Privacy Policy
Version: 2026-07-31
1. Who processes the data
Platform operator: iProdGest, NIF 186148844.
Address: Portugal.
Privacy contact: info@iprodgest.com.
Data Protection Officer: rodrigo.marques@iprodgest.com.
For data entered by a customer company about workers, subcontractors, suppliers and project documents, the customer company is generally the controller and the ObraDocs operator acts as processor. For account, billing, security and commercial platform-management data, the operator may act as controller.
2. Data processed
- Customer company data: name, tax number, contact details, plan and billing information.
- User data: name, email, role, hashed credentials, access logs and actions performed.
- Data relating to workers and other entities: name, tax number, contact details, associated company and status.
- Uploaded documents, their metadata, expiry dates and project information.
- Technical and security data: IP address, browser, session dates, authentication attempts and audit logs.
- Billing and subscription data processed directly or through the payment provider.
3. Purposes and legal bases
| Purpose | Typical legal basis |
|---|---|
| Create and administer the account, provide the service and manage the subscription. | Performance of the contract and pre-contractual measures. |
| Manage the customer company’s documents, expiry dates, access and notifications. | Instructions from the customer company, which must determine the applicable legal basis for data subjects. |
| Billing, accounting and compliance with legal obligations. | Legal obligation. |
| Security, abuse prevention, auditing and the establishment or defence of legal claims. | Legitimate interests and compliance with security obligations. |
| Service communications, password recovery and document alerts. | Performance of the contract and instructions from the customer company. |
Consent will only be used where it is genuinely necessary and appropriate. Acceptance of the policy during registration confirms that the information was provided; it does not replace the legal bases required to provide the service.
4. Recipients and processors
Data may be processed by providers essential to operating the platform, including hosting, email, backup and payment providers. The payment provider receives the data required for the subscription and operates under its own legal obligations. Providers must be bound by confidentiality, security and data protection duties.
Stated hosting: Fornecedor de alojamento contratado, region European Economic Area.
5. International transfers
Whenever a provider processes data outside the European Economic Area, appropriate safeguards, such as an adequacy decision or standard contractual clauses, must be adopted and the necessary assessment carried out. Specific information on providers and locations must be kept up to date by the operator and made available on request.
6. Retention
Data is retained only for as long as necessary for the stated purposes, the contract, legal obligations and the establishment or defence of legal claims. Each customer company may define internal document and audit retention periods in the GDPR Centre. Deletion may be suspended where there is a legal obligation, dispute, investigation or legal hold.
7. Data subject rights
Depending on the circumstances, data subjects may exercise rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent. Requests concerning data entered by a customer company should first be addressed to that company. ObraDocs provides tools to record, track, export and carry out requests.
Requests must be answered without undue delay and generally within one month, subject to the extensions and limitations provided by law. Information necessary to verify the requester’s identity may be requested.
8. Security and data breaches
Technical and organisational measures are applied, including company-level access control, hashed passwords, secure sessions, CSRF protection, auditing, files outside the public area and limits on authentication attempts. No system is completely invulnerable; incidents must be documented and assessed. Where required, the supervisory authority must be notified within the legal deadline and data subjects informed in applicable cases.
9. Complaints
Data subjects may lodge a complaint with the Portuguese Data Protection Authority (CNPD), without prejudice to other administrative or judicial remedies. Before doing so, they are encouraged to contact the controller to allow the request to be reviewed and resolved.
10. Changes
This policy may be updated to reflect legal, technical or service changes. The current version is identified at the beginning of the document, and material changes will be communicated through the application or by email.