Buildano
← LegalΕλληνικά

Data Processing Agreement

Version 2026-09-29 — effective 29/09/2026

This Data Processing Agreement ("DPA") forms part of the Buildano Terms of Service between the Customer (controller) and [to be completed: company legal name] (processor, "Buildano"). It sets out the terms required by article 28(3) of Regulation (EU) 2016/679 (GDPR), Cyprus Law 125(I)/2018 and Greek Law 4624/2019. On data-protection matters it prevails over the Terms. Words defined in the GDPR have the same meaning here.

1. Subject matter, duration, nature and purpose

Buildano processes Customer Personal Data (personal data contained in Customer Data) to provide the Service described in the Terms: storing, organising, calculating, displaying and transmitting project, commercial and financial information, operating the client portal, contributor area and website calculator, sending notifications, and — only if the Customer enables them — AI features and integrations. Processing lasts for the term of the Terms plus the retrieval and deletion periods in section 10. Annex 1 describes the processing.

2. Instructions

2.1. Buildano processes Customer Personal Data only on the Customer's documented instructions, which are given by these Terms, this DPA, and the Customer's configuration and use of the Service, including with regard to international transfers — unless required to do otherwise by Union or Member State law, in which case Buildano informs the Customer before processing unless that law prohibits it.

2.2. Buildano will immediately inform the Customer if, in its opinion, an instruction infringes the GDPR or other data-protection provisions.

2.3. The Customer is responsible for the lawfulness of the processing it instructs, including having a legal basis and giving data subjects the information required by GDPR articles 13 and 14.

3. Confidentiality

Buildano ensures that persons authorised to process Customer Personal Data are bound by confidentiality obligations or are under an appropriate statutory obligation of confidentiality, and have access only as needed.

4. Security

Buildano implements the technical and organisational measures in Annex 2, appropriate to the risk (GDPR art. 32). It may update them provided the overall level of protection is not reduced.

5. Sub-processors

5.1. The Customer gives general written authorisation for Buildano to engage sub-processors. The current list is on the Sub-processors page (Annex 3).

5.2. Buildano will notify account owners by email at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected Service without penalty and receive a refund of prepaid fees for the period after termination.

5.3. Buildano imposes on each sub-processor, by contract, data-protection obligations that offer at least the same protection as this DPA, and remains fully liable to the Customer for its sub-processors' performance.

6. International transfers

Buildano transfers Customer Personal Data outside the European Economic Area only in compliance with Chapter V GDPR: to countries covered by an adequacy decision (including the United Kingdom, Switzerland, and U.S. recipients certified under the EU-U.S. Data Privacy Framework), or on the basis of the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), with supplementary measures where required. Where the Standard Contractual Clauses between Buildano and a sub-processor are used, Module 3 (processor to processor) applies.

7. Data subjects' rights

Taking into account the nature of the processing, Buildano assists the Customer by appropriate technical and organisational measures in responding to requests to exercise data subjects' rights. Much of this is self-service (viewing, correcting, exporting and deleting data in the Service). If Buildano receives a request directly, it will not answer it itself (other than to redirect the data subject) and will forward it to the Customer without undue delay.

8. Assistance

Buildano assists the Customer, taking into account the nature of processing and the information available to it, in ensuring compliance with articles 32 to 36 GDPR (security, breach notification, data-protection impact assessments and prior consultation).

9. Personal-data breaches

Buildano notifies the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal-data breach affecting Customer Personal Data. The notice describes, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed, and is supplemented as more information becomes available. Buildano takes reasonable steps to contain and remedy the breach. Notification is not an acknowledgement of fault.

10. Return and deletion

During the term, the Customer can export Customer Data at any time. When the Terms end, the Customer Data remains available for export for 30 days (and for the longer switching periods under the Terms where applicable). Buildano then deletes Customer Personal Data from its live systems, and from backups within a further 90 days, unless Union or Member State law requires storage. On request, Buildano confirms deletion in writing.

11. Audits and information

Buildano makes available to the Customer all information necessary to demonstrate compliance with article 28 GDPR, and allows for and contributes to audits, including inspections, by the Customer or an independent auditor mandated by it and bound by confidentiality. Audits are limited to once every 12 months (unless required by a supervisory authority or following a personal-data breach), take place on 30 days' notice during business hours, must not compromise other customers' data or security, and are at the Customer's cost. Buildano may first answer by written information, certifications of its providers and questionnaires, and an on-site audit takes place only if these are reasonably insufficient.

12. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Terms, except where the GDPR provides otherwise (in particular art. 82). If there is a conflict, this DPA prevails over the Terms, and the Standard Contractual Clauses (where applicable) prevail over this DPA.

Annex 1 — Description of the processing

Categories of data subjects: the Customer's clients and prospective clients (including persons submitting the website calculator); contributors such as subcontractors, site managers, architects, quantity surveyors and suppliers; the Customer's staff and Users; other persons mentioned in project records.

Categories of personal data: identification and contact details (name, email, phone, address); project and property information (site address and coordinates, plans, photos, site-diary entries, snag lists); commercial and financial data (quotes, variations, selections, invoices, payments, purchase orders, supplier invoices, tax identifiers such as VAT numbers); communications (portal messages, requests, notes); evidence of electronic acceptance (name, time, IP address, browser); account and usage data of portal and contributor users (email, hashed password, access dates); leads (the data submitted through the calculator).

Special categories: none intended. The Customer should not upload special categories of data unless necessary and lawful.

Frequency: continuous, for the term of the Terms.

Operations: collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission (e-mail notifications; to AADE myDATA or payment providers where the Customer uses those integrations), alignment, restriction, erasure and destruction.

Purpose: providing the Service to the Customer under the Terms.

Retention: as determined by the Customer during the term; afterwards as in section 10.

Annex 2 — Technical and organisational measures

  • Encryption in transit: all connections use TLS (HTTPS); the database is reached over encrypted connections.
  • Encryption at rest: data is stored on managed database and hosting infrastructure with encryption at rest; stored tax-authority credentials are additionally encrypted with AES-256-GCM.
  • Authentication: passwords stored only as salted bcrypt hashes; one-time links stored only as SHA-256 hashes, single-use and time-limited; sign-in and public forms are rate-limited.
  • Access control and tenant isolation: every request is checked against the live membership and role; data of different customers is logically separated and scoped on every query; portal and contributor sessions are restricted to the invited project; view-only role cannot change data.
  • Personnel: production access limited to authorised personnel who need it, bound by confidentiality.
  • Resilience: managed hosting with redundancy; regular database backups; ability to restore.
  • Testing: automated tests, including tenant-isolation and security tests, run before changes are released; dependencies are kept up to date.
  • Minimisation: we collect only what the features need; AI features send only the data needed for the requested task.
  • Incident management: documented process for detecting, assessing, notifying and remedying personal-data breaches.
  • Sub-processor management: providers are selected for their security, bound by data-processing terms, and listed publicly.

Annex 3 — Sub-processors

See the Sub-processors page, which forms part of this DPA.