DESign inRequest a demo
Legal

Privacy policy

Last updated: 15 October 2026

This privacy policy explains how Berrinex FlexKapG processes personal data when you use the Docelix website and application. Personal data means any information relating to an identified or identifiable natural person.

1. Controller

Berrinex FlexKapG
Wienerstraße 11, Stiege 2, Top 1
2482 Münchendorf, Austria
Email: office@berrinex.com
Phone: +43 677 61991832

Docelix is a product of Berrinex FlexKapG and is not a separate legal entity.

2. Scope and allocation of roles

This policy applies to the public website, contact and demo requests, and use of the Docelix software. Berrinex FlexKapG generally acts as controller for account, contract, billing, and support data.

Where business customers enter data concerning their own customers, suppliers, employees, or other persons into Docelix, the relevant business normally determines the purposes and means of processing. In that case, the business is the controller and Berrinex FlexKapG processes the data as processor under an agreement pursuant to Article 28 GDPR. Customers must ensure that they are authorised to enter and process this data and that they provide the required information to affected persons.

3. Website visits and server logs

When you access the website, technically necessary connection data may be processed, including your IP address, date and time, requested page, referrer URL, browser, operating system, language, device information, transferred data volume, and HTTP status. We use this information to deliver the website and maintain its stability, security, and error diagnostics. The legal basis is our legitimate interest under Article 6(1)(f) GDPR. Log data is retained only for as long as required for operations and security, then deleted or anonymised unless a specific security investigation or legal obligation requires longer retention.

4. Contact and demo requests

If you contact us by form, email, or telephone, we process the information you provide. The website form includes your first and last name, work email address, company, team size, message, and record of consent. We use this data to respond, handle follow-up questions, and take steps before entering into a contract.

Depending on the request, the legal basis is Article 6(1)(b) GDPR (contract or pre-contractual steps), Article 6(1)(f) GDPR (efficient communications and customer service), or Article 6(1)(a) GDPR (consent). We delete inquiry data when it has been resolved unless statutory retention duties or legitimate reasons, such as the defence of legal claims, require continued retention.

5. User accounts, authentication, and administration

To create and operate a Docelix account, we process information such as names, email addresses, login credentials, company membership, roles, permissions, settings, invitations, and technical session and security data. This is necessary to provide accounts, authenticate users, control access, prevent misuse, and perform our contract. The legal bases are Article 6(1)(b) and (f) GDPR and, where required, Article 6(1)(c) GDPR.

We use Supabase for authentication and central application infrastructure. If you choose “Continue with Google”, Docelix receives the profile data released by Google in the consent screen, typically your name, email address, and an account identifier. We process it to perform the login you requested under Article 6(1)(b) GDPR. The Google Privacy Policy also applies.

6. Use of Docelix and business documents

Depending on the features used, we process company and contact master data, customer and supplier information, quotes, orders, invoices, receipts, ledger and account data, payment information, tax attributes, files, emails, notes, usage and activity logs, and support content. We process this information to provide the agreed software functions, secure and troubleshoot the service, and meet legal obligations under Article 6(1)(b), (c), and (f) GDPR.

Please upload only data necessary for the relevant business purpose. Docelix is not intended for processing special categories of personal data under Article 9 GDPR without a suitable legal basis and additional safeguards.

7. Document recognition and AI-assisted features

When you use document recognition, extraction, classification, or AI-assisted features, uploaded documents, images, extracted text, and your prompts may be processed to provide the requested function. Depending on the feature, we may use contractually bound OCR, cloud, or AI service providers. The legal basis is Article 6(1)(b) GDPR; security and quality controls additionally rely on Article 6(1)(f) GDPR. Results may contain errors and should be reviewed before business, tax, or legal use.

Docelix does not use these functions to make decisions based solely on automated processing that produce legal or similarly significant effects for you, unless we separately inform you in advance.

8. Optional email and third-party integrations

You may voluntarily connect Docelix to Google Gmail or Microsoft Outlook/Microsoft 365. After you authorise the connection, Docelix processes the necessary account information, OAuth permissions and tokens and, depending on the selected feature, messages, senders, recipients, subject lines, metadata, and attachments. This supports the import of business documents and the sending and replying to emails. The legal basis is Article 6(1)(b) GDPR. You can disconnect the integration in Docelix and in your provider account’s security settings.

See the privacy information provided by Google and Microsoft. Other integrations are activated only when you explicitly connect them; the requested permissions are shown before connection.

9. Subscriptions and payments

We use Stripe for paid subscriptions and payment processing. Identity and contact details, company and billing data, subscription status, payment references, transaction data, and fraud-prevention signals may be processed. Full card or bank details are generally collected directly by Stripe. The legal bases are Article 6(1)(b) GDPR for contract performance, Article 6(1)(c) GDPR for statutory billing and retention duties, and Article 6(1)(f) GDPR for fraud prevention and secure payment processing.

10. Cash register, RKSV, and FinanzOnline

Where the Austrian cash-register features are activated, Docelix processes company and tax identifiers, register and signature data, receipt and transaction data, status and audit logs, and the information required for setup. We use fiskaly for legally compliant signing and technical communication with FinanzOnline. Processing is necessary to perform the contract and meet tax and cash-register obligations under Article 6(1)(b) and (c) GDPR and to operate the service securely under Article 6(1)(f) GDPR. Statutory rules may require long-term retention of this data.

11. Local storage, cookies, and similar technologies

The marketing website currently does not use optional analytics or advertising trackers. Technically necessary cookies, local storage, or session storage may be used on the website and especially in the application to maintain sessions and logins, complete security flows, remember language and settings, and provide requested functions. The legal bases are section 165(3) of the Austrian Telecommunications Act 2021 and Article 6(1)(b) or (f) GDPR. Optional analytics or marketing technologies will be used only with consent. See our cookie policy for more information.

12. Recipients and processors

Personal data is available only to recipients who need it for the stated purposes. These may include:

  • hosting, database, storage, authentication, security, and support providers;
  • payment and billing providers;
  • email, cloud, OCR, AI, accounting, and other integration providers you activate;
  • fiskaly and competent authorities when statutory cash-register functions are used;
  • tax, legal, and other professional advisers; and
  • courts, authorities, and other bodies where disclosure is legally required.

We carefully select providers and, where required, bind them by agreements under Article 28 GDPR. You may request a current list of material processors at office@berrinex.com.

13. International transfers

Some providers or their subprocessors may process data outside the European Economic Area. Where required, we rely on an adequacy decision by the European Commission, Standard Contractual Clauses under Article 46 GDPR, or another valid safeguard and assess supplementary measures. You may contact us for information about the safeguards that apply to a particular transfer.

14. Retention

We retain personal data only for as long as required for the relevant purpose, contract performance, security interests, or statutory duties. Account and content data is generally retained for the contract term and a reasonable wind-down and backup period. Under section 212 of the Austrian Commercial Code (UGB), books, inventories, opening balance sheets, annual financial statements and management reports, consolidated financial statements and group management reports, received business correspondence, copies of sent business correspondence, and accounting vouchers generally must be retained in an orderly manner for seven years. They must be retained longer where relevant to pending judicial or administrative proceedings in which the business is a party. Other tax, cash-register, limitation, or special statutory retention periods may also apply. The data is then deleted or anonymised unless another legal basis applies. Backups are overwritten through controlled deletion cycles.

15. Data security

We use appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration, and disclosure. These include encrypted transmission, role-based access, authentication, logging, backups, and regular review of security measures. Absolute security cannot be guaranteed for electronic transmission.

16. Your rights

Subject to the statutory conditions, you have the right to:

  • access your personal data (Article 15 GDPR);
  • correct inaccurate or complete incomplete data (Article 16 GDPR);
  • erasure (Article 17 GDPR);
  • restriction of processing (Article 18 GDPR);
  • data portability (Article 20 GDPR);
  • object to processing based on legitimate interests (Article 21 GDPR); and
  • withdraw consent with future effect (Article 7(3) GDPR).

To exercise your rights, contact office@berrinex.com. To prevent unauthorised disclosure, we may request suitable proof of identity. You also have the right to complain to a data protection supervisory authority, in particular the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, email: dsb@dsb.gv.at.

17. Changes to this privacy policy

We update this policy when features, providers, or legal requirements change. The current version is available on this page. We will provide appropriate notice of material changes affecting existing accounts.