Privacy policy

Here we explain in plain language what personal data we process, why, how long we keep it and what rights you have, in accordance with the General Data Protection Regulation (GDPR 2016/679) and Greek law 4624/2019.

Who we are

The data controller is Bouldoza. For any personal data matter write to us through the contact form, choosing "Personal data".

Building permit data

The permits you see on Bouldoza are public acts that must be published on Diavgeia, the Greek government transparency portal (Greek law 3861/2010). From them we keep only what is needed to describe the building and to let a professional find out who to talk to:

• Private owners (natural persons): we never store or display their name, tax ID (AFM) or any other detail: not on screen, not in exports, not in the API, not in the A.I. assistant.
• Company owners (legal entities): the company name is shown, as it appears in the act.
• Engineers and design offices: they appear as professionals with their full name, specialty and Technical Chamber of Greece (TEE) registry number, as they sign the design or the supervision. The legal basis is legitimate interest (Article 6(1)(f) GDPR): that the market can find the professional who has taken on a publicly permitted project.
• Location: the location of the building comes from the coordinates in the act. On the public pages we show it only approximately.

If you are an engineer and want to correct something or object to the processing, write to us. We will examine your request without delay.

Your own data, as a user

• Account: email, name, password (only a cryptographic hash is stored, never the password itself), your organisation and your role in it. Basis: the contract with you.
• Sign-ins: the IP address and browser of each sign-in, for the security of your account.
• Usage: the searches, lists and notes you save, the alerts you asked for, and your questions to the A.I. assistant.
• Forms: what you write to us in the contact form or in the "3 free leads" request. We keep your IP only as an irreversible hash, to stop abuse.

We do not sell your data, we do not pass it on for advertising and we do not send you bulk email. We only send you what you asked for: confirmations, password resets and the alerts you set up.

Cookies

We use only one necessary cookie, to keep you signed in (bz_auth). We do not use advertising or third-party tracking cookies, which is why we do not ask for your consent with a pop-up.

Who else processes it for us

• The hosting provider of our servers, within the European Union.
• The email delivery provider, only for the emails we send you.
• The artificial intelligence model provider (Anthropic), only for the questions you ask the A.I. assistant. We do not send it your account details.

We have, or will have, a data processing agreement with all of them. Where data is transferred outside the EU, it relies on Standard Contractual Clauses.

How long we keep it

• Account and anything you have saved: for as long as the account exists. If you delete it, it is erased within 30 days.
• Sign-in records: up to 12 months.
• Form requests: up to 24 months, or earlier if you ask us to.

Your rights

You can request access, rectification, erasure, restriction, portability, or object to the processing. We reply within one month. If you believe we have not respected your data, you can lodge a complaint with the Hellenic Data Protection Authority (dpa.gr).