Data Processing note

This note summarises the Article 28 UK GDPR terms between your firm and Docquo. A full Data Processing Agreement will be available on request.

Roles

• Your firm is the controller of your clients' personal data and decides why and how it is collected.
• Docquo is the processor: we process that data only on your documented instructions — to store, show, check and remind about records — and for no other purpose.

What we commit to

• Confidentiality: only authorised staff can access data, and only to support you.
• Security: encryption in transit and at rest, private file storage with short-lived download links, firm and role isolation enforced in the database, hashed upload links.
• Sub-processors: hosting/database, email delivery and AI document checks. We'll tell you before adding new ones.
• Location: data is stored in the UK/EU.
• Assistance: we'll help you respond to client rights requests and notify you without undue delay of a personal data breach.
• Deletion: files are deleted under your retention setting (default 24 months after each quarter), and all data is erased 30 days after you delete your account. You can export everything first.

Categories of data

Client names, contact details and financial records (bank statements, invoices, receipts, rent records) uploaded for MTD quarterly updates.