Dossalis › Privacy
Privacy policy
Last updated: 20 September 2026
What data we handle, on what legal basis, for how long and who else sees it. No copied boilerplate: only what actually happens at Dossalis.
Written to comply with Regulation (EU) 2016/679 and Spain's Organic Law 3/2018, and to be understood on first reading.
1. Two different roles, worth not confusing
Dossalis handles data in two situations the law keeps apart, and answers for them differently:
- As controller, for your data if you visit this site, take the test or ask for information, and for the data of your account in the panel: signing up, the people who log in and the login log. We decide what happens to it, and this policy covers it.
- As processor, for the data a client enters in their panel — their suppliers' contacts, the staff who carry out the checks. That data still belongs to the client company: we only handle it on their behalf and on their instructions, under the article 28 processing agreement, which forms part of the terms of service and is accepted when the account is created. If you are an employee or supplier of a client of ours and want to exercise a right, you need to approach that company, not us; we assist them.
2. Who handles your data
| Controller | Oscar Escanez Abad |
|---|---|
| Tax number | 23302634T |
| Registered address | Calle Trece de Septiembre, n.º 10, 1.º, 30310 Cartagena (Murcia), España |
| Privacy contact | info@dossalis.com |
We are not required to appoint a data protection officer. If that changes, their contact details will be published here.
3. What we handle, exactly
| What | What for | Legal basis | How long |
|---|---|---|---|
| Name, email, phone if you give it, company and activity | Answering your enquiry | Your consent when you submit the form | 1 year from last contact |
| Test answers and email | Sending you the result and, if you tick it, the weekly email | Your consent, withdrawable in one click | Until you withdraw it; 2 years maximum without interaction |
| Account: business name, email, activity, region and whether you import | Signing you up and providing the service, free or paid | Performance of the contract | While the account is open. A sign-up nobody confirms is deleted after 7 days; a closed account, after 30; a free account nobody logs into for 24 months is closed after a 30-day email warning |
| People who log into the panel: email, name if given, permission and date of last login | So each person has their own access, and it can be revoked | Performance of the contract | While they have access; deleted with the account |
| If you sign in with Google: the identifier Google assigns to your account, your verified email and your name | Signing in without a password | Performance of the contract, at your request when you click “Sign in with Google” | While the account is open |
| Your company, product, supplier, verification and supporting-document data | Providing the service (here we act as the client’s processor) | Performance of the contract | While the account is open; on closing it, 30 days and then deleted. “Download everything” lets you take them with you first |
| Verification records: business name, date, type and hash of the document | So whoever receives a record can check it with its code on the website | Performance of the contract, at the request of the client who issues it | While the account is open. The verification page shows only those four fields, and only to whoever has the code |
| Activity log: what was done, when and from which network (truncated) | Security, and being able to prove what was checked and when | Legitimate interest in security and proof of service | Kept chained, because deleting one line would break the proof of all the others. It does not store the record’s content, and once the account is deleted it is no longer linked to names or emails |
| Invoicing | Meeting tax and accounting obligations | Legal obligation | 6 years (art. 30, Spanish Commercial Code) |
| Technical data of the submission: originating network, date and time, browser | Stopping spam and form abuse | Legitimate interest in keeping the service up | Rotated and deleted automatically |
| Backups | Recovering the service if the server fails | Legitimate interest and the security obligation under article 32 | 60 days. Deleted items disappear from backups within that period; deleted supporting documents, the next day |
One detail few sites mention and this one does: we do not keep your full IP address. It is truncated to the network before being written — the first three groups in IPv4 — because that is enough to tell a bot from a customer, and it means we don't retain a value that identifies you.
4. What we don't do
- We don't track you. This site sets no cookies, uses no local storage and carries no analytics: no Google Analytics, no advertising pixels, no social buttons. The panel uses only the technical cookies essential to keep your session open and the one that remembers your chosen language; they are all listed in the cookie policy.
- We load nothing from outside. Typefaces and images are served from our own server, so opening this site makes not a single request to any other domain. Your IP doesn't leave us.
- We don't sell or share your data with anyone, not even in aggregate.
- No profiling, no automated decisions with legal effect. The test and the panel compute a result from what you enter; it is indicative and grants or denies nothing.
- No cold email and no sales calls. We only write to people who asked us to, and every marketing email carries its unsubscribe link. Panel emails (login links, expiry warnings and regulatory updates on paid plans) are part of the service and only reach people who have an account.
5. Who we share data with, and why
Only those needed for the service to work:
- Hosting for the website and the panel, within the European Economic Area, as our processor.
- Outbound email, within the European Economic Area, as our processor, to send login links, notices, test results and the weekly email.
- Payment gateway (Stripe), only if you move to a paid plan: it handles card data directly, we never see it, and it does so as controller under its own privacy policy, which includes its safeguards for transfers outside the European Economic Area.
- Google, only if you choose “Sign in with Google”: Google identifies you on its own page and returns to us your identifier, your verified email and your name. What happens on its page is governed by its own policy. If you don't click that button, the panel tells Google nothing — not even its logo loads from Google's servers.
If we ever change or add a provider, this list is updated first.
6. Health data: what the panel does not store
Dossalis documents products and suppliers, not patients. The panel has no patient record, no diagnosis field and no clinical history, and it is not designed to handle health data. A complaint entry notes that there was an incident with a reference and a batch, not who it was fitted to.
We ask you to keep it that way: do not write health data or patient identifiers into free text fields. If any did appear, it would remain the client company's responsibility and we would handle it as processor under the same duty of confidentiality — but the sensible thing is for it never to get in.
7. Security: what we do and what we don't yet
What we do today: the connection is encrypted in transit (HTTPS); form data is stored outside the server's public folder, where a browser cannot reach it; the site ships security headers that prevent code from another domain running or the site being framed by someone else; there are per-address limits and a global brake so nobody can flood or take down the form; the files the panel produces are sealed with their SHA-256 hash and date, so later modification can be detected.
In the panel: no passwords for clients (you sign in with Google or with a one-time link that expires after fifteen minutes); mandatory two-factor authentication for administration accounts; each person with their own access, which the account holder can revoke instantly; protection against request forgery on every form; an activity log chained by SHA-256 hash; a daily backup of the database and supporting documents, verified when it is made.
What we don't yet: we hold no ISO 27001 certification or equivalent, and we are not going to claim otherwise until we do. Backups are still on the same server and are not separately encrypted; when they move elsewhere, it will say so here, with the date.
8. Your rights
You can ask us, at any time and free of charge, to access your data, correct it, delete it, restrict its processing, object to it and receive a copy in a portable format. If you have an account, two of these are one click away in the panel, under “My plan”: Download everything (a full copy in a ZIP) and Close my account (deleted after 30 days). You can also withdraw any consent you gave, without affecting what was done before.
Write to info@dossalis.com saying which right you want to exercise. We answer within one month at most. If we don't reply, or the reply doesn't satisfy you, you can complain to the Spanish Data Protection Agency (aepd.es), free and without a lawyer. If you live in another EU country, you can also complain to your own country's data protection authority.
9. Minors and changes
The service is aimed at businesses and professionals. It is not intended for anyone under fourteen and we do not knowingly collect data from people of that age.
If we change anything material, we will tell you by email before it takes effect. The date in the header always indicates the current version.