Privacy Notice — Doc4Org
Last updated: 2026-10-12
1. Who is responsible for your data?
Doc4Org is an independent technology project in development, operated by Salikh Osmanov, an individual based in Lisbon, Portugal (the controller for the processing described here).
General contact: [email protected].
Privacy enquiries and requests: [email protected]. This address is an alias of our main mailbox.
Doc4Org is not currently a registered company or an operational banking service.
2. What data do we process and why?
Correspondence. If you email us, we process your name, email address, organization or professional role (where provided), the contents of your message, and related correspondence metadata. We use this information to respond, assess potential collaboration, and understand requirements for a future Doc4Org platform. Our legal basis is our legitimate interests under Article 6(1)(f) GDPR in responding to professional inquiries and researching a potential technology project.
Website operation and security. When you access the website, technical data such as IP address, request time, requested URL, HTTP headers, browser and device information, traffic-routing information and security events may be processed by our hosting and security provider to deliver the site, maintain availability, and protect against abuse. The precise data, retention and controller/processor roles depend on the Cloudflare configuration and contractual terms. Our legal basis, insofar as we act as controller, is Article 6(1)(f) GDPR (secure, reliable site operation).
Analytics. We use Cloudflare Web Analytics to understand visits and website performance, only after you select Accept analytics. Our chosen legal basis for processing personal data for this analytics mechanism is consent under Article 6(1)(a) GDPR. Rejecting analytics does not affect access to the website. You can withdraw or change your choice at any time through Cookie settings in the footer; withdrawal does not affect the lawfulness of processing before withdrawal. The official browser beacon is loaded only with valid consent. It reports page views, referring websites, country, browser, operating system, device type and performance measurements. According to Cloudflare, Web Analytics does not use its own analytics cookies or localStorage for collecting metrics. This does not mean that Cloudflare processes no personal data.
We do not currently offer user accounts, document uploads, bank applications, payments, or customer onboarding through this website.
3. Who receives the data?
We use Cloudflare for Pages hosting, content delivery (CDN), DNS, website security (WAF) and, when activated with consent, Web Analytics. Cloudflare's published Data Processing Addendum (DPA), version 6.4 dated 3 April 2026, provides for processing on a customer's behalf where the applicable agreement covers those operations. Cloudflare may act as an independent controller for other operations described in its privacy policy. These roles depend on the particular processing; we do not describe all Cloudflare operations as processing on our behalf.
We use Zoho Mail to receive, store, send and manage emails, including messages sent to our privacy alias. Providers may use subprocessors for the services concerned; inclusion in a provider's published list does not mean that every listed subprocessor receives Doc4Org visitor data. Data may also be disclosed when required by applicable law.
4. International transfers
Our Zoho account uses accounts.zoho.com, which Zoho identifies as its United States data-centre region. This does not mean that all processing or access takes place exclusively in the United States. Zoho describes international processing by its group and service providers and contractual safeguards for relevant transfers in its published privacy policy, including agreements based on European Commission standard contractual clauses.
Cloudflare operates internationally, and processing may involve countries outside the European Economic Area. Its published DPA and standard contractual clauses provide safeguards for relevant restricted transfers, including applicable EU standard contractual clauses and additional safeguards. We do not claim that all data is stored or accessed exclusively within the EU. You may contact [email protected] for information about applicable safeguards and how to obtain a copy.
5. How long do we keep data?
For ordinary, completed inquiries, we delete correspondence 12 months after the last substantive contact.
For ongoing negotiations or collaboration with banks, we retain the correspondence needed for that relationship for as long as it remains necessary. Correspondence needed to document contracts, meet legal obligations, or establish, exercise or defend legal claims is retained for the applicable period, assessed separately for that purpose.
We review retained correspondence at least once a year and delete information that is no longer needed. Any retention beyond the ordinary 12-month period must have a specific, documented reason; annual review does not justify indefinite retention.
Security reporting. Cloudflare documents up to 31 days of history for Security Analytics and Security Events on the Free plan; Security Events on that plan displays sampled logs. These product-specific periods do not establish a deletion deadline for every internal Cloudflare log.
Web Analytics. Cloudflare documents seven days of unsampled beacon data, followed by longer-term aggregated data. Its FAQ states that customers can access the previous six months of analytics. This access window is not a confirmed maximum retention period or a guarantee of deletion of all underlying data.
6. Your rights
Subject to the conditions of GDPR, you may request access, rectification, erasure, restriction, portability where applicable, and object to processing based on legitimate interests. Contact [email protected] to exercise your rights. You may also complain to Portugal's supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD): https://www.cnpd.pt/.
7. Whether you must provide data
You are not legally or contractually required to email us. However, without your contact information and message, we may be unable to respond. We do not use automated decision-making producing legal or similarly significant effects through this website.
8. Cookies and browser storage
The website stores your analytics preference in localStorage under doc4org_analytics_consent (accepted or rejected), with the decision date, expiry and notice version in doc4org_analytics_consent_meta. The preference is valid for six calendar months, after which we ask again. This is the preference lifetime, not Cloudflare's analytics-data retention period. Storage is specific to each browser and website origin; a preview choice does not automatically apply to the public domain. Clearing browser storage also resets the choice.
Cookie settings lets you accept or reject again. When you withdraw consent, we block further analytics transmissions and reload the page if the beacon has already been loaded. Data already transmitted cannot be recalled by the browser. If the preference cannot be saved or read, analytics remains off and the site remains usable. With JavaScript disabled, analytics is not loaded.
Technical security cookies from Cloudflare are separate from optional analytics. Cloudflare security features may use cookies during a security check. The domain's configured Challenge Passage is 30 minutes; this concerns a completed check, not a general retention period.
Closed testing only. Cloudflare Access protects restricted preview deployments and uses authentication cookies, including CF_Authorization, to verify authorised access. Access is not intended for the public site; this description does not mean that public visitors receive Access cookies.
9. Updates
We may update this notice if the project or its data processing changes. The date above will show the latest revision.