OFFICEZERO PRIVACY POLICY

Effective date: 1 September 2026

This Privacy Policy (hereinafter: Privacy Policy) explains how OfficeZero OÜ (hereinafter: OfficeZero, we, us, or our) collects, processes, stores, and protects the personal data of natural persons and Users (hereinafter: You or Your) when you use our software service, website, and knowledge base platform (hereinafter: the Service).

We are committed to protecting your privacy and processing personal data in a transparent, secure manner in compliance with the General Data Protection Regulation (GDPR) of the European Union and applicable legislation.

1. Data Controller

Company name: OfficeZero OÜ
Registration code: 17560884
Address: Koidutähe 13, Tartu, 51011, Estonia
Email for personal data matters: support@officezero.eu

2. Personal Data

We collect and process only the data necessary to provide the Service, ensure security, and fulfill contractual obligations:

• Account and Contact Data: Email address, name, preferred language, user account settings, and password (stored solely in the form of an encrypted hash).
• Authentication Data: If you use third-party or eID solutions to log in (e.g., Web-eID, Smart-ID, Passkey/WebAuthn, Google OAuth), we process the identification tokens provided by the authentication provider.
• Billing and Payment Data: Payment and invoice data, account status, and balance calculated in real time. Note: Full payment card details are processed directly by our authorized payment processor, LHV Pank; OfficeZero does not see or store your full card details.
• Content and Knowledge Base Data: Documents, texts, files, and queries that you upload or input into the Service to form graphs and knowledge bases.
• Technical Data and Logs: IP address, device and web browser type, operating system, query timestamps, and application usage logs (necessary to ensure system security and fault tolerance).

3. Special Terms for Artificial Intelligence and Document Processing

We treat all data and documents you enter with total confidentiality:

3.1. Data Ownership and Privacy: All documents uploaded, knowledge graphs generated, and RAG queries submitted by you belong to you and remain private.

3.2. Prohibition on Model Training: OfficeZero does not use your private documents, knowledge base entries, or queries to train public artificial intelligence models or third-party algorithms.

3.3. Vector Databases and Localization: Vector data and graph structures formed from documents are stored securely and in isolation on servers located within the European Union.

4. Purposes and Legal Basis for Processing Personal Data

We process your personal data under the following legal bases and for the following purposes:

• Performance of a contract (GDPR Art. 6(1)(b)): To provide the Service, manage accounts, offer customer support, and execute billing.
• Legal obligation (GDPR Art. 6(1)(c)): To comply with accounting and tax laws (e.g., retaining transaction and invoice records).
• Legitimate interest (GDPR Art. 6(1)(f)): To ensure the security of the Service, prevent cyberattacks, detect system failures, and improve Service quality.
• Consent (GDPR Art. 6(1)(a)): To send direct marketing communications or newsletters (where you have given explicit consent).

5. Data Retention Location and Servers

5.1. All OfficeZero infrastructure, databases, and servers are located within the European Union (EU) / European Economic Area (EEA).

5.2. We do not transfer your personal data or documents outside the European Economic Area, unless directly necessary to provide a specific data processor’s service and appropriate safeguards complying with GDPR requirements (e.g., Standard Contractual Clauses) are guaranteed.

6. Data Processors and Third Parties

We may share your data strictly to a limited extent and only with trusted processors who provide necessary services to us:

• Payment Service Providers: Banks and authorized payment institutions to process payments.
• Server and Cloud Service Providers: European Union data centers for data hosting and storage.
• Notification Services: Email delivery services for transactional emails and password resets.

All data processors are obligated to ensure data protection at the same level as OfficeZero and are prohibited from using your data for their own purposes.

7. Data Retention Period

7.1. We retain your personal data for as long as your user account is active and the Agreement remains in force.

7.2. Upon closing an account or submitting a deletion request, your account data, documents, and knowledge graphs are immediately and irreversibly deleted or anonymized from the system.

7.3. We retain accounting documents and invoices for 7 (seven) years from the end of the respective financial year, as required by law.

8. Your Rights Regarding Your Personal Data

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: The right to request confirmation on whether data is being processed and to receive a copy of your personal data.
• Right to rectification: The right to request the correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): The right to request the deletion of your personal data where there is no legal basis for processing.
• Right to data portability: The right to receive your data in a machine-readable format and transfer it to another service provider.
• Right to withdraw consent: Where processing is based on consent (e.g., newsletters), you have the right to withdraw your consent at any time via the link in the footer of the message.

To exercise your rights, please contact us by email at support@officezero.eu. We will respond to your request within 5 business days at the latest.

9. Cookies and Tracking Technologies

9.1. The OfficeZero web application uses only strictly necessary cookies and browser local storage, which are essential for maintaining log-in sessions, ensuring security, and remembering user preferences (e.g., theme, language).

9.2. We do not use privacy-intrusive third-party advertising or tracking cookies.

10. Supervisory Authority and Complaints

If you believe that we have infringed your rights in processing your personal data, you have the right to lodge a complaint with the national data protection authority:
Data Protection Inspectorate (Andmekaitse Inspektsioon)
Website: www.aki.ee
Address: Tatari 39, 10134 Tallinn, Estonia
Email: info@aki.ee