The purpose of this Personal Data Processing Policy is to provide information about what personal data the Company processes about data subjects when delivering and providing services, selling goods, visiting websites and using the Buildo application operated by the Company. Furthermore, contacts with existing and potential customers, for what purposes and for how long the company processes this personal data in accordance with applicable law, to whom and for what reason the company may pass it on. Also to inform about what rights belong to data subjects in connection with the processing of their personal data. This is always done only to the extent determined by the specific service or purpose of the processing.
The Personal Data Processing Policy has been issued by Buildo s.r.o., Company ID: 54693918, Tax ID: 2121759277 with registered office at Horná Trnovská 438/94 010 01 Žilina, Slovakia (hereinafter also referred to as the Company) pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of the European Union (hereinafter also referred to as the Regulation). The Company is the controller of personal data pursuant to Article 4 point 7 of Regulation (EU) 2016/679 of the European Parliament and of the Council.
This Policy is issued in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the Regulation or GDPR).
This document will be updated regularly. The current version can always be found at https://buildoapp.com/privacy_policy_en/, previous versions are available on request from the Company at the contacts listed in this Policy.
Personal data is any information relating to an identifiable private person. Personal data may be processed by the Company in connection with the provision of services and the sale of goods. However, we only process such data to enable us to provide you with a professional service and to enable us to fulfill our contractual obligation in relation to you and to comply with our legal obligations and protect our legitimate interests. Depending on the nature of the situation, we process data about, for example, representatives, including members of statutory bodies and employees.
Such data is necessary for the conclusion and performance of the contract. In particular:
Among the technical data, we include your IP address among the identification data.
The data is necessary for contacting the data subject. This includes:
This data arises in the course of communication related to the provision of services between the company. This includes records of face-to-face communications with the customer, written and electronic communications with the customer. This data also includes data from the use of our website and app. Your preferences enable the company to improve its services and offer you products that are tailored to you (personalisation).
The only location data we process are the address and the geographic coordinates of the construction sites that you enter in the application. The application never reads the location of your device. In connection with the provision of electronic services, our systems also process operational data necessary to provide and secure the service and to resolve any disputes arising from the provision of the services.
When you use the Buildo application (Android, iOS), we process the following data in addition to the categories above:
a) Account data: e-mail address, password (stored only as a hash), your name if you sign in with Google or Apple, the identifier of your Google or Apple account, language, date of registration and last login, and the subscription plan of your company.
b) Company data: company name, team name, address, contact e-mail and phone, company logo, and the list of users who belong to the company with their role.
c) Content you enter about your business: construction sites (name, address and geographic coordinates of the site, name and contact details of the investor and site manager), daily records (date, working hours, notes, weather), descriptions of work carried out, machines, materials, subcontractors and their prices, and workers (name, e-mail, phone number, position, hourly rate, hours worked and the resulting remuneration per day). Most of this content concerns persons other than you, typically your employees and business partners – see section 7 on our role for this data.
d) Photographs you take or attach in the application. Photographs are reduced in size before upload and location metadata (EXIF) is removed as part of that process. Photographs may show people present on the site; you are responsible for having a lawful basis to take them.
e) Technical data: platform (Android/iOS), application version, device language, a random installation identifier generated by the application (it does not identify you personally and is used only to distinguish installations), the time of last activity, and error reports described in section 3(5).
f) Purchase data: the product purchased, subscription period, price, currency, store and status of the purchase. Card and bank details are processed only by Google, Apple or Stripe and never reach us.
Account, company and content data are stored on your device and synchronised to our servers so that they are available to all members of your company and are not lost if you change your device. If you use the application without an account (anonymous mode), this content stays only on your device and is not sent to our servers. Your device may include the application’s local database in its Google or iCloud backup according to your device settings.
The application does not access your device location, contacts, calendar, microphone or clipboard. It uses the camera only when you take a photograph.
The scope of the data processed depends on the purpose of the processing. For some purposes, data may be processed directly on the basis of a contract, legitimate interest or law (without consent), for others only on the basis of consent.
In order for us to enter into a contract with you and provide our services, we need to know your basic information. Providing the personal data necessary for the performance of the contract, the fulfilment of legal obligations and the protection of legitimate interests is thus essential. Without the provision of personal data for these purposes, it would not be possible to provide the services. Processing for the performance of a contract and the fulfilment of legal obligations cannot therefore be refused.
In order for you to operate your personal account in Buildo, we manage your access data - in particular login names and passwords, which are used to securely authenticate the person you are logging in to.
In particular, the following key sub-purposes:
Personal data for these activities are processed to the extent necessary for the fulfilment of these activities and for the period necessary to achieve them or for the period directly provided for by law.
We only keep your data for as long as is strictly necessary. We keep it for 10 years for the purpose of fulfilling our legal obligations, for the duty of prudence and due professional care, in particular with regard to the statutory limitation periods, and for a further 10 years thereafter. The long-term nature of some claims, such as the long-term duration of a licence, extends the need for the length of processing for at least the duration of copyright protection.
According to the VAT Act, the company is obliged to keep tax documents and records with detailed data relating to the selected services provided for 10 years from the end of the tax period in which the supply took place.
In addition to the above archiving rules, the Company retains most data for longer periods of time in light of the Company's obligations of prudence and professional care, particularly in the event that it is necessary to submit evidence in legal proceedings.
In connection with your use of products and services, the Company may use your contact information to send you information regarding those products and services you use. This is primarily to create a suitable offer of the Company's products and services.
If the subject has cookies enabled in his/her web browser, we process behavioural records about him/her from cookies placed on websites operated by the company, for the purpose of ensuring better internet traffic and for the purpose of the company's internet advertising.
The company uses Google Analytics to improve and simplify the use of the website and for marketing purposes.
A cookie is a short text file that is sent to your browser by a website you visit. It allows the website to record information about the Data Subject's visit, such as preferred language and other settings. Cookies serve a number of purposes. For example, they are used to store your secure search settings, to select relevant advertisements, to track the number of visitors to the site, to facilitate the registration of new services, to protect your data or for storage. You can find out more about cookies at https://policies.google.com/technologies/types?hl=sk.
Website users may refuse the use of cookies by selecting the appropriate setting in their browser, but if they do so, the Data Subject should be aware that they may not be able to take full advantage of all the features of this website. You can also prevent the collection of data from Google by downloading and installing the browser plug-in software https://tools.google.com/dlpage/gaoptout.
Each user, i.e. also the customer, determines in the settings of their PC or browser whether the browser should allow the website to store cookies on the end device. This setting can be regarded as consent to the processing of personal data. The browser is an instrument for mediating consent.
In the application we further process data for these purposes:
We do not use your data for automated decision-making or profiling within the meaning of Art. 22 GDPR.
To understand how the application is used and to fix errors, the application uses the following services:
Firebase Analytics (Google Ireland Ltd.) records which screens you open and which actions you take (for example creating a site, exporting a report, making a purchase). The data is pseudonymous: we do not send your name, e-mail or user identifier to Google. Google receives an identifier of the application instance, the advertising identifier of your device, the IP address, device model and operating system version. Legal basis: your consent (Art. 6(1)(a) GDPR), which you give in the application and can withdraw at any time in Settings. Retention: 14 months for user-level data, aggregated reports for longer.
Firebase Crashlytics (Google Ireland Ltd.) collects reports when the application crashes or encounters an error, including the type of error, the state of the application, device model and operating system version. Legal basis: our legitimate interest in keeping the application working (Art. 6(1)(f) GDPR). Retention: 90 days.
Meta SDK (Meta Platforms Ireland Ltd.) receives the same usage events as Firebase Analytics, including purchases with price and currency, together with the advertising identifier of your device, so that we can measure the effectiveness of our advertising on Meta platforms. Legal basis: your consent, which you can withdraw in Settings. On iOS the application does not request tracking permission and Meta therefore does not receive the advertising identifier.
These services start only after you have given consent, except Crashlytics, which runs from the first start of the application. You can withdraw consent at any time in Settings, after which no further data is sent. Data already collected is deleted at the end of the retention periods above.
Data in the application is kept for the following periods: account, company and content data for as long as your account exists and are erased without undue delay when you delete your account, although residual copies may remain in our encrypted backups for a short time until those backups are overwritten; photographs the same; invoices and payment records for 10 years under tax law; analytics and error data for the periods stated above; the installation identifier until you uninstall the application. If you use the application without an account, the content stays on your device until you delete it or uninstall the application.
The Company is entitled to market the Services and services related to the Services (including Value Added Services) on the basis of generally applicable law and the Consent. The Company is entitled to choose the form in which such marketing activities are carried out and is entitled to carry them out through third parties. The Company shall be entitled to contact the Subscriber via postal address, electronic mail address, subscriber number, mobile application, or other similar means to inform about its new Services and products in order to carry out marketing activities.
The Company uses professional and specialised services of other entities in the performance of its obligations and duties under contracts, in particular the recovery of receivables, the activities of experts, lawyers, auditors, the management and solution of IT systems, internet advertising or commercial representation, bookkeeping, information for financial operations for the purpose of making payments, the performance of analytical services. The company will notify the specific recipient, if interested, of the request.
In addition to the professional services mentioned above, we use the following processors and independent providers. For each we state where the data is processed and, for providers outside the European Economic Area, the legal mechanism for the transfer.
| Provider | Purpose | Data | Location and transfer mechanism |
|---|---|---|---|
| Hetzner Online GmbH, Germany | hosting of our servers and database | all account, company and content data, photographs | EU (Germany) |
| WebSupport s.r.o., Slovakia | hosting of the website and web application | data entered on the website | EU (Slovakia) |
| Supabase Inc. | authentication of user accounts on our backend | e-mail, password hash, Google/Apple account identifier | EU (Frankfurt) |
| Google Ireland Ltd. / Google LLC | Firebase Analytics, Firebase Crashlytics, Google Sign-In, Google Places, Google Play Billing | see sections 2(7) and 3(5); sign-in token; typed address text; purchase data | EU and USA; EU–US Data Privacy Framework (Google LLC certified) |
| Meta Platforms Ireland Ltd. / Meta Platforms Inc. | advertising measurement (Meta SDK) | usage events, advertising identifier of the device | EU and USA; EU–US Data Privacy Framework |
| Apple Inc. | Sign in with Apple, App Store purchases | sign-in token and name; purchase data | USA; EU–US Data Privacy Framework |
| RevenueCat Inc. | subscription and entitlement management | user identifier, e-mail, purchase history, device platform | USA; Standard Contractual Clauses (SCCs) |
| Stripe Payments Europe Ltd. / Stripe Inc. | card payments on the web | e-mail, payment card, billing details | EU and USA; EU–US Data Privacy Framework |
| OpenWeather Ltd. | weather data for daily records | coordinates of the construction site and date | United Kingdom; European Commission adequacy decision |
Google, Apple and Meta act as independent controllers for the processing they perform for their own purposes (for example the operation of Google Play or the App Store); their own privacy policies apply to that processing.
We do not sell personal data and do not pass it to anyone for purposes other than those stated in this policy.
The Company, in the performance of its legal obligations, transfers personal data to the administrative authorities and authorities provided for by the applicable legislation, if necessary.
Under the Regulation, the data subject has the following rights if he or she is an identifiable person and identifies himself or herself to the company.
According to Article 15 of the Regulation, the data subject has the right of access to personal data. You have the right to ask the company to confirm whether we process personal data concerning you and to obtain an overview of this data from us. You are also entitled to be informed about the purposes of processing, the categories, the intended storage period, the source of the data and with whom we share it, your rights to rectification, erasure, restriction of processing, the possibility to object to us or lodge a complaint with a supervisory authority. , and about whether automated decision-making and related information occurs.
Under Article 16 of the Regulation, the data subject has the right to rectification of inaccurate personal data. If the personal data concerning you is incorrect or inaccurate, we will, of course, rectify it at your initiative. We may also supplement the data at your request.
According to Article 17 of the Regulation, the data subject has the right to erasure of personal data concerning him or her. In the following cases:
However, we would like to point out that the erasure of data will not and cannot be carried out by the company if the processing of the data is necessary, among other things:
According to Article 18 of the Regulation, the data subject has the right to restrict processing until the complaint is resolved if he or she contests the accuracy of the personal data, the grounds for processing or objects to processing.
According to Article 19 of the Regulation, the data subject has the right, if he so requests, to be notified by the company in the event of rectification, erasure or restriction of the processing of personal data carried out in accordance with Article 16, Article 17(1) and Article 18.
According to Article 20 of the Regulation, the data subject has the right to the portability of data relating to him or her which he or she has provided to the controller in a structured, commonly used and machine-readable format and the right to request the company to transmit those data to another controller.
Pursuant to Article 21 of the Regulation, the data subject has the right to object to the processing of his or her personal data on the grounds of legitimate business interest.
Consent to the processing of personal data for marketing and commercial purposes can be withdrawn at any time. The revocation must be made by an express, intelligible and specific expression of will, with possible identification of the data subject.
The data subject has the right to contact the Office for Personal Data Protection, located at Hraničná 4826/12, 820 07 Bratislava, if you feel that your personal data protection rights have been violated.
You can delete your account directly in the application (Settings → your account → “Delete account”). Deletion removes your account and, if you are the only member of your company, all company content and photographs from our servers within the period stated in section 3; data on your device is deleted immediately. If other members remain in the company, the company content stays available to them, because it belongs to the company. Deleting your account does not delete data held by Google, Apple, Meta or RevenueCat as independent controllers; you can exercise your rights with them directly.
You can export your records at any time as PDF or Excel files from the application. For a copy of all data we hold about you in a machine-readable format, contact us at app@buildo.sk. You can withdraw consent to analytics and advertising measurement at any time in Settings of the application.
The content you enter into Buildo about workers, subcontractors, investors, site managers and other persons – including their contact details, hourly rates, hours worked and photographs taken on site – is data for which you (or the company you work for) are the controller. You decide why and how this data is processed, and you are responsible for informing the persons concerned in accordance with Art. 13 and 14 GDPR and for having a lawful basis for the processing.
For this data Buildo s.r.o. acts as your processor within the meaning of Art. 28 GDPR. We process it only to provide the application and the synchronisation service to you, only according to your instructions given through the application, and we do not use it for our own purposes. The terms of processing, including our security measures, the sub-processors we use (listed in section 5) and what happens to the data when your contract ends, are set out in clause 13 of our Terms of Use, which constitutes the data processing agreement between you and us.
Requests from workers or other persons concerning this data should be addressed to the company that entered it. If such a request reaches us, we will forward it to that company and assist it in responding.
This section applies to you if you use Buildo as a resident of the United States. It supplements the information above and reflects the California Consumer Privacy Act (CCPA/CPRA) and comparable state privacy laws (for example in Virginia, Colorado, Connecticut and Texas). Where this section and the rest of the policy differ, this section prevails for US residents.
Categories of personal information we collect. In the preceding 12 months we have collected the following categories: identifiers (e-mail, account identifier, device and advertising identifiers, IP address); commercial information (subscription and purchase records); internet or network activity (application usage and analytics events); geolocation data (the address and coordinates of construction sites you enter – never the location of your device); audio or visual information (photographs you take or attach); professional or employment-related information (data you enter about workers, such as position, hours and rate); and account log-in information. We do not collect government identifiers, biometric information, or the precise geolocation of your device.
Sources, purposes and disclosures. We collect this information from you, from your device and from your use of the application, for the purposes described in sections 2, 3 and 7. We disclose it to the service providers listed in section 5, who process it on our behalf.
“Sale” and “sharing” of personal information. We do not sell your personal information for money. However, when the application’s analytics and advertising tools (Firebase Analytics and the Meta SDK) receive device and advertising identifiers to measure and improve advertising, this may be considered a “sale” or “sharing” for cross-context behavioral advertising under some US state laws. We enable these tools only after you consent, and you can turn them off at any time in the application Settings. We do not knowingly sell or share the personal information of consumers under 16 years of age.
Sensitive personal information. We do not use or disclose sensitive personal information for purposes that would give rise to a right to limit its use under the CCPA.
Your rights. Depending on your state, you have the right to know and access the personal information we hold about you, to delete it, to correct it, to opt out of the “sale” or “sharing” of personal information and of targeted advertising, to data portability, and not to be discriminated against for exercising these rights. In some states you may also appeal a decision on your request.
How to exercise your rights. Submit a request at app@buildo.sk or use the “Your Privacy Choices” / opt-out controls in the application Settings. We will verify your request using your account information and respond within the period required by applicable law (for California, generally 45 days, extendable once). You may use an authorized agent to submit a request on your behalf.