DokDesk Privacy Policy

1. Pre-launch draft and not legal advice

DokDesk is currently in an early-access, pre-launch stage. This Privacy Policy is a generic draft intended as a starting point. It should be reviewed and adapted by qualified legal counsel before it is relied upon as a final, binding document, and the named contact details, the legal entity behind DokDesk, and any specific dates should be completed at that time.

Nothing in this policy is legal advice. DokDesk is not a law firm and does not provide legal advice. The descriptions here are intended to be understandable rather than exhaustive, and where this policy differs from applicable law, applicable law prevails.

Because DokDesk is pre-launch, the way we process data may change as the service develops. When we make a material change, we will update this policy and, where appropriate, take reasonable steps to let users know.

2. Who we are and the scope of this policy

In this policy, "DokDesk", "we", "us" and "our" refer to the provider of the DokDesk service. DokDesk is a secure contract workflow for the Baltics and the EU: it lets you build contracts from reusable templates with dynamic data fields and clauses, work on a single live version through negotiation, sign electronically at the eIDAS SES/AES level using EU national electronic identity methods such as Smart-ID, Mobile-ID and other national eIDs through a no-account secure link, and retain a record of each signature.

DokDesk is a contract workflow and electronic-signing service only. It is not invoicing, payments, accounting, or a CRM, and this policy does not cover any such activities.

This policy applies to personal data we process about visitors to our website, people who request early access, account holders, and individuals who are invited to view, negotiate or sign a contract. It does not cover third-party websites or services that may be linked from ours, which have their own privacy practices.

3. What personal data we process and why

Account and contact data: when you register interest, request early access, or create an account, we may process information such as your name, email address, organisation name, and your communications with us. We use this to provide access, respond to enquiries, and operate the service. The legal basis is typically the performance of a contract with you, our legitimate interest in operating and improving DokDesk, or your consent where required.

Contract and document data: when you create, negotiate or sign a contract, we process the contents of templates, the data you enter into dynamic fields, the parties involved, version history, and negotiation activity. Contracts and the people named in them may include personal data; we process this to deliver the contract workflow on your behalf. Where you use DokDesk to handle other people's data within your contracts, you are generally the controller of that data and we act as a processor on your instructions.

Signing and evidence data: to support electronic signatures under eIDAS, and to produce a court-ready evidence record, we process information about each signature, including who signed, when they signed, the signing method used, and identity information returned by the relevant electronic identity service. We process this to perform the signing service, to create reliable evidence of signing, and to comply with our legal obligations.

Technical and usage data: we may process limited technical information such as log data, device and browser information, and basic usage analytics, to keep the service secure, diagnose problems, and improve it. On this website we use Google Analytics 4 for aggregate usage statistics, and it runs only after you consent via the cookie banner. The legal basis is usually our legitimate interest in security and service quality, or your consent for non-essential analytics.

4. Electronic identification, eIDAS and signing

DokDesk supports electronic signing at the eIDAS Simple (SES) and Advanced (AES) levels using EU national electronic identity methods, including Smart-ID, Mobile-ID and other national eIDs, accessed through a no-account secure link. When you sign, identity verification is carried out by the relevant electronic identity service, and that service processes your identity data according to its own terms and privacy practices.

Qualified signing (QES) is architecture-ready, meaning DokDesk is designed so that qualified trust providers and qualified signing methods can be connected. QES is not represented here as already operating in production, and this policy will be updated if and when qualified signing is made available.

The identity and signature information we receive is used to complete the signature and to build the evidence record associated with the contract, so that the parties have a reliable account of how, when and by whom a document was signed.

5. Legal bases, retention and data location

We rely on the GDPR legal bases that fit each purpose, which may include performance of a contract, our legitimate interests, compliance with a legal obligation, and your consent. Where we rely on consent, you may withdraw it at any time, without affecting processing that has already taken place.

We keep personal data for as long as needed to provide the service and to meet legal, evidentiary and accountability requirements. Because the evidence record exists to demonstrate the validity of a signature over time, signing and evidence data may be retained for longer than other data. When data is no longer needed, we take reasonable steps to delete or anonymise it.

DokDesk processes and stores personal data within the EU. We use technical and organisational measures intended to protect data, such as access controls and encryption in transit, and we work only with service providers that offer appropriate safeguards. Specific sub-processors are not named in this generic draft and should be listed once finalised.

6. Sharing your data and our service providers

We share personal data only as needed to run DokDesk. This includes other parties to a contract you are involved in, who will see the contract content, version history and signing information relevant to that contract.

We also rely on service providers that help us operate, such as hosting, infrastructure and electronic identity services. These act on our instructions or under their own role where they verify identity, and are expected to apply appropriate data-protection safeguards. The specific providers should be listed in a finalised version of this policy.

We do not sell personal data. We may disclose data where required by law or to establish, exercise or defend legal claims, and we may transfer data as part of a corporate transaction, in each case with appropriate protections.

7. Your rights and how to contact us

Under the GDPR you have rights over your personal data, which may include the rights to access, rectify, erase, restrict or object to processing, and to data portability, as well as the right to withdraw consent where processing is based on consent. Where DokDesk acts as a processor for contract data controlled by an organisation, we will direct relevant requests to that organisation.

To exercise your rights or ask a question about this policy, please contact DokDesk using the contact details to be provided in the finalised version. We will respond in line with applicable law. If we cannot resolve your concern, you have the right to lodge a complaint with a data protection supervisory authority in the EU, typically in the country where you live or work.

Because DokDesk is pre-launch, this policy is a generic draft and the contact information, supervisory-authority details and entity information are placeholders to be completed and reviewed by qualified counsel before launch.