Privacy Policy

1. Who are we?

1.1 Ziggu BV, with registered office at Vlasgaardstraat 52, 9000 Ghent, Belgium, company number BE 0699.472.839 ("Ziggu", "we"), offers a digital project management and customer portal for construction, real estate and related projects.

1.2 We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

1.3 Our website contains links to third-party websites. We are not responsible for the content or privacy policies of those websites.

2. In what capacity do we process your data?

2.1 Ziggu as controller. Ziggu itself determines why and how personal data are processed in the case of:

• visits to our website and the use of cookies (see also our Cookie Policy);
• contact, demo and information requests, newsletters, events and webinars;
• prospecting and managing our relationships with customers, prospects, suppliers and partners;
• invoicing and administration of our subscriptions;
• job applications;
• the security of the platform, fraud prevention and the improvement of our services on the basis of aggregated or pseudonymised usage data.

2.2 Ziggu as processor. When you use the Ziggu platform through an organisation that is a customer of Ziggu (the "Customer"), as a Private or Professional User as defined in our General Terms and Conditions for End Users (for example as an employee or partner of the Customer, or as a buyer, building owner or client), that Customer is the controller for the personal data in the platform, such as your name and contact details, messages, documents, photos, plans, choices and project data. Ziggu processes those data only on behalf of, and in accordance with the instructions of, the Customer, on the basis of a data processing agreement (Article 28 GDPR). For information about that processing and to exercise your rights, please contact the Customer. Requests that we receive directly are forwarded to the Customer. The rest of this policy concerns the processing operations in 2.1, unless stated otherwise.

3. What personal data do we process?

3.1 Customers, prospects, suppliers and partners: name, position, organisation, professional contact details (e-mail, telephone, address), communications with us, data on quotes, orders and contracts, invoicing and payment data, and interactions with our e-mails and website (insofar as you have consented to this).

3.2 Website visitors: IP address (masked: the last two octets are removed before storage), approximate location, device type, operating system and browser, language preference, pages visited, browsing behaviour, referring URLs, and data from forms and chat. More information can be found in our Cookie Policy.

3.3 Contact requests: the data you provide to us yourself, such as your name, e-mail address, telephone number, organisation and the content of your message.

3.4 Platform users (for whom Ziggu is controller): account and login data, technical log data (such as IP address, time, device and error messages) and usage data about the use of features, for security, fraud prevention and product improvement. We process support provided via the support chat in the platform as a processor on behalf of the Customer (see 2.2).

3.5 Job applicants: identification and contact details, CV, education, diplomas and certificates, language skills, career history, portfolio, cover letter, interview notes, and photos or videos you provide yourself.

4. For what purposes and on what legal basis?

• Quotes, concluding and performing agreements with customers and suppliers, customer management, support
  Legal basis (Art. 6 GDPR): Performance of a contract
• Invoicing, accounting, tax and other legal obligations
  Legal basis (Art. 6 GDPR): Legal obligation
• Answering questions and requests via the website, e-mail, chat or telephone
  Legal basis (Art. 6 GDPR): Legitimate interest (handling your question) or pre-contractual measures
• B2B prospecting via professional contact details (e-mail, telephone, LinkedIn)
  Legal basis (Art. 6 GDPR): Consent (B2B prospecting by e-mail to a personal professional address)
  Legitimate interest (other B2B prospecting involving the processing of personal data, such as keeping contact details, research and telephone contact:
• Newsletters and marketing communications to contacts who have subscribed
  Legal basis (Art. 6 GDPR): Consent.
  To existing customers about similar services: legitimate interest, with opt-out
• Analytical and marketing cookies
  Legal basis (Art. 6 GDPR): Consent
• Strictly necessary cookies, security of the website and platform, fraud prevention
  Legal basis (Art. 6 GDPR): Legitimate interest (security, integrity and availability)
• Improvement and development of our services on the basis of aggregated or pseudonymised usage data
  Legal basis (Art. 6 GDPR): Legitimate interest (product improvement)
• Automated onboarding and e-mail flows for contacts of Customers (e.g. tips based on role or project phase)
  Legal basis (Art. 6 GDPR): Performance of the agreement with the Customer
• Photos or testimonials on social media or our website
  Legal basis (Art. 6 GDPR): Consent
• Selection procedure for a vacancy
  Legal basis (Art. 6 GDPR): Performance of the agreement; longer retention in a recruitment reserve only with consent

4.2 Where we rely on a legitimate interest, we limit the processing to what is strictly necessary and take your reasonable expectations into account. You can always object (see section 11).

5. How do we handle AI?

5.1 The platform contains AI features, for example to summarise messages, draft or translate texts, or suggest replies. For this, we use Google Cloud Vertex AI, processed within the European Union (the Netherlands). For content in the platform, this is done as a processor on behalf of the Customer.

5.2 We do not use your data or the generated output to train or fine-tune AI models, and only work with model providers that likewise do not do so.

5.3 We make it visible when you are interacting with an AI feature or when content has been generated by AI. A Customer can have the AI features disabled for its environment.

6. With whom do we share your data?

6.1 We do not sell personal data. We only share them where this is necessary for the purposes listed below or where the law requires us to do so (for example with government authorities, judicial bodies or our accountant).

6.2 Sub-processors for the platform. The current list of sub-processors that we engage for the platform, with their purpose, location and transfer mechanism, is available at ziggu.io/legal/sub-processors.

6.3 Processors for our own processing operations. For the processing operations in section 2.1, we work with service providers in the following categories:

• hosting and management of the website;
• CRM, marketing automation and e-mail;
• web analytics and advertising platforms;
• office software, communication and scheduling;
• invoicing and accounting;
• workflow automation;
• support for our Customers and prospects outside the platform; for the support chat in the platform, Intercom acts as a sub-processor (see 6.2).

We conclude a data processing agreement with all these processors. They may not use your data for their own purposes. For some marketing cookies and social media features, LinkedIn and Meta act (partly) as separate or joint controllers. Their own privacy policies therefore also apply.

7. Are your data processed outside the EEA?

7.1 Platform data are hosted in the European Union (Google Cloud, Belgium). A number of service providers are established in the United States or have access to data there, for example for authentication, transactional e-mail, error tracking, support, CRM or web analytics.

7.2 For such transfers, we ensure appropriate safeguards within the meaning of Articles 44 to 49 GDPR: certification under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023) and/or the standard contractual clauses of the European Commission, with additional measures where necessary. You can request a copy of the relevant safeguards via privacy@ziggu.io.

8. How do we secure your data?

8.1 We take appropriate technical and organisational measures against unauthorised access, unlawful processing, loss or destruction, including:

• hosting in certified Google Cloud data centres in the EU (including ISO 27001);
• encryption, and passwords that are hashed (scrypt via Firebase Authentication);
• strictly limited access to production data. Support access only takes place via time-limited impersonation, after the user's express consent;
• development exclusively on anonymised data;
• two-factor authentication, encrypted workstations and a data breach policy;
• regular staff training.

9. Automated decision-making

9.1 We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). The AI features are not used for this either.

9.2 We do use automated processes to improve your experience, such as onboarding flows that adapt to your role, type of organisation or project phase, and e-mails that are sent on the basis of activity. These have no legal effects or comparable impact. You can always unsubscribe from such e-mails.

10. How long do we keep your data?

• Contractual, accounting and tax data of customers and suppliers
  Retention period: 7 years after the end of the financial year (legal obligation); contract data until the end of the limitation period
• Contact details of customers and contact persons
  Retention period: Duration of the relationship + 3 years
• Prospect data
  Retention period: Maximum 2 years after the last meaningful contact, or until you object
• Newsletter subscriptions
  Retention period: Until you unsubscribe
• Cookie data
  Retention period: See the Cookie Policy
• Platform data (as processor)
  Retention period: For as long as the Customer has a subscription, plus any period of read-only access after it ends. Then deletion within 30 days, unless the Customer requests their return within that period. Backups are kept for approximately 30 days.
• Technical logs and error reports
  Retention period: Between 30 days and a maximum of 13 months, depending on the type of log
• Job applications
  Retention period: Up to 6 months after the end of the selection procedure; with your consent, up to 2 years in our recruitment reserve

11. What rights do you have?

11.1 You have the right to:

• access and a copy of your data and information about the processing;
• rectification of inaccurate or incomplete data;
• erasure ("right to be forgotten"), unless we must or may retain the data (for example to comply with a legal obligation or to defend legal claims);
• restriction of processing, for example while the accuracy of your data is being verified;
• object to processing based on legitimate interest, on grounds relating to your particular situation. You can always object to direct marketing, without giving reasons;
• withdraw your consent at any time, without affecting the lawfulness of the processing before its withdrawal;
• portability of the data you have provided to us yourself.

11.2 For data in the platform (section 2.2), you exercise these rights with the Customer. You can also view, modify or export much of the data yourself via the platform.

11.3 You can exercise your rights free of charge via privacy@ziggu.io. We may ask you to prove your identity if we have reasonable doubts. Never send us a full, unmasked copy of your identity card for this purpose. We will respond within one month. In the case of complex or numerous requests, that period may be extended by two months; we will then let you know. In the case of manifestly unfounded or excessive requests, we may charge a reasonable fee or refuse the request.

11.4 You have the right to lodge a complaint with a supervisory authority:

• Belgium: Data Protection Authority (GBA/APD), Rue de la Presse 35 / Drukpersstraat 35, 1000 Brussels, +32 (0)2 274 48 00, contact@apd-gba.be, www.dataprotectionauthority.be;
• the Netherlands: Dutch Data Protection Authority (Autoriteit Persoonsgegevens), autoriteitpersoonsgegevens.nl;
• other EEA countries: see the website of the European Data Protection Board (edpb.europa.eu).

You can also bring an action before the competent court.

12. Contact

12.1 For questions about this Privacy Policy or about the processing of your personal data:

E-mail: privacy@ziggu.io

Post: Ziggu BV, Vlasgaardstraat 52, 9000 Ghent, Belgium

13. Changes

13.1 We may amend this Privacy Policy, for example in the case of new services, service providers or legislation. The date at the top shows when it was last changed. In the case of important changes, we will actively inform you, for example via the platform or by e-mail.