1. Who we are
This Privacy Policy explains how ConPo ("ConPo", "we", "us") processes personal data when you use the ConPo website and mobile app (together, the "Platform"). ConPo is the controller of this data under the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable Greek law.
For any question about this Policy or your personal data, contact us at info@conpo.app or through our Contact page.
2. Data we collect
- Account data: your e-mail address, your name where provided, and the sign-in details handled by our authentication provider.
- Member profile: first name and last name, if you provide them, and, optionally, the description you choose for yourself (for example "Architect" or "Planning to build or renovate").
- Company profile: company name, location, sectors, service areas, logo, cover image, phone, e-mail, website, map link, description, and the projects and photos you publish.
- Activity on the Platform: the projects you save and the companies you add to your favourites.
- Messages: your name, e-mail address and message when you use the contact form, and the details of a promotion request sent by a company.
- Notifications (app): if you are signed in and allow notifications, a push token for that device, the type of device (iOS or Android) and your notification settings. We use them only to send you ConPo notifications.
- Reports: if you report a project or company, the reasons you chose and your account. Only ConPo's administrators see who sent a report; the reported company is not told.
- Technical data: your IP address and basic device and browser information, which our servers and hosting provider process to deliver the Platform, keep it secure and prevent abuse.
3. How we use your data and on what legal basis
- To provide the Platform (create and manage your account, publish company profiles and projects, keep your saved items): necessary for the performance of our agreement with you (Article 6(1)(b) GDPR).
- To review company applications and content against our quality standards before and after publication: performance of our agreement and our legitimate interest in a reliable Platform (Article 6(1)(b) and (f)).
- To communicate with you (replies to your messages, account and service e-mails, such as a welcome message or the outcome of a company application): performance of our agreement and our legitimate interests (Article 6(1)(b) and (f)).
- To produce usage statistics for companies and for us (see section 5): our legitimate interest in showing companies how their profile and projects perform and in improving the Platform (Article 6(1)(f)).
- To keep the Platform secure and prevent spam, fraud and abuse, including rate limits: our legitimate interests (Article 6(1)(f)).
- To comply with the law and respond to lawful requests from authorities: legal obligation (Article 6(1)(c)).
We do not sell your personal data and we do not use it for advertising.
4. Public and private information
Company profiles are public. Everything a company publishes on its profile, including its name, location, contact details and project photos, can be seen by anyone, with or without an account.
Member accounts are private. Your saved projects, favourite companies and profile details are visible only to you. Companies cannot see which members viewed or saved their content.
5. Usage statistics
We count how many times a company profile is visited and how many times a project is shown or opened, and we show companies these figures as totals, together with the visitor's country. Companies never see who viewed their content.
To avoid counting the same visit twice, we briefly use your account or, if you are not signed in, a hashed form of your IP address. We also measure page visits and performance in aggregate, without cookies.
6. Cookies
We only use cookies that are strictly necessary for the Platform to work, mainly to keep you signed in and to protect your session. These are set by our authentication provider and do not require your consent. We do not use advertising, tracking or social media cookies.
7. Service providers
We share personal data only with providers that process it on our behalf, under contract and only as needed to run the Platform:
- authentication and account management;
- hosting, analytics and performance measurement;
- database and data storage, including uploaded images;
- e-mail delivery, including the welcome e-mail sent when you create an account;
- push notification delivery (through Apple and Google).
We may also disclose personal data where required by law or to protect our rights, our users or the public.
Some providers may process data outside the EEA, under the safeguards required by the GDPR.
8. How long we keep your data
- Account and profile data: for as long as your account exists. When you delete your account, we delete your profile, your saved items, your published projects and images, and your contact from our e-mail list. If a company application is rejected, the related account and data are deleted.
- Messages: for as long as needed to handle your request and any follow-up.
- Rate limit and statistics keys: no longer than 30 minutes, except the daily limit on reports, which is kept for 24 hours.
- Push tokens: until you sign out on that device, the device stops accepting notifications, or you delete your account.
- Reports: until reviewed and then as a record of the decision; deleted with your account.
- Usage statistics: kept as totals per company and per project, which do not identify anyone.
- Backups and logs: deleted data may remain in our providers' backups and security logs for a limited period before it is overwritten.
9. Your rights
Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable format. You can edit your details or delete your account at any time from your account settings. For any other request, contact us at info@conpo.app; we will reply within one month.
You may also lodge a complaint with the Hellenic Data Protection Authority.
10. Security
We use encrypted connections, access controls and reputable providers to protect your data. No online service can be completely secure, so please use a strong password and keep your sign-in details private.
11. Changes to this Policy
We may update this Policy from time to time. The date at the top shows the latest version.