PlanDoc Drawing and Document Management System terms & conditions / data processing policy

1. INTRODUCTION

The PlanDoc Drawing and Document Management System is a software product developed by PlanDoc Ltd, licensed to and applied by several building-trade companies, serving the purposes of managing, systematizing and sharing the multitudinous plans and project documentation related to construction projects.

According to its design and purposes, the actors of construction projects fulfil most of their co-operation and communication tasks, by signing into the system as users. This means partly person to person interactions and partly modifications made to documents as team-work.

The licensee of a copy of the PlanDoc Drawing and Document Management System concerned (our contracting party) is in all cases one company or institution; however the natural persons fulfilling their tasks using the system may be employees of different companies or institutions.

PlanDoc Ltd. carries out data processing activities by the provision of the the PlanDoc Drawing and Document Management System and related operating and operation support services, in accordance with the instructions of the data controllers. PlanDoc Ltd. does not control the personal data of natural persons who fulfil their tasks in the system under any circumstances.

By the present “TERMS & CONDITIONS / DATA PROCESSING POLICY”, we intend to make our personal data processing activities as transparent as possible, both to our licensee company and institution contracting partners and to all natural persons using the PlanDoc Drawing and Document Management System related to their work.

We elaborated the present “TERMS & CONDITIONS / DATA PROCESSING POLICY” in general, covering all of our possible data processing activities related to the PlanDoc Drawing and Document Management System, meaning that many of the data processing activities described herein may not be incurred in many cases.

2. DATA PROCESSED

We are processing the following types of personal data by the PlanDoc Drawing and Document Management System:

• Email:
• Identifier: (ID – eg.: tom01)
• Administrator: (system administrator or not, namely whether acsesses user data, rights, documents, etc. or not)
• Surname:
• First name:
• Language:
• Company:
• Position:
• Phone:
• Sending Notifications:

3. CONDITIONS AND PURPOSES OF DATA PROCESSING

The system administrator designated by the data controller company or institution (contracting partner), whom the PlanDoc Drawing and Document Management System is licensed to, has the right and possibility to record, modify, or delete users from the system (natural persons with their personal data listed above).

PlanDoc Ltd. executes the recording, modification or deletion of the data referred to in the previous paragraph only in specific cases, based on and according to the express written instructions of the data controller. PlanDoc Ltd. notifies the data controller in all cases, if it considers that the instructions given by the data controller are unlawful, especially in the event of a conflict of data protection laws. In such case, PlanDoc Ltd. suspends execution of the instruction until the data controller confirms or modifies the instruction. However, PlanDoc Ltd. does not perform legality checks, and the lawfulness of the instructions shall in all cases be the sole responsibility of the data controller.

Users of the PlanDoc Drawing and Document Management System have the possibility to access each other’s personal data only in the instances and to the extent strictly necessary. Only the system administrator designated by the data controller has the possibility to access all personal data listed above. Log in passwords are not accessible to any actors including PlanDoc Ltd. The “identifier” is accessible for any user fulfilling their tasks using the system related to the same project. Surname, first name, language, company, position or phone may be made accessible to other users in cases of necessity of direct contact, by the user concerned or the system administrator designated by the data controller.

The purpose of data processing is in all cases to ensure the possibility of documented communication related to the construction project concerned and to ensure the availability of stored documents in a controlled manner. Personal data processed related to a construction project will not be made available to users using the system (including a specific copy of the system) related to another construction project.

At the time of the completion of the construction project concerned, we discontinue our data processing activities related to this project. Accordingly, the entire database (all records related to the project including personal data, user communications data and the plan documentation stored in the system) will be transferred to the data controller and irrevocably deleted from our own devices.

Prior to the deletion of the entire database generated during the project as described in the previous paragraph, the system administrator of the data controller has the possibility at any time to set a user, related to whom the purpose of the data controlling in the PlanDoc Drawing and Document Management System no longer applies, to “inactive” status. As a result, the availability of the user’s personal data concerned by other users for communications purposes will be terminated.

Personal data indicated on construction plans and other documents stored in the PlanDoc Drawing and Document Management System can be deleted along with the document concerned, and/or the data controller may create depersonalized versions thereof, in which personal data are masked. Therefore, setting a user to “inactive” status as outlined above cannot, by itself, ensure that personal data indicated on stored documents is removed.

If the PlanDoc Drawing and Document Management System is operated by the licensee company / institution, PlanDoc Ltd. may only perform data processing activities, in case the fulfilment of the customer’s specific requirement makes it necessary. Even in such a case, we perform such data processing according to the documented written instructions of the data controller.

“Sending Notifications” is a yes / no option defined by the user itself in relation to its own activity. This determines whether email notifications shall be sent to the user concerned with regard to tracking changes of the documents related her/his work.

Special categories of personal data (sensitive data) are not processed by the PlanDoc Drawing and Document Management System due to the purpose of the system. This, of course, does not ensure that recording non-work-related content by a user, in a freely editable box, would be blocked. Rules, procedural and liability aspects of blocking non-work-related content shall be determined by the data controller in all cases.

In the case of an official request for disclosing certain personal data, we will only fulfil the request of the competent authority, restricted to minimum extension defined by the law and/or the decision of the authority, following collation with the data controller, if it is possible, and following examination the legality of the request in good faith.

We do our data processing activities in Hungary, reserving the right to later extend it to the European Economic Area.

As a further data processor, we engage the following hosting provider to provide the operating environment for our servers:

• Szervernet International Ltd.
  Seat: 1132 Budapest, Victor Hugo utca 18-22. 5.em.
  Tax ID: 25112335-2-41
  Company Reg. Nr.: 01-09-200402
• Szervernet Kft.
  Seat: 1132 Budapest, Victor Hugo utca 18-22. 5.em.
  Tax ID: 13451516-2-41
  Company Reg. Nr.: 01-09-735858

The data controllers shall, with regard to all of their data controlling activities, determine and develop the terms and conditions of these activities, including in particular the purpose, legal basis, duration and source data, in addition to and in consideration of this TERMS & CONDITIONS / DATA PROCESSING POLICY.

4. USERS OF PLANDOC.SITE PRODUCT

Plandoc.Site is an edition of the PlanDoc Drawing and Document Management System and an add-on to it, developed for mobile platforms with special functionalities, to make the work of the users more efficient and more comfortable. This helps in particular the work of professionals working in construction sites separated from office environments. Due to the characteristics of the mobile platform, this edition is not intended to serve for facilitating precise and thorough engineering work, but simple, quick access to stored data; the possibility of prompt notification on the change of documents and the contents thereof.

Not all PlanDoc Drawing and Document Management System licensees have the licence to use the Plandoc.Site product edition as well, so please make inquiries about it at your employer!

The Plandoc.Site product edition is available for devices running Android OS through the https://play.google.com/store address of Google Play store or installed on your device, as well as for ios operating systems from the App Store store on the https://www.apple.com/hu/itunes/ address or as an app installed on your device.

The use of the Plandoc.Site edition technically (also) presupposes the acceptance of the terms and conditions of the Play Store or the iTunes store, which are broader in scope and even geographically than the data processing under these conditions. These service providers may control personal data, generated or made accessible to them in connection with the use of the Plandoc.Site product, as described in their privacy policies. To this end, application of a device for running the Plandoc.Site product, other than that privately owned or used by the user for private purposes, may be necessary or justified, especially if the employer (data controller) wishes to define this as a work-related obligation. The level of necessity or justification may vary considerably depending on the rules of data controlling of the licensee companies and institutions. Using the services of the Plandoc.Site product requires accepting that these third party service providers are solely responsible for their own data controlling activities and that PlanDoc Ltd. excludes all related liability to users of the Plandoc.Site product, even with regard to the cases where those third party service providers may have access to some of their personal data, that they are using the services of the Plandoc.Site product.

Furthermore, using the services of the Plandoc.Site product requires accepting that Plandoc.Site may provide direct access to pages offering services of third parties, which are no longer subject to these terms, but the data controlling terms and conditions defined and applied by the these parties.

5. PROTECTION OF PERSONAL DATA

PlanDoc Ltd. ensures protection and security of its data processing activities by means of technological, data security and organizational measures that provide a level of protection proportional to the risks associated with data processing, in view of the current state of the art.

To protect the data stored in the PlanDoc Drawing and Document Management System, we use at least the following technical and protection measures to prevent the data being adequately secured, unauthorized or unlawfully handled, accidental loss, destruction or damage:

• The system can be accessed only via secure SSL layer, protected by two-key encryption;
• The system is operated in a professional service server room with a physical firewall, with automatic backup climate control switching on high-performance, well-maintained servers that fit the state of the art;
• The data stored in the system are backed up in line with the data backup procedures of PlanDoc Ltd. on a regular basis and are stored in a safe place other than the server as well;
• We apply enhanced security requirements for setting up user passwords (min … characters, capital letters, numbers, necessity of … daily modification, …)
• Application for a new password is secured by a time limit, the process can only be passed through a link sent to the user’s e-mail address;
• User passwords are not stored in the database, only the md5 imprints are found here, so the system does not know the user’s password and PlanDoc Ltd. does not even have the possibility to get to know them;
• The system applies two cookies in the internet browser to store personal data. One is sessionid and the other – if the user uses this option – the RememberMe token, which will allow the user to not have to re-enter and re-enter the password.

PlanDoc Ltd. notifies the data controller on any event referring to data vulnerabilities, data incident and security event related to the security of the data stored in the PlanDoc Drawing and Document Management System, as soon as possible, if such event comes to its knowledge.