Last update: 16 August 2026
Publisher: Alеxander Rеzun (hereinafter “BENE.BIZ”)
This Privacy Policy explains how personal data is handled in connection with Docus, the document workspace application for Microsoft® 365 published by BENE.BIZ. It supplements, and for Docus takes precedence over, the general Privacy Policy for the bene.biz website.
The controller for the processing described in Sections 4 to 6 of this policy is:
BENE.BIZ
Alеxander Rеzun
Athеnеr Str. 5
60327 Frankfurt am Main, Germany
Email: contact@bene.biz
BENE.BIZ has not appointed a Data Protection Officer, as the statutory thresholds under Art. 37 GDPR and § 38 BDSG are not met. Data protection enquiries should be sent to the email address above.
Docus is a SharePoint Framework (SPFx) solution. It is installed into your own Microsoft 365 tenant and runs in the browser of the signed-in user. Understanding this architecture explains most of this policy:
Consequently, for all content and personal data processed inside your tenant, you (the customer) are the controller and Microsoft is your processor under your own agreements with Microsoft. BENE.BIZ is neither controller nor processor for that data.
For transparency, these are the locations Docus creates and uses within your tenant. All of them remain under your control and your retention, backup, eDiscovery and audit policies:
DocusComments, DocusApprovals, DocusMentions,
DocusLocks, DocusBookmarks, DocusRecent,
DocusUserPreferences, DocusCheckInRequests,
DocusCheckInNotifications and DocusSiteSettings.
These contain, among other things, user names, user principal names, comment text and approval decisions.
com.docus.instances, com.docus.featureFlags) and, where a tenant administrator
sets tenant-wide defaults, on the organization object (com.docus.featureFlagDefaults). These
hold interface preferences and feature settings — no document content.None of this data is transmitted to BENE.BIZ.
Docus is a paid product licensed per user. To confirm that the person using it holds a valid licence, the application calls a Licence Validation Service operated by BENE.BIZ. This is the only BENE.BIZ-operated component involved in running Docus.
The service is an Azure Functions application running on Microsoft Azure in the West Europe region (Netherlands), within the EU. It consists of three endpoints:
check-license — called by the Docus application at runtime to verify a user's licence.activate — called once, by our activation page, when a new subscription is purchased.webhook — called by Microsoft to notify us of subscription lifecycle changes.
When Docus starts, it requests a Microsoft Entra ID access token scoped to our application and sends it to
the check-license endpoint. The service validates the token's signature against Microsoft's
public keys and then reads two claims from it:
tid) — a GUID identifying your organisation;oid) — a GUID identifying the signed-in
user within your tenant.
The user object identifier is a pseudonymous identifier and therefore personal data under
the GDPR. It is required because Docus is licensed per user: the service uses it to ask Microsoft Graph
whether a licence seat has been assigned to that specific person
(/users/{id}/usageRights). Where a tenant-wide subscription model is used instead, only the
tenant identifier is used and no user identifier is processed.
The service returns only whether a valid licence exists, and the plan name. No name, no email address, no document content, and no file names are transmitted to the service.
The Licence Validation Service is stateless and holds no database. It does not persist licence check results.
However, diagnostic log entries are written to Azure Application Insights (also West Europe). These log entries include the tenant identifier and the user object identifier, together with the outcome of the check, and are used to investigate errors and detect abuse. Application Insights is operated by Microsoft on our behalf as a processor under a data processing agreement and Microsoft's standard contractual terms.
When a subscription is purchased through the Microsoft Commercial Marketplace, Microsoft redirects the
purchaser to our activation page. The page signs the purchaser in with Microsoft Entra ID (scope
User.Read only) and forwards the Marketplace purchase token to the activate
endpoint. We resolve that token with Microsoft's SaaS Fulfillment API, which returns the subscription
identifier, plan, quantity, tenant identifier and the email address of the beneficiary
(the person or mailbox the subscription is registered to). This is required to activate the subscription
and to identify our contractual counterparty.
Microsoft calls our webhook endpoint when a subscription is changed, suspended, reinstated,
renewed, transferred, or cancelled. These notifications contain subscription and plan identifiers and the
action taken. They do not contain names, email addresses, or content.
Docus requests a number of delegated Microsoft Graph permissions. Every one of them is delegated, meaning Docus can only ever act as the signed-in user and within that user's existing rights; none are application permissions granting standalone access. All of them require your tenant administrator's explicit approval in the SharePoint Admin Center before they take effect, and the data accessed through them stays within your tenant and Microsoft's services.
Sites.Read.All, Files.ReadWrite.All — reading and writing the documents
and files in the Docus library.User.ReadWrite — storing the user's own interface preferences and instance list on
their own Graph profile.Directory.Read.All, Organization.ReadWrite.All — reading directory role
membership to determine whether a user may edit tenant-wide feature defaults, and storing those defaults.People.Read.All — resolving people pickers, avatars and @-mentions.Tasks.ReadWrite, Group.ReadWrite.All — the optional Microsoft Planner
integration.Calendars.ReadWrite, OnlineMeetings.Read — the optional meetings and
events feature.OnlineMeetingTranscript.Read.All, OnlineMeetingAiInsight.Read.All — the
optional meeting transcript and recap feature (see Section 6.2).Mail.Send, Chat.Create, ChatMessage.Send — sending approval
notifications, as the signed-in user, by email and Teams chat (see Section 6.1).Mail.Read, Chat.Read, ChannelMessage.Read.All,
ExternalItem.Read.All — required by Microsoft as a fixed scope set for the
Microsoft 365 Copilot Chat API. Docus itself never reads your mailbox, your chats, or your
channel messages, and contains no code that calls those endpoints. These scopes exist solely because
Microsoft's Copilot API refuses to issue a token without them. If you do not enable the Copilot feature,
you may decline these scopes and the rest of Docus continues to work.The following features are switched off by default and only operate after a tenant administrator enables them and grants the corresponding consent.
When a user requests approval on a document, Docus can send an email (via /me/sendMail) and a
Teams chat message to the chosen approvers. These messages are sent from the requesting user's own
account through Microsoft's services; they do not pass through BENE.BIZ. They contain the document
title, the requester's name and a deep link back to the document.
Where enabled, Docus can display a Microsoft Teams meeting transcript or AI recap for a meeting the user is entitled to access, and insert it into a document. Transcripts may contain the spoken words of meeting participants and are therefore sensitive. This data is read from Microsoft Graph with the user's own permissions and, if inserted, is written into a document in your own library. It is never transmitted to BENE.BIZ. Note that inserting a transcript makes it visible to everyone with access to that document — you should ensure this is compatible with your own recording and transcription policies and any applicable works council agreements.
Where enabled and where the individual user holds their own Microsoft 365 Copilot licence, Docus can send document text and selections to Microsoft's Copilot APIs to generate answers, drafts and rewrites. Specifically, the text of the documents you place in the Copilot context set, and any text you select for rewriting, are sent to Microsoft as part of the request.
/beta Copilot endpoints and is offered as a beta
feature.Content that you choose to embed — for example a YouTube or Vimeo video, or an external web page — is loaded from that provider when a reader opens the document, and that provider will then see the reader's IP address. This is a consequence of your own content choices, not of Docus itself.
To state the allocation of roles precisely:
Because BENE.BIZ does not process content on your behalf, a data processing agreement under Art. 28 GDPR is not legally required for Docus as delivered. We nevertheless provide a data processing agreement on request where your internal governance requires one, and we will conclude one before performing any service that does involve processing your content on your behalf — for example hands-on support inside your environment, or migration services. Please write to contact@bene.biz.
In respect of the data for which BENE.BIZ is the controller (Section 4), you have the rights of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR, in particular against processing based on Art. 6(1)(f)). Please note that if you object to or obtain erasure of licence validation data, we can no longer verify your entitlement and the application will not unlock.
Requests should be sent to contact@bene.biz. To locate records we may need your tenant identifier and, where applicable, the relevant user object identifier.
For content held inside your own tenant, requests from your employees or customers must be addressed to you as the controller; BENE.BIZ cannot access or act on that data.
You also have the right to lodge a complaint with a supervisory authority. The authority competent for BENE.BIZ is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Wiesbaden, Germany.
Access tokens sent to the Licence Validation Service are transmitted over TLS and are cryptographically validated against Microsoft's published signing keys before any claim is trusted. The service holds no content and no persistent store of personal data beyond the diagnostic logs described in Section 4.3. Access to the Azure resources is restricted to BENE.BIZ. Any licence check that cannot be positively verified fails closed, so a failure never results in unauthorised access.
BENE.BIZ may update this Privacy Policy, for example when features are added or the architecture changes. Updates are published with a revised “Last update” date. Where changes are material, we will indicate them in the Marketplace listing or notify customers by email. Previous versions are available on request.
For questions about this Privacy Policy, to request a data processing agreement, or to exercise your rights:
Email: contact@bene.biz
This Privacy Policy has been prepared in English. In the event of any conflict between this English version and a translation into another language, the English version shall prevail.