# Privacy notice This notice describes how we handle your data when you use Catius Documents. ## Controller The controller for this processing is Evgenii Shiriaev, Calle de Mendez Alvaro 2, 28045 Madrid, Spain, e-mail: [info@catius.app](mailto:info@catius.app) (see the [legal notice](/at/en/impressum/)). ## Which data we process - The photo or PDF of your Zahlungsbefehl (court payment order) that you upload. - The details read out of it and confirmed by you, for example the court, the Geschäftszahl (case number), the amount claimed and the day of service. - Your e-mail address, to deliver the result and for any queries. - Payment data, which arises solely at our payment provider Stripe. - Technical data for abuse protection: your IP address is counted in order to limit the number of requests, and is stored only briefly for that. ## The scan you upload Your photo or PDF is used solely for automated text recognition and is deleted immediately afterwards. For that one step the file is transmitted to the providers named below under "Recipients of your data"; which of them receives it depends solely on whether the file already contains machine-readable text. Deletion takes place directly after processing, whether the processing succeeded or failed. ## Automated reading: please check it The court, the Geschäftszahl, the amount claimed, the day of service and the remaining details are read out of your scan by machine, using text recognition and a language model. This reading can be wrong. We show you the values that were read before the document is created, for you to confirm; check them carefully before you continue. ## How long we keep your case For as long as you have not paid, your case is deleted after 48 hours. After a successful payment it is kept for 14 days, or 30 days if you choose an extension. Once that period ends we delete the files belonging to your case and set your e-mail address and the remaining case details to null. For accounting purposes only the case ID, the amounts, the country that governs VAT and the timestamps of your order are kept, for as long as tax and commercial retention obligations require. ## Contact data for marketing If you separately consent to your e-mail address being used for similar offers of our own, we store that address separately from your case in its own contact list, on the basis of your consent. You can object to its use at any time, without any particular form. ## Recipients of your data - **Cloudflare**: hosting, database, object storage for your files, and limiting the number of requests as abuse protection. The database and the object storage are pinned to locations in the EU. - **Google Ireland Limited**, Dublin, Ireland: measurement of advertising performance through Google Tag Manager and Google Ads, only after your agreement. A transfer to Google LLC in the United States is not excluded; Google LLC is certified under the EU-US Data Privacy Framework. - **Stripe**: handling your payment. We never see your full payment data; it stays with Stripe. - **Resend**: sending our e-mails. The e-mail with your result carries your documents (PDF and DOCX) as attachments, so their content, including the details of your case, passes through Resend's systems. Resend processes data in the USA and is certified under the EU-US Data Privacy Framework. The subject and the text of our e-mails contain no details of your case. - **Cloudflare Workers AI**: reading the text out of PDF files that already contain a text layer, and the language model that sorts the recognised text into the individual fields. By Cloudflare's own undertaking, the content processed here is not used to train AI models. For this processing step no location in the EU is fixed; the processing rests on the data processing agreement with Cloudflare including the standard contractual clauses. - **Mistral AI SAS**, Paris, France: text recognition for photographs and for scanned PDF files without a text layer. According to the provider, the processing takes place in the European Union. We have expressly declined the use of our API calls to train Mistral AI's models. ## Other people's data in your document Your Zahlungsbefehl and the Einspruch prepared for you also contain personal data of other people, in particular of the claimant. We process that data because it is necessary in order to produce the document you ordered. ## Legal bases - Article 6(1)(b) GDPR: performance of the contract concluded with you, including the processing of your scan and of the details you confirm. - Article 6(1)(f) GDPR: legitimate interest in producing the document ordered, including insofar as it contains third party data. - Article 6(1)(a) GDPR: your consent, insofar as you have agreed to your data being used for marketing. - Article 6(1)(c) GDPR: statutory retention obligations for the accounting details that remain after the retention period ends. ## Your rights You have the right of access, rectification, erasure, restriction of processing, data portability, and objection to the processing of your data. To exercise them write to [info@catius.app](mailto:info@catius.app) or use our [contact form](/at/en/kontakt/). ## Supervisory authority You have the right to lodge a complaint with a data protection authority, in Austria with the Österreichische Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40-42, 1030 Wien. The Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD), is also competent for the controller. ## Measurement with Google Tag Manager and Google Ads We advertise our service on Google Ads. To learn which advert brings visitors to us, we use Google Tag Manager and, through it, tags from Google Ads. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. These services are loaded only once you have agreed in the notice banner. Until then nothing is transmitted to Google and no cookies from Google are set. You can withdraw your agreement at any time through "Cookie settings" at the foot of the page; from the withdrawal onwards the services are no longer loaded. After your agreement Google processes in particular your IP address, the page you opened, the date and time, and details of your browser, and stores identifiers in cookies on your device. The legal basis for storing and reading on your device is § 165 Abs. 3 TKG 2021, and for the subsequent processing Article 6(1)(a) GDPR. A transfer to the United States is not excluded; Google LLC is certified under the EU-US Data Privacy Framework. We store your answer to the banner in a cookie on your device so that we do not have to ask you again on every page. This cookie is also set when you decline and contains nothing but your answer. None of this is needed to prepare your document.