The following information explains which personal data we process when you visit this website, use DocuNorm or have a business relationship with us, and which rights you have.
Controller
The controller responsible for data processing is:
FRESEN.IT LTD
Peiraios 30
Floor 1, Flat/Office 1
2023, Strovolos, Nicosia
Cyprus
The company is represented by Raphael Fresen. You can reach us by email at support@docunorm.com.
What data we process and why
Visiting the website
Each time a page is accessed, our server processes your IP address, the date and time, the requested address, the previously visited page, your browser identifier and the status code of the response. The server needs this information to deliver the page, and we need it to detect faults and attacks.
The legal basis is our legitimate interest in secure and fault-free operation (Art. 6(1)(f) GDPR).
Our own visitor measurement
To see which pages are read, we count page views on our own server. We store the requested page including the details in the address, the time, the status code, the previously visited page, your browser identifier and the language your browser prefers.
We do not store your IP address for this. From it and the browser identifier, we create an identifier using a key that is valid only for the current day. This lets us recognise which page views of a day belong together. At midnight (UTC) we discard the key; after that, the identifier can no longer be attributed to anyone. Nothing is stored on your device for this, and the data does not leave our server.
In the logged-in area of DocuNorm, we count in the same way which pages of the application are accessed. There, the identifier is created from account and company, with the same daily key.
The legal basis is our legitimate interest in improving the service based on how it is actually used (Art. 6(1)(f) GDPR).
Statistics with your consent
If you consent to the “Statistics” category in the cookie notice, we store a random number in a cookie on your device. This lets us recognise returning visits beyond a single day. The number is stored with your page views.
If you sign up for the newsletter or the launch notification, the number is also stored with your sign-up. This shows us which pages were read before a sign-up.
The legal basis is your consent (Art. 6(1)(a) GDPR). If you withdraw it, we delete the cookie.
Google Analytics
If you consent to “Google Analytics” in the cookie notice, we load this service from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Without this consent, it is not loaded.
Google then sets cookies on your device and analyses how the website is used: pages visited, length of visit, device, browser and approximate location. In addition, we report to Google when someone signs up for the newsletter or registers. These reports contain neither an email address nor a name.
In the process, data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework. For certified companies, the EU Commission has determined an adequate level of data protection (Art. 45 GDPR).
The legal basis is your consent (Art. 6(1)(a) GDPR). If you withdraw it, we delete Google’s cookies on your device.
Newsletter and launch notification
If you sign up for the newsletter or the launch notification, including via the checkbox in the contact form, we store your email address, the language, the page on which you signed up, the time and your IP address. The IP address serves as proof of the sign-up. Beforehand, we check whether the domain of your email address accepts emails.
We pass your email address, language, page and an identifier of the sign-up to our newsletter service provider. It sends you an email with a confirmation link. Only when you click it are you signed up. You can unsubscribe at any time via the link in every email you receive this way.
The legal basis is your consent (Art. 6(1)(a) GDPR). Providing this information is voluntary; without an email address we cannot send you anything.
Registration and user account
For an account, we store your first and last name, email address, company name, language and your password. We store the password only as a hash from which it cannot be recovered. We also record when you agreed to which version of our terms and conditions. You confirm your email address via a link we send you.
In the settings, you can store further details about your company: address, VAT identification number, phone number, email address and logo.
While you are logged in, we store your IP address and browser identifier with your session. We log changes to templates, contracts, accounts and settings with the time, account, IP address and browser identifier. This makes it possible to trace who changed what.
The legal basis is the contract with you (Art. 6(1)(b) GDPR), and for the log our legitimate interest in traceability and security (Art. 6(1)(f) GDPR). Without name, email address, company name, language and password, we cannot create an account.
Contact form
If you write to us via the contact form, we store your topic, your name, your company if provided, your email address, your message, the language and the page from which you wrote. We send your message by email to our support mailbox and reply to the address you provided. To prevent the form from being submitted en masse, we count for one minute how often it has been sent from your IP address; the IP address is not stored with the enquiry.
The legal basis is the contract or its initiation if the enquiry relates to it (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). If you tick the newsletter checkbox, the section “Newsletter and launch notification” also applies.
Contact by email
If you write to us, we process your details to answer your enquiry. The legal basis is the contract or its initiation if the enquiry relates to it (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).
Business relationship and billing
For the business relationship with you or your employer, we also process contract and billing data, i.e. booked plans, invoices and payments, as well as our correspondence.
- To perform the contract (Art. 6(1)(b) GDPR): for the initiation, performance and handling of the contract and the agreed services.
- Due to legal obligations (Art. 6(1)(c) GDPR): commercial and tax law require certain data to be processed and retained, for instance for invoices and accounting.
- Based on legitimate interests (Art. 6(1)(f) GDPR): to assert or defend legal claims and to ensure IT security.
Data you enter in DocuNorm
In DocuNorm you enter data from which contracts are created, for instance about your employees, customers or contracting partners. You are the controller for this data; we process it on your behalf (Art. 28 GDPR) and conclude a data processing agreement with you for this purpose. You inform the data subjects about this processing yourself.
Cookies and browser storage
We set necessary cookies without consent because the website does not work without them. We only set all others once you have consented in the cookie notice. You can change your choice at any time via “Cookie settings” at the bottom of every page.
Essential
- docunorm-session: keeps your session, your language and your login. Expires 120 minutes after your last page view.
- XSRF-TOKEN: protects forms against forged submissions. Expires after 120 minutes.
- remember_web_…: only if you choose “Stay signed in” when signing in. Keeps you signed in for up to 400 days.
- consent: stores your choice in the cookie notice. Expires after one year.
Statistics
- visitor_id: the random number for statistics. Expires after one year.
Google Analytics
- _ga and _ga_…: set by Google to distinguish visits. Expire after up to two years.
Browser storage
The following are kept in your browser’s storage (local storage) without an expiry date:
- docunorm-consent: your choice in the cookie notice, with a timestamp.
- fds-contrast-mode: only if you use the contrast switch. Remembers your setting.
Recipients
Within our company, only the departments that need your data to fulfil our contractual and legal obligations have access to it. We handle hosting ourselves (fresenit.systems): we do not use any processors for the servers on which DocuNorm runs or for the mail servers through which we send transactional emails, for instance about your account and contracts. Newsletters and the launch notification are sent by our newsletter service provider.
We only pass data on to others where this is permitted or required by law:
- Newsletter service provider, based in the United Kingdom: receives the details of your sign-up. According to its own information, it processes them exclusively in the EU and, as a processor, is bound by our instructions (Art. 28 GDPR).
- Google: only with your consent, for Google Analytics.
- Stripe, based in Ireland: handles payments for paid plans and receives the necessary details for this (Art. 6(1)(b) GDPR). Stripe also transfers data to its parent company in the USA, which is certified under the Data Privacy Framework.
- Professional advisers and authorities: tax advisers, auditors, legal advisers, banks and tax and judicial authorities, insofar as they need the data for their tasks.
We only transfer data to countries outside the EU and the EEA if the EU Commission has determined an adequate level of data protection there or if appropriate safeguards have been agreed, such as the EU standard contractual clauses. Such a decision exists for the United Kingdom and for companies in the USA certified under the Data Privacy Framework.
Retention periods
We store your data for as long as we need it for the respective purpose. After that, we delete it or remove everything that refers to you:
- Server log files: 14 days.
- Our own visitor measurement: after midnight (UTC), page views can no longer be attributed to anyone. Without this link, they are kept for statistics.
- Statistics number with your page views: 12 months.
- Google Analytics: Google keeps the data on individual visits for 14 months.
- Newsletter and launch notification: email address and IP address with us for 30 days after they are passed on to the service provider. You remain signed up there until you unsubscribe.
- Contact form: name, company, email address and message with us for 30 days after delivery to our mailbox. Topic, page, language and time are kept for statistics without any link to you.
- Account: for as long as it exists. After deletion, for another 30 days so that accidental deletion can be undone; after that, we anonymise it.
- IP address and browser identifier in the change log: 90 days. Who changed what remains traceable afterwards.
- Failed background tasks that may contain email addresses: 30 days.
- Password reset links: valid for 60 minutes and removed by the following day at the latest.
- Backups: 30 days.
- Emails to us: until your enquiry has been dealt with, unless there is an obligation to retain them.
- Contract and billing data: for as long as commercial and tax law require, and beyond that for as long as claims arising from the contract are not time-barred.
- Cookies and browser storage: as stated under Cookies and browser storage.
Your rights
Subject to the statutory requirements, you have the following rights:
- Right of access to the data we process about you (Art. 15 GDPR).
- Right to rectification of inaccurate or completion of incomplete data (Art. 16 GDPR).
- Right to erasure of your data stored by us (Art. 17 GDPR).
- Right to restriction of processing (Art. 18 GDPR).
- Right to data portability in a common, machine-readable format (Art. 20 GDPR).
An informal message to support@docunorm.com is sufficient for any of these rights.
Withdrawing consent
You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). Processing carried out up to that point remains lawful. For cookies, use “Cookie settings” at the bottom of every page; for the newsletter, use the unsubscribe link in every email.
Right to object
Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object to this at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.
Right to lodge a complaint with a supervisory authority
You can lodge a complaint about our processing of your data with a data protection supervisory authority, in particular in the EU member state where you live or work or where the alleged infringement took place (Art. 77 GDPR).
Our lead supervisory authority is the Office of the Commissioner for Personal Data Protection, 15 Kypranoros Street, 1061 Nicosia, Cyprus (www.gov.cy/dataprotection).
Automated decision-making
We do not make automated decisions within the meaning of Art. 22 GDPR.
Last updated: 6 October 2026