Privacy Policy - Docutone Data Protection

Privacy Policy

Last update: 30 April 2024

This Docutone Privacy Policy explains how Docutone Information Technology Limited (“Docutone”, “we” or “us”) collect, use, store and disclose your personal data when you use the following Docutone’s products and services:

Docutone Website (www.docutone.com)
Docutone Virtual Data Room (vdr.docutone.com)
Docutone DocTransport (doctransport.docutone.com)
Docutone eBinder (ebinder.docutone.com)

(“Docutone Product” or collectively “Docutone Products”).

What Personal Data Do We Collect?

How Do We Use Personal Data?

How Do We Share Personal Data?

Your Privacy Rights and Choices

Children

Retention

Special Terms in Compliance with Personal Information Protection Law

Special Terms in Compliance with General Data Protection Regulations

Special Terms in Compliance with California Privacy Rights

Changes to This Privacy Policy

How to Contact Us

What Personal Data Do We Collect?

The types of your personal information we collect depend on how you are using our Products and how you are specifically interacting with us. In general, the following are the categories of personal information we collect from you:

Contact Information：Your name, alias, address, phone number, social media user ID, email address, and similar contact data.
Organization Information: Your organization’s name, address and telephone number; your position at the organization; and industry your organization is in.
Project Information: Your project name, type, duration, status, size of your project files and name & contact details of project managers etc.
Account Information: Your login name, passwords, authentication methods, user roles.
Financial Information: Your billing address, Alipay ID, credit card information, billing contact details, purchase history, profiles, billing-related information and similar data.
User Content : Your requests, questions, messages, comments, feedback, and/or other information that you provide to us when you contact us, or that you send to us when you use any Docutone Product or Products
Device & Browser Information : Your internet service provider (ISP), internet protocol (IP) addresses, device and browser identifiers and information (including device, application, or browser type, version, plug-in type and version, operating system, language and time zone settings, and other technical information), advertising identifiers, cookie identifiers and information, etc.
Usage Information and Browsing History : Your usage data (including usage rates, error occurrences, diagnostic reports, settings preferences, backup information, API calls), and other logs, content actions (including searches, views, downloads, prints, shares, streams, and display or playback details), and user journey history (including clickstreams and page navigation, URLs, timestamps, content viewed or searched for, page response times, page interaction information (such as scrolling, clicks, and mouse-overs), and download errors), advertising interactions (including when and how you interact with marketing and advertising materials, click rates, purchases or next steps you may make after seeing an advertisement, and marketing preferences), and similar data.
Location Data : Your device location, your household, and similar location data.
Social Media and Online Content : Your information in social media and online profiles, online posts, and similar data.

How Do We Use Personal Data?

Docutone employees will not access your projects, collections, folders, documents, Q&As or reports unless directed by you, or as required for legal, technical support or security reasons. However Docutone uses your personal data to conduct the following activities:

Provide Docutone Products and Services : We use your personal data to provide, deliver, analyze, administer and manage Docutone Products and Services, including in providing technical assistances there to.
Improve and Develop Products and Features : We use your personal data to develop, test, improve and troubleshoot Docutone Products and any new products and features.
Marketing and Promotions : We use your personal data to market, advertise, and promote Docutone Products, features, and services to you and if you visit our websites, we may use your personal data to provide advertisements to you relating to Docutone Products and Services.
Authentication, Security and Safety : We use your personal data to authenticate your account and activities, to investigate and prevent malicious or unsafe activities and to address security & safety threats to Docutone Products and Services.
Communicate with You : We use your personal data to communicate with you about project document or user activity alerts and about Docutone Products, features, and services, including product updates, your account. We also use your personal data to respond to you when you contact us.
Legal Reasons : We also use your personal data when we are obliged to comply with applicable law or respond to valid legal process, including from law enforcement or government agencies, to investigate or participate in civil discovery, litigation, or other adversarial legal proceedings, and to enforce or investigate potential violations of our Terms of Service or policies.

Docutone uses technical tools to automatically scan content such as logo images, data and documents uploaded for the purpose of detecting and preventing violations of our terms or policies and illegal or other harmful activities, and may investigate such content where required for legal, safety, or security reasons.

How Do We Share Personal Data?

Docutone shares your personal data to third parties only with your consent or in one of the following circumstances (subject to your prior consent where required under applicable law):

Your Collaborators: Your collaborators include project managers, your group members and/or other users you work with on any Docutone Product. These collaborators will have access to your personal data, including but not limited to your name, user, organization, documents you have read, printed or downloaded and your comments on the documents.
Third-party Service Providers: Docutone may work with third-party service providers to market, promote, support, analyze and improve Docutone website and Docutone Products, including the infrastructures on which Docutone website and Docutone Products are hosted/operated. These service providers can access your personal data but will be contractually and legally obliged to protect your personal data and not to use your personal data for any purpose other than to provide services to Docutone or as required by law.
For Legal Reasons: Docutone may share your personal data in order to: (1) comply with applicable law and regulations or respond to legal processes and proceedings, including from law enforcement or government agencies; (2) perform or solve disputes of Docutone Service Contract or Terms of Service or policies; (3) investigate, detect or prevent fraud, abuse, or safety and security concerns; (4) meet Docutone Products’ maintenance requirements; (5) meet our corporate and social responsibility commitments; and (6) protect our customers’ legitimate rights and interests.
Online Marketing and Analytics Partners: Docutone uses third-party marketing and advertising providers to provide statistics and analysis about how people are using our website and to provide advertising and marketing, including targeted advertising based on your use of our website. These third-party partners may receive information about your activities on Docutone’s website through third-party cookies placed on Docutone’s website. To opt out of our use of third-party cookies that share data with these partners, visit our cookie management tool. Where required by law, Docutone will first obtain your consent before engaging in the activities described here.
Change of Control: We may share personal data with actual or prospective acquirers, their representatives and other relevant participants in, or during negotiations of, any sale, merger, acquisition, restructuring, or change in control involving all or a portion of Docutone’s business or assets, including in connection with bankruptcy or similar proceedings.

Your Privacy Rights and Choices

If you are in the European Economic Area (“EEA”), Switzerland, or the UK, or a resident of California, please refer to the respective dedicated sections below.

If you are in a location other than EEA, Switzerland, UK or California, at your request, and as required by applicable law, we will:

Inform you of what personal data we have about you that is under our control;
Amend or correct such personal data or any previous privacy preferences you selected, or direct you to applicable tools; and/or
Delete such personal data or direct you to applicable tools.

In order to exercise any of your rights as to personal data controlled by Docutone, or if you have any other questions about our use of your personal data, please send a request t0 postmaster@docutone.com. Please identify yourself and, for information relating to Docutone Products, specify your account and/or user information and other information to enable us to authenticate and respond to your request. Where legally permitted, we may decline to process requests that are unreasonably repetitive or systematic, require disproportionate technical effort, or jeopardize the privacy of others. As an account owner or a user under a licensed account, you may also take steps to affect your personal data by visiting your account and modifying your personal data directly.

Children

Docutone website and Docutone Products are intended for professionals and/or individuals over eighteen (18) years of age. We do not target children and do not knowingly collect any personal data from children under the age of sixteen (16). When you are using Docutone website or Docutone Products, you are representing to us that you are at least eighteen (18) years of age.

Retention

Unless it is required by applicable law, the length of time for which Docutone retains your personal data will be determined by the following criteria:

The time period of a project to which you are a manager or a user, or the length of time you maintain a user account with Docutone for using a Docutone Product;
Whether account owners or project managers add, suspend or delete you as a user of a Docutone Product or retain your personal data even though you are no longer a user of any Docutone Product;
Whether there is any law or regulation or compliance need that requires Docutone to keep your personal data; or
Whether there is any judicial/administrative order, dispute resolution or investigation that requires Docutone to keep your personal data.

Special Terms in Compliance with Personal Information Protection Law

These Special Terms in Compliance with Personal Information Protection Law of the People’s Republic of China (“PIPL Special Terms”) are provided as required by Personal Information Protection Law of the People’s Republic of China promulgated on 1 November 2021 (“PIPL”) and apply solely to you if you are in the People’s Republic of China (excluding Hong Kong, Macau and Taiwan, herein after referred to as “China”) and are using any Docutone Product.

These PIPL Special Terms supplement the provisions of Docutone Privacy Policy. In the event of a conflict, discrepancy or inconsistency between the Docutone Privacy Policy and these PIPL Special Terms, the PIPL Special Terms will prevail for residents in China.

Principles of Processing Your Personal Data

Under the PIPL, our principles for processing your personal data are:

Lawfulness, legitimacy and good faith : Docutone collects and processes your personal data to serve its lawful and legitimate purposes as set out in this Privacy Policy. The scope of your personal data Docutone collects and the way Docutone processes your personal data are also elaborated in the Privacy Policy. In addition, all users have the option to request correction or deletion of their personal data at any time.
Minimum necessity: Your personal data will be processed only for specific purposes with the scope of your personal data restricted to minimum necessity when they are collected. If there is any change to the purpose, method or scope of your personal data to be collected or processed, Docutone will obtain your prior consent again.
Open & transparency: We have set out the way and purpose Docutone collects and processes your personal data in this Privacy Policy. As the data subject, you have the right to also request Docutone to disclose how your personal data is being collected, processed and used.
Quality assurance: No matter you visit Docutone website or use any Docutone Product, you or your project manager are the primary source of your personal data Docutone collects and processes. To ensure the accuracy and completeness of your personal data, Docutone provides the convenience for you to view and edit it at any time.
Safety & Security: Docutone attaches great importance to the safety & security of your personal data and has advanced technical measures to safeguard your personal data’s safety & security, including but not limited to measures to monitor and prevent any leakage or illegal tampering of your personal data.
No automated decision making based sales : Docutone does not use personal data to make automated decision-making based sales, nor will it apply unreasonable price differential treatment to customers based on personal data.
No sensitive data : Docutone does not collect personal sensitive information including biometrics, religious beliefs, specific identities, medical health, financial accounts, whereabouts, etc.
No underage users : Docutone does not accept minors as users of any Docutone Product. If you are a minor, please contact us immediately.

Legal Basis for Processing Personal Data

If you are in China, depending on the specific personal data concerned and the context, we rely on the following legal bases as applicable when we collect and process your personal data:

You have given your consent: We rely on your express acceptance of cookies when you are browsing Docutone website and/or your acceptance to become a user of a Docutone product. In either case, you have the right to withdraw your consent at any time by visiting our cookie management tool or by having yourself deleted as a user of the Docutone product;
Required by our contract: We collect and process your personal data because we have a service contract either with yourself or with another person or an organization who adds you as a user of a Docutone Product. Your personal data is needed by us for the purpose of honoring our contractual obligations.
To meet our legal obligations: We collect and process your personal data to meet our following legal obligations: those under China’s laws, regulations, directives and rules; (ii) rulings and orders of Chinese governmental, judicial, or regulatory authorities; (iii) needs to respond to sudden or emergent public incidents; and (iv) needs to respond to any incidents in the public interests.
To protect your own interests or interests of others: We collect and process your personal data in order to make sure the Docutone products are accessed and used only by authorized users and for legitimate purposes so your interests and those of other users will be protected.
To protect our legitimate interests: We collect and process your personal data to protect our following legitimate interests: (i) for maintaining, trouble-shooting, improving and developing Docutone Products and features; (ii) for the authentication, integrity, security and safety of user accounts of Docutone Products; (iii) for preventing, investigating and dealing with violations of Docutone terms of use, malicious conducts, and security threats; (iv) for the marketing, communications, advertising, and promotions related to Docutone Products; (v) for the compliance with Chinese laws, regulations, administrative orders, guidelines and rules applicable to Docutone; (vi) for lodging and responding to lawsuits, claims, requests and communications with competent Chinese judicial, governmental or other regulatory authorities; and (vii) for meeting our corporate and social responsibilities; and (viii) for resolving disputes, and enforcing agreements.

Your Rights under PIPL

If you are in China and have used Docutone website and/or any Docutone Product, you are protected by PIPL regarding your personal data collected and processed by us. Your rights in relation to your personal data processed by Docutone under PIPL include:

Right to know: You have the right to know the details of your personal data Docutone collects and processes;
Right to decide: You have the final say in how your personal data Docutone collects and processes;
Right to copy and portability: You have the right to request a copy of all your personal data we hold and, in certain circumstances, to request us to provide all your personal data back to you in a portable form;
Right to rectification: You have the right to ask us to rectify any inaccurate or incomplete personal data;
Right of erasure: You have the right to request the erasure of your personal data that we hold about you (Please note that by doing so, you may no longer be able to use Docutone Products);
Right to clarification : You have the right to request us to explain to you our rules for processing your personal data
Right to object to processing: You have the right to request us to stop processing your personal data and/or stop sending you marketing communications;
Right to restrict processing : You have the right to request us to restrict processing of your personal data only to purposes specifically allowed by yourself.

If you want to exercise any of your rights as to your personal data controlled by Docutone, or otherwise have any questions about your personal data with us, please send a request at the contact details specified in the How to Contact Us section of this Privacy Policy. Please note that we may request additional information from you in order to confirm your identity and ensure that you are entitled to access the relevant personal data.

You also have the right to lodge a complaint to a data protection authority. For more information, please contact your local data protection authority.

Principles of Processing Your Personal Data

Our principles for processing your personal data are:

Fairness and lawfulness. When Docutone processes your personal data, your rights as the Data Subjects must be protected. All your personal data will be collected and processed in a legal and fair manner.
Restricted to a specific purpose. Your personal data will be processed only for specific purposes.
Transparency. As the Data Subject, you will be informed of how your peronal data is being collected, processed and used.

Your Rights under GDPR

If you are in the EEA, Switzerland, or the UK and have used Docutone website and/or any Docutone Product, you are protected by the GDPR regarding your personal data collected and processed by us. Your rights in relation to your personal data processed by Docutone under GDPR include:

Right of access and/or portability: You have the right to access all your personal data that we hold about you and, in some circumstances, request us to provide all your personal data back to you;
Right of erasure: You have the right to request the erasure of your personal data that we hold about you (Please note that by doing so, you may no longer be able to use Docutone Products);
Right to object to processing: You have the right to request us to stop processing your personal data and/or stop sending you marketing communications;
Right to rectification: You have the right to ask us to rectify any inaccurate or incomplete personal data;
Right to restrict processing: You have the right to request us to restrict processing of your personal data only to purposes specifically allowed by yourself.

In order for you to exercise any of your rights as to your personal data controlled by Docutone, or if you have any questions about your personal data with us, please send a request at the contact details specified in the How to Contact Us section of this Privacy Policy. Please note that we may request additional information from you in order to confirm your identity and ensure that you are entitled to access the relevant personal data.

You also have the right to lodge a complaint to a data protection authority. For more information, please contact your local data protection authority.

Personal Data Cross-Border Transfers

If you are in China and are using any Docutone Product, your personal data that Docutone processes will be stored on Docutone’s servers in China. Except that your authorized overseas collaborators (if any) might access to some of your personal data, Docutone does not not transfer your personal data to outside of China.

Special Terms in Compliance with General Data Protection Regulations

These Special Terms in Compliance with General Data Protection Regulations (“GDPR Special Terms”) are provided as required by the General Data Protection Regulations (“GDPR”) and apply solely to you if you are in the EEA, Switzerland, or the UK and are using any Docutone Product.

These GDPR Special Terms supplement the provisions of Docutone Privacy Policy. In the event of a conflict, discrepancy or inconsistency between the Docutone Privacy Policy and these GDPR Special Terms, the GDPR Special Terms will prevail for residents in the EEA, Switzerland, or the UK.

Principles of Processing Your Personal Data

Our principles for processing your personal data are:

Fairness and lawfulness : When Docutone processes your personal data, your rights as the Data Subjects must be protected. All your personal data will be collected and processed in a legal and fair manner.
Restricted to a specific purpose : Your personal data will be processed only for specific purposes.
Transparency: As the Data Subject, you will be informed of how your peronal data is being collected, processed and used.

Your Rights under GDPR

Right of access and/or portability: You have the right to access all your personal data that we hold about you and, in some circumstances, request us to provide all your personal data back to you;
Right of erasure: You have the right to request the erasure of your personal data that we hold about you (Please note that by doing so, you may no longer be able to use Docutone Products);
Right to object to processing: You have the right to request us to stop processing your personal data and/or stop sending you marketing communications;
Right to rectification: You have the right to ask us to rectify any inaccurate or incomplete personal data;
Right to restrict processing: You have the right to request us to restrict processing of your personal data only to purposes specifically allowed by yourself.

You also have the right to lodge a complaint to a data protection authority. For more information, please contact your local data protection authority.

Legal Basis for Processing Personal Data

If you are in regions such as the EEA, Switzerland, and the UK, depending on the specific personal data concerned and the factual context, we rely on the following legal bases as applicable in your jurisdiction when we collect and process your personal data:

Required by our contract: We collect and process your personal data because we have a service contract either with yourself or with another person or an organization who adds you as a user of a Docutone Product. Your personal data is needed by us for the purpose of honoring our contractual obligations.
You have given your consent: We rely on your express acceptance of cookies when you are browsing Docutone website, your direct consent by adding yourself as a user of using Docutone Products and your indirect consent when you agree to be invited by another user of a Docutone product. In either case, you have the right to withdraw your consent at any time by visiting our cookie management tool or by having yourself deleted by the Manager of Docutone product;
To protect your own interests or interests of others : We collect and process your personal data in order to make sure the Docutone products are accessed and used only by authorized users and for legitimate purposes so your interests and those of other users will be protected;
To protect Docutone’s legitimate interests: We collect and process your personal data to protect our following legitimate interests: (i) our rights and obligations and those of our customers under the contract between us and our customers; (ii) for maintaining, trouble-shooting, improving and developing Docutone Products and features; (iii) for the authentication, integrity, security and safety of user accounts of Docutone Products; (iv) for preventing, investigating and dealing with violations of Docutone terms of use, malicious conducts, and security threats; (v) for the marketing, communications, advertising, and promotions related to Docutone Products; (vi) for the compliance with EEA/non-EEA laws, regulations, administrative orders, guidelines and rules applicable to Docutone; (vii) for lodging and responding to lawsuits, claims, requests and communications with competent EEA/non-EEA public, governmental, judicial, or other regulatory authorities; and (viii) for meeting our corporate and social responsibilities; and (ix) for resolving disputes, and enforcing agreements.
To meet our legal obligations: We collect and process your personal data to meet our legal obligations under the EEA/non EEA laws, regulations, directives and rules as well as any governmental, judicial, or regulatory authorities’ rulings and orders that are applicable to us. This includes filing any claims and lawsuits; attending any hearings; preparing any defenses as well as detecting, investigating, preventing, and stopping fraudulent, harmful, unauthorized, or illegal activities.

International Data Transfers

Docutone operates globally, which means your personal data may be transferred, stored, and processed outside of the country or region where it was initially collected. Therefore, by using Docutone Products or providing your personal data directly or indirectly through an account owner for any of the purposes stated above, you acknowledge that your personal data may be transferred to or stored in China where we are established, as well as in other countries outside of the EEA, Switzerland, and the UK and that these countries may have data protection rules that are different and less protective than those of EEA, Switzerland and the UK .

We undertake that where personal data of users in the EEA, Switzerland, or the UK is being transferred to a recipient located in a country outside the EEA, Switzerland, or the UK which has not been recognized as having an adequate level of data protection, we ensure that the transfer will be governed by the European Commission’s standard contractual clauses.

Special Terms in Compliance with California Consumer Privacy Act

These Special Terms in Compliance with California Consumer Privacy Act Notice (“CCPA Special Terms”) are provided as required by the California Consumer Privacy Act of 2018 (“CCPA”) and applies solely to you if you are a resident in the State of California (“Consumers”) and are using any Docutone Product.

These CCPA Special Terms shall be read together with the provisions of Docutone Privacy Policy. In the event of a conflict, discrepancy or inconsistency between the Docutone Privacy Policy and these CCPA Special Terms, the CCPA Special Terms will prevail for Consumers.

Your Rights under CCPA

If you are a resident of California of the United States and are using any Docutone Product, under the California Consumer Privacy Act of 2018 (CCPA), you have the following rights:

Right to Access

You have the right to request us to disclose your personal data we collect and process over the past 12 months. Once we receive your request and verify your identity and subject to any exceptions, we will disclose to you:

The categories of personal data (as defined in the CCPA) we have collected about you;
The categories of sources for the personal data (as defined in the CCPA) we have collected about you;
Our business or commercial purpose for collecting your personal data;
The categories of third parties with whom we share your personal data; and
The specific pieces of personal data we have collected about you (also called a data portability request).

Right to Deletion

You have the right to request us to delete your personal data, subject to certain exceptions. Once we receive your request and verify your identity, we will delete your personal data from our records, unless an exception applies. We may deny your deletion request if retaining the data is necessary for us or our service provider(s) for certain reasons as permitted and set forth in the CCPA. These reasons include but not limited to:

completing a service for which the personal data was collected;
providing a service requested by you;
detecting and fixing security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, or prosecuting those responsible for such activities;
complying with a legal obligation;
conducting research in the public interest; and
carrying out any actions for internal purposes that the consumer might be reasonably expect.

Right to Opt out of the Sale of Your Personal Data

We do not sell your personal data in the conventional sense. However, like many companies, from time to time we may engage advertising services to promote Docutone Products to you based on your interests and your personal data collected via cookies and your use of Docutone Products.

Under the CCPA, you have the right to direct us to not “sell” your personal data. To submit an opt-out request please click the Do Not Sell My Personal Information link.

The right not to be discriminated against

The CCPA prohibits businesses from:

denying goods or services to you
charging different prices or rates for goods or services, including the use of discounts or other benefits or imposing penalties
providing a different level or quality of goods or services to you
suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services
Docutone will not discriminate against you for exercising any of these rights. If you believe you have been discriminated against by us, please contact us according to “How to Contact Us” below.

How We Will Respond to Your Request

Under the CCPA, only you or a person registered with the California Secretary of State that you authorize through a proper executed power of attorney may make a request related to your personal data. In so doing, you need to provide sufficient details that allow us to properly understand, evaluate and respond to your request.

To respond to your requests, we will need to verify your identity first. You will be required to log into your Docutone account (if applicable) and provide information relating to your account so that we can compare your personal data with your user information we have. You may be required to give a declaration as to your identity under penalty of perjury and/or provide additional information.

We will acknowledge receipt of your request within 10 business days, and provide a substantive response within 45 calendar days, or inform you of the reason and extension period (up to 90 days) in writing.

To exercise your rights, contact us by emailing postmaster@docutone.com. To opt out of the use of cookies on our sites for interest-based advertising purposes, follow the instructions above.

California’s Shine the Light Law

Under the California Civil Code Section 1798.83, also known as “Shine The Light” law, if you are a California resident, you have the right to annually request information regarding the disclosure of your Personal Information (if any) to third parties for them to engage in the direct marketing in the preceding calendar year. At Docutone, we do not share your Personal Information with third parties for the third parties’ direct marketing purposes.

Changes to This Privacy Policy

We may update this Privacy Policy periodically and will post the updated Privacy Policy on our website with an indication of the date it is updated. You are required to read our updated Privacy Policy and decide whether you want to continue using Docutone Products based on the Privacy Policy.

How to Contact Us

To exercise your rights or if you have any privacy-related questions or comments related to this Privacy Policy, please send an email to privacy@docutone.com.

You can contact our Data Protection Officer via email to postmaster@docutone.com.