Legal
DocumentMS privacy notice
This notice covers personal data DocumentMS handles as a controller: website visitors, demo requesters, trial users and job applicants. Data our customers put inside their own tenants is handled as a processor instead, under the data processing addendum rather than this notice.
Which data this notice covers
This notice covers personal data we determine the purposes for — website visitors, people who request a demo or start a trial, customer administrators and users we correspond with, job applicants, and partner contacts. For all of these we are a controller.
It does not cover the documents and personal data our customers place inside their own tenants. For that material the customer is the controller and we are a processor acting on their documented instructions, governed by the data processing addendum. If you are a customer’s employee or client and want to exercise a right over documents held in their tenant, the request needs to go to them — we are not permitted to act on it directly.
What we collect and why
| Category | Examples | Purpose | Lawful basis | Retention |
|---|---|---|---|---|
| Website analytics | Pages viewed, approximate region, device type | Understanding which content is useful | Consent — nothing is collected until you choose | 26 months from collection |
| Demo and trial requests | Name, work email, company, role, stated use case | Responding to the request and preparing a relevant session | Legitimate interests, or steps prior to contract | 24 months from last contact |
| Customer contacts | Name, work email, role, correspondence | Providing the service, support and contractual notices | Contract performance | Contract term plus 7 years, to meet tax and limitation periods |
| Support requests | Contact details and the content of the request | Resolving the issue and improving the product | Contract performance and legitimate interests | 3 years from resolution |
| Job applications | CV, contact details, interview notes and assessment | Assessing the application | Steps prior to contract, and consent for a talent pool | 12 months from decision, or 24 months with your consent |
Your rights
- Access — a copy of the personal data we hold about you, and information about how we use it
- Rectification — correction of inaccurate or incomplete data
- Erasure — deletion, where no overriding obligation or legitimate ground to retain applies
- Restriction — limiting how we use the data while an issue is resolved
- Portability — a machine-readable copy of data you provided, where processing is by consent or contract
- Objection — to processing based on legitimate interests, including direct marketing, which we will stop on request without needing a reason
- Withdrawal of consent — at any time, without affecting processing already carried out
- To exercise any of these, contact support@documentms.com. We acknowledge within 5 business days and respond in full within one month. Where a request is complex or you have made several, we may extend by a further two months and will tell you why within the first month.
Last reviewed: 2026-07-15