Privacy Policy
Version 2026-10-01
1. Who we are
Ground Zero is a construction operations platform operated by ABSOLUTLEGACY — Mediação Imobiliária, Unipessoal Lda, which is the data controller for the personal data described in this policy.
Privacy contact: the controller’s mailbox, geral@absolutlegacy.com, for any question on this policy or on how your data is processed.
To exercise your rights, see section 8.
The application is built and maintained by Arcavora Labs Pvt. Ltd., which acts as a processor to the controller for development, maintenance and technical support.
2. What personal data we process, and why
| Data | Whose | Purpose | Lawful basis (GDPR Art. 6) |
|---|---|---|---|
| Name, email, telephone, role, password (hashed) | Platform users (staff) | Account sign-in, access control, workflow assignment | Contract — Art. 6(1)(b) |
| Worker name, telephone, attendance, wages, advances | Site labourers | Workforce management, payroll, statutory labour records | Legal obligation — Art. 6(1)(c) — and contract |
| Site photographs and progress reports (may show people) | Anyone present on site | Evidence of construction progress, defect documentation | Legitimate interests — Art. 6(1)(f) — evidence of the works |
| Vendor contact details, tax identification numbers, bank details | Vendors and subcontractors | Procurement, invoicing, payment | Contract and legal obligation (tax) |
| Visitor name, company, reason | Site visitors | Site access log | Legitimate interests — site security |
| Entity and representative name and, if you give them, the owner's and contact agent's; email, telephone, address, NIF/NIPC, AMI licence number, IMPIC permit number, IBAN, speciality and fees (consultants), insurance policies and the documents you upload (company certificate, AMI licence or permit, policies, IBAN proof, professional card or credentials). The forms do not ask for the Citizen Card or its number, nor for ACT or Social Security numbers | Business partners — real-estate brokers, contractors and consultants (including sole traders) | Partner registration and verification; know-your-customer and anti-money-laundering due diligence; preparation of non-disclosure agreements and contracts | Pre-contractual steps — Art. 6(1)(b) — and legal obligation — Art. 6(1)(c), Law 83/2017 |
| Name, role, email, signature image, signing timestamp and IP address | Signatories of non-disclosure agreements and contracts | Evidence that the agreement was entered into, and by whom | Contract and legitimate interests — evidentiary record |
| Name, email, description and screenshots | Users raising support requests | Resolving support requests | Legitimate interests — running the service |
| Action history (who did what, when, and from which IP address) | Platform users | Security audit log | Legitimate interests — accountability |
We process no special categories of data (GDPR Art. 9) — no health, biometric, trade-union, religious or comparable data is collected.
3. Where your data comes from
Not all data is provided directly by you. Where it comes from another source, that source is (GDPR Art. 14):
- From your employer or the organisation that invited you — where an account is created by an administrator, or a labourer is registered on site by a supervisor.
- From a business partner — where you are named as a representative, signatory or contact for a partner entity.
- Generated by your use of the service — audit records, IP addresses and timestamps of your actions.
4. How long we keep it
We keep personal data only as long as necessary (GDPR Art. 5(1)(e)). The periods follow Portuguese law:
- Accounting and tax records (orders, goods receipts, payments, invoices, expenses, payments and advances to workers): 10 years, counted from the end of the fiscal year (ending 31 December) in which the record’s latest date falls (Commercial Code, art. 40). After that the record is kept without personal data — only amounts, dates, codes and document numbers remain.
- Payroll and attendance records: 5 years(labour inspection requirement — ACT). A site worker’s own record is kept 5 years after they stopped working for us, and for as long as a payroll or accounting record still names them.
- HR and personnel records: 5 years after the relationship ends.
- Requests to register on the platform: deleted at once when approved or rejected; a request nobody decided is deleted after 90 days, together with the sign-in account created for it.
- Evidence of construction progress (reports, photographs): 5 years (defects guarantee, Civil Code, art. 1225).
- Site visitor log: the visit stays on record, but 5 yearsafter the visit the visitor’s name, company, reason and notes are irreversibly anonymised.
- Support requests: 2 years.
- Partner records and KYC/AML due diligence: 7 years after the business relationship ends (Law 83/2017, art. 24). A partner form that did not lead to a partnership: 7 years from its last submission. A form never submitted, or an invitation never used: 1 year after the invitation expired or was cancelled.
- Images of identity documents, if one is ever uploaded with a partner form (the current forms do not ask for one): kept with the form, for the same period.
- Non-disclosure agreements and contracts: they follow the period of the partner they belong to. With no partner linked: signed — 7 years after signature; voided or never signed — 1 year.
- Our own representatives who sign contracts (name, identification, power of attorney, signature): while any contract they signed is still kept, then 5 years after they stop representing us.
- Register of data-protection requests: until the request is closed, then 3 years, as evidence of how we handled it (GDPR Art. 5(2)).
- Security audit records: 180 days, after which they are deleted automatically (see section 10).
At the end of these periods the data is deleted or irreversibly anonymised; an automated process checks these periods every night. Where a record falls under more than one period, the longest applies.
Backups. Deleted or anonymised data can remain in the encrypted backup copies for up to 77 days, until those copies are replaced, and is not used for anything else. If a backup ever has to be restored, the deletions are applied again before the system is used.
5. Who we share it with (processors)
We never sell personal data and we do not share it for advertising. It is processed only by the processors listed below, each under a data processing agreement as required by GDPR Article 28:
| Processor | Location | Purpose | Data processing agreement |
|---|---|---|---|
| Oracle Cloud Infrastructure (OCI) | European Union — Madrid, Spain (eu-madrid-3) | Hosting of the application, the database and uploaded files. | Data Processing Agreement for Oracle Services (v14082025), incorporated by reference into the Cloud Services Agreement. No separate signature is required. View document |
| Contabo Planned — date to be announced. | European Union — Germany (the provider’s “European Union” region) | Hosting of the application, the database and uploaded files. | Data Processing Agreement concluded by the controller in the Contabo Customer Panel, before any data is moved to the new server. View document |
| Supabase | European Union — Paris, France | Authentication only — email address and hashed password. It receives no files and no business data. | Data Processing Addendum, incorporated into the Terms of Service. No separate signature is required. View document |
| Brevo | European Union — France | Transactional email — account invitations, password resets, signing links and project reports. | Data Protection Agreement (Annex 2 to the General Terms and Conditions), incorporated by reference. Changes to sub-processors are notified 10 business days in advance. View document |
Beyond these, data may be disclosed to public authorities where the law requires it, and to our lawyers and auditors where necessary to establish or defend legal claims.
6. International data transfers
The application, the database and uploaded files are hosted in data centres in the European Union, as set out in the table above. Backup copies are encrypted on the server before they leave it.
There is, however, one transfer we must disclose. The Arcavora Labs development team operates from India and holds remote administrative access to the EU-based server for maintenance and troubleshooting. Under GDPR, remote access from a third country is a transfer even where the data itself remains on EU servers.
This access is under assessment, including the adoption of Standard Contractual Clauses and a Transfer Impact Assessment. We state it here for transparency rather than omit it. For more information about this transfer, contact geral@absolutlegacy.com.
Where a processor itself uses suppliers outside the EEA, it applies the safeguards shown in the table in the previous section — Binding Corporate Rules or European Commission Standard Contractual Clauses (GDPR Arts. 46 and 47).
7. Automated decision-making and profiling
We make no solely automated decisions producing legal effects or similarly significantly affecting you (GDPR Art. 22). We do not carry out profiling. The application contains no artificial-intelligence or machine-learning functionality, and no personal data is sent to any language-model service.
8. Your rights
Under GDPR you may, at any time:
- Access and portability — obtain a copy of your data. Signed-in users: use “Download my data” on your Privacy page. Partners and others without an account: use the request form (verified by email).
- Rectification — correct inaccurate data, in the application or by email.
- Erasure — ask us to delete your data, also through the request form. We will delete everything not subject to a legal retention duty (for example tax or anti-money-laundering records) and anonymise the rest once that duty ends.
- Restriction and objection — limit how we use your data, or object to processing based on legitimate interests (Arts. 18 and 21).
- Withdraw consent — where processing relies on your consent, you may withdraw it at any time. This does not affect the lawfulness of processing carried out beforehand (Art. 7(3)).
- Complaint — lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134 — 1.º, 1200-651 Lisbon (cnpd.pt), without prejudice to any judicial remedy.
How to make a request
- Use the request form — it works even if we hold no e-mail address for you —, write to geral@absolutlegacy.com or, if you have an account, use the Privacy page in the app. On site you can also speak to the site manager, who passes the request on to us the same day.
- Tell us who you are (your name and how you relate to us — for example user, partner, site worker, visitor), what you want (access, rectification, erasure, restriction, objection or portability) and how we can reach you.
- We confirm your identity before disclosing or erasing anything, so that data does not reach someone not entitled to it — for example by a reply from the address we hold, or through the site manager.
- You receive an acknowledgement: straight away if you use the form or the app; otherwise within 3 business days. Every request is logged in our request register.
- We respond within one month (GDPR Art. 12(3)), extendable by two further months for complex requests, in which case we tell you within the first month. We tell you what we did and, if we keep any data, why and until when. Exercising these rights is free of charge.
Requests are handled by the controller through geral@absolutlegacy.com; every request is logged and its response deadline tracked.
9. Is providing this data mandatory?
Some data is necessary to give you access to the service or to meet our legal obligations — without it an account cannot be created, a payment cannot be processed and a partner cannot be registered. Other data, such as site photographs in which you appear, arises from normal operation of the service and you may object to its processing.
10. Security
Data is encrypted in transit (TLS) and hosted in the EU. The most sensitive identifiers — tax number, permit number, IBAN and social security number — are encrypted in the database. Access is controlled by roles and permissions, every change is written to an audit log with sensitive values redacted, and access to photographs and documents requires authentication.
Users cannot edit the audit log. No screen in the application lets anyone change or delete an entry. Entries are deleted automatically after 180 days. The only other exception: when an administrator permanently deletes a whole project (with password confirmation), that project’s entries go with it — and that deletion is itself recorded.
In the event of a personal data breach posing a risk to your rights, we will notify the CNPD within 72 hours and, where the risk is high, inform you directly (GDPR Arts. 33 and 34).
11. Cookies
We use only strictly necessary and preference cookies — no analytics, tracking or advertising. For that reason no consent banner is required under Law 41/2004. Details: Cookie Policy.
12. Applicable law
This processing is governed by Regulation (EU) 2016/679 (GDPR) and by the Portuguese legislation implementing and supplementing it, in particular:
- Law 58/2019 of 8 August — implementation of the GDPR in Portuguese law
- Law 41/2004 of 18 August — privacy in electronic communications (cookies and messaging)
- Law 83/2017 of 18 August — prevention of money laundering and terrorist financing
- Labour Code and ACT regulations — personnel and working-time records
- Commercial Code (art. 40) and Civil Code (art. 1225) — document retention and the defects guarantee for construction works
13. Changes to this policy
This policy carries a dated version, shown at the top. When we change it materially we publish the new version on this page. When you confirm that you have read it — on registering, activating your account or submitting a partner form — we record the date and the version that was shown to you, as evidence that you were informed (GDPR Art. 13). That confirmation is not consent: the lawful bases are those set out in section 2. The version in force is 2026-10-01.