Privacy Policy

1. Controller

SeeBubble Media FlexCo, Mühlweg 5, 7062 Sankt Margarethen im Burgenland, Austria. E-mail: martin.bundschuh@seebubble.me.

2. This website

When you visit this website, our server processes technically necessary data: IP address, time, page requested, browser and operating system. This data is used to deliver the page, to defend against attacks and to troubleshoot errors, and is deleted after a short time. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

This website uses no trackers, no analytics tools and no advertising cookies. Fonts and all content are loaded from our own server. Your language choice and color scheme are stored only in your browser (local storage) and are not transmitted to us.

Exception on the purchase page: there, when you click "Continue to payment", we load the payment dialog of our partner Paddle (see section 6).

3. Contact form

If you send us a message via the contact form, we process your name, company, e-mail address, optionally your phone number and your message in order to answer your enquiry (Art. 6(1)(b) and (f) GDPR). The message is sent to us as an e-mail; we do not store it in the database. To prevent abuse, we briefly count requests per IP address.

4. The DocTrace platform

Companies use DocTrace to have documents signed. In doing so, DocTrace processes on behalf of the respective company: user data (name, e-mail address, roles, login times), recipient data (name, e-mail address, optionally company, employee number, location, date of birth), the uploaded documents, the drawn signatures, the final versions and the audit log with timestamps, IP addresses and device identifiers of the people involved.

For this data, the respective company is the controller within the meaning of the GDPR; SeeBubble Media FlexCo is the processor. We provide a data processing agreement pursuant to Art. 28 GDPR for this purpose. If you have questions about a document you have been asked to sign, please contact the company that sent it to you.

The audit log is deliberately immutable: its purpose is to prove who did what with a document and when. Entries cannot be changed or deleted afterwards; the company can, however, archive documents and cancel its account.

5. Hosting and storage location

DocTrace runs on a server in the Google Cloud region europe-west3 (Frankfurt am Main, Germany). Documents and final versions are kept in a storage bucket in the same region that prohibits deleting and overwriting. The provider is Google Cloud EMEA Limited, Ireland, with whom a data processing agreement with EU standard contractual clauses is in place.

Connections are encrypted (TLS). Credentials for mail servers and payment services are stored encrypted.

6. Payment via Paddle

The purchase of a plan is handled by our payment partner Paddle.com Market Ltd (United Kingdom) as the merchant (Merchant of Record). When you click "Continue to payment", Paddle's payment dialog is loaded; Paddle then processes your payment and billing data under its own responsibility. Payment data never reaches our servers. We receive customer and subscription identifiers and the payment status from Paddle in order to set up and manage your company account. Paddle's privacy policy is available at paddle.com/legal/privacy.

7. E-mail delivery

DocTrace sends e-mails with signing links, final versions and invitations. Companies can enter their own mail server for this; the e-mails are then sent through it. Otherwise DocTrace sends via Amazon Web Services (Amazon SES) in the Frankfurt region, alternatively Brevo (Sendinblue SAS, France); servers and storage run on Google Cloud in the Frankfurt am Main data centre (europe-west3).

8. Retention period

Server logs: 30 days. Contact enquiries: until resolved, then in accordance with statutory retention obligations. Platform data: for as long as the company uses DocTrace and thereafter in accordance with its instructions and the statutory retention periods; the details are governed by the data processing agreement.

9. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection, insofar as the legal requirements are met. To exercise these rights, contact the address given above. If your request concerns a document that a company sent you via DocTrace, we will forward it to that company or name your contact person there.

You can lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb.gv.at).

10. Changes

We update this policy when our processing changes. The version published here at any given time applies.