Privacy Policy & Data Governance

1. Overview and Data Controller

This Privacy Policy and Data Governance Statement ("Policy") details how Docmine Technology ("Docmine", "we", "us", or "Data Processor/Controller") processes personal data and corporate documents within our secure cloud management platform accessible at docmine.com.br.

Docmine delivers high-trust infrastructure tailored for law firms, accounting practices, consulting organizations, and enterprise departments that require strict professional secrecy, data custody, and information security.

2. Core Definitions

• Personal Data: Any information relating to an identified or identifiable natural person.
• Data Subject: The natural person whose personal data is processed.
• Custodied Document: Word (.docx), Excel (.xlsx), PowerPoint (.pptx), PDF, or related business files stored, edited, and viewed within Docmine.
• Audit Trail: A chronological, cryptographically verified record of all operations performed on a file or folder.
• Controller vs. Processor: The subscribing organization acts as the primary Data Controller for files placed into custody, while Docmine operates as the high-security technical Data Processor.

3. Data We Collect and Processing Scope

We process only the minimum data required to deliver reliable enterprise document custody:

1. User Registration Data: Full name, professional corporate email, phone number, title, firm name, and encrypted access credentials.
2. Operational Telemetry and Audit Logs: Source IP address, access timestamps, session tokens, browser and device user-agents, file revision history, and user access control logs.
3. Cloud Document Content: Text, tabular calculations, formatting, and notes inside files opened in Docmine's browser office suite. Docmine never sells, mines, or trains public AI foundation models on customer documents without explicit written consent.
4. Billing Information: Corporate billing entities, tax IDs, invoice addresses, and processed payment references.

4. Processing Purposes and Legal Bases

Data processing operations on Docmine adhere strictly to the legal frameworks of the LGPD (Lei nº 13.709/2018) and EU GDPR:

• Contractual Performance: Providing authenticated access, real-time multi-user editing, granular folder permissions, and automated cloud autosaving.
• Legal & Regulatory Compliance: Retaining mandatory connection logs (Internet Civil Framework) for a minimum of 6 months, and preserving financial records according to legal accounting statutes.
• Legitimate Interests & Security: Preventing account hijacking, detecting anomalous file downloads, maintaining forensic audit logs, and defending legal rights.

5. Enterprise Security & Cryptographic Standards

Security is built directly into Docmine's core architectural layers:

• Encryption at Rest: Storage volumes and file blocks are encrypted with AES-256 GCM.
• Encryption in Transit: Mandatory HTTPS connections enforced via TLS 1.3 with Perfect Forward Secrecy.
• Role-Based Access Control (RBAC): Granular permissions per folder and file (Restricted Reader, Draft Reviewer, Department Manager).
• SHA-256 Document Signatures: Every revision generates an immutable cryptographic hash stamp guaranteeing data integrity.
• Logical Tenant Isolation: Strict multi-tenant isolation preventing any cross-tenant data access.

6. Third-Party Data Sharing

Docmine does not sell, lease, or monetize customer data. Data sharing is strictly restricted to:

• Tier III Cloud Infrastructure: ISO 27001, SOC 2 Type II, and HIPAA certified cloud facilities hosting encrypted servers and backups.
• Payment Processors: PCI-DSS certified financial gateways for subscription billing.
• Legal Authorities: Only when strictly mandated by a valid judicial court order or applicable regulatory mandate.

7. Data Retention & Secure Sanitization

Customer files remain active throughout the subscription term. Upon contract termination, customers retain 30 days to export all documents and audit logs, following which data is permanently wiped using DoD-standard overwriting algorithms.

8. Data Subject Rights

Under LGPD (Article 18) and GDPR (Articles 15-22), users have the right to request access, correction, deletion, data portability, and revocation of consent at any time without fees by contacting privacidade@docmine.com.br.

9. Cookies & Technical Identifiers

Docmine utilizes only essential technical session cookies necessary to maintain authenticated sessions, secure document synchronization, and defend against CSRF attacks. No third-party ad tracking cookies are placed in our secure application workspace.

10. Terms of Use & Document Custody

By utilizing Docmine, the subscribing organization and its team agree to the following terms:

• Authorized Content: Users are solely responsible for the legality and intellectual property rights of files uploaded. Unlawful files, malware, or illicit data distribution are strictly prohibited.
• Credential Security: Users must maintain confidential credentials and enable Two-Factor Authentication (2FA) wherever available.
• Service Availability: Docmine maintains a 99.9% uptime SLA for Enterprise tiers and performs automatic continuous backups.

11. Data Protection Officer (DPO) and Inquiries

For inquiries, rights requests, or security notices, reach our Data Protection Officer:

• DPO Office: Docmine Data Governance & Information Security Committee
• Direct Email: privacidade@docmine.com.br
• General Support: contato@docmine.com.br
• Website: https://docmine.com.br/en/