Privacy Notice
Documents

Last updated: July 31, 2023

Intro

Readdle Limited (“Readdle” or “we”) welcomes you. We provide you with our iOS and macOS application “Documents” (“App” or “Documents”) under the Terms of Service.

This Privacy Notice describes which of your personal data the Documents collects, how stores, processes, and uses it, and what happens when you use the App.

We collect your personal data according to this Privacy Notice when you use the App. When you use our website, available following the link https://readdle.com/documents (“Website”), your personal data is processed in accordance with the Privacy Notice for the Website.

We understand you care about your privacy, and we appreciate the trust you place in us. To justify that trust, we embed the latest data security standards, improve our awareness of privacy matters, and comply with the General Data Protection Regulation and other privacy laws.

Please note that we do not collect, track, or store any personal data over what we need to provide and improve our product and services, perform our marketing campaigns as described in this Privacy Notice, and comply with our legal obligations.

Table of contents

• About Us
• About You
• Personal Data
  • Sources of Data
  • Legal Basis for Processing
  • Age limitation
• Personal Data in Documents
  • Technical Data
  • General information
• Details
  • Onboarding
  • Subscription or Trial
  • Document transfer
  • Login via Third-party Services
  • Push notifications
  • Automated individual decision-making
  • Turning on the VPN
  • Upgrade and extension to Documents Subscription
  • Invoice history
  • App usage
  • Support Request Data
  • Feedback Data
  • Analytics
• Data Sharing with Third Parties
  • Details
• Data Transfer Outside the European Economic Area
• Security measures
• Data Subjects Rights
  • European Economic Area Residents
  • United States Residents
  • Do Not Sell My Personal Information
  • Do-Not-Track Requests
• Privacy Notice Updates

About Us

About You

When you use Documents, you become our user.

Personal Data

Sources of Data

We receive data about you when you download our App and interact with it, depending on your actions in the App.

We may also, although we do not necessarily do so, receive data from third parties. It depends on your settings and the features you use.

Legal Basis for Processing

To process your personal data, we rely on the following legal bases:

• performance of the contract — for the processing of personal data necessary for the negotiating on, conclusion, and performance of a contract (for example, the Terms of Service) with you;
• legal obligation — for the processing of data as required by applicable laws or if requested by a law enforcement agency, court, supervisory authority, or another state-authorized public body;
• legitimate interest — for the processing necessary for the development of our services, taking into consideration your interests, rights, and expectations;
• consent — for additional processing for specific purposes.

Age limitation

Please pay attention. We knowingly do not process the data from users below 16 years of age without a legal representative’s consent. If you are such a user or the user’s legal representative, please inform us by email at dpo@readdle.com.

Personal Data in Documents

We collect your personal data according to this Privacy Notice when you use the App. Some of the data we collect automatically, such as the country the App is used in: we get this data based on the IP address or from the AppStore (we receive this information in a generalized form).

Generally, all the data provided to us can either be linked to you or not (i.e., anonymized data).

Technical Data

When you use our App, we may collect some technical data. Pay attention to the fact that we collect your device’s name for security purposes.

General information

All the data you can use through our App is stored on Google Drive, iCloud, Dropbox, Box, WebDAV, etc. process right on the device, via SDKs, and we don't have access to these files.

Overall function:

• Logging in through third-party accounts. When you connect "Documents" to other accounts, the App accesses all personal data stored in that account: cloud data and third-party app data.
  
  This may include media files, documents, history, and application interaction results. This is achieved thanks to AppToken.
• Automated individual decision-making.
• DocsTransfer.

Receipt is an electronic document provided by Apple about your payment. It is stored on your device. We receive only hash (electronic value) to verify the transaction.

Details

We understand that you might wish to know the details about our privacy practices. We grouped our data privacy processes by features.

Onboarding

Subscription or Trial

You are charged through the App Store.

To track and issue invoices on time, we process your receipt. The receipt is stored on your device. We receive only a hash (electronic value) to verify the transaction.

We also keep the history of payments, as this is a legal requirement, and we cannot delete this information until the filing of the annual accounts expires.

Document transfer

We provide you with the functionality for data transfer. Wi-Fi Transfer is the easiest way to transfer files and photos from a computer to your iPhone or iPad and vice versa. All you need to do is open an App on your phone.

We would like to clarify some important details:

1. At the moment of connection, our server sees the IP address of the device from which it is connected. We store it during the connection and then delete it.
2. All user data is transmitted exclusively over the local network and never gets to our or any other server.
   

   In other words, we are not aware of what exactly you transfer. We only know about the fact of this connection.

3. Within the local network, the transmission of user data goes without encryption.
4. Auxiliary control commands are transmitted between the device and the browser.

Login via Third-party Services

We provide you with the possibility to link accounts from third-party services for integration and synchronization of data.

Push notifications

We can send you small notifications to inform you about changes or updates via pushes from the App. You can allow or disable push notifications in the App Settings on your device

Automated individual decision-making

We can use Automated individual decision-making to customize your experience with our App.

Turning on the VPN

For greater security and anonymity when using the Internet, we have added a VPN. With VPN enabled, your IP address will be changed. A connection server can be random, or you can choose some specific one.

Upgrade and extension to Documents Subscription

In addition to the data set that we processed before, now we also store information that you have a subscription.

Invoice history

In order to track and issue invoices on time, we process your receipt. We also keep the history of payments, as this is a legal requirement, and we cannot delete this information until the expiration of the filing of the annual accounts.

App usage

Here we described the data you see in our App.

Support Request Data

When you address your request to support in the App, we collect some information to help you.

We may collect your detailed log files to help you with your problem. These log files may contain sensitive personal information and are connected to you.

Pay attention to our practice on the log files:

• iOS or iPadOS – when you address your support request, you can choose whether to add detailed log files or not;
• MacOS – when you address your support request, we collect your log files by default.

Feedback Data

When you submit your feedback about the App to us directly or via third-party platforms, we process personal data in your feedback, which may include your first and last name, username, the text of the feedback and/or any other information such as the feedback submission date, the rating which you assigned to the App, etc., contained in or related to the feedback.

Analytics

We use the Amplitude service to gather statistics on the App usage. As a user, you will not see how this service operates. The Amplitude projects (statistics per specific user after combined into general groups via several criteria) are fully anonymized. This process does not involve personal data that we can access.

Data Sharing with Third Parties

We use your personal data on the basis of the performance of the contract to provide services and communicate with the Users.

We share your data with the service providers (please, request Annex A. List of the processors to look through the list of service providers) and contractors to the extent necessary to provide services, technical and customer support, who, for example, help us:

• operate, develop, and improve the features and functionality of our App;
• provide you with their services;
• complete your payment transactions;
• fulfill your support requests;
• convert your files;
• communicate with you as described elsewhere in this Privacy Notice.

In addition, we have implemented organizational and technical measures to ensure the security of personal data during data transfer to third-party.

We can share your data on the following grounds: consent, legal obligation, and legitimate interest.

Details

Performance of a contract. We may transfer your data to our contractors and partners for contractual purposes.

Consent. We may transfer your personal data based on your explicit consent.

Legal obligation. We may disclose your personal data to third parties to the extent that it is necessary:

• to comply with a government request, court order, or applicable law;
• to prevent unlawful use of our App or policies;
• to protect against claims of third parties;
• to help prevent or investigate fraud.

Transfer of personal data to third parties. We may transfer your personal data to third parties based on a data processing agreement, subject to applying technical and organizational measures to protect your personal data. We may share data with certain companies, consultants, and contractors hired to provide certain services to us or on our behalf.

Please note! We will ask for your consent if data transfer is not part of the contract.

Data Transfer Outside the European Economic Area

The personal data we collect is stored on servers in the USA. The data is stored in the USA by default, but we may need to process your personal data in another country. We also share some data with our service providers in Ukraine.

There is no adequate decision by the European Commission regarding either the US or Ukraine. This means that the USA and Ukraine are not deemed to provide an adequate level of protection for your personal data. We use adopted Standard Contractual Clauses based on legislation assessments for data protection during transfer and storage.

You can read more detailed measures to protect your personal data here and in our Data Processing Agreement for the European Economic Area residents and Data Processing Agreement for the United States residents.

However, if a data transfer is required to perform a contract or provide you services, we have the right to do so without your consent.

Security measures

We regularly perform Data Protection Impact Assessments to ensure that we use an appropriate level of technical and organizational measures to prevent accidental or unlawful destruction, loss, alteration, and unauthorized disclosure of or access to personal data transmitted, stored, or otherwise processed. We follow ISO 27001 Standard to put all security controls in place as a basis.

To be more specific, to protect your personal data, we use HTTPS and encryption, divided group and individual access (where appropriate), an alarm system, corporate VPN, and written approved internal policies (like password policy and physical access policy).

Moreover, we systematically monitor our technologies’ state of the art and never forget about the backups. All our contractors are under contractual obligations compliant with the GDPR requirements.

Here you can find information about the steps we mentioned above:

Data Subjects Rights

European Economic Area Residents

You, as a data subject, have the right to interact with your data directly or through a request to us. This section describes these rights and how you can exercise them:

United States Residents

You, as data subjects, have some special privacy rights. To use them, please contact us.

Note: Depending on the state and legislative requirements, we have from 30 to 60 days to exercise your request with the right to postpone it for 30 days more.

If your complaint is not satisfied, you can file a complaint with the Federal Trade Commission.

Your rights vary depending on the laws that apply to you, but may include:

Do Not Sell My Personal Information

California residents have the right under the California Consumer Privacy Act (“CCPA”) to opt out of the “sale” of their personal information by a company governed by CCPA.

Readdle does not sell your personal information to anyone nor use your data as a business model.

However, we support the CCPA by allowing California residents to opt out of any future sale of their personal information. If you would like to record your preference that we will not sell your data in the future, please contact us.

Do-Not-Track Requests

California residents visiting our App may request that we do not automatically gather and track information pertaining to their online browsing movements across the Internet.

Such requests are typically made through web browser settings that control signals or other mechanisms that allow consumers to exercise choice regarding collecting personal data about an individual consumer’s online activities over time and across third-party websites or online services.

We currently do not have the ability to honor these requests. We may modify this Privacy Notice as our abilities change.

Privacy Notice Updates

The Privacy Notice and the relationships falling under its effect are regulated by the General Data Protection Regulation. Existing laws and requirements for processing personal data are subject to change. Should this be the case, we will publish a new version of the Privacy Notice addressing such changes in our App and as the pop up banner on the Website.

If we make substantial changes to the Privacy Notice or the App that affect your data privacy rights, we will notify you by email or display information in the App and ask you to read it. We will notify you in advance, and, if you continue using the App after the changes come into effect, it shall be deemed that you have agreed to and accepted the updated Privacy Notice.