Privacy statement

1. Who we are

Doory is software for managing flexible office buildings. Building operators use the platform for meeting room bookings, memberships, access control, visitor registration, invoicing and building communication, among other things.

This privacy statement covers the data we process for ourselves: visits to our website, contact and demo requests, our marketing and sales process and our support. We are the controller for that processing.

Do you work in a building that uses Doory, are you a member there, or have you been registered there as a visitor? Then we do not process your data for ourselves, but on behalf of the operator of that building. See the section "Data in the platform" below. For that data, please contact the operator.

Doory is a product of Spoelie B.V., Weesperstraat 113, 1018 VN Amsterdam, the Netherlands, registered with the Dutch Chamber of Commerce under number 94087512. You can reach us at [email protected]. We have not appointed a data protection officer.

2. What data do we process about you?

Depending on your contact with us, we process:

• Contact and company details: name, email address, phone number, job title, company name and anything else you send us yourself, for example via a form, by email or during a demo.
• Data about our relationship: correspondence, call notes, services requested or purchased, status in our sales process.
• Account data of administrators: if you have an administrator account on behalf of an operator, we also process your account data and login metadata for our own support and security.
• Website data: IP address, browser and device characteristics, pages visited, time and source of your visit.
• Billing data: if you are a customer, the data needed for our accounts.

We do not ask for special categories of personal data, such as health data, and do not process them as part of our services.

3. For what purpose and on what legal basis?

Where we rely on a legitimate interest, you can object to that processing. Where we ask for consent, you can always withdraw it.

4. Statistics on platform use

We use anonymised and aggregated data on the use of the platform to improve our product, to create benchmarks and statistics, to support our pricing and for our marketing. That data cannot be traced back to an individual person, an individual building or an individual operator. If we want to name a building or customer, for example in a customer story, we ask for separate permission.

5. Who do we share data with?

We only share data where necessary, with:

• Hosting and technical management: D-TT, our development and hosting partner, which manages the platform on its own infrastructure at Amazon Web Services in the European Union.
• AI assistance: Anthropic, for features that speed up onboarding and setting up a building.
• Push notifications from our mobile app: Expo Push Service.
• Our own office, email, invoicing and marketing software.
• Advisers, such as accountants, lawyers or security specialists, where necessary.
• Supervisory authorities or other bodies, if we are legally required to do so.

We do not sell your data.

6. Transfers outside the EEA

Our hosting and data storage take place within the European Union. Some services may process data outside the European Economic Area, such as the push notification service and, once we start using them, analytics and advertising services. In that case we use an appropriate transfer mechanism, such as an adequacy decision or the European Commission’s standard contractual clauses, and take additional measures where necessary.

7. How long do we keep data?

8. Data in the platform: we are the processor

If you use the platform as a member, employee, booker or visitor of a building, the operator of that building is the controller. We process that data solely on behalf of that operator, under a data processing agreement. This also applies if you book or purchase something from the operator via the platform: in that case you are buying from the operator, and the invoice and payment are handled by the operator.

What this means in practice:

• Do you want to know what data has been recorded about you, or do you want it corrected or deleted? Please contact the operator of your building. We support the operator in this and forward any requests we receive directly to them.
• The operator decides which modules they use and which retention periods they set.
• Visitor registration: if you are registered as a guest, we process your name and, if the operator has set it up that way, your company name, expected arrival time, your host and whether you have arrived. When you check in yourself at the reception kiosk, your name is shown abbreviated on the screen.
• Access events: by default, the platform does not record who opened which door and when. An operator can switch this on per building. If they do, they are responsible for it and must inform you of it themselves.
• Integrations with other systems: if the operator uses an integration with, for example, an access control system, a payment or invoicing service, an email or calendar integration or a digital signing service, they have their own agreement with that service provider. We only provide the technical integration. For questions about processing by that service provider, please contact the operator or the service provider directly.
• Outside the platform: if an operator uses camera surveillance, a paper visitor log or their own attendance lists, that is separate from Doory. We have no access to it and no role in it, and the operator must inform you about it themselves.

9. Cookies

At the moment we only use strictly necessary cookies on our website, for authentication, security and remembering your session and preferences. No consent is required for these.

We plan to also use analytics, advertising and tracking services, such as Google Analytics, Google Ads, the Meta pixel, the LinkedIn Insight Tag and Leadinfo. We will not place these until you have given consent via the cookie banner. You can change or withdraw your choice at any time. You can read more about this in our cookie policy.

10. Your rights

Within the limits of the law, you have the right of access, rectification, erasure, restriction of processing, objection to processing based on a legitimate interest, and data portability. Where processing is based on consent, you can withdraw it.

You can send requests to [email protected]. If your request concerns data in a building’s platform, we will refer you to the operator of that building (see section 8). You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

11. Security

We take appropriate technical and organisational measures, including role-based and building-scoped access control, encrypted connections, cookie-based authentication with no tokens in browser storage, encryption of integration secrets, audit logging, rate limiting on sensitive components and an automated process for retention periods and deletion. No system can be completely secure, so please also protect your own login details and devices.

12. Changes

We may change this privacy statement. In the event of substantive changes, we will publish a new version with a new effective date. The date at the top shows when this last happened.

Questions or want to submit a request?

Email us at [email protected]. We respond within one working day and in any case within the statutory period of one month.

Doory’s own platform entity is still being incorporated; until then, Spoelie B.V. (Chamber of Commerce no. 94087512) is the controller. Once the new entity has been registered, we will update this statement.

Cookie policy →Data processing agreement →