GDPR and your data rights

Controller and processor roles

When you use a personal space to keep your own receipts, contracts and household paperwork, Formalini is the controller for your account data and processes the documents on your instruction.

When your organisation uses a work space, your organisation is the controller of the documents it uploads and Formalini acts as processor under the data processing agreement.

What we process and why

We keep processing narrow and tied to a purpose.

• Account data (email, name, workspace membership) to give you access — necessary to perform our contract with you.
• Documents and extracted values to deliver the service you asked for — on your instruction.
• Payment records to bill correctly and meet accounting duties — contract and legal obligation.
• Security and delivery logs to keep accounts safe and diagnose failures — legitimate interest.

Your rights

You can exercise all of these from the application, and we answer written requests within one month.

• Access and portability: export your documents and extracted data as a file from your privacy page.
• Rectification: correct any extracted value directly on the document, and the correction is recorded.
• Erasure: delete individual documents, or delete your whole account and its files.
• Restriction and objection: ask us to pause a specific processing activity.
• Withdraw consent: turn off optional AI answers and optional emails at any time.
• Complaint: lodge a complaint with your national data protection authority.

Automated processing and human review

Reading a document is automated, but Formalini makes no decision about you. Every extracted value keeps a confidence score and stays next to the original page so a person can check and correct it. Nothing is delivered onward from a work space until a person approves it, where your workflow requires approval.

Retention and international transfers

Documents stay until you or your workspace administrator delete them; deleting removes the original file and the extracted values. Payment and accounting records are kept as long as tax law requires.

Data is hosted in the European Union. Where a service provider processes data outside the EEA, the transfer relies on the European Commission’s standard contractual clauses. Named providers are listed on the subprocessors page.

Contacting us

Data protection requests: privacy@formalini.com. We do not require a special form — a plain email naming what you want is enough.

Who you are contracting with

• Trader: Pascalini Marco Irinel, PFA (Formalini)
• Country of establishment: Romania
• Registered address: Romania, Sibiu, Cisnadie, 555300, Str Grigore Ionescu 82
• Tax identification number: 25962868
• Legal contact: legal@formalini.com
• Billing contact: billing@formalini.com