Struvo · Legal information

# Privacy policy

Full personal data processing information (GDPR) for people using Struvo.

This document contains fields that must be completed with the operator's details before publication. Configure the production build with the `VITE_LEGAL_*` variables.Shown only until the legal identity is configured.

# Privacy and Personal Data Protection Policy (GDPR Compliance) for Struvo

**Version:** 1.0  
**Effective Date:** [INSERT DATE, E.G. OCTOBER 1, 2026]  
**Last Updated:** [INSERT DATE]

---

## 1. General Information and Data Controller Identity

1.1. This Privacy Policy sets forth the principles governing the collection, processing, and protection of personal data of individuals using the **Struvo** platform (including the marketing website, web dashboard, and mobile applications for iOS and Android), in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, hereinafter: **"GDPR"**).

1.2. The **Data Controller** responsible for personal data of Users, corporate representatives, billing contacts, security telemetry, and legal consent records is:  
**[LEGAL ENTITY NAME / FULL NAME]**, with registered seat at: **[REGISTERED ADDRESS: POSTAL CODE, CITY, STREET AND NUMBER]**, Tax ID (NIP): **[NIP NUMBER]**, REGON: **[REGON NUMBER]**, KRS: **[KRS NUMBER]** (hereinafter: **"Data Controller"** or **"Service Provider"**).

1.3. For any inquiries regarding personal data processing, data protection, or exercising your rights under the GDPR, please contact our designated privacy team:
- Privacy contact email: `privacy@struvo.pl`
- Postal address: **[REGISTERED ADDRESS ATTN: DATA PROTECTION OFFICER]**
- General contact: `kontakt@struvo.pl`

1.4. **Governing Language Clause**: This Privacy Policy has been established in the Polish language and translated into English. In the event of any discrepancies or divergence between the versions, **the Polish version shall be prevailing and legally binding**.

---

## 2. Dual Role of Struvo: Controller vs. Data Processor

2.1. In operating the Struvo platform, two distinct legal relationships exist:
1. **Struvo as a Data Controller (Art. 4(7) GDPR)**:
   - Covers user account registration data, company profiles, billing/invoicing records, security audit logs, Keycloak identity sessions, and legal acceptance records. Struvo determines the purposes and means of processing for these datasets.
2. **Struvo as a Data Processor (Art. 4(8) GDPR / DPA)**:
   - Covers project-specific content uploaded and managed by the Client (e.g., photographs taken at construction sites potentially capturing workers or subcontractors, worker log entries, site location coordinates).
   - In relation to this data, the Client acts as the Controller, and Struvo processes the data strictly on the documented instructions of the Client pursuant to the Data Processing Agreement (DPA).

---

## 3. Categories of Personal Data Processed

Depending on your interaction with the Platform, we process the following categories of data:

3.1. **Account and Identity Data**:
- First name, last name, email address, telephone number, username (login), Keycloak identity identifier (`keycloak_user_id`), assigned role in the organization (`global_admin`, `company_admin`, project roles).

3.2. **Company and Business Data**:
- Business entity name, Tax Identification Number (NIP/VAT), statistical number (REGON), registration number (KRS), professional license numbers, registered office address, billing email addresses.

3.3. **Technical, Telemetry, and Security Logs**:
- IP address, HTTP request identifier (`X-Request-ID`), timestamps of access, browser type and version, operating system and device model (iOS/Android), failed login counters, account lock status.

3.4. **Geolocation Data**:
- Precise geographic coordinates (GPS latitude and longitude) collected through the mobile application upon explicit User authorization, used solely for tagging the location of construction projects. The application does not conduct passive or continuous background location tracking.

3.5. **Photographs and Multimedia Content (UGC)**:
- Construction site photographs uploaded to private object storage (Cloudflare R2). These photos may occasionally capture images of workers or vehicle license plates.  
  *Crucial Clarification:* AI algorithms analyze photos exclusively for technical object classification, building progress evaluation, and safety gear identification. **The Data Controller does not perform remote biometric facial recognition or identity resolution on individuals in photographs.**

3.6. **Legal Acceptance Registry (`legal_acceptances`)**:
- Version of accepted Terms (`terms_version`), version of Privacy Policy (`privacy_version`), timestamp of acceptance (`accepted_at`), User and Company IDs, and registration source (`web_registration` / `mobile`).

---

## 4. Purposes and legal bases

The following bases concern data for which the Operator acts as controller.

| Purpose | Basis and scope |
| :--- | :--- |
| Concluding and performing a contract with an individual, handling their account and requests | Article 6(1)(b) GDPR: data necessary for the contract or pre-contractual steps requested by that person |
| Supporting representatives and users of organisational clients | Article 6(1)(f) GDPR: legitimate interests in client communication, permissions and providing the business relationship |
| Billing and tax obligations | Article 6(1)(c) GDPR: applicable tax and accounting legislation |
| Security, necessary server logs, abuse prevention and legal claims | Article 6(1)(f) GDPR: protecting the service, users and the Operator's rights |
| Optional web analytics and error diagnostics through PostHog | Article 6(1)(a) GDPR and Article 399 of the Polish Electronic Communications Law: voluntary consent, covering usage events, errors and identifiers and, after sign-in, name, email and role |
| Electronic marketing where the user subscribes | Article 6(1)(a) GDPR and prior consent under Article 398 of the Polish Electronic Communications Law; messages necessary for the contract do not depend on marketing consent |

Project records, photos, people appearing in photos and project location are processed on client instructions under the [DPA](/dpa), including requested AI analysis. The client as controller determines the legal basis and information obligations towards employees and others. The Struvo contract does not automatically provide an Article 6(1)(b) basis for every person shown in a photo.

Device location permission enables access to the device; it does not replace determining the legal basis for project data. Device access can be withdrawn in system settings.

Data needed for account management and billing is required for the contract or legal obligations. Refusing it may prevent the corresponding service. Analytics and marketing are optional. Representatives' and invited users' data may come from the inviting client; other users provide their data directly.

---

## 5. Providers and data recipients

We use Cloudflare and Railway infrastructure, OpenAI AI services, Resend transactional email and Stripe payments. With user consent, the web integration uses PostHog. Data scope, roles and details requiring confirmation for particular accounts are described in the [provider and subprocessor list](/podwykonawcy).

Not every recipient is a subprocessor of project data. Stripe may act as an independent controller, including for its payment and fraud prevention obligations. Legal advisers, accountants, auditors and authorised public bodies receive data only as necessary for their tasks. Keycloak is identity management software; using the software does not itself disclose data to its producer.

For AI content, we do not make an unconditional assurance covering every provider product, tier and setting. Applicable service conditions, including retention and possible use to improve models, are addressed on the [AI and data page](/ai-i-dane).

---

## 6. Transfers outside the EEA

Global providers may involve access or processing outside the EEA, including the United States. European storage does not exclude access from a third country.

Before a transfer, a Chapter V GDPR basis is required: an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses with transfer assessment and necessary supplementary measures. DPF applies only to the certified entity and covered data. This does not mean every listed provider is certified or that merely referring to SCCs is sufficient.

Read country, entity and mechanism information together with the [provider list](/podwykonawcy). Request a copy of applicable safeguards or instructions for obtaining them at `privacy@struvo.pl`, subject to protection of confidential information and others' rights. HTTPS/TLS protects transmission; it does not promise end-to-end encryption preventing providers from processing content.

---

## 7. Retention

- Account data is needed while providing the contract; on termination we separate content to return/delete from records needed for billing or claims.
- Project data, including retained AI drafts, follows client instructions, the DPA and [export and termination rules](/eksport-danych). We do not promise automatic deletion of all drafts after 14 days.
- Tax documents are retained for the statutory period, generally five years from the end of the year in which the tax payment deadline expired; separate duties and suspended or interrupted limitation periods may affect this.
- Data needed for specific claims is retained for the applicable limitation period, taking ongoing proceedings into account. This does not justify retaining every client's entire project archive.
- The analytics choice is valid for 180 days. PostHog event/error retention is separate from consent validity and browser storage.

**To confirm before final publication:** maximum server log and PostHog retention, backup deletion cycle, and AI input/output retention. The previous 90-day and 14-day statements were not verified descriptions of those settings.

---

## 8. Data Subject Rights

Under Articles 15 through 22 of the GDPR, you have the following enforceable rights:
1. **Right of Access (Art. 15 GDPR)** – the right to obtain confirmation as to whether your data is processed, and to receive a copy of that data.
2. **Right to Rectification (Art. 16 GDPR)** – the right to have inaccurate personal data corrected or incomplete data completed.
3. **Right to Erasure ("Right to be Forgotten", Art. 17 GDPR)** – the right to obtain deletion of your data when legal grounds for processing cease.
4. **Right to Restriction of Processing (Art. 18 GDPR)** – the right to pause processing under circumstances specified in the GDPR.
5. **Right to Data Portability (Art. 20 GDPR)** – the right to receive your data in a structured, commonly used, and machine-readable format (JSON/CSV).
6. **Right to Object (Art. 21 GDPR)** – the right to object at any time to processing based on legitimate interests (Art. 6(1)(f) GDPR).
7. **Right to Withdraw Consent** – where processing is based on consent (e.g., optional analytics), the right to revoke consent at any time without affecting lawful processing prior to revocation.

To exercise your rights, please submit an email request to: `privacy@struvo.pl`. We inform you of action without undue delay, normally within one month. An extension of up to two further months under Article 12(3) GDPR is communicated with reasons during the first month. Rights apply subject to GDPR conditions; objection to direct marketing requires no justification. For entrusted data we assist the relevant controller under the DPA.

8.1. **Right to Lodge a Complaint with a Supervisory Authority**:  
You have the right to lodge a complaint with the competent data protection supervisory authority. In Poland, the competent authority is:  
**Prezes Urzędu Ochrony Danych Osobowych (UODO)**  
ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland
Website: https://uodo.gov.pl

---

## 9. Automated Decision-Making and Profiling

9.1. The Platform utilizes generative AI models to analyze images and assist in drafting logs.  

9.2. No processing within the Platform constitutes **automated decision-making producing legal effects or similarly significantly affecting individuals** within the meaning of Art. 22 GDPR. All AI outputs require human verification before adoption.

---

## 10. Security

Protection includes user and organisation permissions, logical separation of client resources, authentication and time-limited signed links to private files. Production connections must use HTTPS/TLS. Separate client databases do not mean a dedicated physical server for each client. Signing a JWT is not equivalent to encrypting its contents.

The Operator must maintain risk-appropriate technical and organisational measures under Article 32 GDPR and the DPA. Details requiring confirmation, including backup and recovery parameters, are not a specific SLA guarantee. Report incidents to `privacy@struvo.pl` without sending passwords or access keys.

---