This Policy describes who processes Personal Data in connection with the use of the Contractors.es application for what purposes, on what legal basis, to whom we disclose it and what rights are vested in the data subjects. This Policy is drawn up in accordance with Articles 13 and 14 GDPR.
Capitalised terms have the meaning given to them in the Terms & conditions. Where the Data Processing Agreement deviates from this Policy on any given matter, the Data Processing Agreement prevails.
DATA CONTROLLER
| Data Controller within the meaning of the “Two Roles” section below | CONTRACTORS.ES SP. Z O.O. with its registered office in Zielonka, KRS 0001219274, NIP 5543043884, REGON 543878653 |
| Address | Zielonka, Poland |
| Personal Data contact | Please contact us using the email address provided on the Contact page at https://contractors.es/ or by post to the registered office of the company. |
| Data Protection Officer | Not appointed. We do not meet the conditions for a mandatory appointment of a Data Protection Officer under Article 37(1) GDPR. |
TWO ROLES
In relation to the same data, we are not always the Data Controller. The distinction is legally significant: in the first case we ourselves decide the purposes and the means of processing, in the second case only the Customer decides.
| Who is the Data Controller | Which data this concerns |
|---|---|
| We — CONTRACTORS.ES SP. Z O.O. | Personal Data of the Organization Account owner and the Authorised Users: first and last name, email address, authentication and account security data, settlement and invoicing data, technical data and service usage logs, technical support data |
| Customer — the company using the service | All data entered into the system by the Customer and its Authorised Users, including data of employees, sub-processors, customers, contractors, suppliers, and documents and files of construction projects, including data passed through the Support Chat. In that case we process this data as a Data Processor under the Data Processing Agreement, on the Customer’s documented instructions |
If you belong to the staff of a Customer using Contractors.es, the Customer is the Data Controller of your data, not we. Your data has been passed to us by the Customer — as the source of the data. In such a case address your request to the Customer, not to us. If you do not know who the Data Controller of your data is, contact us at the address given above.
PURPOSES AND LEGAL BASES
We state the legal basis separately for each purpose. We do not rely on a single general consent.
| Purpose | Data | Legal basis |
|---|---|---|
| Creation and operation of the Organization Account, authentication of the Authorised Users, making the service available | Identification, contact and authentication data | Article 6(1)(b) GDPR — performance of the contract |
| Retention of data during the Export Window after expiry of the Agreement, in order to enable its retrieval | Identification, contact and authentication data | Article 6(1)(f) GDPR — our legitimate interest: enabling retrieval of a copy of the data after the service has ended; Article 6(1)(c) GDPR — a legal obligation, where the retrieval takes place at your request |
| Settlement, invoicing, accounting | Identification data, address, tax data, NIP or EU VAT, bank data | Article 6(1)(b) GDPR — performance of the contract, and Article 6(1)(c) GDPR — legal obligation, in particular Article 121 of the Tax Ordinance and the Accounting Act |
| Service security, prevention of abuse, maintaining availability | Technical data, IP address, device identifiers, event logs | Article 6(1)(f) GDPR — our legitimate interest: protecting the service and its users against abuse and ensuring information security |
| Service analysis and development | Anonymised statistical data on the use of the service, not containing content entered by Customers | Article 6(1)(f) GDPR — our legitimate interest: improving the quality of the service. This data is anonymised permanently and does not allow the identification of a person or the determination of which data were processed |
| Communication related to the service | Identification and contact data | Article 6(1)(b) GDPR |
| Marketing communication | Identification and contact data | Article 6(1)(a) GDPR — consent. You may withdraw consent at any time |
| Exercise of the rights of data subjects | Data indicated by that person | Article 6(1)(c) GDPR — a legal obligation arising under the GDPR |
| Establishment and pursuit of claims, defence against claims | Data related to communication and cases | Article 6(1)(f) GDPR — our legitimate interest: protecting the legal position of both parties |
We do not process data for profiling purposes, nor do we make decisions about persons based solely on automated processing, and in particular we do not transfer such data to Sub-processors. The Support Chat assigns the user a technical session identifier used solely to maintain the chat connection; we use tawk.to’s AI features to translate conversations and to power an automatic first line of support.
CATEGORIES OF DATA AND THEIR SOURCES
We process the following categories of data: identification data (first and last name), contact data (email address, telephone number, registered office address), authentication data (password in hashed form, session identifiers), tax and settlement data (NIP or EU VAT, invoicing address, bank account number), technical data (IP address, device type, operating system, browser, event timestamps), the history of communication with technical support, the content of conversations held in the Support Chat together with the contact data disclosed in them and chat session identifiers, and data on the use of the service in anonymised form.
The sources of the data are: the person to whom the data relates, and an external entity where the Customer is the Data Controller — that Customer. In respect of data passed by the Customer, we have not collected it directly from the person to whom it relates. Support Chat data is collected directly from the user by our sub-processor tawk.to, with whom we have concluded a data processing agreement.
Personal Data entered by the Customer into the system is not processed by us for marketing purposes, nor is it passed to third parties for our own purposes.
DATA RECIPIENTS AND SUB-PROCESSORS
The recipients of Personal Data are:
- Processing sub-processors — solely to the extent necessary to provide the service, under data processing agreements. Their list, together with the service, the processing location and the basis for any transfer outside the European Economic Area, is set out in the List of Sub-processors and constitutes Annex 3 to the Data Processing Agreement. A change of sub-processor requires prior notification to the Customer at least 30 days in advance, and the Customer may raise an objection; if the objection is not upheld — the Customer may terminate the agreement without penalty. The Support Chat is operated by tawk.to, Inc. — see the “Support Chat” section.
- Providers of accounting, legal, telecommunications and advisory services — to the extent necessary to achieve the purposes set out in the table of legal bases. These entities process data on our instructions.
- Public authorities — to the extent required by law, in particular tax authorities and courts.
- Authorities in third countries where sub-processors process — to the extent necessary to perform obligations arising under the law of the country of import. In such a case we inform the Data Controller before processing, unless the law prohibits disclosure of the information.
We do not sell Personal Data and do not disclose it for marketing purposes to third parties.
TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA
In the European variant of the service, data is stored and processed in the European Union. Personal Data is transferred outside the European Economic Area to the extent set out in the List of Sub-processors — in particular to the extent of access by the sub-processor storing the files (Akamai Technologies (Linode)) to the stored files from the territory of the United States and onward transfer of those files to its sub-processors, and in respect of Support Chat data, which is processed by tawk.to in the United States on the basis of the European Commission’s standard contractual clauses adopted by Implementing Decision (EU) 2021/914, supplemented with a data protection impact assessment.
In the American variant, data is stored and processed in the United States. The transfer of data outside the European Economic Area takes place on the basis of the European Commission’s standard contractual clauses adopted by Implementing Decision (EU) 2021/914, supplemented by a data protection impact assessment, or — in respect of a sub-processor certified under the EU-US Data Privacy Framework — on the basis of that framework, together with its UK and Swiss extensions.
Artificial intelligence features of the application are provided in the European Union in both variants. The AI features of the Support Chat (conversation translation and an automatic first line of support) are provided by tawk.to in the United States.
RETENTION PERIODS
| Data category | Retention period |
|---|---|
| Organization Account and Authorised Users data | For the duration of the account, then for the Export Window, and thereafter for the period arising under tax and accounting regulations |
| Accounting documents, invoices, correspondence related to settlement | 5 years from the end of the tax year to which they relate, in accordance with the Accounting Act and the Tax Ordinance |
| Technical data and event logs | 1 year |
| History of communication with technical support | 2 years from the closure of the case |
| Support Chat conversation data | 2 years from the end of the conversation; after that period we instruct tawk.to to erase the data. tawk.to’s backups are deleted within a retention cycle of no longer than 90 days |
| Data used to establish or pursue claims | 3 years from the date the claim becomes due |
| Anonymised statistical data | Undetermined — the data is anonymised permanently |
After the expiry or termination of the Agreement we delete the data within 30 days, except for backups deleted in a retention cycle of no longer than 12 months and data whose retention is required by law. The period after which the Agreement expires by operation of its terms due to non-use of the service is described in clause 12.8 of the Terms.
RIGHTS OF DATA SUBJECTS
In relation to the data for which we are the Data Controller, you have the right to:
- access to the data and to receive a copy of it (Article 15 GDPR);
- rectification of inaccurate or incomplete data (Article 16 GDPR);
- erasure of data (Article 17 GDPR);
- restriction of processing (Article 18 GDPR);
- portability of data (Article 20 GDPR);
- objection to processing based on legitimate interests (Article 21 GDPR), in particular to processing for security purposes;
- withdrawal of consent at any time, without affecting the lawfulness of processing carried out before its withdrawal (Article 7(3) GDPR);
- lodging a complaint with the President of the Office for Personal Data Protection (Article 77 GDPR);
- objection to automated decision-making (Article 22 GDPR) — we do not make such decisions.
You may lodge a complaint with the President of the UODO, ul. Stawki 2, 00-193 Warszawa. In relation to data for which the Customer is the Data Controller, direct your request to that Customer — we are obliged to support them, but they decide.
We respond within one month of receiving the request. If a request is manifestly unfounded, in particular where it is repeated, or would require excessive effort, we may refuse to comply, giving reasons.
DATA PROTECTION OFFICER — NOT APPOINTED
We have not appointed a Data Protection Officer. We do not meet the conditions under Article 37(1) GDPR. For matters concerning Personal Data, in particular in order to exercise the rights described in the section above, contact us at the address given at the beginning of this Policy.
MANDATORY PROVISION OF DATA
Providing data marked as required is voluntary, but necessary to set up and use the service. Without it we cannot create an Organization Account or make the service available. Providing invoicing data is necessary where the free account threshold is exceeded. Providing contact data for marketing purposes is voluntary and based on consent.
DATA SECURITY
We apply technical and organisational measures appropriate to the risk, in accordance with Article 32 GDPR, including encryption of transmission (TLS), access control based on the principle of least privilege, mandatory multi-factor authentication for personnel, event logging, regular backups, a documented incident response procedure and periodic security testing. A detailed description of the measures is set out in the Data Processing Agreement.
No method of transmission or electronic storage provides absolute security. In the event of a Personal Data breach we notify the Data Controller without undue delay, no later than 24 hours of its detection, together with the information required by Article 33(3) GDPR.
ARTIFICIAL INTELLIGENCE FEATURES
Some features of the service use artificial intelligence models. Every feature of the service which uses such models is an AI feature, including features added after the date of publication of this Policy. These features process data entered by the Customer into the service, in particular for the purposes of recognising and extracting data from documents, classifying and matching data, and calculating values — for example text recognition in documents, materials matching, and pricing and inventory.
- What data is processed. Within these features the following may be processed: the content of documents and files entered by the Customer, and the Customer’s commercial data, including price list and materials list items.
- Who processes this data. The data is passed to the AI sub-processor identified in the List of Sub-processors, in the European Union, under a data processing agreement.
- Who is the Data Controller. The Data Controller of this data is the Customer, who enters it into the system. We process it as a Data Processor.
- Model training. Personal Data and processing results are not used for model training. We have disabled such use in the settings of our account with the AI sub-processor.
- Restrictions. Special category data within the meaning of Article 9 GDPR and data on criminal convictions within the meaning of Article 10 GDPR should not be passed to AI features.
- Nature of the output. The output of an AI feature is machine-generated and may contain errors. It is neither a source of law nor a decisive source of information and should be verified by a human before being used in accounting records, tax records, offer calculations or legal transactions.
- Labelling. Content generated by AI features is labelled in a way that allows it to be recognised and must not be presented as produced by a human.
This section concerns all the AI features of the application. The Support Chat is operated by a separate sub-processor — tawk.to, Inc. — using its AI features; see the “Support Chat” section.
SUPPORT CHAT
The Support Chat is the chat providing assistance with the Contractors.es application. It allows you to contact our technical support. The Customer is the Data Controller of the data passed through the Support Chat — we process it as a Data Processor under the Data Processing Agreement.
- When it is loaded. The chat widget, including the code that initialises it, is not loaded until the user deliberately clicks the chat icon. Before that click tawk.to receives no data and no identifiers, and stores no cookies or local storage.
- What data is processed. Chat transcripts, data provided by the user in the chat form (e.g. name, email address), IP address, device and browser data, online identifiers and location data.
- Who processes this data. tawk.to, Inc., registered in Las Vegas, United States, under a data processing agreement. We remain liable to the Data Controller for the sub-processor’s compliance with data protection obligations.
- Where and on what basis. tawk.to declares that all processing takes place in the United States. Support Chat data is therefore transferred outside the European Economic Area. In the European variant this is not the only such channel — alongside Support Chat data, files stored by the sub-processor Akamai Technologies (Linode) are transferred, to the extent of access to them from the United States and onward transfer to its sub-processors. The transfer of Support Chat data is based on the European Commission’s standard contractual clauses, Decision (EU) 2021/914, and on the EU-US Data Privacy Framework together with its UK and Swiss extensions. The sub-processor is listed in the List of Sub-processors.
- Consent and cookies. Storing tawk.to’s cookies and local storage is subject to the consent form built into tawk.to. They are stored only after the user accepts the consent; refusing consent makes the chat unavailable.
- AI features. Conversations are translated automatically, and simple questions are answered by an automatic first line of support. Both features are provided by tawk.to in the United States. The first line of support is built on the application’s instructions and documentation — conversation content is not used for model training, and we require tawk.to contractually not to use it for training its own models either.
- Chat content. The chat is a free-text channel and is not subject to automatic content screening. Special category data and data on criminal convictions should not be disclosed in it.
COOKIES
We use cookies only to the extent necessary for the service to operate:
| Name | Purpose | Lifetime | Necessary |
|---|---|---|---|
| Authentication and session cookies | Maintaining login and securing the session | Until the end of the session | Yes |
| Language and interface settings cookies | Remembering display settings | Up to 12 months | Yes |
Support Chat widget cookies and local storage (tawk.to): tawk_uuid_propertyId, tawk_uuid_*, twk_idm_key, TawkConnectionTime, tawk_token_* |
Identifying the visitor and maintaining the chat session | tawk_uuid_propertyId up to 6 months; the others until the end of the session |
Yes — stored only after consent given in the tawk.to consent form |
Other cookies, including analytical and marketing cookies, may be used only after obtaining prior consent. Consent is voluntary and withdrawing it does not affect access to the service. We publish a full, up-to-date list of cookies together with their purpose and lifetime on the Website.
CHANGES TO THIS POLICY
We update this Policy where the scope of processing, the suppliers, the legal bases or the applicable law change. We notify you of each material change by email to the address specified in the Organization Account at least 30 days in advance; non-material changes (editorial corrections, contact-data updates) take effect on the date of publication.
The addition of a new AI feature, or a change in the operation of an existing AI feature, does not in itself constitute a material change to this Policy. A material change is any change to: the categories of data processed; the purposes of processing; the recipients of the data or the sub-processors; the legal basis for processing; the retention period; or the basis for transferring data outside the European Economic Area. Where no such change occurs, this Policy does not need to be updated.
Continued use of the Service after 30 days constitutes acceptance of the amended Policy; in the case of non-acceptance you have the right to terminate the Agreement with effect at the end of the current billing period pursuant to clause 2 of the Terms. We make previous versions of this Policy available on request.
This policy is effective as of 2026-10-31.
CONTACT
For matters concerning Personal Data protection, including in order to lodge a complaint, please contact us using the email address provided on the Contact page at https://contractors.es/ or by post to the registered office of the company.