Privacy Policy

Who is responsible

The controller for the processing described here is Surpassion, a sole proprietorship (eenmanszaak) owned by Dimitri Pietersz, registered with the Netherlands Chamber of Commerce (KvK) under number 52362914, VAT ID NL001876948B91, Stationsstraat 17, 2042 LD Zandvoort, The Netherlands. Email: [email protected].

What we process and why

• Website. Our hosting provider Cloudflare processes technical data such as your IP address and browser type to deliver and protect the site. We use no analytics, no advertising and no tracking cookies. Your light/dark choice is stored only in your own browser. Legal basis: legitimate interest (a secure, working website).
• Contact and support. When you email us we process your name, email address, organization and the content of your message, to answer you. Legal basis: legitimate interest, or taking steps towards a contract.
• Purchases. Paddle processes your payment as our reseller and Merchant of Record, as an independent controller under its own privacy policy. Paddle shares with us what we need to deliver and account for your order: name, email address, company, country, VAT number, the products bought and the amounts. We never receive your card details. Legal basis: performance of the contract and our legal (tax) obligations.
• Licences. To issue and check a licence we record your Azure DevOps organization name and ID, the number of users and the licence period. Licence keys contain these details and are verified inside your own organization, without contacting us. Legal basis: performance of the contract.
• Direct invoices. For Business and Enterprise invoices we process company, contact person, billing address, VAT number and payment details. Legal basis: performance of the contract and legal obligations.

What we do not process

DocSync runs in your own Azure DevOps organization and talks directly to your Microsoft 365 as the signed-in user. It sends no data from Azure DevOps, SharePoint or OneDrive — no work items, document content or file names — to Surpassion or anyone else. For that data, your organization and Microsoft are responsible; we are neither controller nor processor of it.

Who receives data

• Paddle (Paddle.com Market Ltd and affiliates) — reseller and Merchant of Record.
• Cloudflare, Inc. — website hosting and security.
• Google Workspace (Google) — to send and receive email.
• Our accountant and the Dutch Tax Administration — where needed for bookkeeping and tax.

We do not sell personal data. Some of these providers are based outside the European Economic Area (for example Paddle in the United Kingdom, and Cloudflare and Google in the United States). Transfers then rely on an EU adequacy decision (including the EU-US Data Privacy Framework) or on the EU standard contractual clauses.

How long we keep data

• Billing and licence records: 7 years after the end of the financial year, as required by Dutch tax law.
• Support emails: up to 2 years after our last contact, unless they are part of the billing records.
• Website logs: only as long as Cloudflare needs them for delivery and security.

Your rights

You have the right to access, correct or delete your personal data, to restrict or object to processing, and to receive your data in a portable format. Email [email protected]; we respond within one month. We take no decisions about you based solely on automated processing. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Security

We keep the data we hold to a minimum, protect accounts with multi-factor authentication, and sign licence keys with keys that never leave a secured key store.

Changes

If we change how we process data, we update this page and the date below. We announce material changes to customers by email.