain acts as a controller and when it acts as a processor

DoxyChain acts as a controller where it independently determines the purposes and means of processing, in particular in relation to:
- visitors to the DoxyChain website;
- individuals who create an account and use account administration features;
- representatives, employees and contractors of customers and prospective customers;
- individuals who contact us, use our support services or participate in events;
- recipients of DoxyChain marketing communications;
- billing, service security and the establishment, exercise or defence of legal claims.

Where a DoxyChain customer uploads documents or other data to the system, invites individuals to sign a document or otherwise determines the purposes of processing as part of its business process, that customer will generally be the controller of the relevant data and DoxyChain will process the data on the customer's behalf as a processor. The rules governing such processing are set out in the agreement with the customer, including the data processing agreement. An individual whose data is contained in a customer's documents or who has received an invitation to sign from a customer should first direct any request concerning their rights to that customer. DoxyChain assists its customers in responding to such requests in accordance with applicable law and the relevant agreement.

This Privacy Policy does not replace the privacy information that a DoxyChain customer is required to provide to individuals whose data it places in the system.

3. Personal data we process

Depending on how you use DoxyChain, we may process the following categories of personal data:

• identification and profile data, such as your first and last name, username, job title, organisation and account identifier;
• contact data, such as your email address, telephone number and postal address;
• account and authentication data, such as encrypted or hashed authentication credentials, login information, account settings and authentication methods;
• contract and billing data, such as customer details, subscription plan, order history, invoices, payments and correspondence relating to the agreement;
• technical and usage data, such as your IP address, device and session identifiers, browser type and version, operating system, language, timestamps, security logs, error information and service activity;
• communications and support data, such as the content of messages, support requests and conversations, as well as submitted attachments;
• marketing data and preferences, such as consents, objections, preferred communication channels and information about interactions with messages or the website—only to the extent permitted by law;
• document and signing data, such as document metadata, signatory data, the status and time of actions, the audit trail and information necessary to ensure integrity and demonstrate the course of the process—primarily where DoxyChain acts as a processor on behalf of a customer.

When the qualified electronic seal functionality is used, we may process the user's identification and contact data, organisation data, document data, and technical and evidentiary information concerning the application of the seal. The qualified electronic seal service is provided by an external qualified trust service provider. The scope of the data processed depends on the selected functionality and the requirements of that provider.

4. Sources of personal data

We obtain personal data:

• directly from you, for example when you register, contact us, make a purchase or use a service;
• from the organisation that created an account for you, designated you as a user or invited you to sign a document;
• automatically from your device, browser and use of the service;
• from login or integration providers selected by you or your organisation;
• from providers of payment, security, support and analytics services, to the extent permitted by law;
• from publicly available sources or business partners—only where an appropriate legal basis exists and the applicable transparency obligations have been fulfilled.

How we protect your information

We adopt appropriate data collection, storage, and processing practices and security measures to protect against unauthorized access, alteration, disclosure, or destruction of your personal information, username, password, transaction information, and data stored on our Site.

Sharing your personal information

We do not sell, trade, or rent Users' personal identification information to others. We may share generic aggregated demographic information not linked to any personal identification information regarding visitors and users with our business partners, trusted affiliates, and advertisers for the purposes outlined above.

Cookies

Our Site may use "cookies" to enhance User experience. Users' web browsers place cookies on their hard drive for record-keeping purposes and sometimes to track information about them. Users may choose to set their web browser to refuse cookies or to alert you when cookies are being sent. If they do so, note that some parts of the Site may not function properly.

Changes to this privacy policy

Our Site may use "cookies" to enhance User experience. Users' web browsers place cookies on their hard drive for record-keeping purposes and sometimes to track information about[Your Company Name] has the discretion to update this privacy policy at any time. When we do, we will revise the updated date at the bottom of this page. We encourage Users to frequently check this page for any changes to stay informed about how we are helping to protect the personal information we collect. You acknowledge and agree that it is your responsibility to review this privacy policy periodically and become aware of modifications them. Users may choose to set their web browser to refuse cookies or to alert you when cookies are being sent. If they do so, note that some parts of the Site may not function properly.