DE Book a demo

Privacy policy

robodocxs GmbH
Seitzstraße 23, 80538 Munich
Munich Local Court (Amtsgericht München), HRB 281 065
Email: info@robodocxs.ai
Phone: +49 89 540 455 766

As of: October 2026

1. Controller and Data Protection Officer

The controller within the meaning of the General Data Protection Regulation (GDPR) is robodocxs GmbH, Seitzstraße 23, 80538 Munich (hereinafter “robodocxs” or “we”).

For any data protection inquiries, you can contact us at: info@robodocxs.ai

2. Subject Matter and Scope

This privacy policy informs you about the nature, scope, and purpose of the processing of personal data when using our website (www.robodocxs.ai) and our SaaS platform for automated document digitization and ERP integration (hereinafter “Platform”).

robodocxs’ services are intended exclusively for entrepreneurs within the meaning of Section 14 of the German Civil Code (BGB), legal entities under public law, or special funds under public law. Accordingly, this privacy policy is primarily addressed to our business customers and their representatives, as well as visitors to our website.

robodocxs operates an Information Security Management System (ISMS) in accordance with ISO 27001. The measures described in this privacy policy are aligned with the requirements of this certification.

3. What Data We Process

3.1 When Visiting Our Website

When accessing our website, the following data is automatically collected by the web server (so-called server log files):

  • IP address of the requesting device
  • Date and time of access
  • Name and URL of the retrieved file
  • Referrer URL (previously visited page)
  • Browser and operating system used
  • Amount of data transferred

This data is processed solely to ensure the smooth operation of the website and to improve our services. It is not merged with other data sources.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the technical provision and security of the website).

3.2 During Registration and Use of the Platform

When registering and within the contractual relationship, we process the following data:

  • Company name, address, and industry
  • Name and contact details of the contact person (email, phone)
  • Access credentials (username, encrypted password)
  • Payment information (credit card details or billing address)
  • Platform usage data (number of processed documents, timestamps, error logs)

Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interest in fraud prevention and platform security).

3.3 Documents Uploaded by Customers

As part of our services, customers upload documents to our platform for automated digitization. These documents may contain personal data of third parties.

In such cases, robodocxs processes this data solely on behalf of and in accordance with the instructions of the customer as a data processor pursuant to Art. 28 GDPR. Details are governed by a separate Data Processing Agreement (DPA).

3.4 Contacting Us and Forms

If you contact us by email, phone, or via a contact form, we process the data you provide (name, email address, content of the inquiry) to handle your request.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

Our website offers the following forms: the contact form (name, company, email address, optional phone number, message), the “Check feasibility” form (a description of your task, optionally the systems involved and cases per month, name, company, email address, optional phone number), the request for our DPA and our TOM (email address) and the download of our case studies (email address). The details are sent to our team by email. The website sends no emails to the address you enter; we reply to you personally. For the case-study download, you get a download link right after submitting, valid for 24 hours.

To prevent misuse, we store a pseudonymised hash of your IP address (for IPv6, of the network prefix) together with the time for one hour for each form submission, in order to limit repeated submissions (Art. 6(1)(f) GDPR).

You only receive the robodocxs newsletter if you expressly agree to it in the contact form (Art. 6(1)(a) GDPR). You can withdraw this consent at any time with effect for the future, e.g. by email to info@robodocxs.ai.

3.5 Booking Appointments via Calendly

We use Calendly, a service of Calendly LLC (USA), to book demo appointments. A connection to Calendly is only established when you click a booking button or open a link with the parameter ?termin-vereinbaren; before that, no data is transferred to Calendly. In the booking window, Calendly processes your IP address and the data you enter (e.g. name, email address, selected time) and sets its own cookies. Legal basis: Art. 6(1)(b) GDPR (steps prior to a contract at your request) and Art. 6(1)(f) GDPR (legitimate interest in simple appointment scheduling). For the transfer to the USA, see section 7.

3.6 Interactive Product Tour (Arcade)

Our interactive product tour is provided by Arcade, a service of Arcade Software, Inc. (USA). The tour is only loaded when you click the preview image; before that, no data is transferred to Arcade. When loading, Arcade processes your IP address and technical usage data of the tour. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in presenting our product at your express request). For the transfer to the USA, see section 7.

4. Purposes of Data Processing

We process personal data for the following purposes:

  • Providing and operating the website and platform
  • Establishing, performing, and terminating contractual relationships
  • Billing for services used
  • Customer support and service
  • Ensuring IT security and platform operations
  • Compliance with legal retention and documentation obligations
  • Further development and improvement of our services (based on anonymized or aggregated data)

5. Data Processing on Behalf (Art. 28 GDPR)

Where robodocxs processes personal data on behalf of the customer in the context of document digitization, we conclude a Data Processing Agreement (DPA) in accordance with Art. 28 GDPR. This agreement regulates in particular:

  • Subject matter and duration of processing
  • Nature and purpose of processing
  • Type of personal data and categories of data subjects
  • Obligations and rights of the controller
  • Technical and organizational measures
  • Use of subprocessors

The DPA can be requested at info@robodocxs.ai.

6. Recipients and Disclosure of Data

Personal data is only shared with third parties if necessary for contract performance, if there is a legal obligation, or if you have given your consent. Possible recipients include:

  • Hosting and infrastructure providers: We use cloud infrastructure services to operate our platform. Servers are located within the European Union.
  • Payment service providers: We use certified payment providers compliant with PCI DSS standards to process credit card payments.
  • Tax advisors and auditors: As required by law.
  • Email delivery: We forward form requests to our team via our email service provider (Amazon SES, data centre in Frankfurt am Main).
  • Google Ireland Limited (Google Analytics 4): only with your consent to the “Statistics” category, see section 12.
  • Leadinfo B.V. (Netherlands) and lemlist SAS (France): only with your consent to the “Marketing” category, see section 12.
  • Calendly LLC (USA) and Arcade Software, Inc. (USA): only if you open the appointment booking or the product tour with a click, see sections 3.5 and 3.6.

All service providers are contractually bound to comply with GDPR. Where data processing on behalf takes place, we have concluded agreements in accordance with Art. 28 GDPR.

7. Data Transfers to Third Countries

We process the platform and the documents uploaded by customers within the European Union. On our website, data may be transferred to the USA if you consent to Google Analytics (Google Ireland Limited may transfer data to Google LLC) or open the appointment booking (Calendly) or the product tour (Arcade) with a click. In these cases, we ensure an adequate level of data protection through an adequacy decision of the European Commission (Art. 45 GDPR, EU-US Data Privacy Framework), insofar as the provider is certified under it, or through EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

8. Technical and Organizational Measures

robodocxs implements appropriate technical and organizational measures to protect your personal data in accordance with Art. 32 GDPR. These include, among others:

  • Encryption of data transmission (TLS/SSL)
  • Encryption of stored data (encryption at rest)
  • Access controls and role-based authorization systems
  • Regular security audits and penetration tests
  • Logging of security-relevant events
  • Emergency and recovery concepts (business continuity management)
  • Regular employee training

These measures are continuously reviewed and improved as part of our ISO 27001-certified ISMS.

9. Storage Duration and Deletion

Personal data is stored only as long as necessary for the respective processing purpose or as required by statutory retention periods:

  • Contract data: For the duration of the contractual relationship and thereafter in accordance with statutory retention periods (generally 6 or 10 years under § 257 HGB and § 147 AO).
  • Documents uploaded by customers: Deleted within 30 days after termination of the contractual relationship, unless statutory retention obligations apply.
  • Server log files: Deleted after a maximum of 90 days.
  • Contact inquiries: Deleted after processing is completed and any applicable warranty periods have expired.
  • Protection against form misuse: The hash of your IP address is no longer used after one hour and is deleted with the next form submission after that.
  • Case-study download links: Valid for 24 hours.
  • Your cookie settings: Stored in your browser for 180 days; after that we ask again.

10. Your Rights as a Data Subject

You have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR): You may request information about the personal data we process.
  • Right to rectification (Art. 16 GDPR): You may request the correction of inaccurate data.
  • Right to erasure (Art. 17 GDPR): You may request the deletion of your data, provided there are no legal retention obligations to the contrary.
  • Right to restriction of processing (Art. 18 GDPR): You may request the restriction of the processing of your data.
  • Right to data portability (Art. 20 GDPR): You may request to receive your data in a structured, commonly used, and machine-readable format.
  • Right to object (Art. 21 GDPR): You may object at any time to the processing of your data based on Art. 6(1)(f) GDPR.

To exercise your rights, please contact: info@robodocxs.ai

11. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data. The authority responsible for robodocxs is:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18, 91522 Ansbach
poststelle@lda.bayern.de
www.lda.bayern.de

12. Cookies and Tracking

On your first visit, our own consent banner asks which services you allow. “Decline” and “Accept” carry equal weight; under “Settings” you choose individual categories. Without your consent, no statistics or marketing services are loaded. You can change or withdraw your choice at any time via the “Cookie settings” link in the footer of every page; the withdrawal applies to the future.

12.1 Necessary

We store in your browser (local storage, no cookies) your choice in the consent banner for 180 days and, if you switch it, your preferred colour scheme (light or dark). This storage is strictly necessary for the function you requested (Section 25(2) No. 2 TDDDG, Art. 6(1)(f) GDPR). We load fonts from our own server; no requests are sent to font providers.

12.2 Statistics: Google Analytics 4

With your consent to the “Statistics” category, we use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to analyse the use of our website. Google Analytics sets cookies (e.g. “_ga”) and processes usage data such as pages viewed, time spent, device and browser information and your IP address, which Google Analytics 4 does not store. We use Google Consent Mode; the service is only loaded after your consent. Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

12.3 Marketing: Leadinfo and lemlist

With your consent to the “Marketing” category, we use:

  • Leadinfo from Leadinfo B.V. (Netherlands): Leadinfo matches the IP address of a website visit to a company, so we can see which companies are interested in our offering. For this, Leadinfo stores an identifier in cookies or in your browser's local storage.
  • lemlist from lemlist SAS (France): lemlist records pages viewed, time spent, clicks and browser information of a visit to recognise visits from contacts of our sales campaigns.

Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

13. Data Protection Incidents

robodocxs has a documented procedure for detecting, reporting, and handling data protection incidents. In the event of a personal data breach (Art. 33 GDPR), we will report it to the competent supervisory authority without undue delay and, where possible, within 72 hours of becoming aware of it, provided the breach is likely to result in a risk to the rights and freedoms of natural persons. If the risk is high, we will also inform affected individuals without undue delay in accordance with Art. 34 GDPR.

Customers whose data is affected will be informed immediately so they can meet their own reporting obligations.

14. Data Protection Impact Assessment

Where processing is likely to result in a high risk to the rights and freedoms of natural persons, robodocxs conducts a Data Protection Impact Assessment (DPIA) in accordance with Art. 35 GDPR. This applies in particular to new processing activities or significant changes to existing processing related to document digitization.

15. Changes to This Privacy Policy

We reserve the right to amend this privacy policy as necessary to reflect changes in legal requirements, technical developments, or our services. The current version is always available on our website. We will inform customers separately of any significant changes.

16. Information Security in Accordance with ISO 27001

robodocxs operates an Information Security Management System (ISMS) in accordance with ISO 27001. This includes policies, processes, and controls to protect the confidentiality, integrity, and availability of all processed information.

Data protection requirements under the GDPR are an integral part of our ISMS. Regular internal and external audits ensure the effectiveness of the implemented measures.