Data Controller
The company responsible for the processing described in this policy is:
TechOne CZ s.r.o.
Address: Dělnická 213/12, 170 00 Praha 7, Czech Republic
Company ID: 06010555
Email: privacy@smartdocto.com
When we are the controller
TechOne determines the purposes and means of processing for website visitors, inquiries, user accounts, business communication, support, billing, and service security.
When we are the processor
For personal data contained in customer documents and reference data, we generally act on the customer’s instructions as a processor. The data processing agreement sets out the details.
Who the service is for
SmartDocTO is intended for businesses and other organizations. We process data about their employees and contractors only to the extent needed to provide the service.
Personal Data We Process
The data involved depends on whether you visit the website, submit an inquiry, use an account, or work with a customer’s documents.
Contact and Account Data
Name, work email, telephone number, company, role, authentication data, and user account settings.
Operational and Security Data
IP address, device and browser information, sign-ins, user actions, technical logs, errors, and data needed to protect the service.
Documents & Content
Files you upload for processing, extracted data, and any metadata associated with your documents.
Billing and Support
Billing details, contractual records, support communication, and information needed to handle requests or incidents.
Website Cookies and Analytics
Necessary cookies and, after consent, pseudonymous data about the use of the marketing website through analytics tools.
How We Use Your Data
Service Provision
To provide AI document processing services, including extracting data, generating outputs, and delivering results via API.
Account Management
Managing your user account, authentication, billing, and subscription.
Communication
Sending service updates, notifications, support responses, and important account information.
Operation and Security
Monitoring availability, performance, and security events, preventing abuse, and resolving technical issues.
Legal Compliance
Complying with legal obligations, preventing fraud, and protecting our rights.
Legal Bases for Processing
Performance of a Contract
Account setup, service delivery, support, and billing.
Legitimate Interests
Service security, abuse prevention, handling B2B inquiries, and operational improvement where these interests are not overridden by your rights.
Legal Obligation
Retention of accounting and tax records and cooperation with authorized public bodies.
Consent
Optional analytics and marketing communication where consent is required. You can withdraw consent at any time.
Customer Instructions
We process personal data in customer documents on the customer’s behalf, following documented instructions and the data processing agreement.
We need fields marked as required to handle an inquiry, create an account, or provide the service. Without them, we may be unable to complete the requested step.
Data Retention
We retain data only for as long as needed for the stated purpose. The period depends on the contractual terms, the nature of the data, security needs, and legal obligations.
Inquiries and Business Communication
For the time needed to handle the inquiry and then for a reasonable period for follow-up communication, protection of rights, and records of the business relationship.
Accounts and Service Operation
For the duration of the contractual relationship and then in accordance with the agreed termination process, unless a particular record is needed longer for legal or security reasons.
Customer Documents
According to the customer’s instructions, the data processing agreement, and the agreed retention schedule. An export or deletion can be arranged after termination.
Billing and Accounting Records
For the period required by accounting, tax, and other applicable laws.
Security and Operational Logs
For a period appropriate to secure the service, investigate incidents, and protect rights. The period depends on the type of record and the severity of the event.
Backups
Deleted data may temporarily remain in rotating, segregated backups until it is safely overwritten under the backup schedule. It is not used for routine operations.
Your Rights Under GDPR
Right to Access
You can request a copy of all personal data we hold about you.
Right to Rectification
You can correct inaccurate or incomplete personal information.
Right to Erasure ("Right to be Forgotten")
You can request erasure of personal data. We will respond without undue delay, generally within one month, and erase data unless a legal obligation or another lawful reason requires us to retain specific records.
Right to Restrict Processing
Where the GDPR conditions apply, you can ask us to restrict processing temporarily.
Right to Data Portability
You can export your data in machine-readable format (JSON, CSV).
Right to Object
You can object to processing of your data for marketing or analytics purposes.
Withdrawal of Consent
You can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.
Right to Lodge a Complaint
You can file a complaint with your local data protection authority if you believe your rights have been violated.
If your request concerns personal data inside a customer document, you should normally contact that customer as the controller first. We will support the customer in handling the request.
To exercise your rights, contact us at: privacy@smartdocto.com
Data Security
We use technical and organizational measures appropriate to the type of data processed:
- TLS for data in transit between clients and the service
- Protection of storage and sensitive integration credentials at rest
- Ongoing monitoring of operational and security events
- Role-based access control
- History of user actions and document changes
Changes to This Policy
We may update this policy when the service, providers, or legal obligations change. For material changes, we will state a new effective date and notify affected customers in advance. If consent is required, we will request it separately.
Questions About Privacy?
If you have questions about this privacy policy or how we handle your data, please contact us:
Email: privacy@smartdocto.com