Privacy Notice
This notice explains how MB Qodoonect ("Qodoonect", "we") processes personal data when you use the Qodoonect Trust Platform. We act as a controller for account data and identity and entity verification data, and as a processor for envelope content uploaded by our customers (see the DPA).
1. Controller
The controller is MB Qodoonect, legal entity code 308013013, registered in the Register of Legal Entities of the Republic of Lithuania. Details are in the Imprint. Privacy contact: dpo@qodoonect.com.
2. Categories of data we process
- Account: email, hashed password, display name, authentication factors, MFA seeds, Ordinal Pass identifiers, workspace memberships.
- Identity and entity verification: name and surname; the declaration and the signed file (PDF), which contains your qualified certificate, including your personal identification code; certificate issuer, serial number and validity; a keyed hash (HMAC) of your personal identification code; level, status, dates and reason codes; data of the Register of Legal Entities about the entity (code, name, legal form, status); when signing in the Service becomes available, signing session data (method, time, document hash — no phone number or personal code is stored); the signature validation report.
- Envelope & signature data:documents you upload, signer information, audit trail, signature receipts, IP & user-agent of signers.
- Operational telemetry: request logs, error reports (PII-scrubbed before transmission to error trackers), aggregate metrics.
3. Personal identification code
We process your personal code only as part of your qualified certificate in the signed file and as a keyed hash used to prevent the same person from being verified more than once. We never publish it, never show it in the Service and never use it for direct marketing (Article 3 of the Law on the Legal Protection of Personal Data of the Republic of Lithuania). It is not written in declarations, reports or logs.
4. Purposes & legal bases (GDPR Art. 6)
| Purpose | Data | Legal basis |
|---|---|---|
| Account and Service | account data | Contract — Art. 6(1)(b) |
| Verifying your own identity (L3) | verification data | Contract — Art. 6(1)(b) |
| Verifying a representative's authority for a legal entity (L2, L3) | verification data of the representative | Legitimate interest of Qodoonect and the entity in confirming authority and preventing fraud — Art. 6(1)(f) |
| Preventing impersonation (one qualified signature identity — one person) | HMAC of the personal code | Legitimate interest — Art. 6(1)(f), Recital 47 |
| Keeping evidence and defending legal claims | signed file, validation report, records | Legitimate interest — Art. 6(1)(f) |
| Tax and accounting records | invoices | Legal obligation — Art. 6(1)(c) |
| Non-essential cookies, newsletters | — | Consent — Art. 6(1)(a) |
Qodoonect is not a qualified trust service provider and is not subject to anti-money-laundering customer due diligence obligations; verification is not carried out for those purposes.
5. Where data come from
Besides you: the State Enterprise Centre of Registers (open data of the Register of Legal Entities); the qualified certificate in your signature; the EU trusted lists and certificate status services (OCSP, CRL).
6. Recipients & transfers
Signing providers. Today you sign declarations with your own qualified signing means outside the Service, and we send your data to no signing provider. When in-platform signing with Smart-ID, Mobile-ID or LT ID becomes available, SK ID Solutions AS (Estonia — Smart-ID, Mobile-ID) and the State Enterprise Centre of Registers (Lithuania — LT ID) will receive the data needed to create your signature (your personal code if you enter it, your phone number for Mobile-ID, and the document hash); they act as independent controllers and qualified trust service providers. A qualified time-stamp provider receives only a hash.
Processors. Supabase (database and storage, EU — Ireland), Railway (application servers), Vercel (website). The current list of processors is available from the privacy contact.
Transfers. Data are stored in the EU. Some processors are US companies whose staff may access data; such transfers rely on the EU–US Data Privacy Framework or the Standard Contractual Clauses (Decision (EU) 2021/914).
7. Retention
| Data | Kept |
|---|---|
| Signed declaration, validation report, verification record | while the verification is valid and 3 years after it ends; longer only while a dispute is pending |
| Failed or abandoned verification | up to 90 days |
| Unsigned document of a signing session | until the session ends |
| HMAC of the personal code | while your person record exists and 3 years after |
| Signed envelopes you upload | as agreed with you; deleted on request after the contract ends |
| Account data | lifetime of the account + 1 year |
| Operational logs / security logs | 90 days / 365 days |
| Error reports | 30 days, redacted of PII at ingestion |
8. Your rights
Under the GDPR you have the rights of access, rectification, erasure, restriction, portability and objection. You may ask for a copy of your signed declaration. Automated decisions:verification decisions are made automatically; you may contest a decision, express your point of view and ask for a human review in the Service or through our contacts (Art. 22(3) GDPR). Objection: you may object to processing based on legitimate interest; we will stop unless we have compelling grounds, such as preventing fraud or defending legal claims. Erasure:if you delete your account, records of a granted verification are kept for the period above (Art. 17(3)(e)); records of failed attempts are deleted. You may lodge a complaint with the State Data Protection Inspectorate of the Republic of Lithuania (vdai.lrv.lt) or the supervisory authority of your residence. Contact: dpo@qodoonect.com.
9. Security
We implement security measures informed by ETSI EN 319 401 and ISO/IEC 27001, without claiming certification. Qualified signatures are created on qualified signature creation devices operated by qualified trust service providers; Qodoonect never holds signers' keys. Disclose vulnerabilities responsibly via security@qodoonect.com.
10. Age
The Service is for persons aged 18 or over.
11. Changes
Material changes are announced 30 days in advance via email and in-product banner. The current version is always available at this URL.
Last updated: 2026-10-19. Document version: draft-0.3.