Privacy & data protection

The data controller is DORA Workbench, 11 Regent Road, Widnes. For any privacy question or request, email doratools@proton.me.

• Account data — your work email, password (stored only as a salted hash) and the organisation name you enter. Used to create and secure your account and workspace.
• Workspace and team data — the workspace you belong to, your role in it, and invitations you send or accept. Used to control who can see your compliance records.
• Compliance records you save — registers of information, Article 30 contract schedules, incident logs and vendor passports. These may contain business contact details of third parties you enter. Used only to store and show your work back to you and your colleagues.
• Email delivery data — the address and status of account emails such as confirmations and password resets.

Spreadsheets and CSV files you drop into the validator are read inside your browser. They are not uploaded to us unless you choose to save the result to your account.

• Contract — providing the account, workspace and saved records you asked for.
• Legitimate interests — keeping the service secure, preventing abuse, and fixing faults.
• Consent — any optional message or update you opt into; you can withdraw at any time.
• Legal obligation — retaining billing or correspondence records where law requires it.

• Our hosting and database provider, which stores the application data in the EU.
• Our email delivery provider, which sends account emails on our behalf.
• Paddle, our merchant of record, which takes subscription payments, calculates and remits VAT and issues your invoices.
• Our AI model gateway, used only when you ask the compliance assistant a question. It does not store your conversation or use it to train models.
• The public LEI directory (GLEIF) — only when you request a legal entity identifier lookup, and only the code or company name you searched for is sent.

The full list, with what each one does and where it sits, is in our data processing agreement, and we tell account holders before adding a new one. We do not sell personal data and we do not use it for advertising or profiling. Where a provider processes data outside the EEA, transfers rely on the European Commission's standard contractual clauses.

A vendor passport stays private until you publish it. Publishing creates a link that anyone holding it can open without signing in, and it may be indexed by search engines. Only publish information you are happy to share openly, and unpublish at any time from your dashboard.

Saved records are kept until you delete them or close your account. When an account is closed we delete its personal data within 30 days, except where we must keep records for legal or accounting reasons. Email delivery logs are kept for up to 12 months, and security logs for up to 12 months.

Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Database row-level security restricts every record to the workspace that owns it. Passwords must be at least 12 characters with mixed case, a number and a symbol, and are checked against known breached password lists.

• Access — get a copy of the personal data we hold about you.
• Rectification — have inaccurate details corrected.
• Erasure — ask us to delete your data where no legal duty to keep it applies.
• Portability — receive your data in a machine-readable format.
• Restriction — ask us to pause processing while a concern is resolved.
• Objection — object to processing based on our legitimate interests.
• Withdraw consent — at any time, where consent is the basis.
• Complain — to your national data protection authority, or the Irish Data Protection Commission / UK Information Commissioner's Office as applicable.

To exercise any right, email doratools@proton.me. We respond within one month.

We use only what the service needs: a strictly necessary sign-in session cookie, your browser's local storage to hold work in progress on this device, and a record of your cookie choice. There are no advertising trackers, and no analytics cookies are set unless you opt in.

You can accept, reject or change optional cookies at any time using the cookie banner or the “Cookie preferences” link in the footer.

All saved application data — accounts, workspaces, registers, contract schedules, incident logs and vendor passports — is stored in the European Union, and every record is restricted to the workspace that owns it by database row-level security.

When you use the in-app assistant, your question and the conversation in that session are sent to our AI provider to generate an answer. Conversations are not stored in your account and are not used to train models. Please do not paste personal data or client confidential material into the assistant, and treat its answers as compliance guidance rather than legal advice.

If this notice changes materially we will tell account holders by email. Last updated October 2026.