Privacy Policy

Version 2.1 · Last updated: 7 October 2026

This Privacy Policy explains how DoQcheck B.V. ("DoQcheck", "we", "us") handles personal data when you visit our website, get in touch with us, or use the DoQcheck platform on behalf of your organisation.

At a glance

• Your data stays in Europe. The DoQcheck platform runs exclusively on Microsoft Azure in the EU/EEA, primarily in the West Europe region (the Netherlands). Documents and data our customers upload, including all AI processing of them, are not transferred outside the European Economic Area. This is how the platform is built.
• We never use customer data to train AI models, neither our own nor those of our providers.
• We are ISO/IEC 27001:2022 certified and protect data with encryption, network isolation, mandatory multi-factor authentication and strict access control (see section 8).
• Our customers stay in control. For the documents and data in the platform, our customer decides what happens with them; we process them only on its instructions (see section 2).
• Our website uses cookieless analytics by default. Optional cookies are only set if you accept them.
• We do not sell personal data and do not use it for advertising.

1. Who we are

DoQcheck B.V. is a private limited company registered in the Netherlands.

2. Our two roles: controller and processor

The GDPR distinguishes between the party that decides why and how personal data is processed (the controller) and the party that processes it on its behalf (the processor). We act in both roles, depending on the data.

We are the processor for Customer Data. "Customer Data" means all documents, files, records and other content that a customer uploads to, connects to or synchronises with the DoQcheck platform, plus the results the platform generates from them. Our customer (your employer or organisation) is the controller of any personal data in it. We process Customer Data only on the customer's documented instructions, as set out in our agreement with the customer and its data processing terms (see the Terms and Conditions, Annex 1). If you have a question about personal data in Customer Data, please contact the organisation that uses DoQcheck; we will help them answer it.

We are the controller for everything else described in this policy: data about website visitors, people who contact us or book a demo, business contacts at customers and prospects, and the account and security data we need to run the platform safely.

3. What personal data we process, why, and on what legal basis

Website visitors

• What: pages visited, referring website, campaign (UTM) parameters, approximate location derived from your IP address, browser and device type.
• Why: to understand how our website is used and to improve it.
• Legal basis: our legitimate interest in running and improving our website (Article 6(1)(f) GDPR). Optional analytics cookies: your consent (Article 6(1)(a)).
• How: see section 7. By default, measurement is anonymous and nothing is stored on your device.

Contact form, demo bookings and downloads

• What: name, business email address, phone number (optional), company, job title, your message and the time slot you book.
• Why: to respond to your request, schedule and hold a demo, send the resource you asked for, and follow up on it.
• Legal basis: steps at your request before entering into a contract (Article 6(1)(b)) and our legitimate interest in answering business enquiries (Article 6(1)(f)).
• Spam protection: the contact form is protected by Google reCAPTCHA and a hidden honeypot field, based on our legitimate interest in preventing abuse (Article 6(1)(f)).

Business relationships

• What: names, business contact details, roles and correspondence of contacts at customers, prospects, suppliers and partners; contract and invoicing details.
• Why: to manage our relationship, deliver our services, invoice and keep our administration.
• Legal basis: performance of a contract (Article 6(1)(b)), our legitimate interest in maintaining business relationships (Article 6(1)(f)) and our legal obligations, such as tax record-keeping (Article 6(1)(c)).
• Marketing: we may send business contacts relevant updates about DoQcheck. You can opt out at any time with the link in each message or by emailing us.

Platform users

Users of the DoQcheck platform get an account from their own organisation; there is no public sign-up.

• What: name, business email address, role and permissions, multi-factor authentication settings, login and session records, and an audit trail of actions in the platform. Your questions to the platform and the answers it gives are part of Customer Data.
• Why: to provide secure access, enforce permissions, provide support, keep the platform secure, and provide the customer with an audit trail.
• Legal basis: we process this data as a processor on behalf of the customer (see section 2). Where we use it for our own purposes, such as detecting misuse and securing our infrastructure, we rely on our legitimate interest in keeping the platform secure (Article 6(1)(f)).

We do not process special categories of personal data (such as health data or political opinions) for our own purposes, and we do not use automated decision-making that has legal or similarly significant effects on you.

4. Where your data is stored

The DoQcheck platform: EU/EEA only

The DoQcheck platform and all Customer Data are hosted exclusively in Microsoft Azure data centres in the EU/EEA:

• Primary region: West Europe (the Netherlands). This hosts the application, file storage, encryption key vaults, logging and the AI services.
• Database: our managed database currently runs in Azure's Sweden Central region (Sweden, EU).
• Backups: all backups are stored within the EU.

AI processing also stays in the EU. The AI models the platform uses run in our own Microsoft Azure AI resources, deployed in EU regions or in Microsoft's EU Data Zone. Your documents and questions are not sent to OpenAI or to any other AI provider outside Microsoft Azure, and they do not leave the EU for AI processing.

We do not transfer Customer Data outside the European Economic Area. If EU or Member State law ever requires a disclosure, we will inform the customer first, unless the law forbids it.

Our website and business tools

Our website and some of our business tools use well-known providers, some of which are based in the United States (see section 5). These providers only receive the website, contact and business data described in section 3, never Customer Data from the platform. Where data is transferred outside the EEA, we rely on the EU–US Data Privacy Framework (an adequacy decision of the European Commission) or the European Commission's Standard Contractual Clauses.

5. Who we share data with (sub-processors)

We share personal data only with providers that help us deliver our services, under written agreements that require them to protect it and to use it only on our instructions. We do not sell personal data.

Platform sub-processors (may process Customer Data)

Microsoft is bound by its Data Protection Addendum and its EU Data Boundary commitments, and does not use Customer Data to train its models. Under Microsoft's standard terms, Azure may retain prompts and outputs for up to 30 days solely to detect abuse of its AI services. This data stays in the EU, is accessible only to authorised Microsoft personnel, and is never used for training.

Website and business sub-processors (no Customer Data)

Changes to our platform sub-processors. We will notify customers at least 30 days before we add or replace a sub-processor that processes Customer Data, so that they can object on reasonable data protection grounds. Any new platform sub-processor must also keep Customer Data in the EU/EEA.

Other disclosures. We may share personal data with our professional advisers (lawyers, accountants, auditors) under a duty of confidentiality; with authorities where the law requires it; and, under the same protections as described here, with a successor in the event of a merger or acquisition of our business.

6. AI and your data

The DoQcheck platform uses AI to search, interpret and summarise our customers' quality and food safety documents. We apply these principles:

• No training on Customer Data. Neither we nor our providers use Customer Data, questions or AI output to train or improve general AI models. Our AI providers are contractually prohibited from doing so.
• Customer-specific improvement stays with the customer. We may tune search, prompt suggestions and recommendations for a specific customer. These improvements are used only for that customer and are never made available to other customers.
• Anonymised statistics only. We may use aggregated, anonymised statistics about how the platform is used (for example, response times or which features are used) to improve the service. Such statistics never contain document contents and cannot be traced back to a customer or a person.
• Human judgement first. AI output supports, and does not replace, professional judgement. The platform is designed to keep its answers traceable to the underlying documents, so users can verify them.

7. Cookies and analytics

• Cookieless by default. We measure website use with PostHog (EU) in a privacy-friendly mode: visits are counted anonymously, in your browser's memory only, and nothing is stored on your device. We also use Vercel's cookieless, aggregated web analytics and performance measurement, and Ahrefs Web Analytics, which is cookieless too and discards your IP address after deriving an approximate (city-level) location. We honour your browser's Do Not Track setting for PostHog analytics.
• Optional cookies only with your consent. If you click "Allow cookies" in our cookie banner, PostHog stores an identifier in a cookie and in your browser's local storage, so we can recognise repeat visits. You can change your choice at any time by clearing this site's cookies and storage in your browser; the banner will then ask you again.
• Third-party features. On pages with our contact form, Google reCAPTCHA is loaded to protect the form against spam; Google may set its own cookies for this. When you open our demo scheduler or download form, HubSpot loads its form and may set cookies that the form needs to work.
• No advertising cookies. We do not use cookies for advertising or cross-site tracking.

8. How we protect data

Security is built into how DoQcheck is designed and operated, because our customers trust us with confidential documents. Our information security management system is certified under ISO/IEC 27001:2022. Our measures include:

• Isolation per customer: each customer runs in its own environment, with its own network, application servers, encryption key vaults and AI resources. Each customer's data is stored in its own database and storage container, which only that customer's environment can access.
• Encryption: data is encrypted in transit over public networks (TLS 1.2 or higher, with HSTS) and encrypted at rest (databases, file storage, backups and disks).
• Network protection: databases, file storage, key vaults and AI services have no public internet access and are reachable only through private connections within Azure. Access to the platform passes through a web application firewall with DDoS protection, and can be restricted to the customer's own IP addresses.
• Access control: multi-factor authentication is required for platform users by default, sessions expire automatically, and role-based permissions apply. Our administrative access is limited to a small number of authorised staff, through a secured bastion host and VPN, following the principle of least privilege. Secrets are kept in managed key vaults.
• Monitoring and audit: infrastructure activity is logged and monitored, and the platform keeps a tamper-evident audit trail of user actions.
• Backups and recovery: daily backups, point-in-time database restore and soft-delete protection for files.
• Secure development and testing: automated code and dependency scanning, change management, and penetration tests by independent specialists.
• Confidentiality: everyone who works for DoQcheck is bound by confidentiality obligations.

Incidents. If we become aware of a confirmed security incident affecting Customer Data, we notify the affected customer without undue delay and in any case within 48 hours, and we help the customer meet its own notification obligations. Where we are the controller, we notify the Dutch Data Protection Authority and, where required, the people affected.

No system can be guaranteed to be completely secure. If you believe you have found a security vulnerability, please report it to info@doqcheck.com.

9. How long we keep data

We keep personal data no longer than necessary for the purpose for which we collected it:

10. Your rights

Under the GDPR, you have the right to:

• access the personal data we hold about you;
• rectify inaccurate data;
• erase your data ("right to be forgotten");
• restrict our processing;
• object to processing based on our legitimate interests, including direct marketing;
• data portability: receive your data in a machine-readable format;
• withdraw your consent at any time, without affecting processing that took place before.

To exercise your rights, email privacy@doqcheck.com. We will respond within one month. We may ask you to verify your identity. If your request concerns Customer Data, we will forward it to the customer that controls it and assist them in responding.

You also have the right to lodge a complaint with a data protection authority. In the Netherlands, this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). We would appreciate the chance to address your concern first.

11. Children

DoQcheck is a business-to-business service, intended for organisations and the professionals who use it on their behalf. Our website and platform are not directed at anyone under the age of 18, and we do not knowingly collect personal data from persons under 18. If you believe that such data has reached us, please contact us at privacy@doqcheck.com and we will delete it.

12. Changes to this policy

We may update this Privacy Policy, for example when we add a sub-processor or a new feature. The version number and date at the top show when it was last changed. We will inform customers of material changes in advance by email.

13. Contact

For questions about this policy or about how we handle personal data:

DoQcheck B.V. Edendreef 13, 6716 HE Ede, the Netherlands privacy@doqcheck.com · info@doqcheck.com