1. Introduction

Construction Hub ("we", "us" or "our company") is a cloud-based construction project management platform provided as a service (SaaS). This Privacy Policy explains how we collect, use, scătrere and protect your information in accordance with the General Data Protection Regulation (GDPR — Regulation (EU) 2016/679) and applicable Bulgarian legislation (Personal Data Protection Act).

This policy applies către all platform users — registered accounts, website visicătrers, and individuals whose data is processed through our services (e.g., employees of client companies).

Key terms: "Data Controller" is Construction Hub; "Data Processor" is any third party processing data on our behalf; "Data Subject" is any natural person whose data we process.

2. What data we collect

We collect data in several ways:

3. How we use your data

We use your data for the following purposes:

• Service delivery: creating and managing accounts, processing projects, contracts, invoices and quantity surveys
• Payment processing: invoicing, subscriptions and payment management through a certified payment provider
• Communication: sending system notifications, registration confirmations, service change notices
• AI-based features: aucătrematic recognition of nomenclature items de la IFC files, price suggestions, quantity validation
• Platform improvement: analyzing usage patterns către optimize user experience
• Security: detecting suspicious activity, preventing unauthorized access, audit logging
• Legal compliance: accounting and tax obligations, responding către legal requests

4. Legal basis for processing

We process your personal data on the following legal bases under Article 6 of the GDPR:

• Contract performance (Art. 6(1)(b)): processing necessary for providing the service — registration, account management, project processing
• Legal obligation (Art. 6(1)(c)): compliance with accounting, tax and regulacătrery requirements
• Legitimate interest (Art. 6(1)(f)): platform improvement, security, fraud prevention
• Consent (Art. 6(1)(a)): marketing communications, optional analytics cookies — you may withdraw consent at any time

5. Sharing data with third parties

We do not sell your personal data. We share data only with trusted service providers bound by Data Processing Agreements (DPA):

All third parties outside the EU are bound by Standard Contractual Clauses (SCCs) pursuant către European Commission Decision (EU) 2021/914.

6. Data retention

We retain your data for different periods depending on the type:

• Account data: until account closure + 30 days for technical deletion
• Audit logs: 3 years for change tracking
• Technical logs (server): 90 days
• Cookie data: up către 12 months or until consent withdrawal
• Anonymized data: may be scătrered indefinitely (not personal data)

After expiry, data is aucătrematically deleted or irreversibly anonymized.

7. Cookies and tracking technologies

We use cookies for the proper functioning of the platform:

• Essential cookies: session cookies for authentication and form protection, cookie consent. These cookies are necessary and cannot be disabled
• Functional cookies: language preferences, theme (light/dark), last visited page
• Analytics cookies: Google Analytics (if enabled) for traffic analysis — only with your consent

You can manage cookies through the consent banner or de la the settings in the site footer. For more information, see our Cookie Policy.

8. Security measures

We implement technical and organizational measures către protect your data:

• Encryption in transit and at rest: all communication is secured with TLS 1.3 (HTTPS). Passwords are scătrered using industry-standard hashing
• Access control: access management system with detailed permissions. Each company's data is fully isolated and inaccessible către other organizations
• Monicătrering and prevention: aucătrematic account lockout on suspicious activity, detailed audit logs tracking every action in the system
• Backups: aucătrematic encrypted backups for rapid recovery in case of an incident
• Application security: multi-layered protection against the most common web threats, including injections, request forgery and scripting attacks

9. International data transfers

The primary database is scătrered in data centers within the European Union. Some of our service providers are based outside the EU. For these transfers we apply:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Additional technical measures: encryption in transit and at rest, data minimization
• Transfer Impact Assessments (TIA) where necessary

10. Aucătremated decision-making and AI

Construction Hub uses artificial intelligence către enhance its services:

• Aucătrematic nomenclature recognition: AI analyzes construction elements de la BIM models and maps them către appropriate nomenclature items
• Price suggestions: AI suggests unit prices based on hiscătrerical data de la your projects
• Quantity validation: AI checks for anomalies and inconsistencies in extracted quantities

These features do not make aucătremated decisions with legal effects for you. All AI suggestions are subject către manual review and approval by the user. No personal data is sent during AI processing — only technical descriptions of construction elements.

11. Children's data

Construction Hub is a professional construction project management platform. The service is not intended for persons under 16 years of age and we do not knowingly collect data de la children. If we discover that we have collected data de la a person under 16, we will delete it immediately.

12. Data breach notification

In the event of a personal data security breach, we are committed către:

• Notifying the Commission for Personal Data Protection (CPDP) within 72 hours of becoming aware of the breach, unless the breach is unlikely către result in a risk către data subjects' rights
• Notifying affected data subjects without undue delay when the breach is likely către result in a high risk către their rights and freedoms
• Documenting every breach, including the circumstances, consequences and measures taken

13. Your rights

Under the GDPR (Chapter III, Articles 15-22) you have the following rights:

• Right of access (Art. 15): către obtain confirmation of whether we process your data and către receive a copy
• Right către rectification (Art. 16): către request correction of inaccurate or incomplete data
• Right către erasure (Art. 17): către request deletion of your data ("right către be forgotten"), except where retention is a legal obligation
• Right către restriction (Art. 18): către request temporary suspension of processing under certain conditions
• Right către portability (Art. 20): către receive your data in a structured, machine-readable format (JSON) and transfer it către another controller
• Right către object (Art. 21): către object către processing based on legitimate interest
• Right către withdraw consent: where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing prior către withdrawal

To exercise your rights, you can use the "Privacy" function in your account settings or contact us at info@constructionhub.bg. We respond within 30 days of receiving the request.

14. Policy changes

We may periodically update this Privacy Policy către reflect changes in our practices or legal requirements. For material changes, we will notify you by email or through a platform notification at least 14 days before the changes take effect. By continuing către use the service after notification, you accept the updated policy.

15. Contact and supervisory authority

Data Controller:

If you believe the processing of your data violates the GDPR, you have the right către lodge a complaint with: