Privacy Policy

Last updated: November 5, 2026

1. Controller

Prexis Labs Digital Services, Lda., registered in Portugal (“Prexis”, “we”), identified at the top of this page and in the website footer, is the controller of the personal data collected through www.dokstamp.com and the DokStamp platform (app.dokstamp.com). Privacy contact: privacy@dokstamp.com (or sales@dokstamp.com).

2. What data we process and why

a) Website contact form: name, e-mail and message — to answer your request and, where applicable, prepare a demo or proposal. Legal basis: steps prior to entering into a contract at your request and our legitimate interest in handling enquiries (Art. 6(1)(b) and (f) GDPR). The message is delivered by e-mail to our sales team through an e-mail delivery provider (see section 4).

b) Technical browsing data: the server hosting this website automatically records the IP address, date and time, requested address, browser type and referring page (access logs), solely to keep the website secure and working and to limit abuse of the contact form. Legal basis: legitimate interest (security). This website uses no cookies, analytics tools or third-party services — see the Cookie Policy.

c) DokStamp platform (users of client institutions): account data (name, e-mail, role, institution), activity logs and the data contained in issued certificates and diplomas (holder name, course, dates, identifiers). Here the issuing institution is, as a rule, the controller and Prexis acts as processor under the service agreement and data processing agreement (Art. 28 GDPR). We also process, as controller, the data needed for contract management, invoicing and support (performance of the contract and legal obligations).

d) Public verification of certificates: a verifier only sees the information the issuer chose to make verifiable.

3. Electronic signature and blockchain

Documents issued on the platform are signed with an advanced electronic signature (PAdES format) under Regulation (EU) No 910/2014 (eIDAS). As proof of existence and integrity, only a cryptographic digest (hash) of the document is anchored on a public blockchain (Polygon). No personal data and no document content is ever written to the blockchain. The hash cannot be used to reconstruct the document. Records on a public blockchain cannot be deleted, which is why only hashes are anchored.

4. Recipients and processors

Data is processed by us and by service providers acting on our behalf under contract (Art. 28 GDPR):

• Hetzner Online GmbH (Germany/Finland) — hosting of this corporate website, and hosting and storage of the platform and documents.
• Sinch (Mailjet, France) — transactional e-mails (notifications, invitations, codes) and delivery of contact-form messages.
• Vercel Inc. (USA; functions run in the Frankfurt region) — hosting of the platform’s web interface (Data Privacy Framework and standard contractual clauses).
• Laravel Forge (Laravel LLC, USA) — server management/provisioning (no routine access to document data).
• Cloudflare, Inc. (USA) — DNS service for the dokstamp.com and dokstamp.xyz domains, and forwarding of messages sent to the sales@ and privacy@ addresses to Prexis’s mailbox (Data Privacy Framework and standard contractual clauses).
• Mistral AI (France) — automated extraction of data from contracts/documents uploaded by institutions, when that feature is used.
• The public Polygon network — receives hashes only (see section 3).

We may also disclose data to authorities where required by law.

5. International transfers

Data is processed primarily in the European Union. Where a provider is located outside the EEA (USA), transfers rely on an adequacy decision (EU-US Data Privacy Framework) or the European Commission’s standard contractual clauses, with supplementary measures where needed.

6. Retention

• Contact-form enquiries: up to 24 months after the last contact, unless a contract follows.
• Platform account data: for the term of the contract and up to 12 months after it ends, unless the law requires otherwise.
• Issued documents and certificates: for the period set by the issuing institution in the contract; blockchain hashes are permanent (they contain no personal data).
• Invoicing data: 10 years (tax obligation).
• Technical logs: up to 12 months.

7. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection. To exercise them, contact privacy@dokstamp.com. If your data was processed on behalf of an issuing institution, we will forward your request to it. You may also lodge a complaint with the Portuguese supervisory authority, Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt.

8. Security

We apply appropriate technical and organisational measures: encryption in transit (TLS) and at rest, access control, activity logging, backups and EU hosting.

9. Changes

We may update this policy; the version in force is the one published on this page, with its update date.

← Back to home