1. Who We Are
Dossentia is operated by FHATAL Oy (Business ID: 3546336-3), a company registered in Vantaa, Finland. We are the data controller for the personal data described in this policy.
| Company | FHATAL Oy |
| Business ID | 3546336-3 |
| Address | Vantaa, Finland |
| Website | dossentia.com |
| Privacy enquiries | support@fhatal.com |
| Support | support@fhatal.com |
| Legal | support@fhatal.com |
| Security issues | support@fhatal.com |
2. What Data We Collect and Why
We collect only the data we need to operate Dossentia.
| Category | Data | Purpose | Legal basis |
|---|---|---|---|
| Account data | Name, email address, hashed password | Authentication, providing the service | Art. 6(1)(b) |
| Organisation data | Company name, contact details | Licence management | Art. 6(1)(b) |
| Usage logs / Audit trail | Actions, timestamps, session info | Security, compliance record-keeping | Art. 6(1)(f) |
| AI system content | User-entered compliance content (company-owned data) | Generating compliance documentation | Art. 6(1)(b) |
3. Data Retention
- Account data: duration of the contract + 2 years.
- Audit logs: 10 years (EU AI Act Article 18, continuous documentation obligation).
- Data is deleted upon request within the limits of applicable law. Data subject to statutory retention obligations will not be deleted early.
4. Data Hosting & Infrastructure
All data is stored and processed within the EU/EEA. Dossentia is hosted on Hetzner infrastructure in Finland via Coolify. No personal data is transferred outside the EU/EEA.
| Hosting | Coolify on Hetzner, Helsinki, Finland (EU) |
| Database | Supabase, EU region |
5. Your Rights
Under GDPR you have the following rights:
- Right of access (Art. 15): request a copy of the personal data we hold about you.
- Right to rectification (Art. 16): request correction of inaccurate data.
- Right to erasure (Art. 17): request deletion of your personal data.
- Right to restriction (Art. 18): request that we restrict processing in certain circumstances.
- Right to data portability (Art. 20): receive your data in a machine-readable format.
- Right to object (Art. 21): object to processing based on legitimate interest.
- Right to withdraw consent: where processing is based on consent, withdraw it at any time.
Submit requests to support@fhatal.com, we respond within 30 days.
Right to lodge a complaint: Office of the Data Protection Ombudsman, tietosuoja.fi, PO Box 800, FI-00531 Helsinki, Finland.
6. Cookies
Dossentia uses only technically necessary cookies for session management (Supabase Auth session cookie). These cookies are not used for marketing or tracking. No third-party advertising or analytics cookies are used.
7. Automated Decision-Making
Dossentia does not make solely automated decisions that produce legal or similarly significant effects on individuals. The AI-assisted Risk Classification Wizard is an assistive tool; all outcomes are reviewed and confirmed by the user.
8. Security
We implement appropriate technical and organisational measures to protect your data, including AES-256 encryption at rest, TLS 1.3 in transit, row-level database isolation between organisations, and role-based access control.
9. Changes to This Policy
We may update this policy from time to time. For material changes, we will notify users by email at least 30 days before the change takes effect.
Last updated: 6 June 2026