Digital Services Act

This page explains how Spyral meets its obligations under the Digital Services Act, Regulation (EU) 2022/2065 (the "DSA"): who to contact, how to report content that you consider illegal, and how we handle reports.

How the DSA applies to Spyral

Spyral stores documents and other content that its customers, professional firms, upload to their own private workspaces. That makes Spyral a provider of a hosting service under the DSA (Article 3(g)(iii)).

Spyral is not an online platform. Content in a workspace is available only to the users the customer has invited into that workspace, and to the specific recipients a customer chooses to send a document to, for example for signature. It is never disseminated to the public. The DSA rules that apply only to online platforms (Articles 19 to 28), such as the internal complaint-handling system and out-of-court dispute settlement, therefore do not apply to Spyral.

Spyral is a micro enterprise within the meaning of Commission Recommendation 2003/361/EC. Under Article 15(2) of the DSA it is therefore not required to publish annual transparency reports.

The obligations that do apply, and that this page addresses, are:

• points of contact for authorities and for users (Articles 11 and 12);
• terms and conditions that explain which content is not allowed (Article 14);
• a mechanism to report illegal content (Article 16);
• statements of reasons for any restriction we impose (Article 17);
• notification of suspected serious criminal offences (Article 18); and
• action on orders from authorities (Articles 9 and 10).

Point of contact for authorities (Article 11)

Authorities of the Member States, the European Commission and the European Board for Digital Services can contact Spyral directly by email:

• Email: legal@spyral.lu
• Languages: English, French, German, Dutch and Italian

Please use the same address to send orders under Articles 9 and 10 of the DSA.

Point of contact for users (Article 12)

If you use Spyral, you can contact us directly and quickly about any matter covered by the DSA:

• by email at legal@spyral.lu; or
• through the form on this page.

You can write to us in English, French, German, Dutch or Italian. Every message is read and answered by a person: we do not rely on automated tools to deal with it. For questions about using Spyral that have nothing to do with the DSA, write to contact@spyral.lu.

Reporting illegal content (Article 16)

Anyone, whether or not they use Spyral, can tell us about specific content stored in Spyral that they consider to be illegal under EU law or the law of a Member State, for example content that infringes intellectual property rights, discloses personal data unlawfully, or relates to fraud or another criminal offence.

Content that is inaccurate, or that you disagree with, is not for that reason illegal. If your concern is about your own personal data held by a firm that uses Spyral, the firm decides how that data is used and is the first place to exercise your rights. You can also write to privacy@spyral.lu, and we will pass your request on to the firm concerned.

What a notice must contain

To let us act on it, a notice should contain:

1. Why the content is illegal. A sufficiently substantiated explanation of the reasons why you consider the content to be illegal, including, where you can, the law concerned.
2. Where the content is. A clear indication of its exact location, such as a link, the name of the workspace, company or document, and any other information that helps us find it.
3. Who you are. Your name and email address. These are not required if your notice concerns content that you believe relates to one of the child sexual abuse offences referred to in Articles 3 to 7 of Directive 2011/93/EU.
4. Good faith. A statement confirming that you believe, in good faith, that the information and allegations in your notice are accurate and complete.

A notice that contains these elements, and that allows us to identify the illegality without a detailed legal examination, gives Spyral actual knowledge of the content concerned (Article 16(3)). We may ask you for more information if a notice is incomplete or unclear.

Submit a notice

Your name

Optional, but it helps us follow up.

Your email address

Optional. Without it we cannot confirm receipt or tell you our decision. Not needed for notices about child sexual abuse material.

Where is the content?

The exact address (URL) or the identifier of the document or item.

Type of issueChoose a type (optional)

Why is the content illegal?

Explain clearly why you consider it illegal (at least 20 characters).

I confirm that the information and allegations in this notice are accurate and complete to the best of my knowledge and are made in good faith.

We use these details only to handle your notice, as described in our Privacy Policy.

Send notice

You can also send a notice containing the same information by email to legal@spyral.lu.

What happens next

1. Acknowledgement. If you give us an email address, we confirm receipt by email without undue delay. This acknowledgement is sent automatically, and it is the only automated step in the procedure.
2. Assessment. A person at Spyral assesses your notice in a timely, diligent, non-arbitrary and objective manner. We do not use automated tools to assess notices or to decide on them. Customer content is confidential and is often covered by professional secrecy. We look at it only to the extent needed to assess the notice, only people bound by confidentiality do so, and only in the cases the Data Processing Agreement allows.
3. Hearing the customer. Unless the matter is urgent, the law prevents it, or an authority instructs us otherwise, we tell the owner of the workspace concerned about the notice and give the customer an opportunity to respond, or to remove the content, before we decide.
4. Decision. We inform you of our decision without undue delay, with the reasons for it and the possibilities for redress open to you. We may disregard a notice that is manifestly unfounded.
5. Measures. If we conclude that content is illegal, or that content or conduct breaches our Terms of Service, we may remove specific content or disable access to it, suspend or restrict access to specific features, suspend a user account or a workspace in whole or in part, or terminate a user account or the customer's contract. We choose the least restrictive measure that is effective, with due regard to the rights and legitimate interests of everyone involved, including their fundamental rights. Removed content is no longer available in Spyral, although we may keep a copy where the law requires us to preserve it. A measure against specific content does not by itself end the customer's contract or its right to retrieve its other data under the Terms of Service.

How we process the personal data in your notice is described in the Privacy Policy.

Statement of reasons (Article 17)

If we take one of the measures above because content is illegal or incompatible with our Terms of Service, we send a statement of reasons by email to the owner of the customer's workspace and, where we can identify them, to the user concerned, at the latest when the measure takes effect. It sets out:

• the measure, its territorial scope and its duration;
• the facts and circumstances we relied on, including whether we acted on a notice or on our own initiative, and the identity of the person who sent the notice only where that is strictly necessary to identify the illegality;
• whether automated means were used (we do not use them to take these decisions);
• for illegal content, the legal ground we relied on and why the content is illegal under it;
• for content incompatible with our Terms of Service, the contractual ground we relied on and why the content is incompatible with it; and
• the possibilities for redress open to the user.

We do not send a statement of reasons where the law or an order of an authority prevents us. Where we act on an order from an authority under Article 9 of the DSA, we inform the user as that article and the order allow.

If you disagree with a decision

If you disagree with a decision we took on a notice, or with a measure we took against content or an account, you can:

• contest it within six months of being informed of it, by replying to our decision or writing to legal@spyral.lu. A person reviews your complaint free of charge, where practicable someone who was not involved in the original decision, and we tell you the outcome and our reasons without undue delay. If the complaint shows that the decision was wrong, we reverse it without undue delay and restore the content or access concerned;
• lodge a complaint with the Digital Services Coordinator of the Member State where you are located or established (Article 53 of the DSA). In Luxembourg, this is the Autorité de la concurrence; and
• bring the matter before the competent courts.

These options are independent of each other, and using one does not affect your other rights.

Content rules and how we apply them (Article 14)

The content you may not store in Spyral, and the measures we may take, are set out in our Terms of Service.

We do not monitor customer content to look for illegal content, and we do not use automated tools to detect, assess or remove content because of what it says. We act on content when we receive a notice or an order, or when we otherwise become aware of it, and every decision to restrict content or an account is taken by a person. Our automated controls are limited to technical checks that apply to everyone, such as file type checks, file size limits, usage limits and rate limits; they reject a file or a request that fails the check without assessing whether its content is lawful. Spyral's AI features process content only to provide the functions customers use, as described on the AI transparency page, and never to moderate stored content. One feature applies a limit to what it will do: for complex questions, the chat assistant first runs a short automated check of the question and may decline to answer a question it assesses as inappropriate. That check affects only the answer to that question. It does not touch your content or your account.

Orders from authorities (Articles 9 and 10)

When a competent judicial or administrative authority orders us to act against specific illegal content, or to provide information about specific users, we inform the authority without undue delay of the effect we have given to the order. We inform the user concerned as the DSA requires, unless the order says otherwise. How we handle requests from authorities for customer data is described in the Privacy Policy and in the Data Processing Agreement.

Suspected serious criminal offences (Article 18)

If we become aware of information giving rise to a suspicion that a criminal offence involving a threat to the life or safety of a person has taken place, is taking place or is likely to take place, we promptly inform the law enforcement or judicial authorities of the Member State or Member States concerned and provide all relevant information available to us. If we cannot identify the Member State concerned with reasonable certainty, we inform the Luxembourg authorities or Europol, or both.

Version history