1. Data Controller
[FILL IN: company name, registry code, address] ("Constrio", "we", "us") is responsible for processing personal data under this privacy policy. For any questions, contact us at: [FILL IN email].
2. What Data We Collect
- Account data: name, email address, role within the company
- Company data: name, registry code, contact details (if provided)
- Work-related data: daily reports, work descriptions, quantities, hours
- Photos uploaded by the user to reports
- Scheduling and task data (who, where, when)
- Technical data: login times, device/browser information for security purposes
3. Why We Process Data
We process personal data on the following legal bases:
- Contract performance — to provide the Constrio service (user account, report management)
- Legitimate interest — to ensure the security and reliability of the service
- Legal obligation — to retain accounting and tax-related data
4. Who We Share Data With
We use the following subprocessors to help us provide the service:
- Supabase — database, authentication, and file storage
- Stripe — payment processing (billing data)
- Cloudflare — content delivery network and connection security
We do not sell users' personal data to third parties for advertising purposes.
5. Data Retention
We retain personal data for as long as the user account is active, and after account closure for [FILL IN: retention period, e.g. 7 years for billing data under applicable accounting law].
6. Your Rights
Under the GDPR, you have the right to:
- access your own data
- request correction of inaccurate data
- request deletion of your data ("right to be forgotten")
- request data portability
- object to processing
- lodge a complaint with the Estonian Data Protection Inspectorate (www.aki.ee)
To exercise these rights, contact us at: [FILL IN email].
8. Security
We use technical and organizational measures to protect data, including encrypted connections (HTTPS), role-based access control, and data isolation between companies (each company can only see its own data).